last executing test programs: 10.693062864s ago: executing program 2 (id=3157): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61107000000000006113740000000000bfa00000000000000700000008ffffffd503010017740040950000000000000069163a0000000000bf67000000000000350607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_emit_ethernet(0x5e, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "e20f00", 0x28, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0x4e22, 0x28, 0x0, @wg=@data={0x4, 0x1, 0x1b5a, "5d0719656701ba4d2a43d88e945401b9"}}}}}}}, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000080)={'gretap0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @local}}}}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={0x1, 0xffffffffffffffff}, 0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000ae0000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001b00)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3200000000a0000000060a010400000000000000000100000008000b400000000078000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000220500020007000000400001800c0001006269747769736500300002800800034000000002080001400000001408000240000000120c000780060001002b66000008000640000000040900010073797a300000000014000000110001"], 0x114}}, 0x0) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendfile(r7, r4, 0x0, 0xfffbffff) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r8, &(0x7f00000005c0)=[{&(0x7f0000000080)='/', 0x1}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r8, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="12000000090000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r10}, &(0x7f0000000040), &(0x7f0000000140)=r9}, 0x20) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r11, 0x0) r12 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r12, &(0x7f0000000200)='cgroup.threads\x00', 0x2, 0x0) r13 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x12, &(0x7f0000000300)=@ringbuf={{0x18, 0x8}, {{0x18, 0x4, 0x1, 0x0, r13}, {}, {}, {0x85, 0x0, 0x0, 0x5a}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x7}}, [@ldst={0x0, 0x3, 0x1, 0x1, 0x1, 0x1, 0x8}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x8}], {{0x6, 0x1, 0x3, 0x8}, {0x6, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1c, 0x1b, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6393, 0x0, 0x0, 0x0, 0xf6dc}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @call={0x85, 0x0, 0x0, 0x19}, @map_fd={0x18, 0x4, 0x1, 0x0, r3}, @map_fd={0x18, 0x5, 0x1, 0x0, r4}, @alu={0x4, 0x0, 0x6, 0x8, 0x5, 0x20, 0xfffffffffffffffc}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xe}, @generic={0x9, 0xa, 0xf, 0x7, 0x6}]}, &(0x7f0000000240)='syzkaller\x00', 0x3ff, 0xb0, &(0x7f00000003c0)=""/176, 0x41000, 0x0, '\x00', r1, 0x0, r8, 0x8, &(0x7f0000000280)={0x8, 0x4}, 0x8, 0x10, &(0x7f00000002c0)={0x5, 0x5, 0x80, 0x5}, 0x10, 0xa545, 0xffffffffffffffff, 0x4, &(0x7f0000000480)=[0xffffffffffffffff, r10, r11, r13], &(0x7f00000004c0)=[{0x0, 0x2, 0x8, 0x2}, {0x1, 0x2, 0x4}, {0x3, 0x4, 0xf, 0x8}, {0x1, 0x1, 0x1, 0xc}], 0x10, 0x1}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) 10.470981574s ago: executing program 2 (id=3159): r0 = socket$inet(0x2, 0x1, 0x6) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040)=0x7b, 0x4) shutdown(r0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000bc0)=@getspdinfo={0x14, 0x25, 0x1}, 0x14}}, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000440003800800010002000000140002007663616e300000000000000000000000080003000000000014000600ff0100000000000000000000000000010600040001"], 0x58}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000580), r3) recvmmsg(r0, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0xc, 0xc, 0x3, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r4}, 0x38) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r4, &(0x7f0000000040), 0x0}, 0x20) ioctl$FS_IOC_GETFSSYSFSPATH(r4, 0x80811501, &(0x7f0000000300)={0x80}) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000001d80)={0x0, 0x3, &(0x7f0000000080)={&(0x7f0000001dc0)={0x2, 0x3, 0x0, 0x6, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x2b, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x20, 0x0, @in6={0xa, 0x4e24, 0x7, @private1, 0x400}}]}, 0x60}}, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r3) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='freezer.state\x00', 0x0, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) sendto$packet(r8, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r9}, 0x14) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x8c, 0x8c, 0xb, [@var={0xb, 0x0, 0x0, 0xe, 0x1, 0x1}, @func={0x5, 0x0, 0x0, 0xc, 0x3}, @decl_tag={0x3, 0x0, 0x0, 0x11, 0x4, 0x9}, @float={0xc, 0x0, 0x0, 0x10, 0x4}, @struct={0x5, 0x5, 0x0, 0x4, 0x0, 0x8001, [{0xa, 0x2, 0x8}, {0x5, 0x1}, {0x1, 0x4, 0xfff}, {0x3, 0x2}, {0x8, 0x2, 0x8}]}, @type_tag={0xb, 0x0, 0x0, 0x12, 0x4}]}, {0x0, [0x0, 0x61, 0x5f, 0x2e, 0x30, 0x5f, 0x2e, 0x2e, 0x5f]}}, &(0x7f00000007c0)=""/16, 0xaf, 0x10, 0x0, 0x2, 0x10000}, 0x28) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001c00)={0xffffffffffffffff, 0xe0, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000008c0)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x5, &(0x7f0000000900)=[0x0, 0x0], &(0x7f0000000940)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xb2, &(0x7f0000000980)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000a00), &(0x7f0000000a40), 0x8, 0xdb, 0x8, 0x8, &(0x7f0000000a80)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000001cc0)={0x1, 0x13, &(0x7f0000000600)=@raw=[@ldst={0x1, 0x1, 0x1, 0x2, 0xd, 0xfffffffffffffff4, 0xfffffffffffffff9}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfff}, @call={0x85, 0x0, 0x0, 0x35}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x7}, @tail_call={{0x18, 0x2, 0x1, 0x0, r7}}], &(0x7f00000006c0)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000c00)=""/4096, 0x0, 0x10, '\x00', r9, @fallback=0x32, r10, 0x8, &(0x7f0000000840)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000880)={0x4, 0x10, 0xfffffff8, 0x1}, 0x10, r11, 0xffffffffffffffff, 0x2, &(0x7f0000001c40)=[r4], &(0x7f0000001c80)=[{0x4, 0x3, 0xd}, {0x0, 0x1, 0xd, 0x1}], 0x10, 0xb0}, 0x94) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000540)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x170, r6, 0x300, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x786}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10}]}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x101}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}]}, @TIPC_NLA_BEARER={0x84, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x7, @mcast2, 0xe}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x77}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x93}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8d6}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x87e}]}]}]}, 0x170}, 0x1, 0x0, 0x0, 0x48080}, 0x20000005) 10.223741336s ago: executing program 2 (id=3162): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r0) recvfrom$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=""/15, 0xf, 0x12080, &(0x7f00000000c0)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r1, 0x105, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x84}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r0) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f00000004c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x258, r2, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4e}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xdde1}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffc}]}, @TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x4}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffb63e}]}, @TIPC_NLA_SOCK={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x80}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0xb0, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6e2e85d5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x10000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9d9f}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x75b2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xa}, @TIPC_NLA_SOCK_CON={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffffb}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xa7f}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x10000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffd}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xc}]}, @TIPC_NLA_MEDIA={0x90, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x77}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x86e9ec}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc78a}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}]}, @TIPC_NLA_BEARER={0x3c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x5, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xff}}, {0x14, 0x2, @in={0x2, 0x4e24, @empty}}}}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xa0}]}]}, 0x258}, 0x1, 0x0, 0x0, 0x4040004}, 0x240040c4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r0, &(0x7f0000000780)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000740)={&(0x7f00000005c0)={0x16c, r3, 0x8, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x9c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="857da3d04a4c4a861859d2f4a58b3db9c514185d600c28c3"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0f6b4fcfb4e4d4d0e45b1b50b191ba46b461516b2a392b38"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x419}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="eeab50fb1321039fdd190ac852bedde66d15b3c1412bde05"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "225c2cad6aba8e3e"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "91c1860d938ac934"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="66738657e3df6c065e77a37b4a769bc2"}]}, @NL80211_ATTR_REKEY_DATA={0x18, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1ff8}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "946a38ac011197e2"}]}, @NL80211_ATTR_REKEY_DATA={0x8c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4fd}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "2419a48d36d2b969"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="7afc1a330bec7b4285d677308cbdcb76"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="b94661d67f14ba777b8f9660a4e5b476"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "f5dee461e49ac785"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x80}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="110b90c0f10c4d82896ec39f776a8fca03ea6a4064a11dd7"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="cbacfc441e1baecef009af719c4496b7"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xb1e}]}, @NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "7b9e358fceacd54d"}]}]}, 0x16c}}, 0x20048000) 10.080692471s ago: executing program 2 (id=3164): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="c1", 0x1}], 0x1}, 0x0) setsockopt$sock_int(r3, 0x1, 0x200000010, &(0x7f0000000000)=0xfffffffc, 0x4) recvmsg$unix(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}, 0x40000000) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000002b40), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000019340)={0x54, r4, 0x1, 0x70bd2a, 0xfffffffe, {0x6}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2001}}, {0x8, 0xb, 0x1000}, {0x6, 0x16, 0x794}, {0x5}}]}, 0x54}, 0x1, 0x0, 0x0, 0x448d5}, 0x24008004) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd0, r4, 0x100, 0x70bd25, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x2f7ffe6}, {0x6, 0x11, 0x34}, {0x8}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8}, {0x6, 0x11, 0x6}, {0x8, 0x15, 0x2}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0xf3}, {0x6, 0x11, 0x5}, {0x8, 0x15, 0x1}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x8000}, 0x98) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@struct={0x4, 0x1, 0x0, 0x4, 0x1, 0x1, [{0xa, 0x3, 0x6}]}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2}}]}}, 0x0, 0x5a}, 0x28) write$tun(r5, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07}, @generic={0x0, 0x2, "d58838000391"}]}}}}}}, 0xfd6c) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0x1f, 0x24, 0x1}, 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000001400791048000000000069003e000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) socket$netlink(0x10, 0x3, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) (async) sendmsg$unix(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="c1", 0x1}], 0x1}, 0x0) (async) setsockopt$sock_int(r3, 0x1, 0x200000010, &(0x7f0000000000)=0xfffffffc, 0x4) (async) recvmsg$unix(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}, 0x40000000) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000002b40), 0xffffffffffffffff) (async) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000019340)={0x54, r4, 0x1, 0x70bd2a, 0xfffffffe, {0x6}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2001}}, {0x8, 0xb, 0x1000}, {0x6, 0x16, 0x794}, {0x5}}]}, 0x54}, 0x1, 0x0, 0x0, 0x448d5}, 0x24008004) (async) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd0, r4, 0x100, 0x70bd25, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x2f7ffe6}, {0x6, 0x11, 0x34}, {0x8}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8}, {0x6, 0x11, 0x6}, {0x8, 0x15, 0x2}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0xf3}, {0x6, 0x11, 0x5}, {0x8, 0x15, 0x1}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x8000}, 0x98) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@struct={0x4, 0x1, 0x0, 0x4, 0x1, 0x1, [{0xa, 0x3, 0x6}]}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2}}]}}, 0x0, 0x5a}, 0x28) (async) write$tun(r5, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07}, @generic={0x0, 0x2, "d58838000391"}]}}}}}}, 0xfd6c) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0x1f, 0x24, 0x1}, 0x24}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000001400791048000000000069003e000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) (async) 9.727687528s ago: executing program 2 (id=3166): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000013000001d680d5691365a600"/27, @ANYRES32=0x0, @ANYBLOB="000000000000000014000300766c616e30000000000000000000000014001680100001800c000300fd01000006000000"], 0x48}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000090600010015"], 0x1c}}, 0x0) r2 = socket(0x26, 0x6, 0xffffd0c4) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, 0x140a, 0x20, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x7}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 9.5357831s ago: executing program 2 (id=3170): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000040)={0xffffffffffffffff, 0xa52, 0x1, 0x800}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x2}, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x2}, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8b07, &(0x7f0000000440)={'wlan1\x00', @random="8dffffffebff"}) (async) ioctl$SIOCSIFHWADDR(r1, 0x8b07, &(0x7f0000000440)={'wlan1\x00', @random="8dffffffebff"}) 1.505945794s ago: executing program 0 (id=3233): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@setlink={0x40, 0x13, 0x1, 0x2000000, 0x25dfdbff, {}, [@IFLA_ADDRESS={0xa, 0x1, @random="4780d8506416"}, @IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c000}, 0x4040000) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, r1, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_ORIG_ADDRESS={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x30000800}, 0x5) syz_emit_ethernet(0x52, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x1c, 0x6, 0x0, @private1, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, {[@generic={0x13, 0x2}, @generic={0xfe, 0x4, "7701"}]}}}}}}}}, 0x0) 1.501850058s ago: executing program 4 (id=3237): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, r2, 0x0, {0x0, 0x0, 0x6}}, 0x18) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000014c0)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x74, r2, {0xfffd, 0xffeb}, {0x1, 0x1}, {0xfff2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x850) getsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000000), &(0x7f0000000040)=0x4) 1.500313699s ago: executing program 0 (id=3239): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) accept(r0, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, &(0x7f00000000c0)=0x80) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000200)=ANY=[@ANYBLOB="0000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000007000000000000000200000000000000f8000000000000000200000000000000000000000000000000000000000000000000000000000000e9000000040000000300000000000000107900000000000008000000000000000700"/256]) (async) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x24, @none={0x3}}, 0x14, &(0x7f0000000100)={0x0, 0x1b}, 0x7}, 0x0) (async, rerun: 64) r3 = socket$kcm(0x10, 0x400000002, 0x0) (rerun: 64) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) (async) recvmsg(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000005580)=""/4084, 0xff4}, {&(0x7f00000016c0)=""/4098, 0x1002}, {&(0x7f0000000140)=""/159, 0x9f}, {&(0x7f0000000200)=""/157, 0x9d}], 0x4}, 0x2000) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x118, 0x1d, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x105, 0xf5, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0xa, 0x0, 0x0, @ipv6=@mcast2}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd", @typed={0x4, 0xe9}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x400c445}, 0x0) 1.490440987s ago: executing program 0 (id=3240): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x5}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001800df0000000000000000001c140000fe00000100000000040012000000f1b9a81697008d68a0328c49d2ee"], 0x30}}, 0x0) 1.414034998s ago: executing program 4 (id=3243): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000007d2700000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000095"], 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000000)=ANY=[@ANYRES8=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r2, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000007d2700000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000095"], 0x0}, 0x90) (async) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000000)=ANY=[@ANYRES8=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r2, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) 1.332098563s ago: executing program 0 (id=3244): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000003a80)={0x0, 0x0, &(0x7f0000003a40)={&(0x7f0000003900)=@dellinkprop={0x38, 0x6d, 0x511, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2, 0x440c0}, [@IFLA_IFNAME={0x14, 0x3, 'gre0\x00'}, @IFLA_PROP_LIST={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r1 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000600)=0x9, 0x4) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000006800)={&(0x7f0000000080)={0x3c, r4, 0x615, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x40}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x50c791be6f0f6de0}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0x3c}, 0x5}, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x8000000000d) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00', 0x9dc}, 0x94) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r7, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$TUNSETLINK(r6, 0x400454cd, 0x304) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r5}, 0x10) ioctl$TUNGETVNETLE(r6, 0x800454dd, &(0x7f0000000140)) r9 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={r9, r8, 0x0, 0x0, 0x0}, 0x30) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000080)=ANY=[], 0x10448) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000200)={'ip6tnl0\x00', &(0x7f0000000400)=@ethtool_eeprom={0xb, 0x0, 0x7, 0xf5, "01f5392627b9223f9d4df826eba14245bd7a1e672db3f877b02a2cdbb95007fc4fdb37a8f5bdf4d15ca8cd94252f58956b2d76690d16e1d8a9764e1c1fcc7913ffe3c3d7f50c49decdf0d802c09138e4f12d4bdcc73d01bda2a1170935e918ec609cba192535ab0d966c94fc758503c5551d10130fffe7b16ec079d022fea6805fff7bc7ee62e971d7631b3b03621b02188745812491161ca2c5258909f0a1f3d3f9f09da0a754f15ba1f78bb1a93a64335a7a8277b4e8615610613ee2b5724c8248e2b8061b3963e16ec6dfad12ff7a8fe21723a512f41e75fb4527b70bd1a4180417d901a45780efbc259f58eb73ba7faadc6708"}}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={r9, r10, 0x0, 0x0, 0x0}, 0x30) syz_emit_ethernet(0x6f, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00318e", 0x39, 0x3a, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @time_exceed={0x2, 0x1, 0x0, 0x4, '\x00', {0x0, 0x6, "000006", 0xda34, 0x3a, 0xff, @rand_addr=' \x01\x00', @empty, [], "ccd151d71f80b0c9bb"}}}}}}}, 0x0) 1.283474951s ago: executing program 4 (id=3246): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000000)={'wg2\x00'}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x4f, &(0x7f0000000140)={&(0x7f00000002c0)=@ipv4_getroute={0x1c, 0x1a, 0x400, 0x70bd2c, 0x25dfdbfd, {0x2, 0x20, 0x20, 0x1c, 0xfc, 0x0, 0xc8, 0x3, 0x600}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 1.20157281s ago: executing program 4 (id=3247): r0 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x700, 0x700, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x60, 0x0, 0x0, 0x2f, 0x0, @multicast1, @initdev={0xac, 0x1e, 0xfe, 0x0}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000000)={'tunl0\x00', r1, 0x20, 0x40, 0x1001000, 0x6, {{0x5, 0x4, 0x2, 0x6, 0x14, 0x67, 0x0, 0xf9, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0xfe, 0x0}}}}}) 1.193929574s ago: executing program 1 (id=3248): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x808000}, 0x8) getsockopt$bt_hci(r2, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(r3, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}, 0x8820) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000002500090122bd7000fcffffff970000000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x449d7}, 0x4040850) bind$netlink(r4, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfd, 0x40000000}, 0xc) bind$netlink(r0, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbfb, 0x4000}, 0xc) close(r1) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYRESOCT=r1], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe46a}, 0x94) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x50, 0x1, [@m_bpf={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x0, 0x4, 0x0, 0x4}}, @TCA_ACT_BPF_FD={0x8, 0x5, r6}]}, {0xfffffffffffffe45}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0xa25bb844b084a7a1}, 0x0) 1.047577502s ago: executing program 1 (id=3250): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x20008040) 1.04653568s ago: executing program 4 (id=3251): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x4000000805, 0x0) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x0, @rand_addr=0x64010102}, 0x10) sendto$inet(r1, &(0x7f0000000280)='V', 0x1, 0x0, &(0x7f0000000380)={0x2, 0x0, @private=0xa010101}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000000100)=0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x20, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x20}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r6) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_int(r8, 0x29, 0x1a, 0x0, &(0x7f0000000040)) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000180)=0x800, 0x4) sendmsg$NLBL_CALIPSO_C_LISTALL(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={0x14, r7, 0x3d810686a7d95765, 0x70bd2a, 0x25dfdbf9}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x24004052) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r10, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32=r11, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000000000000640000002503000000000000080026006c09"], 0x80}}, 0x0) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r5, &(0x7f0000000280)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000200)={0x50, r10, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000004}, 0x800) r12 = socket$nl_route(0x10, 0x3, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x48, 0x10, 0x44b, 0xfffffffe, 0x0, {0x7a}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14}]}, 0x48}}, 0x0) sendmsg$nl_route(r12, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000001907000000040000002bbd7000fddbdf250a2014070000fe"], 0x1c}, 0x1, 0x0, 0x0, 0x84}, 0x4000001) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x484800, 0x0) ioctl$TUNSETIFF(r14, 0x400454ca, &(0x7f0000000340)={'lo\x00', 0x4000}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_POLICY={0x8}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xf8}, 0x1, 0x0, 0x0, 0x8010}, 0x0) 1.045529546s ago: executing program 0 (id=3252): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x3c, r0, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1}]]}, 0x3c}}, 0x884) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000900)={@in={{0x2, 0x4e24, @remote}}, 0x0, 0x0, 0x1e, 0x0, "a1e6c7030e64fe0110f53a64d4d17bde44eb9bc4a67e5693d9695f4918d4334e64441a7fdb5521c32a13c9609690275c1895f8c78c0514baf150cc88eb6d97feb1bff8b13b8405ae2f0f428030503a06"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000080)={@in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x10}}}, 0x0, 0x0, 0xf, 0x0, "df6e1ca3102112016f1e9ba020f5ea3d74c012ad64494e41eff5108cd341662409ec80cd68fd3ba2e96ee3f8d8a3e4e561e68eaddb300484fa8eb74c3f59fb9fd1ee3a622d36454a2d231c9584a4dd07"}, 0xd8) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) sendmsg$NL80211_CMD_PROBE_CLIENT(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4401}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x4c, 0x0, 0xedd29a6047174d57, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40004}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007110a9000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) 975.772231ms ago: executing program 3 (id=3253): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x4001, 0x3, 0x438, 0x0, 0x700001b, 0x148, 0x0, 0x148, 0x3a0, 0x206, 0x240, 0x3a0, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x1ea, 0x2c8, 0x2f0, 0x0, {0x390, 0x8f00}, [@inet=@rpfilter={{0x28}, {0x3}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00', {0x1000}}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x5, 0xff, {0x9184}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x498) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x15}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}]}, 0x44}}, 0x0) 888.985461ms ago: executing program 3 (id=3254): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r2 = socket(0x400000000010, 0x3, 0x0) (async) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) (async, rerun: 32) r5 = socket$inet(0x2, 0x2, 0x0) (rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0xca, 0x2, @TCA_HFSC_USC={0x10}}}]}, 0x44}}, 0x0) setsockopt$inet_mreqn(r5, 0x0, 0x23, 0x0, 0x0) (async, rerun: 32) r9 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r10 = syz_genetlink_get_family_id$fou(&(0x7f0000000680), r9) sendmsg$FOU_CMD_ADD(r9, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000006c0)={0x2c, r10, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x80) r11 = socket(0x400000000010, 0x3, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r12, 0x8924, &(0x7f0000000280)={'veth0_virt_wifi\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r13 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c40)=@newtfilter={0x64, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r14, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_u32={{0x8}, {0x38, 0x2, [@TCA_U32_SEL={0x24, 0x5, {0x6, 0x3, 0x1, 0x41, 0x8, 0xc85e, 0xffff, 0x401, [{0x7fffffff, 0x2, 0x0, 0x81e}]}}, @TCA_U32_MARK={0x10, 0xa, {0x1779800, 0x7}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async, rerun: 64) r15 = socket$kcm(0x11, 0x3, 0x0) (async, rerun: 64) r16 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r16) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r16, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) setsockopt$sock_attach_bpf(r15, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r15, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r17, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accb", 0x26}], 0x1}, 0x4) 587.797661ms ago: executing program 3 (id=3255): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b36, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = socket(0x2a, 0x2, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x35, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, r2, 0xb0260000) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r0, 0xc6e9f000) mmap(&(0x7f0000d8c000/0x1000)=nil, 0x1000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r3, 0xffffe000) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x49}, [@ldst={0x4, 0x0, 0x0, 0x0, 0xa, 0x0, 0xfffffffffffffff0}]}, &(0x7f00000000c0)='syzkaller\x00', 0x2, 0xc0, &(0x7f000000cf3d)=""/192, 0x0, 0x28}, 0x94) 527.277704ms ago: executing program 3 (id=3256): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$igmp6(0xa, 0x3, 0x2) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x20010, r3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x44, 0x6, 0x390, 0x130, 0x0, 0x1c8, 0x130, 0x0, 0x2f8, 0x2f8, 0x2f8, 0x2f8, 0x2f8, 0x6, 0x0, {[{{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@ip={@loopback, @local, 0x0, 0x0, 'wg2\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1d, 0x6, 0x8001}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0xfc}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="05000000000000000000060000000800030061609d184c1f2298", @ANYRES32=r7, @ANYBLOB="0800050007000000"], 0x24}}, 0x48000) sendmsg$NL80211_CMD_CONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYRES8=r1, @ANYRES32=r7], 0x2c}, 0x1, 0x0, 0x0, 0x44840}, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x13, r3, 0xd1383000) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r8, 0x0) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r8, 0x1000) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0xfffff000) mmap(&(0x7f00008b7000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) mmap(&(0x7f000086a000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x2000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x24, 0x0, 0x0) socket(0x10, 0x2, 0x3) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x3, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_LACP_ACTIVE={0x5}]}}}]}, 0x3c}}, 0x54) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) 452.839049ms ago: executing program 1 (id=3257): r0 = socket$key(0xf, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x5a}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x8, 0x7f0dbe3ac64a03d0}, 0x9c) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=@newqdisc={0x3c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xc, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x3}]}}]}, 0x3c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41000, 0x1a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x4, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) getsockopt$llc_int(r2, 0x10c, 0x6, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="0ff0a3d94087998d0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000000085000000720000202070250000000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x6}, [@btf_id={0x18, 0x2, 0x3, 0x0, 0x3}]}, &(0x7f00000001c0)='syzkaller\x00', 0x8001, 0x4a, &(0x7f0000000200)=""/74, 0x41100, 0x2c, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x2, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000340)=[{0x4, 0x2, 0x3, 0x2}, {0x2, 0x4, 0xa, 0xe0ee4340c4c376fe}, {0x0, 0x2, 0x6, 0x7}, {0x2, 0x2, 0x10, 0x8}, {0x0, 0x3, 0x9, 0x4}], 0x10, 0x81}, 0x94) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000002c0)={0x9, 0x0, 0x5, 0x6, 0x0}, &(0x7f0000000480)=0x10) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f00000004c0)=@sack_info={r8, 0x35, 0x3}, &(0x7f0000000500)=0xc) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r10, &(0x7f0000000980), 0xe) listen(r10, 0x0) ioctl$sock_SIOCINQ(r10, 0x5411, 0x0) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2000000076000104000000000002000000000000", @ANYRES32=0x0, @ANYBLOB="080001"], 0x20}}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x4, 0x0, 0x9, 0xe, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @empty}}, @sadb_sa={0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1}}]}, 0x70}}, 0x0) 263.600649ms ago: executing program 3 (id=3258): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x400c050}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket(0x2a, 0x2, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) (async, rerun: 64) setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108) (async, rerun: 64) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000000480)={'sit0\x00', &(0x7f00000007c0)={'ip_vti0\x00', 0x0, 0x20, 0x20, 0x2f90, 0x5, {{0x5, 0x4, 0x1, 0x9, 0x14, 0x66, 0x0, 0x81, 0x4, 0x0, @rand_addr=0x64010102, @empty}}}}) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="3c0000001000010400000000000000c104000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008003a"], 0x3c}}, 0x0) (async, rerun: 64) r6 = socket$igmp(0x2, 0x3, 0x2) (async, rerun: 64) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r7, 0x0, 0x5, &(0x7f0000000240)={@local, @loopback, 0xff7e, "66c5aff8a7eb3af1f6cec2e7420000008c84ae8c170000c4ffff00", 0x3, 0x0, 0x80, 0x4f04}, 0x92) (async, rerun: 32) setsockopt$MRT_ADD_MFC(r6, 0x0, 0x5, 0x0, 0x0) (rerun: 32) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r8, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x200000}, 0x1c) shutdown(r8, 0x1) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x38, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14, 0x10}}, 0x80}}, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x2}, 0x8) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newlink={0xb0, 0x10, 0xffffff1f, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r1}, @IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0x74aa0}]}}}, @IFLA_PROP_LIST={0x68, 0x34, 0x0, 0x1, [{0x14, 0x35, 'geneve0\x00'}, {0x14, 0x35, 'veth1_to_bond\x00'}, {0x14, 0x35, 'veth0_to_bridge\x00'}, {0x14, 0x35, 'nr0\x00'}, {0x14, 0x35, 'batadv_slave_0\x00'}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) (rerun: 32) 260.603464ms ago: executing program 1 (id=3259): r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @multicast2}, 0x3c, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c068c0a7d2eaebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838029f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0x3e}}, @ip_tos_u8={{0x14, 0x29, 0x43}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x50}, 0x9fc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="180000006a000769000200000000000000000005"], 0x18}}, 0x0) 207.063636ms ago: executing program 1 (id=3260): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="b2", 0x1}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES8=r2], 0x18, 0x10}}], 0x1, 0x0) accept(r2, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newtfilter={0x34, 0x28, 0x575ac7824d421509, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, r5, {0x10}, {0x1}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x8, 0x2, [@TCA_BPF_ACT={0x4}]}}]}, 0x34}}, 0x40) socket(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) bind$unix(r2, &(0x7f00000000c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) listen(r2, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) connect$unix(r3, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) sendmmsg$unix(r3, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000340)="b2", 0x1}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES8=r2], 0x18, 0x10}}], 0x1, 0x0) (async) accept(r2, 0x0, 0x0) (async) socket(0x10, 0x803, 0x2) (async) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newtfilter={0x34, 0x28, 0x575ac7824d421509, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, r5, {0x10}, {0x1}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x8, 0x2, [@TCA_BPF_ACT={0x4}]}}]}, 0x34}}, 0x40) (async) 162.579868ms ago: executing program 3 (id=3261): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="2e00000010008188040f6fec59acbc0435a181003f00000000060000000000000e000d000d6ed60012801900121f", 0x2e}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0xbc}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x34, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}]}, 0x34}}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d4", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x80) recvmmsg$unix(r2, &(0x7f0000003680)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/18, 0x12}], 0x1}}], 0x1, 0x2, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r3 = socket$netlink(0x10, 0x3, 0x0) accept4$unix(r2, 0x0, &(0x7f0000000000), 0x400) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 51.584135ms ago: executing program 0 (id=3262): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f0000000680)="170000000200010000ffbe8c5ee17688a2006c000301000a000002a2576e5ed9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000fc0607bdca67a622c45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dfc060115003901000000000000ea000000000000000062068f5ee50ce5af9b1c56835382e9d969ba5149e9e90539062a80e605007f71174aa951f3c63e5a1b47b63a6323ded241482cfe17c3778a", 0xb8) r1 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r1, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f00000000c0)="1d7497394b2dc7860b82e1021626b41abf61cf36c00308eb8b0ca09e107f54b2e3af95e5041d10ae53a151a9da32d514108190c893bb3972e1929f4a78f1c0b568a64c8f6ee3f7f702a56863dbea751432ca77ad66eda5992eaff446749e3860ac2fa6df6454403a2c1894295ef2c4544f56558f959bacf54c05b4014e10acdf2e038bd88958c4277e1abd5945167d2bb36969487dd38508fed143b0471758db9a5ade6ebe241c40e0a228f127298026bae5596af01f57688c7331d8e73dd136fe5e4a8773853ff65726eb4f1026", 0xce, 0x0, &(0x7f00000001c0)={0x2, 0x4e21, @loopback}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540"], 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r7, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r3, @ANYBLOB="00000000000000001c001a800800028008000200080000003e"], 0x44}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa96aaaaaaaa00080045000030000000000001907864010100ac1414aa0b0090780300000045000000000000000000000000000000ac1414aa1aca3942c3edd6"], 0x0) 50.766427ms ago: executing program 4 (id=3263): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000140)={0x18, 0x0, {0x20, @random="a380e37b9489", 'xfrm0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xb, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r1, &(0x7f0000000080)="e00b759cc50aa6f8d8be6bf1dabb2532d378b988a0662e089bf59c426b229fa6b6cdd2e34362b8e66dc2da61a50ddb333225a823d79776e0a603b62f9918e607ba33dc12fe0b2f1f948615b37a4f5d612ad2061fdca021dc6e63", &(0x7f0000000180)=""/183}, 0x20) 0s ago: executing program 1 (id=3264): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0xa, 0x3, 0x3a) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000280)={r5, 0x346}, &(0x7f00000002c0)=0x8) setsockopt$inet6_int(r2, 0x29, 0x7, &(0x7f0000000040), 0x4) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000001700090025bd7000fddbdf2506000000080001000300"], 0x1c}, 0x1, 0x0, 0x0, 0x4000002}, 0x4000080) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000140)={'nat\x00', 0x0, 0x0, 0x0, [0x10001, 0xfff, 0x9, 0x46a, 0x1ff, 0xfffffffffffffff9]}, &(0x7f0000000040)=0x78) sendmsg$nl_xfrm(r6, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025bd7000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) kernel console output (not intermixed with test programs): unset [0, 0] type 1 family 0 port 8472 - 0 [ 205.441014][T12577] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.502774][T12605] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1888'. [ 205.555708][ T44] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.568918][ T44] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.577838][T12607] netlink: 'syz.3.1889': attribute type 1 has an invalid length. [ 205.590626][ T44] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.599094][ T44] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.622814][T12607] 8021q: adding VLAN 0 to HW filter on device bond4 [ 205.643654][ T44] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.652343][ T44] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.667507][T12607] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1889'. [ 205.682295][ T62] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 205.690939][ T62] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 205.709546][T12607] gretap1: entered promiscuous mode [ 205.858490][T12621] netlink: 'syz.2.1891': attribute type 10 has an invalid length. [ 205.877542][T12621] geneve1: entered promiscuous mode [ 205.883889][T12621] `: (slave geneve1): Enslaving as an active interface with an up link [ 206.004577][T12629] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1895'. [ 206.017814][T12629] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1895'. [ 206.050967][T12632] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1896'. [ 206.144084][T12640] syzkaller0: entered allmulticast mode [ 206.313891][T12654] netlink: 'syz.4.1904': attribute type 2 has an invalid length. [ 206.329574][T12657] netlink: 'syz.4.1904': attribute type 2 has an invalid length. [ 206.331513][T12652] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1903'. [ 206.468038][T12662] bond0: entered promiscuous mode [ 206.477641][T12662] bond0: left promiscuous mode [ 206.530346][T12666] syzkaller1: entered promiscuous mode [ 206.537431][T12666] syzkaller1: entered allmulticast mode [ 206.699954][T12680] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 206.715166][T12681] sctp: [Deprecated]: syz.4.1913 (pid 12681) Use of int in max_burst socket option. [ 206.715166][T12681] Use struct sctp_assoc_value instead [ 206.941194][T12678] veth0_to_team: left promiscuous mode [ 206.983733][T12678] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 207.017268][T12678] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 207.078979][T12678] vxlan0: left promiscuous mode [ 207.083875][T12678] vxlan0: left allmulticast mode [ 207.095691][T12678] ip6tnl1: left promiscuous mode [ 207.101334][T12678] ip6tnl1: left allmulticast mode [ 207.108865][T12678] veth3: left promiscuous mode [ 207.127952][T12678] veth11: left promiscuous mode [ 207.170566][ T62] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 207.183072][ T62] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.192135][ T62] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 207.202330][ T62] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.222928][ T62] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 207.232117][ T62] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.244096][ T62] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 207.265220][ T62] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 207.484236][T12723] netlink: 'syz.3.1923': attribute type 4 has an invalid length. [ 207.493943][T12723] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1923'. [ 207.529799][T12725] xt_hashlimit: overflow, try lower: 3/0 [ 207.535961][T12723] wlan1: mtu less than device minimum [ 207.772760][T12739] 0: reclassify loop, rule prio 0, protocol 800 [ 207.813262][T12748] ieee802154 phy1 wpan1: encryption failed: -90 [ 208.004697][T12754] netlink: 'syz.0.1934': attribute type 12 has an invalid length. [ 208.060709][T12754] bond11: option primary_reselect: invalid value (255) [ 208.075863][T12754] bond11 (unregistering): Released all slaves [ 208.207603][T12754] bond11: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 208.220889][T12754] bond11 (unregistering): Released all slaves [ 208.584031][T12786] sctp: [Deprecated]: syz.2.1944 (pid 12786) Use of int in max_burst socket option. [ 208.584031][T12786] Use struct sctp_assoc_value instead [ 208.794180][T12803] xt_hashlimit: invalid rate [ 208.936873][T12816] x_tables: duplicate underflow at hook 3 [ 209.067497][T12820] __nla_validate_parse: 4 callbacks suppressed [ 209.067514][T12820] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1960'. [ 209.116892][T12820] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1960'. [ 209.200849][T12833] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1959'. [ 209.313428][T12835] veth0: entered promiscuous mode [ 209.334495][T12825] netlink: 'syz.2.1959': attribute type 10 has an invalid length. [ 209.344209][T12834] veth0: left promiscuous mode [ 209.353584][T12825] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1959'. [ 209.380689][T12825] dummy0: entered promiscuous mode [ 209.398276][T12825] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 209.552871][T12853] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1969'. [ 209.671291][T12867] bond5: entered allmulticast mode [ 209.683737][T12867] 8021q: adding VLAN 0 to HW filter on device bond5 [ 209.693316][T12867] bridge0: port 1(bond5) entered blocking state [ 209.704166][T12867] bridge0: port 1(bond5) entered disabled state [ 209.705009][T12879] xt_CT: You must specify a L4 protocol and not use inversions on it [ 209.713475][T12867] bond5: entered promiscuous mode [ 209.728989][T12867] bridge0: port 1(bond5) entered blocking state [ 209.735362][T12867] bridge0: port 1(bond5) entered forwarding state [ 209.761876][T12875] bridge4: entered promiscuous mode [ 209.767645][T12875] bridge4: entered allmulticast mode [ 209.779227][ T3003] bridge0: port 1(bond5) entered disabled state [ 209.790779][T12881] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.1976'. [ 210.003280][T12897] batman_adv: batadv0: Adding interface: dummy0 [ 210.010027][T12897] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 210.037032][T12897] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 210.049073][T12895] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1980'. [ 210.049895][T12897] dummy0: mtu less than device minimum [ 210.064705][T12899] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1982'. [ 210.082292][ T1114] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.091325][ T1114] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.103681][ T1114] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.117523][T12903] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1982'. [ 210.147774][ T1114] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 210.239390][T12909] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1985'. [ 210.248540][T12907] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 210.286790][T12909] bond11: option xmit_hash_policy: invalid value (64) [ 210.780611][T12909] bond11 (unregistering): Released all slaves [ 210.814474][T12920] openvswitch: netlink: Message has 8 unknown bytes. [ 210.821655][T12920] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 210.900573][T12926] netlink: 'syz.1.1989': attribute type 5 has an invalid length. [ 211.179597][T12941] xt_ecn: cannot match TCP bits for non-tcp packets [ 211.418418][T12960] netlink: 'syz.0.1998': attribute type 18 has an invalid length. [ 212.849973][T13013] SET target dimension over the limit! [ 213.057323][T13029] netlink: 'syz.2.2016': attribute type 1 has an invalid length. [ 213.065292][T13021] bond11: entered allmulticast mode [ 213.086661][T13021] 8021q: adding VLAN 0 to HW filter on device bond11 [ 213.094104][T13021] bridge0: port 5(bond11) entered blocking state [ 213.101260][T13021] bridge0: port 5(bond11) entered disabled state [ 213.110928][T13021] bond11: entered promiscuous mode [ 213.122288][T13021] bridge0: port 5(bond11) entered blocking state [ 213.128910][T13021] bridge0: port 5(bond11) entered forwarding state [ 213.344286][T13045] policy can only be matched on NF_INET_PRE_ROUTING [ 213.344309][T13045] unable to load match [ 213.675154][ T3003] bridge0: port 5(bond11) entered disabled state [ 214.322879][T13119] netlink: 'syz.3.2038': attribute type 1 has an invalid length. [ 214.418011][T13119] bond6: (slave bridge4): making interface the new active one [ 214.427090][T13119] bond6: (slave bridge4): Enslaving as an active interface with an up link [ 214.508315][T13129] __nla_validate_parse: 16 callbacks suppressed [ 214.508333][T13129] netlink: 288 bytes leftover after parsing attributes in process `syz.3.2041'. [ 214.521270][T13126] bond6: option min_links: invalid value (18446744073709551614) [ 214.532471][T13126] bond6: option min_links: allowed values 0 - 2147483647 [ 214.555679][T13126] bond6 (unregistering): Released all slaves [ 214.628290][T13135] vlan2: entered promiscuous mode [ 214.636673][T13135] bond0: entered promiscuous mode [ 214.641756][T13135] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 214.688501][T13138] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2044'. [ 214.715737][T13138] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2044'. [ 214.769610][T13138] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 214.861656][T13144] gre0: entered promiscuous mode [ 214.869259][T13144] gre0: entered allmulticast mode [ 214.974829][T13159] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2051'. [ 215.129388][T13171] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2054'. [ 215.140394][T13171] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2054'. [ 215.191731][T13171] hsr_slave_0 (unregistering): left promiscuous mode [ 215.290625][T13179] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2057'. [ 215.399589][T13189] netlink: 'syz.1.2059': attribute type 83 has an invalid length. [ 215.462094][T13191] tipc: Enabling of bearer rejected, failed to enable media [ 215.472376][T13191] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2062'. [ 215.547985][T13199] netlink: 'syz.4.2065': attribute type 21 has an invalid length. [ 215.558256][T13199] IPv6: NLM_F_CREATE should be specified when creating new route [ 215.566847][T13199] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 215.572841][T13203] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 215.574086][T13199] IPv6: NLM_F_CREATE should be set when creating new route [ 215.588916][T13199] IPv6: NLM_F_CREATE should be set when creating new route [ 215.596188][T13199] IPv6: NLM_F_CREATE should be set when creating new route [ 215.737512][ T52] Bluetooth: hci4: command 0x0405 tx timeout [ 215.749801][T13210] netlink: zone id is out of range [ 215.755141][T13210] netlink: zone id is out of range [ 215.766116][T13210] netlink: zone id is out of range [ 215.773305][T13210] netlink: zone id is out of range [ 215.780228][T13206] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2067'. [ 215.786580][T13210] netlink: zone id is out of range [ 215.797807][T13210] netlink: zone id is out of range [ 215.805845][T13207] veth5: entered promiscuous mode [ 215.820375][T13210] netlink: zone id is out of range [ 215.829441][T13210] netlink: zone id is out of range [ 215.834857][T13210] netlink: zone id is out of range [ 215.843991][T13213] netlink: 'syz.3.2069': attribute type 1 has an invalid length. [ 216.182685][T13233] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2074'. [ 216.268094][T13239] vlan5: entered allmulticast mode [ 216.325553][T13240] vlan5: entered allmulticast mode [ 216.548821][T13258] IPv6: NLM_F_REPLACE set, but no existing node found! [ 216.743713][T13264] syzkaller0: entered promiscuous mode [ 216.749515][T13264] syzkaller0: entered allmulticast mode [ 216.843733][T13268] netlink: 'syz.0.2084': attribute type 2 has an invalid length. [ 217.024305][T13285] syzkaller0: entered promiscuous mode [ 217.036582][T13285] syzkaller0: entered allmulticast mode [ 219.078789][T13330] netlink: 'syz.1.2101': attribute type 29 has an invalid length. [ 219.170975][T13335] nbd: must specify at least one socket [ 219.223611][T13341] unsupported nla_type 52263 [ 219.300766][T13346] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 219.530903][T13361] netlink: 'syz.2.2113': attribute type 1 has an invalid length. [ 219.542818][T13361] netlink: 'syz.2.2113': attribute type 1 has an invalid length. [ 219.632819][T13364] __nla_validate_parse: 5 callbacks suppressed [ 219.632839][T13364] netlink: 252 bytes leftover after parsing attributes in process `syz.1.2115'. [ 219.991886][T13401] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2126'. [ 220.019847][T13399] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2125'. [ 220.030178][T13401] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2126'. [ 220.077440][T13407] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2124'. [ 220.230729][T13415] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2124'. [ 220.574463][T13435] netlink: 'syz.3.2135': attribute type 4 has an invalid length. [ 220.584142][T13435] netlink: 17 bytes leftover after parsing attributes in process `syz.3.2135'. [ 221.145562][T13449] net_ratelimit: 2 callbacks suppressed [ 221.145578][T13449] openvswitch: netlink: Message has 4 unknown bytes. [ 221.464583][T13468] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 221.487259][T13470] openvswitch: netlink: nsh attr 60 is out of range max 3 [ 221.494437][T13470] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 221.542736][T13470] sctp: [Deprecated]: syz.1.2145 (pid 13470) Use of int in max_burst socket option deprecated. [ 221.542736][T13470] Use struct sctp_assoc_value instead [ 222.559551][T13515] netlink: 'syz.2.2158': attribute type 4 has an invalid length. [ 222.575223][T13512] syzkaller1: entered promiscuous mode [ 222.581627][T13512] syzkaller1: entered allmulticast mode [ 222.600472][T13512] netlink: 'syz.4.2157': attribute type 1 has an invalid length. [ 222.690758][T13525] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2160'. [ 222.917677][T13540] IPVS: set_ctl: invalid protocol: 61 172.30.0.5:20000 [ 223.169074][T13554] netlink: 22 bytes leftover after parsing attributes in process `syz.1.2171'. [ 223.384424][ T10] IPVS: starting estimator thread 0... [ 223.390329][T13571] IPVS: ip_vs_edit_dest(): server weight less than zero [ 223.407657][T13573] IPVS: ip_vs_edit_dest(): server weight less than zero [ 223.506433][T13574] IPVS: using max 27 ests per chain, 64800 per kthread [ 223.625723][T13586] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 223.642728][T13590] netlink: 'syz.0.2181': attribute type 1 has an invalid length. [ 223.725130][T13590] 8021q: adding VLAN 0 to HW filter on device bond12 [ 223.740552][T13594] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2178'. [ 223.753985][T13594] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 223.779335][T13601] netlink: 'syz.1.2184': attribute type 83 has an invalid length. [ 223.792086][T13601] netlink: 'syz.1.2184': attribute type 83 has an invalid length. [ 223.996277][T13614] tipc: Enabling of bearer rejected, media not registered [ 224.033655][T13617] netdevsim netdevsim4 : renamed from netdevsim0 [ 224.260632][T13637] netlink: 'syz.2.2197': attribute type 1 has an invalid length. [ 224.440004][T13644] syzkaller0: entered promiscuous mode [ 224.445581][T13644] syzkaller0: entered allmulticast mode [ 224.872107][T13680] netlink: 'syz.3.2209': attribute type 2 has an invalid length. [ 224.880397][T13680] netlink: 'syz.3.2209': attribute type 2 has an invalid length. [ 224.888554][T13680] netlink: 'syz.3.2209': attribute type 1 has an invalid length. [ 224.987072][T13688] erspan0: entered allmulticast mode [ 225.138667][T13694] __nla_validate_parse: 7 callbacks suppressed [ 225.138679][T13694] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2213'. [ 226.362369][T13739] IPVS: Unknown mcast interface: nicvf0 [ 226.446226][T13743] tipc: Enabled bearer , priority 0 [ 226.459970][T13743] syzkaller0: entered promiscuous mode [ 226.481421][T13743] syzkaller0: entered allmulticast mode [ 226.566467][T13743] tipc: Resetting bearer [ 226.593753][T13741] tipc: Resetting bearer [ 226.648559][T13741] tipc: Disabling bearer [ 226.980994][T13784] A link change request failed with some changes committed already. Interface vet0_virt_wifi may have been left with an inconsistent configuration, please check. [ 227.338090][T13802] validate_nla: 1 callbacks suppressed [ 227.338110][T13802] netlink: 'syz.1.2242': attribute type 2 has an invalid length. [ 227.698927][T13832] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2252'. [ 228.002578][T13854] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2260'. [ 228.029168][T13859] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2262'. [ 228.391653][T13885] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2270'. [ 228.406819][T13886] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2268'. [ 228.416366][T13887] IPVS: set_ctl: invalid protocol: 44 255.255.255.255:20001 [ 228.422665][T13886] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2268'. [ 228.477936][T13885] netlink: 'syz.1.2270': attribute type 18 has an invalid length. [ 228.574414][T13896] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2273'. [ 228.771867][T13909] netlink: 'syz.2.2278': attribute type 6 has an invalid length. [ 228.796424][T13912] netlink: 'syz.2.2278': attribute type 6 has an invalid length. [ 228.877099][T13922] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2279'. [ 228.901398][T13925] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2281'. [ 228.933805][T13922] team0: left allmulticast mode [ 228.939142][T13922] team_slave_0: left allmulticast mode [ 228.950262][T13922] team_slave_1: left allmulticast mode [ 228.964698][T13922] team0: left promiscuous mode [ 228.974525][T13922] team_slave_0: left promiscuous mode [ 228.980657][T13922] team_slave_1: left promiscuous mode [ 228.986995][T13922] bridge0: port 4(team0) entered disabled state [ 229.001897][T13922] syz_tun: left promiscuous mode [ 229.009332][T13922] bridge0: port 3(syz_tun) entered disabled state [ 229.038313][T13922] bridge_slave_1: left promiscuous mode [ 229.051978][T13922] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.072283][T13922] bridge_slave_0: left allmulticast mode [ 229.091328][T13922] bridge_slave_0: left promiscuous mode [ 229.112205][T13922] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.197526][T13940] netlink: 'syz.2.2283': attribute type 1 has an invalid length. [ 229.251116][T13940] bond6: (slave ip6gretap2): making interface the new active one [ 229.259885][T13940] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 229.269670][T13940] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 229.295093][T13940] bond6: (slave ip6gretap2): Enslaving as an active interface with an up link [ 229.403996][T13947] xt_connbytes: Forcing CT accounting to be enabled [ 229.469250][T13947] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 229.536941][T13963] FAULT_INJECTION: forcing a failure. [ 229.536941][T13963] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 229.550214][T13963] CPU: 1 UID: 0 PID: 13963 Comm: syz.4.2291 Not tainted syzkaller #0 PREEMPT(full) [ 229.550237][T13963] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 229.550246][T13963] Call Trace: [ 229.550253][T13963] [ 229.550260][T13963] dump_stack_lvl+0x189/0x250 [ 229.550293][T13963] ? __pfx____ratelimit+0x10/0x10 [ 229.550313][T13963] ? __pfx_dump_stack_lvl+0x10/0x10 [ 229.550331][T13963] ? __pfx__printk+0x10/0x10 [ 229.550347][T13963] ? __might_fault+0xb0/0x130 [ 229.550379][T13963] should_fail_ex+0x414/0x560 [ 229.550408][T13963] _copy_from_user+0x2d/0xb0 [ 229.550430][T13963] nr_rt_ioctl+0x74f/0xd50 [ 229.550463][T13963] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 229.550477][T13963] ? lockdep_hardirqs_on+0x9c/0x150 [ 229.550506][T13963] ? apparmor_capable+0x137/0x1b0 [ 229.550532][T13963] ? capable+0x89/0xe0 [ 229.550550][T13963] ? nr_ioctl+0x1b1/0x3b0 [ 229.550569][T13963] sock_do_ioctl+0xdc/0x300 [ 229.550593][T13963] ? __pfx_sock_do_ioctl+0x10/0x10 [ 229.550611][T13963] ? hook_file_ioctl+0xbf/0x530 [ 229.550642][T13963] sock_ioctl+0x576/0x790 [ 229.550664][T13963] ? __pfx_sock_ioctl+0x10/0x10 [ 229.550688][T13963] ? __fget_files+0x3a0/0x420 [ 229.550704][T13963] ? __fget_files+0x2a/0x420 [ 229.550722][T13963] ? bpf_lsm_file_ioctl+0x9/0x20 [ 229.550740][T13963] ? __pfx_sock_ioctl+0x10/0x10 [ 229.550758][T13963] __se_sys_ioctl+0xfc/0x170 [ 229.550780][T13963] do_syscall_64+0xfa/0xfa0 [ 229.550801][T13963] ? lockdep_hardirqs_on+0x9c/0x150 [ 229.550822][T13963] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.550839][T13963] ? clear_bhb_loop+0x60/0xb0 [ 229.550857][T13963] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 229.550872][T13963] RIP: 0033:0x7fcbd858f749 [ 229.550898][T13963] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 229.550913][T13963] RSP: 002b:00007fcbd9505038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 229.550938][T13963] RAX: ffffffffffffffda RBX: 00007fcbd87e5fa0 RCX: 00007fcbd858f749 [ 229.550950][T13963] RDX: 0000200000000380 RSI: 000000000000890b RDI: 0000000000000004 [ 229.550961][T13963] RBP: 00007fcbd9505090 R08: 0000000000000000 R09: 0000000000000000 [ 229.550972][T13963] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 229.550982][T13963] R13: 00007fcbd87e6038 R14: 00007fcbd87e5fa0 R15: 00007ffe210216b8 [ 229.551020][T13963] [ 229.880535][T13971] x_tables: unsorted underflow at hook 4 [ 230.022759][T13981] netlink: 'syz.4.2296': attribute type 15 has an invalid length. [ 230.259078][T13997] IPVS: set_ctl: invalid protocol: 47 224.0.0.1:20004 [ 230.397971][T14012] FAULT_INJECTION: forcing a failure. [ 230.397971][T14012] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.412155][T14012] CPU: 1 UID: 0 PID: 14012 Comm: syz.0.2307 Not tainted syzkaller #0 PREEMPT(full) [ 230.412179][T14012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 230.412190][T14012] Call Trace: [ 230.412198][T14012] [ 230.412206][T14012] dump_stack_lvl+0x189/0x250 [ 230.412233][T14012] ? __pfx____ratelimit+0x10/0x10 [ 230.412255][T14012] ? __pfx_dump_stack_lvl+0x10/0x10 [ 230.412276][T14012] ? __pfx__printk+0x10/0x10 [ 230.412305][T14012] should_fail_ex+0x414/0x560 [ 230.412339][T14012] _copy_to_user+0x31/0xb0 [ 230.412362][T14012] simple_read_from_buffer+0xe1/0x170 [ 230.412392][T14012] proc_fail_nth_read+0x1b3/0x220 [ 230.412417][T14012] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 230.412441][T14012] ? rw_verify_area+0x2a6/0x4d0 [ 230.412462][T14012] ? __lock_acquire+0xab9/0xd20 [ 230.412477][T14012] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 230.412499][T14012] vfs_read+0x200/0xa30 [ 230.412520][T14012] ? fdget_pos+0x247/0x320 [ 230.412541][T14012] ? __pfx___mutex_lock+0x10/0x10 [ 230.412564][T14012] ? __pfx_vfs_read+0x10/0x10 [ 230.412587][T14012] ? __fget_files+0x2a/0x420 [ 230.412611][T14012] ? __fget_files+0x3a0/0x420 [ 230.412626][T14012] ? __fget_files+0x2a/0x420 [ 230.412651][T14012] ksys_read+0x145/0x250 [ 230.412671][T14012] ? __fget_files+0x2a/0x420 [ 230.412687][T14012] ? __pfx_ksys_read+0x10/0x10 [ 230.412713][T14012] ? do_syscall_64+0xbe/0xfa0 [ 230.412740][T14012] do_syscall_64+0xfa/0xfa0 [ 230.412760][T14012] ? lockdep_hardirqs_on+0x9c/0x150 [ 230.412783][T14012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.412800][T14012] ? clear_bhb_loop+0x60/0xb0 [ 230.412821][T14012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.412837][T14012] RIP: 0033:0x7f954b38e15c [ 230.412853][T14012] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 230.412867][T14012] RSP: 002b:00007f954c215030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 230.412885][T14012] RAX: ffffffffffffffda RBX: 00007f954b5e5fa0 RCX: 00007f954b38e15c [ 230.412897][T14012] RDX: 000000000000000f RSI: 00007f954c2150a0 RDI: 0000000000000003 [ 230.412908][T14012] RBP: 00007f954c215090 R08: 0000000000000000 R09: 0000000000000000 [ 230.412918][T14012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 230.412935][T14012] R13: 00007f954b5e6038 R14: 00007f954b5e5fa0 R15: 00007ffef5034828 [ 230.412965][T14012] [ 230.435263][T14013] __nla_validate_parse: 4 callbacks suppressed [ 230.435281][T14013] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2305'. [ 230.501264][T14016] netlink: 'syz.1.2305': attribute type 8 has an invalid length. [ 231.090436][T14043] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2314'. [ 231.457422][ T56] block nbd1: Possible stuck request ffff888025265080: control (read@0,1024B). Runtime 90 seconds [ 231.468711][ T56] block nbd1: Possible stuck request ffff888025265240: control (read@1024,1024B). Runtime 90 seconds [ 231.480197][ T56] block nbd1: Possible stuck request ffff888025265400: control (read@2048,1024B). Runtime 90 seconds [ 231.492652][ T56] block nbd1: Possible stuck request ffff8880252655c0: control (read@3072,1024B). Runtime 90 seconds [ 231.561773][T14025] vlan0: left allmulticast mode [ 231.569936][T14025] veth0_vlan: left allmulticast mode [ 231.575503][T14025] vlan0: left promiscuous mode [ 231.646736][ T1227] sy: Port: 1 Link DOWN [ 231.666398][ T3580] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 231.684484][ T3580] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.706604][ T3580] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 231.714992][ T3580] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.835300][ T3580] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 231.854092][ T3580] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.854503][T14065] netlink: 'syz.3.2318': attribute type 63 has an invalid length. [ 231.873266][ T3003] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 231.913264][ T3003] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 232.027708][T14083] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 232.087831][T14086] tipc: Started in network mode [ 232.092734][T14086] tipc: Node identity , cluster identity 4711 [ 232.108482][T14091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2323'. [ 232.109028][T14086] tipc: Failed to obtain node identity [ 232.124718][T14086] tipc: Enabling of bearer rejected, failed to enable media [ 232.146945][T14086] netlink: 'syz.1.2320': attribute type 9 has an invalid length. [ 232.164688][T14086] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2320'. [ 232.171605][T14094] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 232.280300][T14086] syzkaller0: entered promiscuous mode [ 232.287634][T14086] syzkaller0: entered allmulticast mode [ 232.820251][T14140] Bluetooth: MGMT ver 1.23 [ 234.319846][T14120] tipc: Enabling of bearer rejected, failed to enable media [ 234.334522][T14135] dvmrp0: entered allmulticast mode [ 234.630508][T14159] netlink: 'syz.3.2337': attribute type 12 has an invalid length. [ 234.684365][T14159] bond7: option primary_reselect: invalid value (255) [ 234.736702][T14159] bond7 (unregistering): Released all slaves [ 234.794455][T14175] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2340'. [ 234.806054][T14173] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2340'. [ 234.939693][T14189] netlink: 'syz.4.2345': attribute type 21 has an invalid length. [ 234.956908][T14189] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2345'. [ 234.998347][T14195] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 235.038361][T14195] bond7: Unable to set peer notification delay as MII monitoring is disabled [ 235.049162][T14195] bond7 (unregistering): Released all slaves [ 235.076660][T14201] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2348'. [ 235.083543][T14203] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2349'. [ 235.088182][T14201] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.175737][T14201] bridge_slave_1 (unregistering): left allmulticast mode [ 235.184029][T14201] bridge_slave_1 (unregistering): left promiscuous mode [ 235.192001][T14201] bridge0: port 2(bridge_slave_1) entered disabled state [ 235.329592][T14212] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2352'. [ 235.428964][T14218] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 235.442366][T14218] x_tables: unsorted underflow at hook 3 [ 235.448673][T14218] netlink: 'syz.4.2355': attribute type 9 has an invalid length. [ 235.579913][T14228] IPv6: sit2: Disabled Multicast RS [ 235.585825][T14228] sit2: entered allmulticast mode [ 235.718105][T14235] pim6reg: entered allmulticast mode [ 235.851739][T14246] syz.3.2365: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 235.877030][T14246] CPU: 1 UID: 0 PID: 14246 Comm: syz.3.2365 Not tainted syzkaller #0 PREEMPT(full) [ 235.877055][T14246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 235.877066][T14246] Call Trace: [ 235.877072][T14246] [ 235.877078][T14246] dump_stack_lvl+0x189/0x250 [ 235.877103][T14246] ? __pfx_dump_stack_lvl+0x10/0x10 [ 235.877120][T14246] ? __pfx__printk+0x10/0x10 [ 235.877134][T14246] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 235.877152][T14246] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 235.877170][T14246] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 235.877189][T14246] warn_alloc+0x214/0x310 [ 235.877213][T14246] ? __pfx_warn_alloc+0x10/0x10 [ 235.877238][T14246] ? __get_vm_area_node+0x28f/0x300 [ 235.877258][T14246] ? hash_netportnet_create+0x354/0xf90 [ 235.877276][T14246] __vmalloc_node_range_noprof+0x690/0x12d0 [ 235.877312][T14246] ? alloc_pages_mpol+0x3cd/0x4a0 [ 235.877327][T14246] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 235.877348][T14246] ? rcu_is_watching+0x15/0xb0 [ 235.877363][T14246] ? hash_netportnet_create+0x354/0xf90 [ 235.877377][T14246] __kvmalloc_node_noprof+0x674/0x910 [ 235.877396][T14246] ? hash_netportnet_create+0x354/0xf90 [ 235.877410][T14246] ? __kmalloc_cache_noprof+0x3d5/0x6f0 [ 235.877429][T14246] ? hash_netportnet_create+0x2fa/0xf90 [ 235.877448][T14246] hash_netportnet_create+0x354/0xf90 [ 235.877468][T14246] ? __nla_parse+0x40/0x60 [ 235.877483][T14246] ? __pfx_hash_netportnet_create+0x10/0x10 [ 235.877504][T14246] ip_set_create+0xa97/0x1940 [ 235.877522][T14246] ? ip_set_create+0x4a2/0x1940 [ 235.877548][T14246] ? __pfx_ip_set_create+0x10/0x10 [ 235.877592][T14246] nfnetlink_rcv_msg+0xb4d/0x1130 [ 235.877611][T14246] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 235.877643][T14246] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 235.877680][T14246] ? __lock_acquire+0xab9/0xd20 [ 235.877708][T14246] netlink_rcv_skb+0x208/0x470 [ 235.877722][T14246] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 235.877740][T14246] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 235.877762][T14246] ? bpf_lsm_capable+0x9/0x20 [ 235.877777][T14246] ? security_capable+0x7e/0x2e0 [ 235.877799][T14246] nfnetlink_rcv+0x282/0x2590 [ 235.877819][T14246] ? is_bpf_text_address+0x26/0x2b0 [ 235.877838][T14246] ? __kernel_text_address+0xd/0x40 [ 235.877856][T14246] ? unwind_get_return_address+0x4d/0x90 [ 235.877872][T14246] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 235.877889][T14246] ? arch_stack_walk+0xfc/0x150 [ 235.877914][T14246] ? stack_trace_save+0x9c/0xe0 [ 235.877930][T14246] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 235.877947][T14246] ? stack_depot_save_flags+0x40/0x860 [ 235.877970][T14246] ? __lock_acquire+0xab9/0xd20 [ 235.878001][T14246] ? __lock_acquire+0xab9/0xd20 [ 235.878021][T14246] ? netlink_deliver_tap+0x2e/0x1b0 [ 235.878038][T14246] ? netlink_deliver_tap+0x2e/0x1b0 [ 235.878056][T14246] netlink_unicast+0x82f/0x9e0 [ 235.878080][T14246] ? __pfx_netlink_unicast+0x10/0x10 [ 235.878099][T14246] ? netlink_sendmsg+0x642/0xb30 [ 235.878110][T14246] ? skb_put+0x11b/0x210 [ 235.878126][T14246] netlink_sendmsg+0x805/0xb30 [ 235.878145][T14246] ? __pfx_netlink_sendmsg+0x10/0x10 [ 235.878161][T14246] ? aa_sock_msg_perm+0xf1/0x1d0 [ 235.878180][T14246] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 235.878193][T14246] ? __pfx_netlink_sendmsg+0x10/0x10 [ 235.878206][T14246] __sock_sendmsg+0x21c/0x270 [ 235.878226][T14246] ____sys_sendmsg+0x505/0x830 [ 235.878246][T14246] ? __pfx_____sys_sendmsg+0x10/0x10 [ 235.878267][T14246] ? import_iovec+0x74/0xa0 [ 235.878286][T14246] ___sys_sendmsg+0x21f/0x2a0 [ 235.878301][T14246] ? __pfx____sys_sendmsg+0x10/0x10 [ 235.878343][T14246] ? __fget_files+0x2a/0x420 [ 235.878355][T14246] ? __fget_files+0x3a0/0x420 [ 235.878375][T14246] __x64_sys_sendmsg+0x19b/0x260 [ 235.878391][T14246] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 235.878417][T14246] ? do_syscall_64+0xbe/0xfa0 [ 235.878439][T14246] do_syscall_64+0xfa/0xfa0 [ 235.878454][T14246] ? lockdep_hardirqs_on+0x9c/0x150 [ 235.878471][T14246] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.878483][T14246] ? clear_bhb_loop+0x60/0xb0 [ 235.878506][T14246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.878519][T14246] RIP: 0033:0x7f8fe818f749 [ 235.878532][T14246] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 235.878543][T14246] RSP: 002b:00007f8fe63ee038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 235.878558][T14246] RAX: ffffffffffffffda RBX: 00007f8fe83e5fa0 RCX: 00007f8fe818f749 [ 235.878568][T14246] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 235.878576][T14246] RBP: 00007f8fe8213f91 R08: 0000000000000000 R09: 0000000000000000 [ 235.878584][T14246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 235.878591][T14246] R13: 00007f8fe83e6038 R14: 00007f8fe83e5fa0 R15: 00007ffde8b646e8 [ 235.878614][T14246] [ 235.878873][T14246] Mem-Info: [ 235.978408][T14257] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 236.019355][T14246] active_anon:5790 inactive_anon:0 isolated_anon:0 [ 236.019355][T14246] active_file:2971 inactive_file:39971 isolated_file:0 [ 236.019355][T14246] unevictable:768 dirty:84 writeback:0 [ 236.019355][T14246] slab_reclaimable:11739 slab_unreclaimable:146863 [ 236.019355][T14246] mapped:29267 shmem:1357 pagetables:1224 [ 236.019355][T14246] sec_pagetables:0 bounce:0 [ 236.019355][T14246] kernel_misc_reclaimable:0 [ 236.019355][T14246] free:1282880 free_pcp:13518 free_cma:0 [ 236.124573][T14263] __nla_validate_parse: 3 callbacks suppressed [ 236.124590][T14263] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2370'. [ 236.160758][T14246] Node 0 active_anon:23260kB inactive_anon:0kB active_file:11884kB inactive_file:159680kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117068kB dirty:336kB writeback:0kB shmem:3892kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13368kB pagetables:5068kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 236.160874][T14246] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 236.160918][T14246] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 236.296858][T14267] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2371'. [ 236.311781][T14246] lowmem_reserve[]: 0 2505 2505 2505 2505 [ 236.564175][T14246] Node 0 DMA32 free:1220972kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23160kB inactive_anon:0kB active_file:11884kB inactive_file:159680kB unevictable:1536kB writepending:336kB zspages:0kB present:3129332kB managed:2565152kB mlocked:0kB bounce:0kB free_pcp:37792kB local_pcp:17112kB free_cma:0kB [ 236.612661][T14246] lowmem_reserve[]: 0 0 0 0 0 [ 236.618772][T14246] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 236.654424][T14270] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2372'. [ 236.673050][T14246] lowmem_reserve[]: 0 0 0 0 0 [ 236.678515][T14246] Node 1 Normal free:3894888kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16660kB local_pcp:8432kB free_cma:0kB [ 236.713435][T14246] lowmem_reserve[]: 0 0 0 0 0 [ 236.719875][T14246] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 236.766779][T14246] Node 0 DMA32: 934*4kB (UME) 582*8kB (UM) 342*16kB (UME) 338*32kB (UM) 56*64kB (UME) 16*128kB (UME) 9*256kB (UME) 5*512kB (UME) 2*1024kB (UM) 4*2048kB (UM) 287*4096kB (UM) = 1220968kB [ 236.886411][T14246] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 236.926138][T14246] Node 1 Normal: 138*4kB (UE) 36*8kB (UME) 24*16kB (UME) 81*32kB (UME) 28*64kB (UME) 7*128kB (UME) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UME) 2*2048kB (UE) 947*4096kB (M) = 3894888kB [ 236.964130][T14246] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 236.984576][T14246] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 237.006629][T14246] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 237.035046][T14246] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 237.044564][T14246] 44295 total pagecache pages [ 237.052744][T14246] 0 pages in swap cache [ 237.059062][T14246] Free swap = 124996kB [ 237.066430][T14246] Total swap = 124996kB [ 237.070743][T14300] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2379'. [ 237.081969][T14246] 2097051 pages RAM [ 237.085814][T14246] 0 pages HighMem/MovableOnly [ 237.091053][T14246] 424121 pages reserved [ 237.109544][T14246] 0 pages cma reserved [ 237.187520][T14309] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2383'. [ 237.239757][T14317] 8021q: VLANs not supported on gre0 [ 237.311036][T14322] netlink: 'syz.1.2386': attribute type 10 has an invalid length. [ 237.369609][T14322] team0: Port device dummy0 added [ 237.383374][T14324] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2388'. [ 237.388299][T14322] netlink: 'syz.1.2386': attribute type 10 has an invalid length. [ 237.405927][T14329] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2389'. [ 237.415154][T14329] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2389'. [ 237.447654][T14328] xt_bpf: check failed: parse error [ 237.471571][T14322] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 237.569345][T14322] team0: Failed to send options change via netlink (err -105) [ 237.579230][T14322] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 237.604971][T14322] team0: Port device dummy0 removed [ 237.613376][T14339] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2391'. [ 237.721900][T14340] syzkaller0: entered allmulticast mode [ 237.968625][T14344] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 240.020858][ T5831] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 240.095496][ T5831] CPU: 0 UID: 0 PID: 5831 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 240.095521][ T5831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 240.095531][ T5831] Call Trace: [ 240.095540][ T5831] [ 240.095548][ T5831] dump_stack_lvl+0x189/0x250 [ 240.095577][ T5831] ? __pfx_dump_stack_lvl+0x10/0x10 [ 240.095598][ T5831] ? __pfx__printk+0x10/0x10 [ 240.095629][ T5831] dump_header+0xd3/0x480 [ 240.095651][ T5831] oom_kill_process+0x387/0x920 [ 240.095670][ T5831] out_of_memory+0xf09/0x12a0 [ 240.095703][ T5831] ? __pfx_out_of_memory+0x10/0x10 [ 240.095733][ T5831] mem_cgroup_out_of_memory+0x145/0x240 [ 240.095750][ T5831] ? __pfx_mem_cgroup_out_of_memory+0x10/0x10 [ 240.095775][ T5831] ? _raw_spin_unlock+0x28/0x50 [ 240.095793][ T5831] ? memcg1_oom_prepare+0x37f/0x450 [ 240.095817][ T5831] try_charge_memcg+0xdf0/0x1280 [ 240.095848][ T5831] ? __pfx_try_charge_memcg+0x10/0x10 [ 240.095888][ T5831] charge_memcg+0x9f/0x180 [ 240.095910][ T5831] ? mem_cgroup_swapin_charge_folio+0x33/0x390 [ 240.095931][ T5831] mem_cgroup_swapin_charge_folio+0x262/0x390 [ 240.095956][ T5831] __read_swap_cache_async+0x212/0x480 [ 240.095986][ T5831] swap_cluster_readahead+0x336/0x630 [ 240.096009][ T5831] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 240.096035][ T5831] ? __switch_to+0xdc8/0x1690 [ 240.096065][ T5831] ? get_vma_policy+0x27c/0x3c0 [ 240.096090][ T5831] swapin_readahead+0x17d/0xb50 [ 240.096121][ T5831] ? __pfx_swapin_readahead+0x10/0x10 [ 240.096141][ T5831] ? swap_table_get+0x1e/0x260 [ 240.096156][ T5831] ? swap_table_get+0x1e/0x260 [ 240.096171][ T5831] ? swap_table_get+0x1e/0x260 [ 240.096188][ T5831] ? swap_table_get+0x216/0x260 [ 240.096207][ T5831] ? swap_cache_get_folio+0x51c/0x530 [ 240.096230][ T5831] do_swap_page+0x43b/0x5b20 [ 240.096253][ T5831] ? __lock_acquire+0xab9/0xd20 [ 240.096280][ T5831] ? ___pte_offset_map+0x29/0x250 [ 240.096300][ T5831] ? do_swap_page+0x184/0x5b20 [ 240.096318][ T5831] ? __pfx_do_swap_page+0x10/0x10 [ 240.096339][ T5831] ? __pfx_default_wake_function+0x10/0x10 [ 240.096356][ T5831] ? ___pte_offset_map+0x1cf/0x250 [ 240.096379][ T5831] ? pte_offset_map_rw_nolock+0xea/0x160 [ 240.096407][ T5831] __handle_mm_fault+0xe55/0x5400 [ 240.096440][ T5831] ? lock_vma_under_rcu+0x1a3/0x450 [ 240.096462][ T5831] ? __pfx___handle_mm_fault+0x10/0x10 [ 240.096495][ T5831] ? lock_vma_under_rcu+0x3d2/0x450 [ 240.096519][ T5831] ? __pfx_lock_vma_under_rcu+0x10/0x10 [ 240.096545][ T5831] handle_mm_fault+0x40a/0x8e0 [ 240.096576][ T5831] do_user_addr_fault+0xa7c/0x1380 [ 240.096600][ T5831] ? rcu_is_watching+0x15/0xb0 [ 240.096618][ T5831] ? trace_page_fault_user+0x84/0x1e0 [ 240.096635][ T5831] exc_page_fault+0x82/0x100 [ 240.096658][ T5831] asm_exc_page_fault+0x26/0x30 [ 240.096673][ T5831] RIP: 0033:0x7fc47b9c2008 [ 240.096689][ T5831] Code: 3c 24 48 89 4c 24 18 e8 f6 54 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 8b 74 24 0c 8b 3c 24 b8 e6 00 00 00 0f 05 44 89 c7 <48> 89 04 24 e8 4f 55 ff ff 48 8b 04 24 48 83 c4 28 f7 d8 c3 0f 1f [ 240.096703][ T5831] RSP: 002b:00007fff20987bf0 EFLAGS: 00010293 [ 240.096717][ T5831] RAX: 0000000000000000 RBX: 00000000000004e2 RCX: 00007fc47b9c2005 [ 240.096727][ T5831] RDX: 00007fff20987c30 RSI: 0000000000000000 RDI: 0000000000000000 [ 240.096736][ T5831] RBP: 00007fff20987c9c R08: 0000000000000000 R09: 0000000000000000 [ 240.096746][ T5831] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000001388 [ 240.096755][ T5831] R13: 00000000000927c0 R14: 000000000003a21c R15: 00007fff20987cf0 [ 240.096784][ T5831] [ 240.451839][ T5831] memory: usage 307200kB, limit 307200kB, failcnt 477 [ 240.467323][ T5831] memory+swap: usage 304816kB, limit 9007199254740988kB, failcnt 0 [ 240.475256][ T5831] kmem: usage 302360kB, limit 9007199254740988kB, failcnt 0 [ 240.483247][ T5831] Memory cgroup stats for /syz2: [ 240.483519][ T5831] cache 8192 [ 240.500694][ T5831] rss 0 [ 240.503489][ T5831] rss_huge 0 [ 240.507346][ T5831] shmem 0 [ 240.510516][ T5831] mapped_file 0 [ 240.513985][ T5831] dirty 0 [ 240.540826][ T5831] writeback 0 [ 240.544159][ T5831] workingset_refault_anon 0 [ 240.551108][ T5831] workingset_refault_file 0 [ 240.555638][ T5831] swap 221184 [ 240.581343][ T5831] swapcached 0 [ 240.584884][ T5831] pgpgin 40421 [ 240.597611][ T5831] pgpgout 40419 [ 240.601122][ T5831] pgfault 78852 [ 240.605854][ T5831] pgmajfault 3 [ 240.610413][ T5831] inactive_anon 0 [ 240.614189][ T5831] active_anon 0 [ 240.618723][ T5831] inactive_file 4096 [ 240.622900][ T5831] active_file 4096 [ 240.627214][ T5831] unevictable 0 [ 240.630803][ T5831] hierarchical_memory_limit 314572800 [ 240.636956][ T5831] hierarchical_memsw_limit 9223372036854771712 [ 240.643211][ T5831] total_cache 8192 [ 240.647446][ T5831] total_rss 0 [ 240.650811][ T5831] total_rss_huge 0 [ 240.654603][ T5831] total_shmem 0 [ 240.664060][ T5831] total_mapped_file 0 [ 240.668648][ T5831] total_dirty 0 [ 240.672195][ T5831] total_writeback 0 [ 240.676429][ T5831] total_workingset_refault_anon 0 [ 240.681593][ T5831] total_workingset_refault_file 0 [ 240.687157][ T5831] total_swap 221184 [ 240.691100][ T5831] total_swapcached 0 [ 240.695096][ T5831] total_pgpgin 40421 [ 240.700098][ T5831] total_pgpgout 40419 [ 240.704173][ T5831] total_pgfault 78852 [ 240.708542][ T5831] total_pgmajfault 3 [ 240.712633][ T5831] total_inactive_anon 0 [ 240.717116][ T5831] total_active_anon 0 [ 240.721210][ T5831] total_inactive_file 4096 [ 240.725849][ T5831] total_active_file 4096 [ 240.730503][ T5831] total_unevictable 0 [ 240.734628][ T5831] anon_cost 0 [ 240.738883][ T5831] file_cost 0 [ 240.742249][ T5831] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz2,task_memcg=/syz2,task=syz.2.2387,pid=14320,uid=0 [ 240.759621][ T5831] Memory cgroup out of memory: Killed process 14320 (syz.2.2387) total-vm:106460kB, anon-rss:1268kB, file-rss:27236kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 240.787990][ T5201] udevd[5201]: worker [5841] /devices/virtual/block/nbd1 is taking a long time [ 240.997352][T14375] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2401'. [ 241.126579][T14383] netlink: 'syz.4.2402': attribute type 30 has an invalid length. [ 241.139578][T14378] netlink: 'syz.1.2400': attribute type 10 has an invalid length. [ 241.147980][T14378] netlink: 228 bytes leftover after parsing attributes in process `syz.1.2400'. [ 241.215482][T14383] bond6: option arp_missed_max: invalid value (0) [ 241.223225][T14383] bond6: option arp_missed_max: allowed values 1 - 255 [ 241.237533][T14383] bond6 (unregistering): Released all slaves [ 242.199302][T14442] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2418'. [ 242.412317][T14453] netlink: 'syz.1.2420': attribute type 12 has an invalid length. [ 242.599334][T14453] bond2: option primary_reselect: invalid value (255) [ 242.661328][T14453] bond2 (unregistering): Released all slaves [ 242.701839][T14462] netlink: 'syz.4.2422': attribute type 29 has an invalid length. [ 242.712609][T14458] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2422'. [ 242.724464][T14458] netlink: 'syz.4.2422': attribute type 29 has an invalid length. [ 242.750995][T14458] netlink: 'syz.4.2422': attribute type 29 has an invalid length. [ 242.771082][T14458] netlink: 'syz.4.2422': attribute type 29 has an invalid length. [ 242.790559][T14458] netlink: 'syz.4.2422': attribute type 29 has an invalid length. [ 242.802907][T14458] netlink: 'syz.4.2422': attribute type 29 has an invalid length. [ 242.825589][T14458] netlink: 'syz.4.2422': attribute type 29 has an invalid length. [ 242.846815][T14474] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2424'. [ 242.865649][ T32] oom_reaper: reaped process 14320 (syz.2.2387), now anon-rss:112kB, file-rss:26108kB, shmem-rss:0kB [ 243.287950][T14495] tipc: Enabling of bearer rejected, failed to enable media [ 243.337776][T14495] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2429'. [ 243.549563][T14506] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2432'. [ 243.570042][T14508] xt_CT: You must specify a L4 protocol and not use inversions on it [ 243.665291][T14512] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2434'. [ 243.694034][T14512] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2434'. [ 243.884068][T14525] xt_TPROXY: Can be used only with -p tcp or -p udp [ 244.148841][T14541] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2442'. [ 244.444665][T14558] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2448'. [ 245.117419][T14620] Cannot find set identified by id 65534 to match [ 245.279043][T14635] bond13: (slave gretap2): making interface the new active one [ 245.290738][T14635] bond13: (slave gretap2): Enslaving as an active interface with an up link [ 245.729158][T14661] wlan0 speed is unknown, defaulting to 1000 [ 246.012143][T14674] 8021q: adding VLAN 0 to HW filter on device bond14 [ 246.241482][T14695] __nla_validate_parse: 5 callbacks suppressed [ 246.241500][T14695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2477'. [ 246.556867][T14722] syzkaller1: entered promiscuous mode [ 246.563983][T14721] sctp: [Deprecated]: syz.4.2482 (pid 14721) Use of int in maxseg socket option. [ 246.563983][T14721] Use struct sctp_assoc_value instead [ 246.565897][T14722] syzkaller1: entered allmulticast mode [ 246.623581][T14724] validate_nla: 6 callbacks suppressed [ 246.623598][T14724] netlink: 'syz.1.2483': attribute type 2 has an invalid length. [ 246.640144][T14724] netlink: 'syz.1.2483': attribute type 1 has an invalid length. [ 246.659287][T14724] netlink: 'syz.1.2483': attribute type 2 has an invalid length. [ 246.679130][T14731] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2483'. [ 246.706365][T14724] netlink: 'syz.1.2483': attribute type 1 has an invalid length. [ 246.717486][T14724] netlink: 'syz.1.2483': attribute type 1 has an invalid length. [ 246.725453][T14724] netlink: 'syz.1.2483': attribute type 1 has an invalid length. [ 246.733223][T14734] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2485'. [ 247.212314][T14755] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2488'. [ 247.354797][T14755] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2488'. [ 247.483109][T14776] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.2494'. [ 247.512940][T14779] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 247.632241][T14787] bridge8: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 247.734178][T14794] netlink: 'syz.2.2499': attribute type 1 has an invalid length. [ 247.770740][T14797] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2500'. [ 247.834757][T14802] IPVS: ip_vs_add_dest(): server weight less than zero [ 247.847794][T14803] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2501'. [ 248.153669][T14823] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2505'. [ 248.345288][T14835] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 248.365270][T14835] dvmrp0: left allmulticast mode [ 248.510057][T14845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2511'. [ 248.837275][T14865] netlink: 'syz.1.2518': attribute type 9 has an invalid length. [ 249.005042][ T3580] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 249.018204][T14876] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 249.065123][T14889] netlink: 'syz.2.2521': attribute type 1 has an invalid length. [ 249.074444][T14889] netlink: 'syz.2.2521': attribute type 3 has an invalid length. [ 249.270849][T14901] ksmbd: Unknown IPC event: 3, ignore. [ 249.490897][T14914] tipc: Enabling of bearer rejected, failed to enable media [ 249.746519][T14936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 249.749600][T14934] bond6: (slave geneve4): making interface the new active one [ 249.758965][T14940] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 249.764710][T14934] bond6: (slave geneve4): Enslaving as an active interface with an up link [ 249.781690][ T3580] netdevsim netdevsim4 : set [1, 2] type 2 family 0 port 20004 - 0 [ 249.790265][ T3580] netdevsim netdevsim4 netdevsim1: set [1, 2] type 2 family 0 port 20004 - 0 [ 249.799235][ T3580] netdevsim netdevsim4 netdevsim2: set [1, 2] type 2 family 0 port 20004 - 0 [ 249.808193][ T3580] netdevsim netdevsim4 netdevsim3: set [1, 2] type 2 family 0 port 20004 - 0 [ 250.309031][T14975] C: Caught tx_queue_len zero misconfig [ 250.639420][T14996] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 250.870819][T15015] sctp: [Deprecated]: syz.3.2558 (pid 15015) Use of int in max_burst socket option deprecated. [ 250.870819][T15015] Use struct sctp_assoc_value instead [ 251.484325][T15070] tipc: Started in network mode [ 251.501541][T15070] tipc: Node identity aaaaaaaaaa3, cluster identity 4711 [ 251.523582][T15070] tipc: Enabled bearer , priority 2 [ 252.213602][T15114] __nla_validate_parse: 20 callbacks suppressed [ 252.213620][T15114] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2586'. [ 252.247438][T15119] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2588'. [ 252.323612][T15130] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2590'. [ 252.345207][T15125] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2589'. [ 252.546845][T15150] tipc: Can't bind to reserved service type 0 [ 252.566417][T15142] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2594'. [ 252.636148][ T43] tipc: Node number set to 10136234 [ 252.702704][T15157] bond2 (unregistering): Released all slaves [ 252.847902][T15175] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2602'. [ 253.011884][T15213] validate_nla: 5 callbacks suppressed [ 253.011906][T15213] netlink: 'syz.2.2607': attribute type 12 has an invalid length. [ 253.030365][T15213] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2607'. [ 253.070278][T15217] syzkaller0: entered promiscuous mode [ 253.079868][T15217] syzkaller0: entered allmulticast mode [ 253.132604][T15219] tipc: Started in network mode [ 253.137679][T15219] tipc: Node identity 4e39ac8699ae, cluster identity 4711 [ 253.144897][T15219] tipc: Enabled bearer , priority 0 [ 253.152783][T15219] syzkaller0: entered promiscuous mode [ 253.159615][T15219] syzkaller0: entered allmulticast mode [ 253.184158][T15219] tipc: Resetting bearer [ 253.338171][T15218] tipc: Resetting bearer [ 253.358215][T15218] tipc: Disabling bearer [ 253.372408][T15226] ip6gre1: entered allmulticast mode [ 253.534992][T15237] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 253.960402][T15269] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2625'. [ 254.093794][T15280] netlink: 'syz.0.2630': attribute type 4 has an invalid length. [ 254.587020][T15304] ip6tnl0: Caught tx_queue_len zero misconfig [ 254.824359][T15323] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 255.019702][T15331] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2641'. [ 255.097248][T15330] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 255.113156][T15336] 8021q: VLANs not supported on gre0 [ 255.315139][T15355] netlink: 'syz.0.2642': attribute type 4 has an invalid length. [ 255.332762][T15353] netlink: 160 bytes leftover after parsing attributes in process `syz.4.2646'. [ 255.350176][T15355] netlink: 'syz.0.2642': attribute type 4 has an invalid length. [ 255.353726][T15356] xt_hashlimit: size too large, truncated to 1048576 [ 255.547806][T15356] warn_alloc: 1 callbacks suppressed [ 255.547825][T15356] syz.3.2647: vmalloc error: size 8392704, failed to allocated page array size 16392, mode:0xcc2(GFP_KERNEL|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 255.573144][T15356] CPU: 0 UID: 0 PID: 15356 Comm: syz.3.2647 Not tainted syzkaller #0 PREEMPT(full) [ 255.573191][T15356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 255.573212][T15356] Call Trace: [ 255.573220][T15356] [ 255.573228][T15356] dump_stack_lvl+0x189/0x250 [ 255.573260][T15356] ? __pfx_dump_stack_lvl+0x10/0x10 [ 255.573282][T15356] ? __pfx__printk+0x10/0x10 [ 255.573301][T15356] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 255.573324][T15356] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 255.573348][T15356] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 255.573373][T15356] warn_alloc+0x214/0x310 [ 255.573404][T15356] ? __pfx_warn_alloc+0x10/0x10 [ 255.573437][T15356] ? __get_vm_area_node+0x28f/0x300 [ 255.573460][T15356] ? htable_create+0x101/0x7a0 [ 255.573486][T15356] __vmalloc_node_range_noprof+0x690/0x12d0 [ 255.573540][T15356] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 255.573568][T15356] ? rcu_is_watching+0x15/0xb0 [ 255.573588][T15356] ? htable_create+0x101/0x7a0 [ 255.573609][T15356] __kvmalloc_node_noprof+0x674/0x910 [ 255.573633][T15356] ? htable_create+0x101/0x7a0 [ 255.573652][T15356] ? hashlimit_pernet+0x23/0x240 [ 255.573672][T15356] ? hashlimit_pernet+0x23/0x240 [ 255.573697][T15356] ? hashlimit_pernet+0x23/0x240 [ 255.573724][T15356] htable_create+0x101/0x7a0 [ 255.573753][T15356] hashlimit_mt_check_common+0x719/0xa10 [ 255.573784][T15356] xt_check_match+0x3d1/0xab0 [ 255.573811][T15356] ? __pfx_xt_check_match+0x10/0x10 [ 255.573835][T15356] ? pcpu_alloc_noprof+0xfdd/0x1720 [ 255.573869][T15356] ? xt_find_match+0x1f7/0x250 [ 255.573896][T15356] translate_table+0x1553/0x2040 [ 255.573945][T15356] ? __pfx_translate_table+0x10/0x10 [ 255.573970][T15356] ? __might_fault+0xb0/0x130 [ 255.574017][T15356] ? _copy_from_user+0x94/0xb0 [ 255.574043][T15356] do_ip6t_set_ctl+0x970/0xce0 [ 255.574071][T15356] ? rcu_is_watching+0x15/0xb0 [ 255.574089][T15356] ? trace_contention_end+0x39/0x120 [ 255.574110][T15356] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 255.574156][T15356] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 255.574192][T15356] ? __lock_acquire+0xab9/0xd20 [ 255.574214][T15356] nf_setsockopt+0x26f/0x290 [ 255.574242][T15356] rawv6_setsockopt+0x23b/0x5b0 [ 255.574263][T15356] ? __pfx_rawv6_setsockopt+0x10/0x10 [ 255.574281][T15356] ? aa_sock_opt_perm+0xff/0x1b0 [ 255.574307][T15356] ? sock_common_setsockopt+0x36/0xc0 [ 255.574329][T15356] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 255.574353][T15356] do_sock_setsockopt+0x17c/0x1b0 [ 255.574377][T15356] __x64_sys_setsockopt+0x13f/0x1b0 [ 255.574400][T15356] do_syscall_64+0xfa/0xfa0 [ 255.574422][T15356] ? lockdep_hardirqs_on+0x9c/0x150 [ 255.574441][T15356] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.574456][T15356] ? clear_bhb_loop+0x60/0xb0 [ 255.574476][T15356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 255.574493][T15356] RIP: 0033:0x7f8fe818f749 [ 255.574508][T15356] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 255.574523][T15356] RSP: 002b:00007f8fe63ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 255.574542][T15356] RAX: ffffffffffffffda RBX: 00007f8fe83e5fa0 RCX: 00007f8fe818f749 [ 255.574554][T15356] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000005 [ 255.574565][T15356] RBP: 00007f8fe8213f91 R08: 0000000000000588 R09: 0000000000000000 [ 255.574576][T15356] R10: 00002000000014c0 R11: 0000000000000246 R12: 0000000000000000 [ 255.574587][T15356] R13: 00007f8fe83e6038 R14: 00007f8fe83e5fa0 R15: 00007ffde8b646e8 [ 255.574617][T15356] [ 255.574756][T15356] Mem-Info: [ 255.756657][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.781509][T15356] active_anon:5329 inactive_anon:0 isolated_anon:0 [ 255.781509][T15356] active_file:2777 inactive_file:39981 isolated_file:0 [ 255.781509][T15356] unevictable:768 dirty:60 writeback:0 [ 255.781509][T15356] slab_reclaimable:11992 slab_unreclaimable:146949 [ 255.781509][T15356] mapped:30208 shmem:1355 pagetables:1142 [ 255.781509][T15356] sec_pagetables:0 bounce:0 [ 255.781509][T15356] kernel_misc_reclaimable:0 [ 255.781509][T15356] free:1269115 free_pcp:25927 free_cma:0 [ 256.003139][T15356] Node 0 active_anon:21116kB inactive_anon:0kB active_file:11108kB inactive_file:159720kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120796kB dirty:240kB writeback:0kB shmem:3884kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14108kB pagetables:4480kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 256.041153][T15356] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 256.062234][T15371] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 256.087249][T15356] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 256.121259][T15356] lowmem_reserve[]: 0 2505 2505 2505 2505 [ 256.127221][T15371] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 256.127579][T15356] Node 0 DMA32 free:1181304kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:21116kB inactive_anon:0kB active_file:11108kB inactive_file:159720kB unevictable:1536kB writepending:240kB zspages:0kB present:3129332kB managed:2565152kB mlocked:0kB bounce:0kB free_pcp:79268kB local_pcp:58768kB free_cma:0kB [ 256.182348][T15356] lowmem_reserve[]: 0 0 0 0 0 [ 256.188918][T15356] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 256.220014][T15356] lowmem_reserve[]: 0 0 0 0 0 [ 256.224773][T15356] Node 1 Normal free:3895016kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16700kB local_pcp:8472kB free_cma:0kB [ 256.287807][T15356] lowmem_reserve[]: 0 0 0 0 0 [ 256.291479][T15377] geneve3: entered promiscuous mode [ 256.293143][T15356] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 256.299187][T15377] geneve3: entered allmulticast mode [ 256.311076][T15356] Node 0 DMA32: 2539*4kB (UME) 948*8kB (UM) 644*16kB (UME) 265*32kB (UME) 50*64kB (UME) 131*128kB (UME) 135*256kB (UME) 106*512kB (UME) 74*1024kB (UME) 23*2048kB (UME) 223*4096kB (UM) = 1181612kB [ 256.311261][T15356] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 256.349809][T15356] Node 1 Normal: 138*4kB (UE) 36*8kB (UME) 24*16kB (UME) 81*32kB (UME) 28*64kB (UME) 8*128kB (UME) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UME) 2*2048kB (UE) 947*4096kB (M) = 3895016kB [ 256.368574][T15356] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 256.394141][T15356] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 256.440820][T15356] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 256.471409][T15356] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 256.491999][T15356] 44111 total pagecache pages [ 256.506119][T15356] 2 pages in swap cache [ 256.513942][T15356] Free swap = 124988kB [ 256.523961][T15356] Total swap = 124996kB [ 256.528686][T15356] 2097051 pages RAM [ 256.532696][T15356] 0 pages HighMem/MovableOnly [ 256.538732][T15356] 424121 pages reserved [ 256.543804][T15356] 0 pages cma reserved [ 256.738378][T15415] netlink: 'syz.3.2661': attribute type 1 has an invalid length. [ 256.773099][T15415] bond7: entered promiscuous mode [ 256.778622][T15415] bond7: entered allmulticast mode [ 256.784877][T15415] 8021q: adding VLAN 0 to HW filter on device bond7 [ 257.190064][T15446] netlink: 'syz.4.2669': attribute type 29 has an invalid length. [ 257.212357][T15446] netlink: 'syz.4.2669': attribute type 29 has an invalid length. [ 257.221559][T15446] __nla_validate_parse: 3 callbacks suppressed [ 257.221577][T15446] netlink: 500 bytes leftover after parsing attributes in process `syz.4.2669'. [ 257.441692][T15461] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2674'. [ 257.452663][T15461] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2674'. [ 257.516964][T15468] netlink: 'syz.2.2677': attribute type 21 has an invalid length. [ 257.525601][T15468] IPv6: NLM_F_CREATE should be specified when creating new route [ 257.955443][T15493] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2685'. [ 257.970149][T15496] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 258.229594][T15518] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2691'. [ 258.243577][T15517] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2693'. [ 258.270165][T15519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2692'. [ 258.384648][T15519] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 258.458748][T15527] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2692'. [ 258.490455][T15527] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2692'. [ 258.643575][T15546] openvswitch: netlink: Key 6 has unexpected len 16 expected 2 [ 258.672295][T15544] openvswitch: netlink: Key 6 has unexpected len 16 expected 2 [ 258.740296][T15555] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2705'. [ 259.418490][T15597] netlink: 'syz.3.2716': attribute type 21 has an invalid length. [ 259.940790][T15625] netlink: 'syz.4.2726': attribute type 4 has an invalid length. [ 259.961014][T15625] netlink: 'syz.4.2726': attribute type 1 has an invalid length. [ 260.772082][T15677] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 261.498399][ T56] block nbd1: Possible stuck request ffff888025265080: control (read@0,1024B). Runtime 120 seconds [ 261.509417][ T56] block nbd1: Possible stuck request ffff888025265240: control (read@1024,1024B). Runtime 120 seconds [ 261.520598][ T56] block nbd1: Possible stuck request ffff888025265400: control (read@2048,1024B). Runtime 120 seconds [ 261.532663][ T56] block nbd1: Possible stuck request ffff8880252655c0: control (read@3072,1024B). Runtime 120 seconds [ 261.911376][T15723] netlink: 'syz.3.2753': attribute type 3 has an invalid length. [ 261.919278][T15723] netlink: 'syz.3.2753': attribute type 1 has an invalid length. [ 262.039140][T15728] sctp: [Deprecated]: syz.2.2758 (pid 15728) Use of int in max_burst socket option. [ 262.039140][T15728] Use struct sctp_assoc_value instead [ 262.096991][T15733] macsec0: entered promiscuous mode [ 262.102720][T15733] bridge0: entered promiscuous mode [ 262.146342][T15733] macsec0: entered allmulticast mode [ 262.152014][T15733] bridge0: entered allmulticast mode [ 262.160408][T15733] bridge0: port 2(macsec0) entered blocking state [ 262.197194][T15733] bridge0: port 2(macsec0) entered disabled state [ 262.233600][T15733] bridge0: left allmulticast mode [ 262.243395][T15733] bridge0: left promiscuous mode [ 262.980954][T15777] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 263.061788][T15785] __nla_validate_parse: 13 callbacks suppressed [ 263.061807][T15785] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2769'. [ 263.403471][T15797] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 263.422235][T15797] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 263.492692][ T5830] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 263.503956][ T5830] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 263.512750][ T5830] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 263.521532][ T5830] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 263.530095][ T5830] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 263.588877][T15798] wlan0 speed is unknown, defaulting to 1000 [ 263.634305][T15801] pim6reg1: entered promiscuous mode [ 263.655256][T15801] pim6reg1: entered allmulticast mode [ 263.682165][T15805] syzkaller0: entered promiscuous mode [ 263.698172][T15805] syzkaller0: entered allmulticast mode [ 264.367977][T15837] sch_tbf: burst 512 is lower than device syzkaller0 mtu (1500) ! [ 264.684844][T15851] xt_ecn: cannot match TCP bits for non-tcp packets [ 264.703185][T15853] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 264.800750][T15798] chnl_net:caif_netlink_parms(): no params data found [ 264.939071][T15865] IPVS: set_ctl: invalid protocol: 22 172.30.1.4:20000 [ 264.974531][T15864] 8021q: VLANs not supported on ipvlan0 [ 265.212347][T15798] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.234755][T15798] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.256769][T15798] bridge_slave_0: entered allmulticast mode [ 265.274968][T15798] bridge_slave_0: entered promiscuous mode [ 265.362333][T15798] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.373521][T15798] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.396310][T15798] bridge_slave_1: entered allmulticast mode [ 265.404224][T15798] bridge_slave_1: entered promiscuous mode [ 265.576774][ T52] Bluetooth: hci4: command tx timeout [ 267.656452][ T52] Bluetooth: hci4: command tx timeout [ 268.130202][T15888] macvlan2: entered promiscuous mode [ 268.135854][T15888] macvlan2: entered allmulticast mode [ 268.148578][T15888] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 268.330627][T15798] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 268.364910][T15896] netlink: 312 bytes leftover after parsing attributes in process `syz.1.2797'. [ 268.384732][T15798] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 268.524446][T15907] netlink: 'syz.1.2797': attribute type 4 has an invalid length. [ 268.549840][T15798] team0: Port device team_slave_0 added [ 268.562197][T15798] team0: Port device team_slave_1 added [ 268.696706][T15798] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 268.713085][T15798] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 268.776955][T15798] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 268.860455][T15798] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 268.867621][T15798] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 268.903885][T15798] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 269.033940][T15930] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2806'. [ 269.175503][T15930] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 269.244525][T15938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2807'. [ 269.280966][T15944] netlink: 16215 bytes leftover after parsing attributes in process `syz.0.2810'. [ 269.327057][T15932] bond2: Unable to set up delay as MII monitoring is disabled [ 269.357527][T15932] bond2 (unregistering): Released all slaves [ 269.507479][T15954] sctp: [Deprecated]: syz.0.2810 (pid 15954) Use of int in maxseg socket option. [ 269.507479][T15954] Use struct sctp_assoc_value instead [ 269.524629][T15940] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2809'. [ 269.602685][T15798] hsr_slave_0: entered promiscuous mode [ 269.609702][T15798] hsr_slave_1: entered promiscuous mode [ 269.737377][ T52] Bluetooth: hci4: command tx timeout [ 269.820295][T15965] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2816'. [ 269.900793][T15967] netlink: 'syz.3.2815': attribute type 1 has an invalid length. [ 270.142630][T15798] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 270.172893][T15798] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.210681][T15798] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 270.236356][T15798] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 270.333266][T15988] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2822'. [ 270.358054][T15988] netlink: 124 bytes leftover after parsing attributes in process `syz.3.2822'. [ 270.460377][T15798] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 270.502143][T15798] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.568412][T15798] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 270.586862][T16001] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2825'. [ 270.589707][T15798] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 270.686705][T16009] dummy0: mtu less than device minimum [ 270.790532][T15798] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 270.824255][T15798] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.849749][T15798] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 270.873275][T15798] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 270.923509][T16020] netlink: 'syz.2.2830': attribute type 11 has an invalid length. [ 270.939343][T16020] IPVS: set_ctl: invalid protocol: 50 172.20.20.29:20002 [ 270.948299][T16020] nbd: must specify at least one socket [ 271.081647][T16038] netlink: 'syz.3.2832': attribute type 16 has an invalid length. [ 271.095350][T15798] bond0: (slave ): Releasing backup interface [ 271.115727][T16038] netlink: 'syz.3.2832': attribute type 3 has an invalid length. [ 271.156097][T16038] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2832'. [ 271.241460][T15798] netdevsim netdevsim4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 271.275650][T15798] netdevsim netdevsim4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.296216][T15798] netdevsim netdevsim4 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 271.316183][T15798] netdevsim netdevsim4 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 271.630622][T16056] veth7: entered promiscuous mode [ 271.636414][T16056] veth7: entered allmulticast mode [ 271.826869][ T52] Bluetooth: hci4: command tx timeout [ 271.845175][T16061] netlink: 'syz.0.2838': attribute type 22 has an invalid length. [ 272.010393][T15798] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 272.045364][T15798] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 272.068786][T16061] netlink: 'syz.0.2838': attribute type 22 has an invalid length. [ 272.204763][T15798] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 272.243180][T16082] syzkaller0: entered promiscuous mode [ 272.249514][T16082] syzkaller0: entered allmulticast mode [ 272.256407][T15798] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 272.539792][T16099] netlink: zone id is out of range [ 272.544946][T16099] netlink: zone id is out of range [ 272.563650][T16099] netlink: zone id is out of range [ 272.577304][T16099] netlink: zone id is out of range [ 272.616476][T16099] netlink: zone id is out of range [ 272.637472][T16099] netlink: zone id is out of range [ 272.653114][T16099] netlink: zone id is out of range [ 272.670394][T16099] netlink: zone id is out of range [ 272.675549][T16099] netlink: zone id is out of range [ 272.708801][T15798] 8021q: adding VLAN 0 to HW filter on device bond0 [ 272.751334][T15798] 8021q: adding VLAN 0 to HW filter on device team0 [ 272.784123][T15194] bridge0: port 1(bridge_slave_0) entered blocking state [ 272.791359][T15194] bridge0: port 1(bridge_slave_0) entered forwarding state [ 272.842556][T15179] bridge0: port 2(bridge_slave_1) entered blocking state [ 272.849821][T15179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 272.889573][T16118] netlink: 'syz.2.2852': attribute type 10 has an invalid length. [ 272.991458][T15798] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 273.247268][T16136] netlink: 'syz.3.2857': attribute type 10 has an invalid length. [ 273.255422][T16136] bridge0: port 2(team0) entered blocking state [ 273.296647][T16136] bridge0: port 2(team0) entered disabled state [ 273.307518][T16136] team0: entered allmulticast mode [ 273.312767][T16136] veth0_virt_wifi: entered allmulticast mode [ 273.319896][T16136] veth1_macvtap: entered allmulticast mode [ 273.328387][T16136] team0: entered promiscuous mode [ 273.333678][T16136] veth0_virt_wifi: entered promiscuous mode [ 273.339970][T16136] veth1_macvtap: entered promiscuous mode [ 273.428346][T15798] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 273.662237][T16152] syz_tun: entered allmulticast mode [ 273.706976][T16152] pimreg: entered allmulticast mode [ 273.717693][T16149] syz_tun: left allmulticast mode [ 273.863564][T16158] syzkaller1: entered promiscuous mode [ 273.875608][T16158] syzkaller1: entered allmulticast mode [ 273.890989][T16155] __nla_validate_parse: 13 callbacks suppressed [ 273.891008][T16155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2862'. [ 274.001805][T16164] ieee802154 phy1 wpan1: encryption failed: -22 [ 274.114536][T16173] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2865'. [ 274.360186][T15798] veth0_vlan: entered promiscuous mode [ 274.415159][T15798] veth1_vlan: entered promiscuous mode [ 274.538954][T15798] veth0_macvtap: entered promiscuous mode [ 274.579361][T15798] veth1_macvtap: entered promiscuous mode [ 274.660102][T15798] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 274.687855][T15798] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 274.742307][T15199] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 274.751281][T15199] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 274.772295][T15199] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 274.833368][T15199] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 275.098635][T15179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 275.146145][T15179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 275.179107][T16233] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2881'. [ 275.202182][T16230] netlink: 'syz.0.2881': attribute type 10 has an invalid length. [ 275.243842][T16216] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2879'. [ 275.256617][T16230] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2881'. [ 275.277243][T16241] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2881'. [ 275.312746][T16233] 8021q: adding VLAN 0 to HW filter on device bond16 [ 275.326259][T15198] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 275.361292][T15198] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 275.748314][T16263] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2890'. [ 275.824377][T16263] sit1: entered promiscuous mode [ 275.846774][T16263] sit1: entered allmulticast mode [ 276.275110][T16285] ieee802154 phy1 wpan1: encryption failed: -22 [ 276.660060][T16294] x_tables: duplicate underflow at hook 2 [ 276.718880][T16306] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2900'. [ 276.728268][T16304] x_tables: duplicate underflow at hook 2 [ 276.844015][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 276.862041][ T5830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 276.872429][ T5830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 276.881280][ T5830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 276.899242][ T5830] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 276.961219][T16309] wlan0 speed is unknown, defaulting to 1000 [ 277.516713][T16338] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2910'. [ 277.578198][T16341] netlink: 'syz.1.2911': attribute type 7 has an invalid length. [ 277.589360][T16341] netlink: 140 bytes leftover after parsing attributes in process `syz.1.2911'. [ 277.807289][T16350] syzkaller1: entered promiscuous mode [ 277.812808][T16350] syzkaller1: entered allmulticast mode [ 277.859374][T16352] bond1: Unable to set down delay as MII monitoring is disabled [ 277.879636][T16352] bond1 (unregistering): Released all slaves [ 277.921482][T16309] chnl_net:caif_netlink_parms(): no params data found [ 278.382430][T16381] Cannot find del_set index 4 as target [ 278.402957][T16309] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.419536][T16309] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.435844][T16309] bridge_slave_0: entered allmulticast mode [ 278.458398][T16309] bridge_slave_0: entered promiscuous mode [ 278.470231][T16309] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.507022][T16309] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.514313][T16309] bridge_slave_1: entered allmulticast mode [ 278.541887][T16309] bridge_slave_1: entered promiscuous mode [ 278.584021][T16390] sctp: [Deprecated]: syz.2.2928 (pid 16390) Use of int in maxseg socket option. [ 278.584021][T16390] Use struct sctp_assoc_value instead [ 278.629712][T16386] batadv_slave_0: entered promiscuous mode [ 278.683878][T16309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 278.723381][T16384] batadv_slave_0: left promiscuous mode [ 278.733719][T16309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 278.894758][T16408] netlink: 'syz.3.2935': attribute type 8 has an invalid length. [ 278.910241][T16309] team0: Port device team_slave_0 added [ 278.937749][ T52] Bluetooth: hci1: command tx timeout [ 279.038196][T16309] team0: Port device team_slave_1 added [ 279.233639][T16432] __nla_validate_parse: 3 callbacks suppressed [ 279.233658][T16432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2940'. [ 279.257218][T16432] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2940'. [ 279.268913][T16432] netlink: 'syz.1.2940': attribute type 14 has an invalid length. [ 279.299136][T16432] netlink: 'syz.1.2940': attribute type 13 has an invalid length. [ 279.307996][T16309] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 279.325236][T16309] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 279.365467][T16309] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 279.379089][T16432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2940'. [ 279.390931][T15194] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 279.391650][T16438] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2943'. [ 279.399188][T15194] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 279.417067][T16432] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2940'. [ 279.418493][T16309] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 279.425946][T16432] netlink: 'syz.1.2940': attribute type 14 has an invalid length. [ 279.438368][T16437] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.441981][T16309] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 279.457696][T16438] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2943'. [ 279.478969][T16309] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 279.500835][T16436] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.517453][T16439] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.536057][T16432] netlink: 'syz.1.2940': attribute type 13 has an invalid length. [ 279.536669][T16438] netlink: 'syz.2.2943': attribute type 20 has an invalid length. [ 279.554572][T16436] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 279.590900][T16438] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2943'. [ 279.606807][T16432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2940'. [ 279.607519][T16309] hsr_slave_0: entered promiscuous mode [ 279.621617][T16438] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2943'. [ 279.630303][T16432] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2940'. [ 279.634232][T16309] hsr_slave_1: entered promiscuous mode [ 279.645316][T16438] netlink: 'syz.2.2943': attribute type 20 has an invalid length. [ 279.654874][T16309] debugfs: 'hsr0' already exists in 'hsr' [ 279.661502][T16309] Cannot create hsr debugfs directory [ 279.667605][T16432] netlink: 'syz.1.2940': attribute type 14 has an invalid length. [ 279.907881][T16309] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 279.922749][T16309] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.996666][T16309] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 280.046254][T16309] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.181038][T16309] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 280.217539][T16309] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.268878][T16463] bond0: Caught tx_queue_len zero misconfig [ 280.380120][T16309] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 280.416509][T16309] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.611220][T16479] validate_nla: 61 callbacks suppressed [ 280.611238][T16479] netlink: 'syz.3.2955': attribute type 10 has an invalid length. [ 280.731929][T16489] bond8: entered allmulticast mode [ 280.747514][T16489] 8021q: adding VLAN 0 to HW filter on device bond8 [ 280.757317][T16494] netlink: 'syz.2.2957': attribute type 1 has an invalid length. [ 280.774827][T16489] bridge0: port 3(bond8) entered blocking state [ 280.789509][T16489] bridge0: port 3(bond8) entered disabled state [ 280.800168][T16489] bond8: entered promiscuous mode [ 280.929096][T16485] bond7: entered promiscuous mode [ 280.967183][T16485] bond7: entered allmulticast mode [ 280.972809][T16485] 8021q: adding VLAN 0 to HW filter on device bond7 [ 280.986747][T16309] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 281.019982][ T52] Bluetooth: hci1: command tx timeout [ 281.060602][T16309] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 281.085395][T16506] mac80211_hwsim hwsim32 : renamed from wlan1 (while UP) [ 281.120086][T16309] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 281.155530][T16309] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 281.660266][T16309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 281.687156][T16551] veth0: entered promiscuous mode [ 281.723989][T16549] veth0: left promiscuous mode [ 281.767409][T16309] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.790561][T15173] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.797800][T15173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.864576][T15173] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.871850][T15173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 282.212263][T16581] netem: change failed [ 282.239228][T16309] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 282.282875][T16586] netlink: 'syz.3.2980': attribute type 2 has an invalid length. [ 282.313566][T16586] 9: entered promiscuous mode [ 282.338199][T16309] veth0_vlan: entered promiscuous mode [ 282.365586][T16309] veth1_vlan: entered promiscuous mode [ 282.434436][T16309] veth0_macvtap: entered promiscuous mode [ 282.448732][T16309] veth1_macvtap: entered promiscuous mode [ 282.477893][T16309] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 282.502890][T16309] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 282.528853][T15194] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.551282][T15194] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.569116][T15194] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.580585][T15194] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.705174][T15199] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.725128][T15199] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.764195][T15199] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.773593][T15199] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.805045][T16569] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 282.918063][T16599] x_tables: duplicate underflow at hook 3 [ 282.939776][T16601] netlink: 'syz.0.2892': attribute type 23 has an invalid length. [ 283.097075][ T52] Bluetooth: hci1: command tx timeout [ 283.191712][T16618] net_ratelimit: 15 callbacks suppressed [ 283.192904][T16618] openvswitch: netlink: Key type 64 is out of range max 32 [ 283.235571][T16618] openvswitch: netlink: Key type 64 is out of range max 32 [ 283.792765][T16645] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 283.805654][ T5830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 283.822627][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 283.832480][ T5830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 283.837425][T16652] openvswitch: netlink: Message has 6 unknown bytes. [ 283.849312][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 283.857909][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 283.933097][T16645] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 284.012828][T16649] tipc: Started in network mode [ 284.018003][T16649] tipc: Node identity 26cd5678335e, cluster identity 4711 [ 284.025504][T16649] tipc: Enabled bearer , priority 0 [ 284.034576][T16642] syzkaller0: entered promiscuous mode [ 284.042619][T16642] syzkaller0: entered allmulticast mode [ 284.053509][T16661] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 284.087463][T16642] tipc: Resetting bearer [ 284.109471][T16642] syz_tun: entered allmulticast mode [ 284.123343][T16648] wlan0 speed is unknown, defaulting to 1000 [ 284.125016][T16641] syz_tun: left allmulticast mode [ 284.153753][T16641] tipc: Resetting bearer [ 284.188942][T16641] tipc: Disabling bearer [ 284.395718][T16686] __nla_validate_parse: 77 callbacks suppressed [ 284.395737][T16686] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3007'. [ 284.448002][T16690] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3007'. [ 284.516852][T16692] sctp: [Deprecated]: syz.3.3009 (pid 16692) Use of int in max_burst socket option. [ 284.516852][T16692] Use struct sctp_assoc_value instead [ 284.669091][T16686] ` (unregistering): left promiscuous mode [ 284.672809][T16700] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3010'. [ 284.675038][T16686] bond_slave_0: left promiscuous mode [ 284.675217][T16686] bond_slave_1: left promiscuous mode [ 284.688418][T16701] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3009'. [ 284.690244][T16686] geneve1: left promiscuous mode [ 284.712605][T16686] ` (unregistering): (slave bond_slave_0): Releasing backup interface [ 284.722493][T16686] ` (unregistering): (slave bond_slave_1): Releasing backup interface [ 284.732329][T16686] ` (unregistering): (slave geneve1): Releasing backup interface [ 284.741489][T16686] ` (unregistering): Released all slaves [ 285.091663][T16723] netlink: 'syz.3.3016': attribute type 1 has an invalid length. [ 285.101257][T16720] lo: entered promiscuous mode [ 285.110328][T16720] tunl0: entered promiscuous mode [ 285.118925][T16720] gre0: entered promiscuous mode [ 285.140044][T16720] gretap0: entered promiscuous mode [ 285.152649][T16720] erspan0: entered promiscuous mode [ 285.161365][T16720] ip_vti0: entered promiscuous mode [ 285.168866][T16720] ip6_vti0: entered promiscuous mode [ 285.178916][ T5830] Bluetooth: hci1: command tx timeout [ 285.187984][T16720] sit0: entered promiscuous mode [ 285.197156][T16720] ip6tnl0: entered promiscuous mode [ 285.206092][T16720] ip6gre0: entered promiscuous mode [ 285.214073][T16720] syz_tun: entered promiscuous mode [ 285.222931][T16720] ip6gretap0: entered promiscuous mode [ 285.231639][T16720] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.239160][T16720] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.247943][T16720] bridge0: entered promiscuous mode [ 285.275944][T16723] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 285.368196][T16648] chnl_net:caif_netlink_parms(): no params data found [ 285.396768][T16740] netlink: 'syz.2.3020': attribute type 1 has an invalid length. [ 285.431245][T16740] 8021q: adding VLAN 0 to HW filter on device bond8 [ 285.477695][T16740] 8021q: adding VLAN 0 to HW filter on device bond8 [ 285.485322][T16740] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 285.499742][T16740] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 285.522953][T16746] xt_CT: You must specify a L4 protocol and not use inversions on it [ 285.564620][T16745] veth15: entered promiscuous mode [ 285.584367][T16745] bond8: (slave veth15): Enslaving as an active interface with a down link [ 285.678864][T16747] vlan0: entered allmulticast mode [ 285.696196][T16747] bond8: entered allmulticast mode [ 285.846485][T16771] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 285.896291][ T5830] Bluetooth: hci0: command tx timeout [ 285.925200][T16773] C: renamed from lo (while UP) [ 285.958323][T16648] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.968582][T16648] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.976286][T16648] bridge_slave_0: entered allmulticast mode [ 285.984422][T16648] bridge_slave_0: entered promiscuous mode [ 285.994833][T16648] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.003300][T16648] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.010668][T16648] bridge_slave_1: entered allmulticast mode [ 286.027646][T16648] bridge_slave_1: entered promiscuous mode [ 286.117359][T16788] netlink: 'syz.0.3031': attribute type 1 has an invalid length. [ 286.164297][T16648] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 286.222464][T16788] bond1: entered promiscuous mode [ 286.228222][T16788] 8021q: adding VLAN 0 to HW filter on device bond1 [ 286.253422][T16648] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 286.328280][T16801] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3036'. [ 286.354308][T16648] team0: Port device team_slave_0 added [ 286.373177][T16801] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3036'. [ 286.397733][T16648] team0: Port device team_slave_1 added [ 286.526677][T16813] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3041'. [ 286.562710][T16648] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 286.574631][T16648] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 286.628766][T16648] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 286.660563][T16818] netlink: 'syz.0.3039': attribute type 1 has an invalid length. [ 286.670058][T16818] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3039'. [ 286.697913][T16648] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 286.704892][T16648] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 286.782596][T16648] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 286.784491][T16827] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3042'. [ 286.835695][T16831] pim6reg: entered allmulticast mode [ 286.983573][T16648] hsr_slave_0: entered promiscuous mode [ 287.021998][T16648] hsr_slave_1: entered promiscuous mode [ 287.032783][T16648] debugfs: 'hsr0' already exists in 'hsr' [ 287.056496][T16648] Cannot create hsr debugfs directory [ 287.193713][T16853] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3048'. [ 287.296721][T16855] gretap1: entered promiscuous mode [ 287.448729][T16860] bridge0: port 3(batadv1) entered blocking state [ 287.458211][T16860] bridge0: port 3(batadv1) entered disabled state [ 287.464856][T16860] batadv1: entered allmulticast mode [ 287.488608][T16860] batadv1: entered promiscuous mode [ 287.632534][T16648] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 287.692848][T16877] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 287.801934][T16648] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 287.837382][T16885] syz_tun: entered allmulticast mode [ 287.853450][T16885] dvmrp6: entered allmulticast mode [ 287.902812][T16648] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 287.947010][T15173] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 287.957083][T15173] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 287.976695][ T5830] Bluetooth: hci0: command tx timeout [ 287.978066][T16884] syz_tun: left allmulticast mode [ 288.073066][T16648] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 288.355557][T16648] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 288.390528][T16648] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 288.422657][T16926] xt_recent: Unsupported userspace flags (000000b1) [ 288.481533][T16648] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 288.555494][T16648] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 288.719504][T16947] openvswitch: netlink: Tunnel attr 15060 out of range max 16 [ 288.808689][T16648] 8021q: adding VLAN 0 to HW filter on device bond0 [ 288.860515][T16648] 8021q: adding VLAN 0 to HW filter on device team0 [ 288.886961][T15198] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.894134][T15198] bridge0: port 1(bridge_slave_0) entered forwarding state [ 289.024341][T15198] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.031580][T15198] bridge0: port 2(bridge_slave_1) entered forwarding state [ 289.084731][T16967] ipt_REJECT: TCP_RESET invalid for non-tcp [ 289.125289][T16969] pim6reg: entered allmulticast mode [ 289.167043][T16969] pim6reg527: entered allmulticast mode [ 289.286516][T16977] ipvlan0: entered promiscuous mode [ 289.357772][T16977] openvswitch: netlink: Key 32 has unexpected len 1026 expected 2 [ 289.441277][T16985] bridge8: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 289.481117][T16989] team0: No ports can be present during mode change [ 289.544445][T16997] __nla_validate_parse: 11 callbacks suppressed [ 289.544463][T16997] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3083'. [ 289.587786][T16985] bond0: (slave wlan1): Releasing backup interface [ 289.600015][T16985] mac80211_hwsim hwsim9 wlan1 (unregistering): left promiscuous mode [ 289.611741][T16985] mac80211_hwsim hwsim9 wlan1 (unregistering): left allmulticast mode [ 289.731770][T17007] netlink: 'syz.2.3085': attribute type 1 has an invalid length. [ 289.796253][T17010] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3086'. [ 289.798642][T16648] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 289.968682][T16648] veth0_vlan: entered promiscuous mode [ 289.993798][T16648] veth1_vlan: entered promiscuous mode [ 290.030435][T17020] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3089'. [ 290.054378][T16648] veth0_macvtap: entered promiscuous mode [ 290.061418][T17022] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3090'. [ 290.077699][T16648] veth1_macvtap: entered promiscuous mode [ 290.084608][ T5830] Bluetooth: hci0: command tx timeout [ 290.094100][T17022] sctp: [Deprecated]: syz.3.3090 (pid 17022) Use of int in max_burst socket option deprecated. [ 290.094100][T17022] Use struct sctp_assoc_value instead [ 290.163673][T16648] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 290.206603][T16648] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 290.245369][T15195] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.274687][T15195] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.320533][T15195] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.349413][T15195] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.515893][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.550839][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.605235][T15179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.628262][T15179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.638894][T17047] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3098'. [ 290.654061][T17047] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3098'. [ 290.691225][T17048] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3098'. [ 290.718267][T17048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3098'. [ 290.750467][T17054] vlan2: entered allmulticast mode [ 291.036596][T17067] xt_HMARK: proto mask must be zero with L3 mode [ 291.560824][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 291.571025][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 291.578814][ T56] block nbd1: Possible stuck request ffff888025265080: control (read@0,1024B). Runtime 150 seconds [ 291.580360][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 291.589844][ T56] block nbd1: Possible stuck request ffff888025265240: control (read@1024,1024B). Runtime 150 seconds [ 291.600314][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 291.608031][ T56] block nbd1: Possible stuck request ffff888025265400: control (read@2048,1024B). Runtime 150 seconds [ 291.616637][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 291.626474][ T56] block nbd1: Possible stuck request ffff8880252655c0: control (read@3072,1024B). Runtime 150 seconds [ 291.914197][T17087] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 291.936958][T17085] syzkaller1: entered promiscuous mode [ 291.954776][T17085] syzkaller1: entered allmulticast mode [ 292.078273][T17083] wlan0 speed is unknown, defaulting to 1000 [ 292.132449][T17107] vxlan0: entered promiscuous mode [ 292.138473][T17107] vxlan0: entered allmulticast mode [ 292.145711][T15198] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.146663][ T5830] Bluetooth: hci0: command tx timeout [ 292.179464][T15198] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.209495][T15198] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.246335][T15198] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.294709][T17111] can: request_module (can-proto-3) failed. [ 292.358670][T17117] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3114'. [ 292.389806][T17119] openvswitch: netlink: Flow key attr not present in new flow. [ 292.440184][T17119] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3115'. [ 292.791021][T17083] chnl_net:caif_netlink_parms(): no params data found [ 292.842204][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 292.868845][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 292.882674][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 292.986600][T17083] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.006280][T17083] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.016538][T17083] bridge_slave_0: entered allmulticast mode [ 293.040155][T17083] bridge_slave_0: entered promiscuous mode [ 293.067597][T17083] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.088251][T17083] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.100033][T17083] bridge_slave_1: entered allmulticast mode [ 293.117035][T17083] bridge_slave_1: entered promiscuous mode [ 293.272015][T17083] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 293.321550][T17083] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 293.388552][T17143] infiniband syz2: set active [ 293.394989][T17143] infiniband syz2: added vxcan1 [ 293.405799][T17083] team0: Port device team_slave_0 added [ 293.418053][ T981] vxcan1 speed is unknown, defaulting to 1000 [ 293.433094][T17083] team0: Port device team_slave_1 added [ 293.484986][T17143] RDS/IB: syz2: added [ 293.489650][T17143] smc: adding ib device syz2 with port count 1 [ 293.507693][T17143] smc: ib device syz2 port 1 has no pnetid [ 293.519056][ T981] vxcan1 speed is unknown, defaulting to 1000 [ 293.540866][T17083] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 293.548231][T17083] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 293.575604][T17083] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 293.591663][T17083] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 293.598748][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 293.607263][T17083] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 293.664454][T17083] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 293.722816][T17186] tipc: Enabled bearer , priority 0 [ 293.743232][ T5830] Bluetooth: hci5: command tx timeout [ 293.772795][T17178] syzkaller0: entered promiscuous mode [ 293.778934][T17178] syzkaller0: entered allmulticast mode [ 293.790454][T17178] tipc: Resetting bearer [ 293.806700][T17177] tipc: Resetting bearer [ 293.840585][T17177] tipc: Disabling bearer [ 293.878901][T17189] netlink: 'syz.4.3130': attribute type 21 has an invalid length. [ 293.932187][T17083] hsr_slave_0: entered promiscuous mode [ 293.947764][T17083] hsr_slave_1: entered promiscuous mode [ 293.967789][T17083] debugfs: 'hsr0' already exists in 'hsr' [ 293.973560][T17083] Cannot create hsr debugfs directory [ 294.049618][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 294.198653][T17196] netlink: 'syz.2.3133': attribute type 21 has an invalid length. [ 294.213521][T17196] netlink: 'syz.2.3133': attribute type 5 has an invalid length. [ 294.415391][T17205] netlink: 'syz.1.3137': attribute type 13 has an invalid length. [ 294.499675][T17205] veth0_macvtap: left promiscuous mode [ 294.507702][T17205] macvtap0: entered allmulticast mode [ 294.554448][T17205] macvtap0: refused to change device tx_queue_len [ 294.561187][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 294.867672][T17219] xt_connbytes: Forcing CT accounting to be enabled [ 294.917230][T17220] __nla_validate_parse: 5 callbacks suppressed [ 294.917251][T17220] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3143'. [ 295.134243][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 295.141208][T17226] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3145'. [ 295.143866][T17083] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 295.200046][T17083] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 295.235571][T17228] netlink: 'syz.1.3146': attribute type 1 has an invalid length. [ 295.248669][T17083] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 295.248727][T17228] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3146'. [ 295.273625][T17083] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 295.521369][T17239] bridge: RTM_NEWNEIGH with unconfigured vlan 7 on bridge0 [ 295.648856][T17083] 8021q: adding VLAN 0 to HW filter on device bond0 [ 295.717697][T17248] netlink: 'syz.1.3150': attribute type 1 has an invalid length. [ 295.749871][T17083] 8021q: adding VLAN 0 to HW filter on device team0 [ 295.799508][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 295.817809][ T5830] Bluetooth: hci5: command tx timeout [ 295.820741][T15199] bridge0: port 1(bridge_slave_0) entered blocking state [ 295.830434][T15199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 295.931281][T17248] veth3: entered promiscuous mode [ 295.975210][T15199] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.982429][T15199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 295.990479][T17255] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3151'. [ 296.051328][T17258] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3152'. [ 296.407296][T17278] xt_hashlimit: max too large, truncated to 1048576 [ 296.452183][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 296.470437][T17276] netlink: 116 bytes leftover after parsing attributes in process `syz.4.3155'. [ 296.484857][T17283] syzkaller0: entered promiscuous mode [ 296.492212][T17283] syzkaller0: entered allmulticast mode [ 296.528569][T17083] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 296.675165][T17288] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3160'. [ 296.709276][T17083] veth0_vlan: entered promiscuous mode [ 296.739846][T17291] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 296.766929][T17083] veth1_vlan: entered promiscuous mode [ 296.819151][T17083] veth0_macvtap: entered promiscuous mode [ 296.848409][T17083] veth1_macvtap: entered promiscuous mode [ 296.934440][T17083] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 296.998781][T17083] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 297.033967][T15179] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 297.059080][T15179] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 297.074087][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 297.089576][T15179] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 297.110270][T15179] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 297.309173][T15173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 297.337828][T15173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 297.400010][T17315] Bluetooth: MGMT ver 1.23 [ 297.420865][T15198] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 297.433415][T15198] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 297.529153][T17319] netlink: 'syz.1.3169': attribute type 4 has an invalid length. [ 297.580495][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 297.768493][T17333] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3174'. [ 297.771085][T17332] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3173'. [ 297.780066][T17333] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3174'. [ 297.857677][T17332] netlink: 'syz.1.3173': attribute type 13 has an invalid length. [ 297.906464][ T5830] Bluetooth: hci5: command tx timeout [ 298.100818][T17332] macvtap0: left allmulticast mode [ 298.363104][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 298.374404][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 298.385520][T17348] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 298.402735][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 298.411413][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 298.419810][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 298.428041][T17348] netlink: 'syz.3.3178': attribute type 2 has an invalid length. [ 298.428695][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 298.590654][ T5916] IPVS: starting estimator thread 0... [ 298.633790][T17345] wlan0 speed is unknown, defaulting to 1000 [ 298.686812][T17354] IPVS: using max 34 ests per chain, 81600 per kthread [ 298.981093][T17143] vxcan1 speed is unknown, defaulting to 1000 [ 299.277927][T17373] netlink: 'syz.4.3186': attribute type 83 has an invalid length. [ 299.435667][T15179] bond6 (unregistering): (slave ip6gretap2): Releasing active interface [ 299.657388][T15179] dvmrp0 (unregistering): left allmulticast mode [ 299.987421][ T5830] Bluetooth: hci5: command tx timeout [ 300.021300][T15179] bond1 (unregistering): Released all slaves [ 300.142515][T15179] bond2 (unregistering): (slave veth3): Releasing active interface [ 300.151447][T15179] bond2 (unregistering): Released all slaves [ 300.261659][T15179] bond3 (unregistering): Released all slaves [ 300.275871][T15179] bond0 (unregistering): Released all slaves [ 300.289183][T15179] bond4 (unregistering): (slave bond5): Releasing backup interface [ 300.299705][T15179] bond4 (unregistering): Released all slaves [ 300.415680][T15179] bond5 (unregistering): Released all slaves [ 300.428635][T15179] bond6 (unregistering): Released all slaves [ 300.548872][ T5830] Bluetooth: hci3: command tx timeout [ 300.553045][T15179] bond7 (unregistering): Released all slaves [ 300.663484][T15179] bond8 (unregistering): (slave veth15): Releasing active interface [ 300.673639][T15179] bond8 (unregistering): Released all slaves [ 300.686509][T15179] bond9 (unregistering): Released all slaves [ 300.857851][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.901120][T15179] tipc: Left network mode [ 300.901613][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.940707][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.948806][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.956182][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.963120][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.970893][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.978009][T17394] openvswitch: netlink: Key type 31 is not supported [ 300.985225][T17394] openvswitch: netlink: Key type 31 is not supported [ 301.135153][T15179] IPVS: stopping backup sync thread 17291 ... [ 301.288038][T17410] __nla_validate_parse: 5 callbacks suppressed [ 301.288055][T17410] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3196'. [ 301.301511][T17408] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3196'. [ 301.313162][T17412] netlink: 'syz.3.3198': attribute type 1 has an invalid length. [ 301.387541][T17345] chnl_net:caif_netlink_parms(): no params data found [ 301.480978][T17421] Cannot find add_set index 0 as target [ 301.641779][T17427] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3199'. [ 301.645169][T17433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3202'. [ 301.735976][T17426] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.743762][T17426] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.014494][T17426] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 302.036272][T17426] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 302.499155][ T3580] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.508447][ T3580] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.562779][ T3580] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.597734][ T3580] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 302.619304][ T5830] Bluetooth: hci3: command tx timeout [ 302.671676][T17345] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.681138][T17345] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.681446][T17456] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3205'. [ 302.690187][T17345] bridge_slave_0: entered allmulticast mode [ 302.707506][T17345] bridge_slave_0: entered promiscuous mode [ 302.762128][T17345] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.787035][T17345] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.804857][T17345] bridge_slave_1: entered allmulticast mode [ 302.813572][T17345] bridge_slave_1: entered promiscuous mode [ 302.883456][T17472] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3209'. [ 302.894259][T17472] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3209'. [ 302.916872][T17466] netlink: 'syz.0.3206': attribute type 2 has an invalid length. [ 302.957035][T17460] veth0_vlan: entered allmulticast mode [ 302.986932][T17345] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 303.012550][T17345] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 303.293345][T17487] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3215'. [ 303.314707][T17345] team0: Port device team_slave_0 added [ 303.320405][T17487] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3215'. [ 303.320494][T17487] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3215'. [ 303.350151][T17345] team0: Port device team_slave_1 added [ 303.519700][T17345] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 303.538257][T17345] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 303.578836][T17345] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 303.602238][T15179] batadv0: left promiscuous mode [ 303.610871][T15179] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 303.672767][T17501] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not filter [ 303.704342][T15179] pim6reg129 (unregistering): left allmulticast mode [ 303.993764][T15179] team0 (unregistering): Port device team_slave_1 removed [ 304.036974][T15179] team0 (unregistering): Port device team_slave_0 removed [ 304.485020][T17345] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 304.492736][T17345] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 304.525817][T17345] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 304.697147][ T5830] Bluetooth: hci3: command tx timeout [ 304.714900][T17522] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.725621][T17345] hsr_slave_0: entered promiscuous mode [ 304.745073][T17345] hsr_slave_1: entered promiscuous mode [ 304.756537][T17345] debugfs: 'hsr0' already exists in 'hsr' [ 304.773385][T17345] Cannot create hsr debugfs directory [ 304.990622][T17534] sctp: [Deprecated]: syz.4.3228 (pid 17534) Use of int in max_burst socket option. [ 304.990622][T17534] Use struct sctp_assoc_value instead [ 305.013637][T17534] syzkaller0: entered promiscuous mode [ 305.022120][T17534] syzkaller0: entered allmulticast mode [ 305.140283][T17546] Cannot find add_set index 0 as target [ 305.173735][T15179] IPVS: stop unused estimator thread 0... [ 306.125398][T17345] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 306.139979][T17345] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 306.153033][T17345] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 306.203480][T17345] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 306.306318][T17611] __nla_validate_parse: 12 callbacks suppressed [ 306.306335][T17611] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3254'. [ 306.415586][T17345] 8021q: adding VLAN 0 to HW filter on device bond0 [ 306.475381][T17345] 8021q: adding VLAN 0 to HW filter on device team0 [ 306.511905][T15195] bridge0: port 1(bridge_slave_0) entered blocking state [ 306.519186][T15195] bridge0: port 1(bridge_slave_0) entered forwarding state [ 306.547085][T15173] bridge0: port 2(bridge_slave_1) entered blocking state [ 306.554321][T15173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 306.587255][T17625] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3256'. [ 306.776294][ T5830] Bluetooth: hci3: command tx timeout [ 306.808523][T17635] netlink: 'syz.3.3258': attribute type 1 has an invalid length. [ 306.914432][T17642] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3260'. [ 306.980201][T17642] netlink: 'syz.1.3260': attribute type 1 has an invalid length. [ 306.996861][T17644] netlink: 'syz.3.3261': attribute type 13 has an invalid length. [ 307.011771][T17644] veth0_macvtap: left promiscuous mode [ 307.038567][T17644] macvtap0: entered allmulticast mode [ 307.054758][T17644] macvtap0: refused to change device tx_queue_len [ 307.065383][T17649] [ 307.067775][T17649] ====================================================== [ 307.074815][T17649] WARNING: possible circular locking dependency detected [ 307.081861][T17649] syzkaller #0 Not tainted [ 307.086282][T17649] ------------------------------------------------------ [ 307.093302][T17649] syz.0.3262/17649 is trying to acquire lock: [ 307.099375][T17649] ffffffff8f426538 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xa9/0x720 [ 307.108866][T17649] [ 307.108866][T17649] but task is already holding lock: [ 307.116224][T17649] ffffffff8f4264d8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720 [ 307.125786][T17649] [ 307.125786][T17649] which lock already depends on the new lock. [ 307.125786][T17649] [ 307.136174][T17649] [ 307.136174][T17649] the existing dependency chain (in reverse order) is: [ 307.145177][T17649] [ 307.145177][T17649] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 307.153079][T17649] lock_acquire+0x120/0x360 [ 307.158110][T17649] _raw_spin_lock_bh+0x36/0x50 [ 307.163401][T17649] nr_rt_ioctl+0x390/0xd50 [ 307.168335][T17649] sock_do_ioctl+0xdc/0x300 [ 307.173351][T17649] sock_ioctl+0x576/0x790 [ 307.178190][T17649] __se_sys_ioctl+0xfc/0x170 [ 307.183300][T17649] do_syscall_64+0xfa/0xfa0 [ 307.188323][T17649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.194737][T17649] [ 307.194737][T17649] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 307.202731][T17649] lock_acquire+0x120/0x360 [ 307.207812][T17649] _raw_spin_lock_bh+0x36/0x50 [ 307.213092][T17649] nr_rt_ioctl+0x193/0xd50 [ 307.218019][T17649] sock_do_ioctl+0xdc/0x300 [ 307.223036][T17649] sock_ioctl+0x576/0x790 [ 307.227873][T17649] __se_sys_ioctl+0xfc/0x170 [ 307.232977][T17649] do_syscall_64+0xfa/0xfa0 [ 307.237995][T17649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.244395][T17649] [ 307.244395][T17649] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 307.252222][T17649] validate_chain+0xb9b/0x2140 [ 307.257512][T17649] __lock_acquire+0xab9/0xd20 [ 307.262799][T17649] lock_acquire+0x120/0x360 [ 307.267818][T17649] _raw_spin_lock_bh+0x36/0x50 [ 307.273097][T17649] nr_rt_device_down+0xa9/0x720 [ 307.278454][T17649] nr_device_event+0x137/0x150 [ 307.283729][T17649] notifier_call_chain+0x1b6/0x3e0 [ 307.289362][T17649] __dev_notify_flags+0x18d/0x2e0 [ 307.294893][T17649] netif_change_flags+0xe8/0x1a0 [ 307.300339][T17649] dev_change_flags+0x130/0x260 [ 307.305719][T17649] dev_ioctl+0x7b4/0x1150 [ 307.310583][T17649] sock_do_ioctl+0x22c/0x300 [ 307.315702][T17649] sock_ioctl+0x576/0x790 [ 307.320559][T17649] __se_sys_ioctl+0xfc/0x170 [ 307.325669][T17649] do_syscall_64+0xfa/0xfa0 [ 307.330688][T17649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.337096][T17649] [ 307.337096][T17649] other info that might help us debug this: [ 307.337096][T17649] [ 307.347312][T17649] Chain exists of: [ 307.347312][T17649] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 307.347312][T17649] [ 307.361117][T17649] Possible unsafe locking scenario: [ 307.361117][T17649] [ 307.368549][T17649] CPU0 CPU1 [ 307.373900][T17649] ---- ---- [ 307.379250][T17649] lock(nr_neigh_list_lock); [ 307.383918][T17649] lock(&nr_node->node_lock); [ 307.391217][T17649] lock(nr_neigh_list_lock); [ 307.398406][T17649] lock(nr_node_list_lock); [ 307.402992][T17649] [ 307.402992][T17649] *** DEADLOCK *** [ 307.402992][T17649] [ 307.411119][T17649] 2 locks held by syz.0.3262/17649: [ 307.416309][T17649] #0: ffffffff8f2cb808 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 307.425108][T17649] #1: ffffffff8f4264d8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720 [ 307.435117][T17649] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 307.435117][T17649] stack backtrace: [ 307.440996][T17649] CPU: 1 UID: 0 PID: 17649 Comm: syz.0.3262 Not tainted syzkaller #0 PREEMPT(full) [ 307.441015][T17649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 307.441035][T17649] Call Trace: [ 307.441045][T17649] [ 307.441051][T17649] dump_stack_lvl+0x189/0x250 [ 307.441074][T17649] ? __pfx_dump_stack_lvl+0x10/0x10 [ 307.441091][T17649] ? __pfx__printk+0x10/0x10 [ 307.441104][T17649] ? print_lock_name+0xde/0x100 [ 307.441119][T17649] print_circular_bug+0x2ee/0x310 [ 307.441136][T17649] check_noncircular+0x134/0x160 [ 307.441154][T17649] validate_chain+0xb9b/0x2140 [ 307.441170][T17649] ? rt6_disable_ip+0x6b3/0x720 [ 307.441191][T17649] ? __lock_acquire+0xab9/0xd20 [ 307.441204][T17649] __lock_acquire+0xab9/0xd20 [ 307.441218][T17649] ? nr_rt_device_down+0xa9/0x720 [ 307.441232][T17649] lock_acquire+0x120/0x360 [ 307.441244][T17649] ? nr_rt_device_down+0xa9/0x720 [ 307.441262][T17649] ? nr_rt_device_down+0xa9/0x720 [ 307.441276][T17649] _raw_spin_lock_bh+0x36/0x50 [ 307.441292][T17649] ? nr_rt_device_down+0xa9/0x720 [ 307.441306][T17649] nr_rt_device_down+0xa9/0x720 [ 307.441321][T17649] ? do_raw_spin_unlock+0x122/0x240 [ 307.441340][T17649] nr_device_event+0x137/0x150 [ 307.441354][T17649] notifier_call_chain+0x1b6/0x3e0 [ 307.441372][T17649] __dev_notify_flags+0x18d/0x2e0 [ 307.441387][T17649] ? __pfx___dev_notify_flags+0x10/0x10 [ 307.441399][T17649] ? __dev_change_flags+0x4cc/0x6d0 [ 307.441414][T17649] ? __pfx___dev_change_flags+0x10/0x10 [ 307.441426][T17649] ? full_name_hash+0x92/0xe0 [ 307.441442][T17649] netif_change_flags+0xe8/0x1a0 [ 307.441457][T17649] dev_change_flags+0x130/0x260 [ 307.441470][T17649] dev_ioctl+0x7b4/0x1150 [ 307.441490][T17649] sock_do_ioctl+0x22c/0x300 [ 307.441508][T17649] ? __pfx_sock_do_ioctl+0x10/0x10 [ 307.441528][T17649] sock_ioctl+0x576/0x790 [ 307.441544][T17649] ? __pfx_sock_ioctl+0x10/0x10 [ 307.441560][T17649] ? __fget_files+0x3a0/0x420 [ 307.441571][T17649] ? __fget_files+0x2a/0x420 [ 307.441584][T17649] ? bpf_lsm_file_ioctl+0x9/0x20 [ 307.441599][T17649] ? __pfx_sock_ioctl+0x10/0x10 [ 307.441613][T17649] __se_sys_ioctl+0xfc/0x170 [ 307.441629][T17649] do_syscall_64+0xfa/0xfa0 [ 307.441647][T17649] ? lockdep_hardirqs_on+0x9c/0x150 [ 307.441665][T17649] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.441678][T17649] ? clear_bhb_loop+0x60/0xb0 [ 307.441693][T17649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.441706][T17649] RIP: 0033:0x7f71b818f749 [ 307.441720][T17649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 307.441732][T17649] RSP: 002b:00007f71b903a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 307.441748][T17649] RAX: ffffffffffffffda RBX: 00007f71b83e5fa0 RCX: 00007f71b818f749 [ 307.441758][T17649] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000007 [ 307.441767][T17649] RBP: 00007f71b8213f91 R08: 0000000000000000 R09: 0000000000000000 [ 307.441776][T17649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 307.441784][T17649] R13: 00007f71b83e6038 R14: 00007f71b83e5fa0 R15: 00007fffb8a2cd28 [ 307.441804][T17649] [ 308.255199][ T3580] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.311120][ T3580] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.361173][ T3580] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.420279][ T3580] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.511602][ T3580] batadv1: left allmulticast mode [ 308.517398][ T3580] batadv1: left promiscuous mode [ 308.522448][ T3580] bridge0: port 3(batadv1) entered disabled state [ 308.530751][ T3580] bridge_slave_1: left allmulticast mode [ 308.536829][ T3580] bridge_slave_1: left promiscuous mode [ 308.542489][ T3580] bridge0: port 2(bridge_slave_1) entered disabled state [ 308.551158][ T3580] bridge0: port 1(bridge_slave_0) entered disabled state [ 308.604405][ T3580] dvmrp6 (unregistering): left allmulticast mode [ 308.652268][ T3580] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 308.662397][ T3580] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 308.671992][ T3580] bond0 (unregistering): Released all slaves [ 308.709783][ T3580] tipc: Left network mode [ 308.941543][ T3580] hsr_slave_0: left promiscuous mode [ 308.963940][ T3580] hsr_slave_1: left promiscuous mode [ 308.975249][ T3580] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 308.983621][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 308.991585][ T3580] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 308.999046][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 309.008866][ T3580] veth1_macvtap: left promiscuous mode [ 309.014356][ T3580] veth0_macvtap: left promiscuous mode [ 309.020218][ T3580] veth1_vlan: left promiscuous mode [ 309.025454][ T3580] veth0_vlan: left promiscuous mode [ 309.132755][ T3580] team0 (unregistering): Port device team_slave_1 removed [ 309.157661][ T3580] team0 (unregistering): Port device team_slave_0 removed [ 309.786073][ T3580] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.830241][ T3580] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.880487][ T3580] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.920460][ T3580] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.134128][ T3580] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 310.145798][ T3580] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.209794][ T3580] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 310.220090][ T3580] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.280432][ T3580] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 310.290885][ T3580] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.320544][ T3580] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 310.330953][ T3580] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.402892][ T3580] bridge_slave_1: left allmulticast mode [ 310.408592][ T3580] bridge_slave_1: left promiscuous mode [ 310.414261][ T3580] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.422575][ T3580] bridge_slave_0: left allmulticast mode [ 310.428692][ T3580] bridge_slave_0: left promiscuous mode [ 310.434361][ T3580] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.443217][ T3580] bridge_slave_1: left allmulticast mode [ 310.449007][ T3580] bridge_slave_1: left promiscuous mode [ 310.454731][ T3580] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.463213][ T3580] bridge_slave_0: left allmulticast mode [ 310.468998][ T3580] bridge_slave_0: left promiscuous mode [ 310.475069][ T3580] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.484597][ T3580] bridge_slave_1: left allmulticast mode [ 310.490612][ T3580] bridge_slave_1: left promiscuous mode [ 310.496490][ T3580] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.504414][ T3580] bridge_slave_0: left allmulticast mode [ 310.510121][ T3580] bridge_slave_0: left promiscuous mode [ 310.515749][ T3580] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.525048][ T3580] bridge_slave_1: left allmulticast mode [ 310.530818][ T3580] bridge_slave_1: left promiscuous mode [ 310.536672][ T3580] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.545024][ T3580] bridge_slave_0: left allmulticast mode [ 310.550873][ T3580] bridge_slave_0: left promiscuous mode [ 310.556754][ T3580] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.701464][ T3580] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 310.711477][ T3580] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 310.721114][ T3580] bond0 (unregistering): Released all slaves [ 310.821185][ T3580] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 310.831273][ T3580] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 310.840813][ T3580] bond0 (unregistering): Released all slaves [ 311.144877][ T3580] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 311.154640][ T3580] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 311.163874][ T3580] bond0 (unregistering): Released all slaves [ 311.380842][ T3580] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 311.392585][ T3580] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 311.402279][ T3580] bond0 (unregistering): Released all slaves [ 311.511817][ T3580] bond1 (unregistering): Released all slaves [ 312.270537][ T3580] hsr_slave_0: left promiscuous mode [ 312.276634][ T3580] hsr_slave_1: left promiscuous mode [ 312.282481][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 312.290660][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 312.303059][ T3580] hsr_slave_0: left promiscuous mode [ 312.309365][ T3580] hsr_slave_1: left promiscuous mode [ 312.315120][ T3580] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 312.322982][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 312.330699][ T3580] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 312.338539][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 312.348609][ T3580] hsr_slave_0: left promiscuous mode [ 312.354484][ T3580] hsr_slave_1: left promiscuous mode [ 312.360466][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 312.368073][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 312.378562][ T3580] hsr_slave_0: left promiscuous mode [ 312.384295][ T3580] hsr_slave_1: left promiscuous mode [ 312.390257][ T3580] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 312.398019][ T3580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 312.410996][ T3580] veth1_macvtap: left promiscuous mode [ 312.416614][ T3580] veth1_vlan: left promiscuous mode [ 312.421870][ T3580] veth0_vlan: left promiscuous mode [ 312.427690][ T3580] veth1_macvtap: left promiscuous mode [ 312.433165][ T3580] veth0_macvtap: left promiscuous mode [ 312.438847][ T3580] veth1_vlan: left promiscuous mode [ 312.590138][ T3580] team0 (unregistering): Port device team_slave_1 removed [ 312.614384][ T3580] team0 (unregistering): Port device team_slave_0 removed [ 312.792911][ T3580] team0 (unregistering): Port device team_slave_1 removed [ 312.818950][ T3580] team0 (unregistering): Port device team_slave_0 removed [ 313.184672][ T3580] team0 (unregistering): Port device team_slave_1 removed [ 313.223891][ T3580] team0 (unregistering): Port device team_slave_0 removed [ 313.542654][ T3580] pim6reg (unregistering): left allmulticast mode [ 313.643579][ T3580] team0 (unregistering): Port device team_slave_1 removed [ 313.668905][ T3580] team0 (unregistering): Port device team_slave_0 removed [ 313.725312][ T44] smc: removing ib device syz2 [ 313.820622][ T855] vxcan1 speed is unknown, defaulting to 1000 [ 313.838480][ T855] syz2: Port: 1 Link DOWN [ 314.708892][ T3580] IPVS: stop unused estimator thread 0...