last executing test programs: 4.689180003s ago: executing program 0 (id=12210): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 4.516215277s ago: executing program 0 (id=12211): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) sendmsg$DCCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002080)={0x4c, 0x13, 0x100, 0x70bd29, 0x25dfdbff, {0x1, 0x70, 0x6, 0x7, {0x4e22, 0x4e24, [0x4, 0xffffffff, 0xfff, 0x2], [0x7, 0x121, 0xabaf, 0x80000001], 0x0, [0x2a, 0x3]}, 0x3, 0x8}}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x40000) sendmmsg$inet6(r0, &(0x7f0000002000)=[{{0x0, 0x0, &(0x7f0000000180), 0x1}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000009c0)='.', 0xc400}], 0x7}}], 0x44, 0x0) 4.410275501s ago: executing program 0 (id=12213): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000100)=0x8001, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0xa, @empty, 0x9}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0x8000) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e23, 0x100002, @ipv4={'\x00', '\xff\xff', @empty}, 0x1e}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000000680)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xab, @loopback, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000900)='2', 0x1}], 0x1}}], 0x1, 0x20000014) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000001590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) 4.322496275s ago: executing program 4 (id=12214): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=@delqdisc={0x24, 0x25, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xfffa, 0xc}, {0xffe3, 0xfff1}, {0x5, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040099}, 0x880) 3.827543707s ago: executing program 4 (id=12218): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000100)={r0}) r2 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000340)={r2}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_hsr\x00', 0x0}) bind$xdp(r3, &(0x7f00000005c0)={0x2d, 0x0, r5, 0xc}, 0x10) bind$xdp(r1, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) close(r0) 3.696536658s ago: executing program 4 (id=12220): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="89e7ee0c7cda99b4b47380c988ca", 0xe}, {&(0x7f00000001c0)="e582df448b7c", 0x6}, {&(0x7f0000000ac0)="03be00fb0f1b38046b10e701dd5802f7b0d29af162fa45cc968ade", 0x1b}], 0x3) 3.373680338s ago: executing program 0 (id=12224): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000240)=0x4000, 0x4) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000140)=0x10000, 0x4) 2.842478728s ago: executing program 2 (id=12228): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0xffff}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r2, &(0x7f0000000040)="a6", 0xffffff4c, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000140)=@ccm_128={{}, "3f968a231afa0e18", "4a952e4ea416ad75f769d6386c3c044b", '\by\x00', "e4eb37b07ad86ed7"}, 0x28) 1.942517237s ago: executing program 2 (id=12229): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x8, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {}, {0xfff2, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x86dd}, @TCA_FLOWER_KEY_PORT_DST_MIN={0x6, 0x59, 0x4e21}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040000}, 0x24000000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.326889691s ago: executing program 0 (id=12230): r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) connect$llc(r0, &(0x7f0000000040)={0x1a, 0x1, 0x0, 0x0, 0xe, 0x29, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x40}}, 0x10) r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05dd42"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x90) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.252195436s ago: executing program 2 (id=12232): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010300000000000000000a0000010900020073797a31000000000900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) recvmsg(r2, &(0x7f0000002240)={0x0, 0x0, 0x0}, 0x0) 1.250685681s ago: executing program 4 (id=12233): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0xa, 0x922000000003, 0x11) socket$rxrpc(0x21, 0x2, 0x2) r0 = socket$kcm(0x2b, 0x1, 0x0) socket$inet6(0xa, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) shutdown(r0, 0x1) 1.210914658s ago: executing program 3 (id=12234): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000500)={'syztnl1\x00', 0x0, 0x4, 0x8, 0x8, 0x0, 0x0, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x7, 0xfffff214}}) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32, @ANYBLOB="10005e01"], 0x2c}}, 0x800) 1.093981734s ago: executing program 1 (id=12235): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r1, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32) sendmmsg(r2, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) 967.023048ms ago: executing program 3 (id=12236): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'veth0_to_bond\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x5c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}, @IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xfffffff7, 0x3}}]}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x600}, 0x0) 863.03143ms ago: executing program 2 (id=12237): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r2 = accept(r0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="120000000400000004000000a4"], 0x48) shutdown(r2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000300), &(0x7f00000002c0)=@tcp6=r2}, 0x47) recvmmsg(r2, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x10042, 0x0) 790.342579ms ago: executing program 2 (id=12238): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 718.813411ms ago: executing program 0 (id=12239): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 682.153569ms ago: executing program 2 (id=12240): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000000), 0xffffff6a) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 605.081602ms ago: executing program 3 (id=12241): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1003d1, 0x3, 0x5, 0x6, 0x6}, 0x6b}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0xd0}, 0x2) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0xc695d31f854950dd}}, [@filter_kind_options=@f_flow={{0x9}, {0x54, 0x2, [@TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1003d1, 0x3, 0x3, 0x6, 0x86}, 0x65}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0xc804}, 0x2) 576.994157ms ago: executing program 1 (id=12242): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x30}}, 0x0) 482.080075ms ago: executing program 1 (id=12243): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x4}, {0xffff, 0xffff}, {0xe, 0x1}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7, 0x1}}}}, @TCA_RATE={0x6, 0x5, {0x0, 0xc1}}]}, 0x48}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 474.75073ms ago: executing program 3 (id=12244): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000200)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) r4 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=r2, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000140)=r4, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000340)=r3, 0x4) 299.750757ms ago: executing program 3 (id=12245): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100bd0300000800034000000001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 289.780749ms ago: executing program 4 (id=12246): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x50) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.stat\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) getsockopt$bt_hci(r1, 0x84, 0x2, 0x0, &(0x7f0000000700)) 287.186299ms ago: executing program 1 (id=12247): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x4c, 0x64, 0xf31, 0xfffffffb, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@TCA_CHAIN={0x0, 0xb, 0xe0d}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 179.101497ms ago: executing program 3 (id=12248): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, 0x0, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) write$nci(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="414601", @ANYRES32=r3], 0x4) 87.51786ms ago: executing program 4 (id=12249): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@gettfilter={0x2c, 0x2e, 0x1, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xc, 0x4}, {0x0, 0xfff1}, {0x700, 0x2}}, [{0x8, 0xb, 0xffffff03}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4041080) 23.817073ms ago: executing program 1 (id=12250): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000280)={r1, r1, 0xfffb, 0x0, 0x0, 0x8, 0x9b, 0x2, 0x5508, 0xff, 0x2, 0x9, 'syz0\x00'}) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000e40)={0xffffffffffffffff, 0x0, 0x0}, 0x10) 0s ago: executing program 1 (id=12251): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x40000) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r4, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800) kernel console output (not intermixed with test programs): ss `syz.3.6371'. [ 363.889602][T19217] netlink: 'syz.3.6371': attribute type 2 has an invalid length. [ 364.192957][T19235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6380'. [ 364.205718][T19235] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6380'. [ 364.242903][ T1022] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 364.266026][ T1022] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 364.288237][ T1022] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 364.307899][ T1022] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 364.762845][T19270] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6397'. [ 364.794274][T19270] unsupported nla_type 7424 [ 364.824352][T19274] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6398'. [ 364.845431][T19274] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6398'. [ 365.028494][T19285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6404'. [ 365.049864][T19285] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6404'. [ 365.296695][T19301] sock: sock_set_timeout: `syz.2.6410' (pid 19301) tries to set negative timeout [ 365.447066][T19308] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6413'. [ 365.795662][T19326] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 366.298285][T19357] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6440'. [ 366.633849][T19373] vcan0: entered allmulticast mode [ 366.680941][T19379] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6450'. [ 366.962267][T19395] netlink: 'syz.3.6457': attribute type 4 has an invalid length. [ 367.251077][T19413] netlink: 'syz.4.6468': attribute type 3 has an invalid length. [ 367.263658][T19413] netlink: 'syz.4.6468': attribute type 1 has an invalid length. [ 367.421500][T19423] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 367.862509][T19449] netlink: 'syz.3.6484': attribute type 1 has an invalid length. [ 367.871061][T19449] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 368.166770][T19466] netlink: 'syz.4.6490': attribute type 2 has an invalid length. [ 368.341736][T19472] rdma_op ffff88802b8d61f0 conn xmit_rdma 0000000000000000 [ 368.923794][T19507] netlink: 'syz.4.6509': attribute type 1 has an invalid length. [ 368.948849][T19507] netlink: 'syz.4.6509': attribute type 1 has an invalid length. [ 369.110210][T19517] netlink: 'syz.0.6516': attribute type 8 has an invalid length. [ 369.137291][T19517] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.147231][T19517] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.690450][T19549] netlink: 'syz.0.6532': attribute type 11 has an invalid length. [ 369.731097][T19549] __nla_validate_parse: 10 callbacks suppressed [ 369.731515][T19549] netlink: 199820 bytes leftover after parsing attributes in process `syz.0.6532'. [ 370.024776][T19569] netlink: 216 bytes leftover after parsing attributes in process `syz.1.6542'. [ 370.053614][T19569] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6542'. [ 370.454282][T19596] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 370.661044][T19608] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 370.768084][T19613] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6564'. [ 370.807922][T19613] netlink: 176 bytes leftover after parsing attributes in process `syz.1.6564'. [ 370.818003][T19613] netlink: 'syz.1.6564': attribute type 5 has an invalid length. [ 370.827038][T19616] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6565'. [ 371.133210][T19632] vlan2: entered promiscuous mode [ 371.148518][T19632] bridge0: entered promiscuous mode [ 371.246230][T19638] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6573'. [ 371.650806][T19665] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 371.691514][T19665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 373.231054][T19748] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.6627'. [ 373.237588][T19744] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6628'. [ 373.256825][T19746] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6626'. [ 374.118523][T19797] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 374.770553][T19834] __nla_validate_parse: 3 callbacks suppressed [ 374.770575][T19834] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6669'. [ 374.892334][T19840] netlink: 100 bytes leftover after parsing attributes in process `syz.3.6672'. [ 375.128275][T19856] netlink: 'syz.3.6679': attribute type 2 has an invalid length. [ 375.689316][T19881] IPVS: stopping backup sync thread 14203 ... [ 376.161390][T19902] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6701'. [ 377.111989][T19964] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6731'. [ 377.179892][T19968] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6733'. [ 377.333573][T19974] nbd: socks must be embedded in a SOCK_ITEM attr [ 378.028209][T20017] tipc: Started in network mode [ 378.052899][T20017] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 378.084262][T20017] tipc: Enabled bearer , priority 24 [ 378.417707][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.555950][T20047] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6771'. [ 378.722707][T20057] netlink: 'syz.1.6775': attribute type 32 has an invalid length. [ 378.738006][T20059] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 261 [ 378.743018][T20057] netlink: 776 bytes leftover after parsing attributes in process `syz.1.6775'. [ 378.840512][T20063] netlink: 176 bytes leftover after parsing attributes in process `syz.2.6779'. [ 378.855741][T20063] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6779'. [ 378.926090][T20067] netlink: 212 bytes leftover after parsing attributes in process `syz.1.6781'. [ 379.204895][ T5745] tipc: Node number set to 10005162 [ 379.543149][T20104] smc: ib device syz2 ibport 1 applied user defined pnetid SYZ1 [ 380.319505][T20155] netlink: 'syz.0.6823': attribute type 18 has an invalid length. [ 380.350877][ T1022] netdevsim netdevsim0 : set [0, 0] type 1 family 0 port 8472 - 0 [ 380.381554][ T1022] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 380.399440][ T1022] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 380.428390][ T1022] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 380.487470][T20158] __nla_validate_parse: 2 callbacks suppressed [ 380.487489][T20158] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6824'. [ 380.905812][T20185] netlink: 76 bytes leftover after parsing attributes in process `syz.1.6838'. [ 381.201132][T20205] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6848'. [ 382.070003][T20254] netlink: 'syz.0.6871': attribute type 1 has an invalid length. [ 382.099011][T20254] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 382.211306][T20261] openvswitch: netlink: Missing valid actions attribute. [ 382.225774][T20261] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 382.968502][T20303] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6894'. [ 384.085435][T20367] sctp: [Deprecated]: syz.0.6924 (pid 20367) Use of int in max_burst socket option. [ 384.085435][T20367] Use struct sctp_assoc_value instead [ 384.643828][T20396] netlink: 'syz.2.6940': attribute type 4 has an invalid length. [ 384.660813][T20396] netlink: 240 bytes leftover after parsing attributes in process `syz.2.6940'. [ 384.740156][T20399] ipvlan2: entered promiscuous mode [ 384.938043][T20413] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6944'. [ 384.985790][T20413] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6944'. [ 385.387973][T20436] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6959'. [ 385.644344][T20453] bridge0: port 3(syz_tun) entered disabled state [ 385.717408][T20453] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.747367][T20453] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.815958][T20453] tipc: Resetting bearer [ 385.824887][T20453] tipc: Resetting bearer [ 385.844777][T20466] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6972'. [ 385.872181][T20457] erspan0: left allmulticast mode [ 385.887405][T20457] bridge0: port 3(syz_tun) entered blocking state [ 385.894179][T20457] bridge0: port 3(syz_tun) entered forwarding state [ 385.939121][T20457] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.946501][T20457] bridge0: port 1(bridge_slave_0) entered forwarding state [ 385.957961][T20457] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.965205][T20457] bridge0: port 2(bridge_slave_1) entered forwarding state [ 386.009500][T20457] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 386.047776][T20457] ip6tnl2: left allmulticast mode [ 386.058227][T20457] veth5: left promiscuous mode [ 386.063079][T20457] veth5: left allmulticast mode [ 386.069613][T20457] vlan2: left allmulticast mode [ 386.074915][T20457] bond0: left allmulticast mode [ 386.079922][T20457] bond_slave_0: left allmulticast mode [ 386.088056][T20457] bond_slave_1: left allmulticast mode [ 386.094178][T20457] vlan3: left promiscuous mode [ 386.099146][T20457] bridge0: left promiscuous mode [ 386.107395][T20457] ipvlan2: left promiscuous mode [ 386.926140][T20510] netlink: 'syz.4.6993': attribute type 1 has an invalid length. [ 386.970490][T20510] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6993'. [ 387.045702][T20518] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6997'. [ 387.195126][T20524] pimreg3: entered allmulticast mode [ 387.543234][T20546] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7010'. [ 387.567257][T20545] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7011'. [ 387.835152][T20556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7016'. [ 388.743274][T20604] netlink: 'syz.1.7039': attribute type 1 has an invalid length. [ 389.098257][T20626] netlink: 'syz.1.7050': attribute type 1 has an invalid length. [ 389.560511][T20650] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7061'. [ 389.598863][T20650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7061'. [ 389.932144][T20670] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 390.168698][T20683] netlink: 'syz.4.7076': attribute type 29 has an invalid length. [ 390.181340][T20686] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7079'. [ 390.349310][T20695] sctp: [Deprecated]: syz.4.7084 (pid 20695) Use of int in max_burst socket option deprecated. [ 390.349310][T20695] Use struct sctp_assoc_value instead [ 390.437140][T20699] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 390.707859][T20710] netlink: 'syz.2.7091': attribute type 1 has an invalid length. [ 390.719497][T20710] nbd: error processing sock list [ 391.727197][T20769] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7119'. [ 392.571305][T20816] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7142'. [ 393.290050][T20860] netlink: 'syz.2.7164': attribute type 1 has an invalid length. [ 393.307917][T20860] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.315245][T20860] IPv6: NLM_F_CREATE should be set when creating new route [ 393.658058][T20881] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7174'. [ 394.004841][T20895] tipc: Resetting bearer [ 394.057133][T20898] bridge0: port 1(gretap0) entered blocking state [ 394.063810][T20898] bridge0: port 1(gretap0) entered forwarding state [ 394.310534][T20909] netlink: 'syz.4.7187': attribute type 1 has an invalid length. [ 394.331550][T20898] bond1: left promiscuous mode [ 394.337725][T20909] netlink: 96 bytes leftover after parsing attributes in process `syz.4.7187'. [ 394.350266][T20898] bond1: left allmulticast mode [ 394.358600][T20898] geneve2: left promiscuous mode [ 394.364646][T20909] netlink: 'syz.4.7187': attribute type 1 has an invalid length. [ 394.373240][T20898] geneve2: left allmulticast mode [ 394.379559][T20910] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7188'. [ 394.388814][T20909] netlink: 'syz.4.7187': attribute type 8 has an invalid length. [ 394.400031][T20898] vlan1: left allmulticast mode [ 394.405336][T20909] netlink: 606 bytes leftover after parsing attributes in process `syz.4.7187'. [ 394.414859][T20898] bond0: left allmulticast mode [ 394.421397][T20898] vlan2: left promiscuous mode [ 394.427212][T20909] netlink: 1 bytes leftover after parsing attributes in process `syz.4.7187'. [ 394.438861][T20898] bridge0: left promiscuous mode [ 394.664898][T20920] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7193'. [ 394.904389][T20929] netlink: 52 bytes leftover after parsing attributes in process `syz.2.7197'. [ 394.935562][T20929] netlink: 13 bytes leftover after parsing attributes in process `syz.2.7197'. [ 395.744241][T20976] ieee802154 phy1 wpan1: encryption failed: -22 [ 398.512498][T21137] __nla_validate_parse: 6 callbacks suppressed [ 398.512519][T21137] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7297'. [ 398.558585][T21137] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7297'. [ 398.747320][T21153] tipc: Enabled bearer , priority 10 [ 399.488264][T21191] netlink: 'syz.3.7323': attribute type 29 has an invalid length. [ 399.507055][T21192] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 399.869374][T21214] netlink: 'syz.2.7335': attribute type 11 has an invalid length. [ 399.883820][ T809] tipc: Node number set to 3758096385 [ 399.893696][T21214] netlink: 'syz.2.7335': attribute type 11 has an invalid length. [ 399.912670][T21214] netlink: 204 bytes leftover after parsing attributes in process `syz.2.7335'. [ 400.042774][T21222] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 400.560842][T21256] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7354'. [ 400.722721][T21267] netlink: zone id is out of range [ 400.743577][T21267] netlink: zone id is out of range [ 400.748895][T21267] netlink: zone id is out of range [ 400.759107][T21267] netlink: zone id is out of range [ 400.769502][T21267] netlink: zone id is out of range [ 400.775132][T21269] netlink: 'syz.1.7362': attribute type 62 has an invalid length. [ 400.797700][T21267] netlink: zone id is out of range [ 400.809433][T21267] netlink: zone id is out of range [ 400.819004][T21267] netlink: zone id is out of range [ 401.046695][T21283] netlink: 10 bytes leftover after parsing attributes in process `syz.3.7369'. [ 401.396310][T21301] veth3: entered allmulticast mode [ 401.979954][T21333] xt_limit: Overflow, try lower: 604147548/4200216962 [ 402.536123][T21356] netlink: 'syz.4.7403': attribute type 1 has an invalid length. [ 402.552373][T21356] netlink: 236 bytes leftover after parsing attributes in process `syz.4.7403'. [ 402.970575][T21379] xt_HMARK: spi-set and port-set can't be combined [ 403.401723][T21404] netlink: 'syz.1.7426': attribute type 3 has an invalid length. [ 403.562170][T21399] syz.0.7425 (21399) used greatest stack depth: 17944 bytes left [ 404.058327][T21440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7444'. [ 404.092000][T21440] netlink: 'syz.2.7444': attribute type 5 has an invalid length. [ 404.122204][T21440] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7444'. [ 404.853939][T21488] netlink: 'syz.1.7468': attribute type 1 has an invalid length. [ 405.987362][T21559] IPVS: length: 8 != 1152 [ 406.233087][T21571] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7509'. [ 406.440638][T21584] netlink: 212304 bytes leftover after parsing attributes in process `syz.4.7515'. [ 406.454362][T21585] netlink: 252 bytes leftover after parsing attributes in process `syz.1.7516'. [ 406.471661][T21584] net_ratelimit: 135 callbacks suppressed [ 406.471678][T21584] openvswitch: netlink: Message has 6 unknown bytes. [ 406.993956][T21610] syz.3.7529 (21610) used obsolete PPPIOCDETACH ioctl [ 407.264904][T21626] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7536'. [ 407.307228][T21632] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 407.412449][T21637] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7542'. [ 407.735372][T21657] netlink: 'syz.4.7552': attribute type 1 has an invalid length. [ 407.974775][T21668] netlink: 'syz.2.7557': attribute type 1 has an invalid length. [ 407.996214][T21668] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7557'. [ 408.006715][T21668] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7557'. [ 408.017256][T21668] netlink: 'syz.2.7557': attribute type 2 has an invalid length. [ 408.026033][T21674] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 408.028367][T21668] netlink: 'syz.2.7557': attribute type 2 has an invalid length. [ 408.054246][T21668] netlink: 'syz.2.7557': attribute type 2 has an invalid length. [ 409.291982][T21738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7590'. [ 409.313230][T21739] netlink: 'syz.4.7589': attribute type 11 has an invalid length. [ 409.691077][T21760] netlink: 1 bytes leftover after parsing attributes in process `syz.3.7600'. [ 409.884887][T21775] wireguard: wg0: Could not create IPv4 socket [ 410.034075][T21782] netlink: 'syz.3.7611': attribute type 1 has an invalid length. [ 410.609652][T21821] tipc: Enabling of bearer rejected, media not registered [ 410.843126][T21833] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 411.009747][T21843] batadv0: entered promiscuous mode [ 411.030406][T21843] macsec1: entered promiscuous mode [ 411.040095][T21843] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 411.056824][T21843] batadv0: left promiscuous mode [ 411.662256][T21882] netlink: 312 bytes leftover after parsing attributes in process `syz.1.7658'. [ 412.162533][T21907] netlink: 'syz.1.7669': attribute type 1 has an invalid length. [ 412.442364][T21924] netlink: 'syz.1.7678': attribute type 32 has an invalid length. [ 412.489774][T21924] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7678'. [ 412.653234][T21924] bond3: Setting coupled_control to off (0) [ 413.854792][T22000] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7713'. [ 414.455051][T22039] vlan3: entered promiscuous mode [ 414.464339][T22041] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 414.486158][T22039] bridge0: entered promiscuous mode [ 414.749394][T22053] smc: ib device syz2 ibport 2 applied user defined pnetid SYZ1 [ 414.779758][T22055] netlink: 80 bytes leftover after parsing attributes in process `syz.4.7740'. [ 414.807699][T22059] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7742'. [ 415.249849][T22080] bond2: (slave bond_slave_1): Device is not our slave [ 415.256954][T22080] bond2: option active_slave: invalid value (bond_slave_1) [ 415.270708][T22080] bond2 (unregistering): Released all slaves [ 415.319455][T22090] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7756'. [ 415.743371][T22114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7767'. [ 415.935413][T22125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7773'. [ 416.011740][T22125] ipvlan2: entered allmulticast mode [ 416.028300][T22125] batadv_slave_1: entered allmulticast mode [ 416.054982][T22132] netlink: 'syz.2.7777': attribute type 3 has an invalid length. [ 416.356705][T22148] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7783'. [ 416.837865][T22182] netlink: 'syz.0.7799': attribute type 58 has an invalid length. [ 416.855000][T22182] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7799'. [ 417.061295][T22195] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7804'. [ 417.531510][T22222] bond0: Error: Cannot enslave bond to itself. [ 417.618003][T22224] x_tables: duplicate underflow at hook 4 [ 417.691443][ T5765] IPVS: starting estimator thread 0... [ 417.804384][T22231] IPVS: using max 25 ests per chain, 60000 per kthread [ 417.927097][T22244] IPv6: NLM_F_CREATE should be specified when creating new route [ 417.953918][T22244] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7827'. [ 418.202568][T22261] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7836'. [ 418.712785][T22291] macsec1: entered promiscuous mode [ 418.746101][T22292] veth1_macvtap: left promiscuous mode [ 418.755914][T22292] macsec0: entered promiscuous mode [ 418.773066][T22292] macsec0: entered allmulticast mode [ 418.781928][T22298] veth1_macvtap: entered promiscuous mode [ 418.792277][T22298] veth1_macvtap: entered allmulticast mode [ 418.805864][T22298] macsec0: left promiscuous mode [ 418.823800][T22298] macsec0: left allmulticast mode [ 418.829153][T22298] veth1_macvtap: left allmulticast mode [ 418.899752][T22302] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 419.069058][T22310] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 419.514480][T22337] lo: entered allmulticast mode [ 420.573925][T22404] __nla_validate_parse: 1 callbacks suppressed [ 420.573945][T22404] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7906'. [ 421.199696][T22441] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7923'. [ 421.642213][T22470] xt_connbytes: Forcing CT accounting to be enabled [ 422.089695][T22497] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7950'. [ 422.162069][ T3392] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 422.191081][ T809] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 422.202968][ T3392] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 422.802469][T22531] xt_l2tp: missing protocol rule (udp|l2tpip) [ 422.813766][ T809] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 422.979891][T22539] tipc: MTU too low for tipc bearer [ 423.134522][ T809] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 423.260605][T22556] syz_tun: left allmulticast mode [ 423.277045][T22556] syz_tun: left promiscuous mode [ 423.289863][T22556] bridge0: port 3(syz_tun) entered disabled state [ 423.352029][T22556] bridge_slave_0: left allmulticast mode [ 423.361072][T22556] bridge_slave_0: left promiscuous mode [ 423.379867][T22556] bridge0: port 1(bridge_slave_0) entered disabled state [ 423.430032][T22556] bridge_slave_1: left allmulticast mode [ 423.445034][T22556] bridge_slave_1: left promiscuous mode [ 423.477880][T22556] bridge0: port 2(bridge_slave_1) entered disabled state [ 423.567238][T22556] bond0: (slave bond_slave_0): Releasing backup interface [ 423.592329][T22570] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7986'. [ 423.613121][T22570] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7986'. [ 423.625798][T22556] bond0: (slave bond_slave_1): Releasing backup interface [ 423.667822][T22556] team0: Port device team_slave_0 removed [ 423.709109][T22556] team0: Port device team_slave_1 removed [ 423.728616][T22556] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 423.743952][T22556] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 423.757286][T22556] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 423.779388][T22556] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 423.803359][T22556] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 424.486950][T22615] nbd: must specify a device to reconfigure [ 424.581747][T22620] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8010'. [ 424.599016][T22622] netlink: 'syz.1.8011': attribute type 1 has an invalid length. [ 424.621925][T22622] netlink: 'syz.1.8011': attribute type 3 has an invalid length. [ 424.641791][T22622] netlink: 172 bytes leftover after parsing attributes in process `syz.1.8011'. [ 424.667286][T22622] NCSI netlink: No device for ifindex 813332851 [ 425.499585][T22672] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8034'. [ 426.282137][T22718] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8057'. [ 426.653845][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 426.666199][T22736] netlink: 'syz.0.8066': attribute type 1 has an invalid length. [ 426.711515][T22739] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8068'. [ 426.963832][T22757] netlink: 'syz.0.8076': attribute type 25 has an invalid length. [ 427.743354][T22791] tipc: Enabling of bearer rejected, media not registered [ 428.572597][T22830] Cannot find add_set index 46338 as target [ 428.867957][T22851] pimreg: entered allmulticast mode [ 429.163971][T22863] : entered promiscuous mode [ 429.451905][T22887] tipc: Enabling of bearer rejected, failed to enable media [ 430.192425][T22930] sctp: [Deprecated]: syz.0.8157 (pid 22930) Use of int in maxseg socket option. [ 430.192425][T22930] Use struct sctp_assoc_value instead [ 430.972246][T22971] xt_limit: Overflow, try lower: 271964/0 [ 431.826281][T23025] xt_time: unknown flags 0xf4 [ 431.846959][T23027] netlink: 120 bytes leftover after parsing attributes in process `syz.3.8206'. [ 431.865519][T23027] netlink: 'syz.3.8206': attribute type 1 has an invalid length. [ 431.885654][T23027] netlink: 64 bytes leftover after parsing attributes in process `syz.3.8206'. [ 432.057332][T23041] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8212'. [ 432.071561][T23041] netlink: 43 bytes leftover after parsing attributes in process `syz.2.8212'. [ 432.093951][T23041] netlink: 'syz.2.8212': attribute type 5 has an invalid length. [ 432.109750][T23041] netlink: 43 bytes leftover after parsing attributes in process `syz.2.8212'. [ 432.247474][T23049] "syz.3.8217" (23049) uses obsolete ecb(arc4) skcipher [ 432.452321][T23057] wireguard0: entered promiscuous mode [ 432.486463][T23057] wireguard0: entered allmulticast mode [ 432.791751][T23078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8228'. [ 432.823328][T23078] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8228'. [ 433.422819][T23106] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 433.456427][T23106] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.497137][T23106] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 433.555665][T23119] netlink: 'syz.3.8249': attribute type 29 has an invalid length. [ 433.564704][T23119] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8249'. [ 433.593162][T23123] netlink: 'syz.3.8249': attribute type 29 has an invalid length. [ 433.602321][T23123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8249'. [ 433.704095][T23106] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 433.716366][T23106] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.727573][T23106] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 433.812629][T23132] IPVS: persistence engine module ip_vs_pe_À not found [ 433.922120][T23106] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 433.955950][T23106] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.977774][T23106] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 434.167020][T23147] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8261'. [ 434.220045][T23106] netdevsim netdevsim0  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.245162][T23106] netdevsim netdevsim0  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.275660][T23106] netdevsim netdevsim0  (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 434.540536][ T1162] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.567087][ T1162] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 434.595683][ T1162] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 434.655920][ T3392] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.675201][ T3392] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 434.708384][ T3392] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 434.785487][ T3392] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.802448][ T3392] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 434.814872][ T3392] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 434.862408][ T3392] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 434.892695][ T3392] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 434.922217][ T3392] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 435.373698][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 435.520230][ T30] audit: type=1804 audit(1778487068.007:4): pid=23220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.8296" name="/newroot/1674/cgroup.controllers" dev="tmpfs" ino=8399 res=1 errno=0 [ 435.580912][ T30] audit: type=1800 audit(1778487068.007:5): pid=23220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.8296" name="cgroup.controllers" dev="tmpfs" ino=8399 res=0 errno=0 [ 436.986886][T23302] ip6gre0: Master is either lo or non-ether device [ 437.663270][T23342] __nla_validate_parse: 3 callbacks suppressed [ 437.663291][T23342] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8347'. [ 438.361495][ T5289] veth0_macvtap: left promiscuous mode [ 438.800220][T23406] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8373'. [ 438.862717][T23409] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8374'. [ 438.897818][T23409] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8374'. [ 438.946942][T23409] netlink: 2 bytes leftover after parsing attributes in process `syz.0.8374'. [ 438.959826][T23409] veth1_to_bridge: entered allmulticast mode [ 438.969404][T23409] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8374'. [ 438.986941][T23409] netlink: 2 bytes leftover after parsing attributes in process `syz.0.8374'. [ 439.353253][T23434] team0: Cannot enslave team device to itself [ 439.551199][T23446] netlink: 'syz.3.8387': attribute type 1 has an invalid length. [ 439.574858][T23446] netlink: 'syz.3.8387': attribute type 2 has an invalid length. [ 439.597128][T23446] netlink: 'syz.3.8387': attribute type 1 has an invalid length. [ 439.610279][T23446] netlink: 'syz.3.8387': attribute type 3 has an invalid length. [ 439.619138][T23446] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8387'. [ 439.687877][T23451] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8390'. [ 439.716239][T23451] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8390'. [ 439.857791][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.319777][T23485] netlink: 'syz.0.8404': attribute type 4 has an invalid length. [ 440.893852][T23515] skbuff: bad partial csum: csum=65535/0 headroom=64 headlen=65537 [ 443.214191][T23649] __nla_validate_parse: 5 callbacks suppressed [ 443.214211][T23649] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8478'. [ 443.269970][T23649] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8478'. [ 443.984991][T23694] netlink: 'syz.4.8500': attribute type 1 has an invalid length. [ 444.007421][T23694] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8500'. [ 444.106149][T23700] netlink: 64 bytes leftover after parsing attributes in process `syz.2.8503'. [ 444.201584][T23706] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8506'. [ 444.224315][T23706] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8506'. [ 444.320976][T23712] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8509'. [ 444.431322][T23720] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8513'. [ 444.973261][T23752] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.8527'. [ 445.010972][T23752] openvswitch: netlink: Message has 5 unknown bytes. [ 445.357097][T23769] netem: change failed [ 445.432835][T23775] netlink: 84 bytes leftover after parsing attributes in process `syz.3.8536'. [ 445.443100][ T5634] block nbd0: Receive control failed (result -32) [ 446.109982][T23813] netem: change failed [ 446.761306][T23847] vxcan0: tx address claim with dlc 0 [ 447.341662][T23874] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 448.216094][T23920] xfrm1: entered promiscuous mode [ 448.225379][T23920] xfrm1: entered allmulticast mode [ 448.251644][T23920] __nla_validate_parse: 7 callbacks suppressed [ 448.251667][T23920] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8599'. [ 448.348665][T23927] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8603'. [ 448.412972][T23933] netem: change failed [ 448.959491][T23962] netlink: 190972 bytes leftover after parsing attributes in process `syz.2.8620'. [ 449.198422][T23965] bond2 (unregistering): Released all slaves [ 449.348134][T23978] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8628'. [ 449.368158][T23978] netlink: 2 bytes leftover after parsing attributes in process `syz.3.8628'. [ 449.555272][ T1022] tipc: Subscription rejected, illegal request [ 449.812456][T24009] sch_tbf: peakrate 5 is lower than or equals to rate 16783679728848008391 ! [ 449.826081][T24007] IPv6: NLM_F_CREATE should be specified when creating new route [ 450.808906][T24065] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.8666'. [ 450.937553][T24070] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8668'. [ 450.975006][T24070] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8668'. [ 450.991547][T24070] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8668'. [ 451.916398][T24128] netlink: 104 bytes leftover after parsing attributes in process `syz.0.8691'. [ 453.160043][T24200] netlink: 'syz.3.8726': attribute type 1 has an invalid length. [ 453.198903][T24200] netlink: 'syz.3.8726': attribute type 1 has an invalid length. [ 453.293798][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 453.313682][T24208] __nla_validate_parse: 4 callbacks suppressed [ 453.313700][T24208] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8730'. [ 453.645664][T24226] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8738'. [ 454.489379][T24278] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8757'. [ 455.308525][T24322] netlink: 'syz.3.8776': attribute type 4 has an invalid length. [ 456.144682][T24363] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8794'. [ 456.155962][T24363] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8794'. [ 456.774111][T24400] netlink: 54 bytes leftover after parsing attributes in process `syz.2.8811'. [ 456.791484][T24396] bond0: (slave bond_slave_1): Releasing backup interface [ 456.803553][T24400] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8811'. [ 456.827999][T24402] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8812'. [ 457.032158][T24412] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8817'. [ 457.053898][T24414] netlink: 'syz.2.8819': attribute type 4 has an invalid length. [ 457.489389][T24441] netlink: 'syz.1.8832': attribute type 83 has an invalid length. [ 458.163921][T24479] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8850'. [ 458.176520][T24479] netlink: 'syz.2.8850': attribute type 30 has an invalid length. [ 458.361801][T24483] __nla_validate_parse: 2 callbacks suppressed [ 458.361822][T24483] netlink: 104 bytes leftover after parsing attributes in process `syz.0.8852'. [ 458.938628][T24518] netlink: 'syz.1.8868': attribute type 5 has an invalid length. [ 458.983864][T24522] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8870'. [ 459.264624][T24536] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8877'. [ 459.872811][T24568] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8892'. [ 460.612087][T24606] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8907'. [ 460.717241][T24612] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 460.741814][T24613] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8912'. [ 460.798961][T24612] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 460.862427][T24613] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 461.208970][T24633] netlink: 'syz.4.8922': attribute type 33 has an invalid length. [ 461.311326][T24633] bond2: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 461.375478][T24633] bond2 (unregistering): Released all slaves [ 461.988637][T24665] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8934'. [ 462.236306][T24681] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8940'. [ 462.704214][T24701] erspan0: entered promiscuous mode [ 462.990485][T24717] ipvlan3: entered allmulticast mode [ 463.005131][T24717] batadv_slave_1: entered allmulticast mode [ 463.019102][T24720] block nbd2: not configured, cannot reconfigure [ 463.040562][T24717] batman_adv: batadv0: Adding interface: ipvlan3 [ 463.058302][T24717] batman_adv: batadv0: The MTU of interface ipvlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.112802][T24717] batman_adv: batadv0: Interface activated: ipvlan3 [ 463.154995][T24724] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8962'. [ 463.287247][T24728] netlink: 'syz.2.8963': attribute type 4 has an invalid length. [ 463.349625][T24736] netlink: 11562 bytes leftover after parsing attributes in process `syz.4.8967'. [ 464.641061][T24810] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9000'. [ 465.277968][T24836] tipc: Enabled bearer , priority 4 [ 465.717427][T24851] netdevsim netdevsim4 netdevsim0: Unsupported IPsec algorithm - please use rfc4106(gcm(aes)) [ 465.793713][T24863] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9025'. [ 466.211567][T24888] netem: change failed [ 466.401554][T24900] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.9043'. [ 466.849194][ T5634] block nbd1: Receive control failed (result -32) [ 467.278784][T24951] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9066'. [ 468.050387][T24994] netlink: 'syz.4.9088': attribute type 5 has an invalid length. [ 468.886602][T25035] tap0: tun_chr_ioctl cmd 2148553947 [ 469.012113][T25041] netem: change failed [ 469.244072][T25049] netlink: 104 bytes leftover after parsing attributes in process `syz.1.9115'. [ 469.317253][T25053] sctp: [Deprecated]: syz.0.9117 (pid 25053) Use of struct sctp_assoc_value in delayed_ack socket option. [ 469.317253][T25053] Use struct sctp_sack_info instead [ 470.246869][T25109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9142'. [ 470.269658][T25108] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9143'. [ 470.396630][T25118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9147'. [ 470.434320][T25118] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9147'. [ 470.458338][T25118] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9147'. [ 470.656150][T25133] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9155'. [ 471.668439][T25189] netlink: 144 bytes leftover after parsing attributes in process `syz.1.9180'. [ 471.867724][T25206] skbuff: bad partial csum: csum=65535/2 headroom=4 headlen=65543 [ 472.069316][T25217] netlink: 64 bytes leftover after parsing attributes in process `syz.3.9194'. [ 472.194272][T25224] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9197'. [ 472.614591][T25246] veth0: entered promiscuous mode [ 472.620669][T25245] veth0: left promiscuous mode [ 473.425471][T25294] netlink: 'syz.2.9230': attribute type 29 has an invalid length. [ 473.461987][T25294] netlink: 'syz.2.9230': attribute type 29 has an invalid length. [ 473.488392][T25294] netlink: 'syz.2.9230': attribute type 29 has an invalid length. [ 473.507298][T25294] netlink: 'syz.2.9230': attribute type 29 has an invalid length. [ 473.527763][T25294] netlink: 'syz.2.9230': attribute type 29 has an invalid length. [ 473.546775][T25299] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9233'. [ 473.560324][T25294] netlink: 'syz.2.9230': attribute type 29 has an invalid length. [ 473.579988][T25294] netlink: 'syz.2.9230': attribute type 29 has an invalid length. [ 475.012788][T25381] netlink: 'syz.3.9272': attribute type 21 has an invalid length. [ 475.075939][T25383] netlink: 'syz.3.9272': attribute type 21 has an invalid length. [ 475.111075][T25381] netlink: 'syz.3.9272': attribute type 4 has an invalid length. [ 475.848025][T25413] __nla_validate_parse: 5 callbacks suppressed [ 475.848052][T25413] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9287'. [ 476.346802][T25439] tipc: New replicast peer: 255.255.255.255 [ 476.359417][T25439] tipc: Enabled bearer , priority 10 [ 476.378808][T25439] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9296'. [ 476.838921][T25463] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.9308'. [ 476.901726][T25467] tipc: New replicast peer: 172.20.20.187 [ 476.923084][T25467] tipc: Enabled bearer , priority 10 [ 477.305776][T25488] macvtap1: entered allmulticast mode [ 477.315294][T25488] veth0_macvtap: entered allmulticast mode [ 478.034420][ T29] tipc: Node number set to 4269801494 [ 478.198859][T25542] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9344'. [ 479.126027][T25598] netlink: 104 bytes leftover after parsing attributes in process `syz.0.9367'. [ 480.052523][T25646] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.240975][T25664] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9398'. [ 480.342846][T25666] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9399'. [ 480.657692][T25685] block nbd2: Unsupported socket: should be TCP or UNIX. [ 480.877906][T25699] veth0: entered promiscuous mode [ 480.895781][T25699] veth0: left promiscuous mode [ 481.277292][T25724] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9427'. [ 481.491146][T25732] tipc: New replicast peer: 255.255.255.255 [ 481.512100][T25732] tipc: Enabled bearer , priority 10 [ 481.528570][T25734] validate_nla: 4 callbacks suppressed [ 481.528595][T25734] netlink: 'syz.4.9432': attribute type 1 has an invalid length. [ 481.571065][T25734] netlink: 'syz.4.9432': attribute type 2 has an invalid length. [ 481.589262][T25734] netlink: 'syz.4.9432': attribute type 1 has an invalid length. [ 481.796776][T25746] openvswitch: netlink: Multiple metadata blocks provided [ 481.838805][T25748] netlink: 108 bytes leftover after parsing attributes in process `syz.0.9439'. [ 481.876983][T25748] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9439'. [ 482.478557][T25785] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9457'. [ 482.669370][T25797] h: entered promiscuous mode [ 483.086494][T25819] netlink: 10 bytes leftover after parsing attributes in process `syz.1.9473'. [ 483.152639][T25822] netlink: 96 bytes leftover after parsing attributes in process `syz.0.9476'. [ 483.307228][T25829] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9479'. [ 483.337190][T25829] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9479'. [ 483.431762][T25837] netlink: 64 bytes leftover after parsing attributes in process `syz.1.9483'. [ 483.512438][T25843] netlink: 'syz.0.9485': attribute type 1 has an invalid length. [ 483.528667][T25843] netlink: 96 bytes leftover after parsing attributes in process `syz.0.9485'. [ 483.550376][T25843] netlink: 'syz.0.9485': attribute type 1 has an invalid length. [ 483.571657][T25843] netlink: 'syz.0.9485': attribute type 8 has an invalid length. [ 483.603069][T25849] tipc: Enabling of bearer rejected, already enabled [ 483.868877][T25859] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 484.732288][T25910] netlink: 'syz.1.9514': attribute type 29 has an invalid length. [ 484.790611][T25913] netlink: 'syz.1.9514': attribute type 29 has an invalid length. [ 484.866553][T25915] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 485.362677][T25945] smc: ib device syz2 ibport 1 erased user defined pnetid SYZ1 [ 485.389509][T25945] smc: ib device syz2 ibport 2 erased user defined pnetid SYZ1 [ 485.435944][T25948] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 485.444099][T25948] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 486.012559][T25973] netlink: 'syz.0.9543': attribute type 83 has an invalid length. [ 486.231174][T25982] netlink: 'syz.0.9546': attribute type 83 has an invalid length. [ 486.681553][T26004] __nla_validate_parse: 4 callbacks suppressed [ 486.681573][T26004] netlink: 88 bytes leftover after parsing attributes in process `syz.1.9558'. [ 487.213592][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 487.968482][T26060] netlink: 36 bytes leftover after parsing attributes in process `syz.0.9584'. [ 488.141901][T25936] syz.4.9528 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 488.199901][T25936] CPU: 1 UID: 0 PID: 25936 Comm: syz.4.9528 Not tainted syzkaller #0 PREEMPT(full) [ 488.199959][T25936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 488.199987][T25936] Call Trace: [ 488.199999][T25936] [ 488.200009][T25936] dump_stack_lvl+0xe8/0x150 [ 488.200040][T25936] dump_header+0xd3/0x4c0 [ 488.200076][T25936] oom_kill_process+0x3ab/0x970 [ 488.200111][T25936] out_of_memory+0x106c/0x1410 [ 488.200137][T25936] ? try_charge_memcg+0xbb9/0x1570 [ 488.200178][T25936] ? __pfx___mutex_lock+0x10/0x10 [ 488.200217][T25936] ? __pfx_out_of_memory+0x10/0x10 [ 488.200242][T25936] ? do_raw_spin_unlock+0xf5/0x210 [ 488.200284][T25936] try_charge_memcg+0xc77/0x1570 [ 488.200337][T25936] ? __pfx_try_charge_memcg+0x10/0x10 [ 488.200365][T25936] ? percpu_ref_tryget+0x15/0x180 [ 488.200421][T25936] ? charge_memcg+0x23/0x2b0 [ 488.200453][T25936] charge_memcg+0x1a2/0x2b0 [ 488.200486][T25936] ? mem_cgroup_swapin_charge_folio+0x33/0x390 [ 488.200516][T25936] mem_cgroup_swapin_charge_folio+0x262/0x390 [ 488.200551][T25936] __swap_cache_prepare_and_add+0xdc/0x700 [ 488.200583][T25936] ? page_rmappable_folio+0x9a/0x170 [ 488.200626][T25936] swap_cache_alloc_folio+0xf1/0x240 [ 488.200657][T25936] swap_cluster_readahead+0x355/0x670 [ 488.200690][T25936] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 488.200731][T25936] ? get_vma_policy+0x27b/0x3c0 [ 488.200767][T25936] swapin_readahead+0x196/0xc50 [ 488.200797][T25936] ? swap_table_get+0x1e/0x260 [ 488.200847][T25936] ? __pfx_swapin_readahead+0x10/0x10 [ 488.200895][T25936] ? swap_table_get+0x1e/0x260 [ 488.200919][T25936] ? swap_table_get+0x1e/0x260 [ 488.200940][T25936] ? swap_table_get+0x1e/0x260 [ 488.200966][T25936] ? swap_table_get+0x216/0x260 [ 488.200993][T25936] ? swap_cache_get_folio+0x2e4/0x2f0 [ 488.201026][T25936] do_swap_page+0x555/0x5120 [ 488.201058][T25936] ? __pte_offset_map+0x29/0x240 [ 488.201087][T25936] ? __pte_offset_map+0x29/0x240 [ 488.201124][T25936] ? do_swap_page+0x128/0x5120 [ 488.201149][T25936] ? __pfx_do_swap_page+0x10/0x10 [ 488.201172][T25936] ? __pte_offset_map+0x1ae/0x240 [ 488.201202][T25936] ? pte_offset_map_rw_nolock+0xea/0x160 [ 488.201234][T25936] handle_mm_fault+0x12d2/0x3170 [ 488.201279][T25936] ? handle_mm_fault+0xee/0x3170 [ 488.201313][T25936] ? __pfx_handle_mm_fault+0x10/0x10 [ 488.201338][T25936] ? lock_vma_under_rcu+0x45a/0x500 [ 488.201404][T25936] do_user_addr_fault+0xa73/0x1340 [ 488.201437][T25936] ? rcu_is_watching+0x15/0xb0 [ 488.201463][T25936] ? trace_page_fault_user+0x84/0x1e0 [ 488.201490][T25936] exc_page_fault+0x6a/0xc0 [ 488.201522][T25936] asm_exc_page_fault+0x26/0x30 [ 488.201543][T25936] RIP: 0033:0x7f4ad1254189 [ 488.201564][T25936] Code: 90 80 3d 42 3c 3c 00 00 48 8b 47 18 48 8b 4f 28 74 1f 48 8b 30 89 f2 83 c6 02 48 8d 04 f0 89 57 04 48 39 c1 0f 92 c0 88 47 48 66 0f 1f 44 00 00 8b 10 8d 72 02 89 57 04 48 8d 04 b0 48 39 c1 [ 488.201582][T25936] RSP: 002b:00007ffc2546e078 EFLAGS: 00010206 [ 488.201602][T25936] RAX: 00007f4acfdf9000 RBX: 00007f4ad1615f40 RCX: 00007f4ad05f9000 [ 488.201618][T25936] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00007f4ad1615f40 [ 488.201632][T25936] RBP: 00007f4ad1617da0 R08: 0000000000000006 R09: 0000000000000000 [ 488.201646][T25936] R10: 00007f4ad1617cb0 R11: 0000000000000246 R12: 0000000000076a82 [ 488.201660][T25936] R13: 00007f4ad161609c R14: 00000000000767b5 R15: 00007ffc2546e190 [ 488.201696][T25936] [ 488.538948][T25936] memory: usage 307200kB, limit 307200kB, failcnt 624 [ 488.599938][T25936] memory+swap: usage 307356kB, limit 9007199254740988kB, failcnt 0 [ 488.772188][T26076] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9592'. [ 488.949508][T25936] kmem: usage 258708kB, limit 9007199254740988kB, failcnt 0 [ 489.029484][T25936] Memory cgroup stats for /syz4: [ 489.029739][T25936] cache 0 [ 489.082327][T25936] rss 0 [ 489.100447][T25936] rss_huge 0 [ 489.121047][T25936] shmem 0 [ 489.147993][T25936] mapped_file 0 [ 489.170635][T25936] dirty 0 [ 489.184208][T25936] writeback 0 [ 489.187577][T25936] workingset_refault_anon 24 [ 489.192191][T25936] workingset_refault_file 2 [ 489.196819][T25936] swap 159744 [ 489.200740][T25936] swapcached 299008 [ 489.222515][T25936] pgpgin 84511 [ 489.248074][T25936] pgpgout 84501 [ 489.254943][T25936] pgfault 222391 [ 489.267880][T25936] pgmajfault 17 [ 489.291576][T25936] inactive_anon 0 [ 489.325194][T25936] active_anon 40960 [ 489.343695][T25936] inactive_file 0 [ 489.365013][T25936] active_file 0 [ 489.370561][T25936] unevictable 0 [ 489.381518][T25936] hierarchical_memory_limit 314572800 [ 489.407163][T25936] hierarchical_memsw_limit 9223372036854771712 [ 489.425831][T25936] total_cache 0 [ 489.439260][T25936] total_rss 0 [ 489.446545][T25936] total_rss_huge 0 [ 489.467780][T25936] total_shmem 0 [ 489.480823][T25936] total_mapped_file 0 [ 489.502773][T25936] total_dirty 0 [ 489.517731][T26094] netlink: 71 bytes leftover after parsing attributes in process `syz.2.9600'. [ 489.525630][T25936] total_writeback 0 [ 489.541172][T25936] total_workingset_refault_anon 24 [ 489.553463][T25936] total_workingset_refault_file 2 [ 489.583252][T25936] total_swap 159744 [ 489.597645][T25936] total_swapcached 299008 [ 489.620898][T25936] total_pgpgin 84511 [ 489.639054][T25936] total_pgpgout 84501 [ 489.657048][T25936] total_pgfault 222391 [ 489.664432][T25936] total_pgmajfault 17 [ 489.676567][T25936] total_inactive_anon 0 [ 489.692623][T25936] total_active_anon 40960 [ 489.716496][T25936] total_inactive_file 0 [ 489.741416][T25936] total_active_file 0 [ 489.753770][T25936] total_unevictable 0 [ 489.771410][T25936] anon_cost 0 [ 489.782385][T25936] file_cost 0 [ 489.803558][T25936] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.9528,pid=25936,uid=0 [ 489.871201][T25936] Memory cgroup out of memory: Killed process 25936 (syz.4.9528) total-vm:102292kB, anon-rss:1240kB, file-rss:22348kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 490.144716][T26117] veth1_macvtap: left promiscuous mode [ 490.326409][T26121] netlink: 64 bytes leftover after parsing attributes in process `syz.1.9613'. [ 490.382036][T26127] netlink: 'syz.0.9616': attribute type 3 has an invalid length. [ 490.405699][T26127] netlink: 'syz.0.9616': attribute type 3 has an invalid length. [ 490.426336][T26127] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9616'. [ 490.947827][T26151] ip6gre1: entered allmulticast mode [ 490.963247][T26153] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.9628'. [ 491.020161][T26151] team0: Port device ip6gre1 added [ 491.028389][T26153] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.9628'. [ 491.276049][T26168] netlink: 52 bytes leftover after parsing attributes in process `syz.3.9635'. [ 491.456543][T26174] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9638'. [ 493.555137][T26259] netlink: zone id is out of range [ 493.608769][T26256] netlink: set zone limit has 4 unknown bytes [ 493.613542][T26259] netlink: zone id is out of range [ 494.258249][T26292] xt_hashlimit: size too large, truncated to 1048576 [ 494.332472][T26300] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9698'. [ 495.039561][T26337] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9716'. [ 495.192013][T26346] gtp1: entered promiscuous mode [ 495.207157][T26346] gtp1: entered allmulticast mode [ 495.387581][T26358] netlink: 'syz.2.9726': attribute type 1 has an invalid length. [ 495.398966][T26358] netlink: 'syz.2.9726': attribute type 2 has an invalid length. [ 495.407499][T26358] netlink: 'syz.2.9726': attribute type 1 has an invalid length. [ 495.415692][T26358] netlink: 'syz.2.9726': attribute type 3 has an invalid length. [ 495.425580][T26358] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9726'. [ 496.446035][T26420] netlink: 'syz.1.9756': attribute type 5 has an invalid length. [ 497.267257][T26442] nbd2: detected capacity change from 0 to 63 [ 497.304237][ T5634] block nbd2: Receive control failed (result -32) [ 497.304256][ T5632] block nbd2: Receive control failed (result -32) [ 497.333309][ T5642] block nbd2: Dead connection, failed to find a fallback [ 497.400340][ T5642] block nbd2: shutting down sockets [ 497.415814][ T5642] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.463061][ T5642] Buffer I/O error on dev nbd2, logical block 0, async page read [ 497.501473][ T5642] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.533618][ T5642] Buffer I/O error on dev nbd2, logical block 1, async page read [ 497.552101][ T5642] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.573082][ T5642] Buffer I/O error on dev nbd2, logical block 2, async page read [ 497.595025][ T5642] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.628270][ T5642] Buffer I/O error on dev nbd2, logical block 3, async page read [ 497.647005][T26482] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9779'. [ 497.658129][ T5642] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.690207][ T5642] Buffer I/O error on dev nbd2, logical block 0, async page read [ 497.720254][ T5642] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.751323][ T5642] Buffer I/O error on dev nbd2, logical block 1, async page read [ 497.779292][ T5642] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.810816][ T5642] Buffer I/O error on dev nbd2, logical block 2, async page read [ 497.830216][ T5642] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.860406][ T5642] Buffer I/O error on dev nbd2, logical block 3, async page read [ 497.887550][ T5642] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.916512][ T5642] Buffer I/O error on dev nbd2, logical block 0, async page read [ 497.948643][ T5642] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 497.990541][ T5642] Buffer I/O error on dev nbd2, logical block 1, async page read [ 498.027998][ T5642] ldm_validate_partition_table(): Disk read failed. [ 498.047813][T26498] netlink: 'syz.2.9789': attribute type 12 has an invalid length. [ 498.061777][ T5642] Dev nbd2: unable to read RDB block 0 [ 498.073552][T26498] netlink: 190972 bytes leftover after parsing attributes in process `syz.2.9789'. [ 498.089853][ T5642] nbd2: unable to read partition table [ 498.117319][ T5642] ldm_validate_partition_table(): Disk read failed. [ 498.127144][ T5642] Dev nbd2: unable to read RDB block 0 [ 498.139405][ T5642] nbd2: unable to read partition table [ 498.281341][T26508] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9793'. [ 499.079235][T26558] IPv6: Can't replace route, no match found [ 499.088645][T26558] IPv6: Can't replace route, no match found [ 499.127333][T26559] bond5: entered promiscuous mode [ 499.279162][T26570] netlink: 56 bytes leftover after parsing attributes in process `syz.2.9817'. [ 499.302545][T26569] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 499.309948][T26569] IPv6: NLM_F_CREATE should be set when creating new route [ 499.317275][T26569] IPv6: NLM_F_CREATE should be set when creating new route [ 499.394217][T26569] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 499.463594][T26575] netlink: 'syz.4.9822': attribute type 10 has an invalid length. [ 499.782515][T26595] netlink: 284 bytes leftover after parsing attributes in process `syz.4.9831'. [ 499.829985][T26598] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9832'. [ 500.560522][T26648] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9855'. [ 500.579969][T26648] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9855'. [ 500.614872][T26650] netlink: 64 bytes leftover after parsing attributes in process `syz.2.9856'. [ 500.711411][T26656] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9859'. [ 501.296112][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.319672][T26689] netlink: 'syz.4.9874': attribute type 1 has an invalid length. [ 501.348499][T26689] netlink: 96 bytes leftover after parsing attributes in process `syz.4.9874'. [ 501.379870][T26689] netlink: 'syz.4.9874': attribute type 1 has an invalid length. [ 501.390724][T26689] netlink: 'syz.4.9874': attribute type 8 has an invalid length. [ 501.398983][T26689] netlink: 582 bytes leftover after parsing attributes in process `syz.4.9874'. [ 501.426902][T26693] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9876'. [ 501.444607][T26693] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9876'. [ 501.684967][T26702] netem: unknown loss type 8 [ 501.691618][T26702] netem: change failed [ 502.582662][T26739] netlink: 'syz.0.9897': attribute type 3 has an invalid length. [ 502.618082][T26741] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 503.343612][T26779] netlink: 'syz.0.9916': attribute type 83 has an invalid length. [ 503.610297][T26799] netlink: 'syz.1.9924': attribute type 1 has an invalid length. [ 505.450794][T26909] __nla_validate_parse: 4 callbacks suppressed [ 505.450817][T26909] netlink: 212356 bytes leftover after parsing attributes in process `syz.4.9974'. [ 505.512448][T26912] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9973'. [ 505.561604][T26912] ip6erspan1: entered allmulticast mode [ 505.885316][T26936] netlink: 104 bytes leftover after parsing attributes in process `syz.2.9986'. [ 506.446005][T26969] netlink: 36 bytes leftover after parsing attributes in process `syz.0.10001'. [ 506.481028][T26971] netlink: 'syz.1.10002': attribute type 39 has an invalid length. [ 506.829340][T26992] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10010'. [ 507.620331][T27038] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10035'. [ 508.226633][T27075] netlink: 208240 bytes leftover after parsing attributes in process `syz.1.10051'. [ 508.568463][T27095] netlink: 'syz.0.10061': attribute type 17 has an invalid length. [ 508.587277][T27095] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10061'. [ 508.608339][T27095] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10061'. [ 508.654334][T27095] gretap0: entered promiscuous mode [ 508.680016][T27095] gretap0: left promiscuous mode [ 509.593183][T27153] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10088'. [ 509.617596][T27153] netlink: 'syz.3.10088': attribute type 7 has an invalid length. [ 509.634799][T27153] netlink: 'syz.3.10088': attribute type 8 has an invalid length. [ 509.650481][T27153] gretap0: entered promiscuous mode [ 509.657861][T27153] gretap0: left promiscuous mode [ 510.934429][T27221] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 511.118850][T27230] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 511.295776][T27238] __nla_validate_parse: 1 callbacks suppressed [ 511.295795][T27238] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10127'. [ 511.318942][T27238] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10127'. [ 511.768351][T27268] netlink: 'syz.1.10142': attribute type 2 has an invalid length. [ 511.778670][T27268] netlink: 'syz.1.10142': attribute type 2 has an invalid length. [ 512.003200][T27279] syzkaller1: entered promiscuous mode [ 512.013049][T27279] syzkaller1: entered allmulticast mode [ 512.034858][T27279] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 512.126888][T27283] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 512.721560][ T808] hsr0: entered promiscuous mode [ 512.729481][T27313] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10161'. [ 512.746763][T27314] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10162'. [ 513.279241][T27345] netlink: 7 bytes leftover after parsing attributes in process `syz.3.10177'. [ 513.361196][T27349] sctp: [Deprecated]: syz.0.10179 (pid 27349) Use of struct sctp_assoc_value in delayed_ack socket option. [ 513.361196][T27349] Use struct sctp_sack_info instead [ 514.118042][T27391] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.10198'. [ 515.397650][ T809] IPVS: starting estimator thread 0... [ 515.494180][T27476] IPVS: using max 25 ests per chain, 60000 per kthread [ 515.817100][T27497] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.10231'. [ 515.967776][T27505] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.10234'. [ 516.086269][T27512] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.10240'. [ 516.169190][T27518] syzkaller1: entered promiscuous mode [ 516.177354][T27518] syzkaller1: entered allmulticast mode [ 516.303768][T27525] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10245'. [ 516.641153][T27540] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 517.294885][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.305910][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.349627][ T151] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.352900][T27576] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10268'. [ 517.361940][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.470190][T27581] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10270'. [ 518.156218][T27610] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10285'. [ 518.171449][T27610] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10285'. [ 518.187489][T27610] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10285'. [ 518.218331][T27610] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10285'. [ 518.821151][T27643] veth0: entered promiscuous mode [ 518.848055][T27642] veth0: left promiscuous mode [ 519.063035][T27659] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.10308'. [ 519.254117][T27670] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10312'. [ 520.456685][T27735] netlink: 64 bytes leftover after parsing attributes in process `syz.0.10343'. [ 523.765683][T27902] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 523.780427][T27902] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 523.789586][T27902] gretap1: entered promiscuous mode [ 523.798012][T27902] gretap1: entered allmulticast mode [ 523.955282][T27912] syzkaller1: entered promiscuous mode [ 523.970976][T27912] syzkaller1: entered allmulticast mode [ 524.382376][T27935] __nla_validate_parse: 1 callbacks suppressed [ 524.382398][T27935] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.10436'. [ 524.438989][T27935] netlink: ct family unspecified [ 524.474014][T27941] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10438'. [ 524.619931][T27945] pimreg: left allmulticast mode [ 524.859473][T27957] syzkaller1: entered promiscuous mode [ 524.881209][T27957] syzkaller1: entered allmulticast mode [ 524.978517][T27967] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10450'. [ 525.478112][T27989] syzkaller1: entered promiscuous mode [ 525.495055][T27989] syzkaller1: entered allmulticast mode [ 525.506397][T27995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10462'. [ 525.518738][T27995] netlink: 65011 bytes leftover after parsing attributes in process `syz.2.10462'. [ 525.614503][T28001] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10465'. [ 525.829335][T28005] tipc: Resetting bearer [ 526.057039][T28021] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10473'. [ 526.078888][T28021] bond0: ARP target 8.4.0.0 is already present [ 526.098712][T28021] bond0: option arp_ip_target: invalid value (1032) [ 527.534530][T19625] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 527.542914][T19625] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 528.132756][T28113] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 528.791584][T28149] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10531'. [ 529.065628][T28160] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 529.565979][T28183] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10546'. [ 529.739472][T28191] netlink: 256 bytes leftover after parsing attributes in process `syz.3.10552'. [ 529.760044][T28191] netlink: 256 bytes leftover after parsing attributes in process `syz.3.10552'. [ 530.296452][T28222] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 530.530758][T28239] syzkaller1: entered promiscuous mode [ 530.536649][T28239] syzkaller1: entered allmulticast mode [ 530.703008][T28247] vcan0: tx drop: invalid da for name 0x0000000000000001 [ 531.073950][T28274] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10590'. [ 531.104869][T28274] netlink: 'syz.1.10590': attribute type 7 has an invalid length. [ 531.120033][T28274] netlink: 'syz.1.10590': attribute type 8 has an invalid length. [ 531.134520][T28274] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10590'. [ 531.144894][T28277] sctp: [Deprecated]: syz.2.10591 (pid 28277) Use of struct sctp_assoc_value in delayed_ack socket option. [ 531.144894][T28277] Use struct sctp_sack_info instead [ 531.246218][T28281] tipc: Enabled bearer , priority 10 [ 531.554641][T28299] netlink: 'syz.2.10601': attribute type 11 has an invalid length. [ 532.085958][T28323] batadv_slave_1: entered promiscuous mode [ 532.092831][T28322] batadv_slave_1: left promiscuous mode [ 532.457446][T28333] syzkaller1: entered promiscuous mode [ 532.473891][T28333] syzkaller1: entered allmulticast mode [ 532.494368][T28334] siw: device registration error -23 [ 532.664942][T19624] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 532.671462][T19624] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 533.116445][T28372] netlink: 376 bytes leftover after parsing attributes in process `syz.2.10634'. [ 533.164151][T28361] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 533.180264][T28366] netlink: 'syz.2.10634': attribute type 29 has an invalid length. [ 533.242379][T28369] netlink: 'syz.2.10634': attribute type 29 has an invalid length. [ 533.286414][T28370] syzkaller1: entered promiscuous mode [ 533.307381][T28370] syzkaller1: entered allmulticast mode [ 533.331170][T28377] netlink: 27 bytes leftover after parsing attributes in process `syz.1.10637'. [ 533.370320][T28380] netlink: 27 bytes leftover after parsing attributes in process `syz.4.10638'. [ 533.610726][T28392] netlink: 68 bytes leftover after parsing attributes in process `syz.3.10642'. [ 533.769960][T28403] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10647'. [ 534.260599][T28431] syzkaller1: entered promiscuous mode [ 534.271383][T28431] syzkaller1: entered allmulticast mode [ 534.544555][T28443] veth1_macvtap: entered allmulticast mode [ 534.619855][T28446] .`: (slave macsec0): Releasing backup interface [ 534.636355][T28454] __nla_validate_parse: 1 callbacks suppressed [ 534.636372][T28454] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10668'. [ 534.747057][T28446] veth1_macvtap (unregistering): left allmulticast mode [ 534.934872][T28454] veth0_macvtap: left promiscuous mode [ 535.214309][ T3392] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.224184][ T3392] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.282310][T28484] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10680'. [ 535.306148][T28484] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10680'. [ 535.678065][T28505] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10687'. [ 535.714823][T28505] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10687'. [ 535.738187][T28505] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10687'. [ 535.786147][T28505] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10687'. [ 536.005471][T28524] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.10694'. [ 536.362311][T28540] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10702'. [ 536.381716][T28540] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10702'. [ 537.191367][T28588] erspan0: entered promiscuous mode [ 537.775825][ T3392] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 537.782338][ T3392] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 537.914652][T28625] syzkaller1: entered promiscuous mode [ 537.931173][T28625] syzkaller1: entered allmulticast mode [ 539.507249][T28726] netlink: 'syz.4.10766': attribute type 11 has an invalid length. [ 539.674091][T28713] tipc: Resetting bearer [ 539.728795][T28713] tipc: Disabling bearer [ 539.896405][T28735] netlink: 'syz.1.10767': attribute type 1 has an invalid length. [ 539.920918][T28735] __nla_validate_parse: 8 callbacks suppressed [ 539.920939][T28735] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10767'. [ 540.140813][T28746] macvlan0: entered promiscuous mode [ 540.157623][T28746] macvlan0: entered allmulticast mode [ 540.167205][T28746] team0: Device macvlan0 is already an upper device of the team interface [ 540.211983][T28745] syzkaller1: entered promiscuous mode [ 540.238936][T28745] syzkaller1: entered allmulticast mode [ 540.494515][T28766] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10776'. [ 540.523532][T28766] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10776'. [ 541.488703][T28814] netlink: 'syz.3.10789': attribute type 9 has an invalid length. [ 541.527923][T28814] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.10789'. [ 541.839453][T28835] netlink: 212336 bytes leftover after parsing attributes in process `syz.1.10796'. [ 542.044946][T28847] geneve3: entered promiscuous mode [ 542.059978][T19628] netdevsim netdevsim1 netdevsim0: set [1, 2] type 2 family 0 port 34058 - 0 [ 542.084052][T19628] netdevsim netdevsim1 netdevsim1: set [1, 2] type 2 family 0 port 34058 - 0 [ 542.100055][T19628] netdevsim netdevsim1 netdevsim2: set [1, 2] type 2 family 0 port 34058 - 0 [ 542.132039][T19628] netdevsim netdevsim1 netdevsim3: set [1, 2] type 2 family 0 port 34058 - 0 [ 542.592237][T28876] netlink: 60 bytes leftover after parsing attributes in process `syz.4.10814'. [ 542.619269][T28876] netlink: 60 bytes leftover after parsing attributes in process `syz.4.10814'. [ 542.660153][T28876] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10814'. [ 542.998684][T28902] netlink: 256 bytes leftover after parsing attributes in process `syz.3.10821'. [ 543.259290][T28916] veth0: entered promiscuous mode [ 543.284883][T28915] veth0: left promiscuous mode [ 543.537226][T19625] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 543.543763][T19625] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 543.658459][T28935] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.10831'. [ 544.133968][T28968] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 544.172584][T28966] syzkaller1: entered promiscuous mode [ 544.205254][T28966] syzkaller1: entered allmulticast mode [ 544.495642][T28990] No such timeout policy "syz1" [ 545.876851][T29057] __nla_validate_parse: 3 callbacks suppressed [ 545.876874][T29057] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10887'. [ 545.892842][T29057] netlink: 'syz.3.10887': attribute type 1 has an invalid length. [ 545.901057][T29057] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10887'. [ 545.910873][T29057] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10887'. [ 545.920527][T29057] netlink: 'syz.3.10887': attribute type 1 has an invalid length. [ 545.930073][T29057] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10887'. [ 546.278067][T29075] veth0: entered promiscuous mode [ 546.300302][T29074] veth0: left promiscuous mode [ 546.307934][T29077] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10897'. [ 546.327808][T29077] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10897'. [ 546.767599][T29102] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 546.946823][T29114] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.10914'. [ 547.148072][T29124] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10919'. [ 547.162989][T29122] bridge6: entered promiscuous mode [ 547.169080][T29122] bridge6: entered allmulticast mode [ 547.178516][T29122] team0: Port device bridge6 added [ 547.215548][T29122] bridge0: port 3(team0) entered blocking state [ 547.222895][T29122] bridge0: port 3(team0) entered disabled state [ 547.231474][T29122] team0: entered allmulticast mode [ 547.236938][T29122] team_slave_0: entered allmulticast mode [ 547.242819][T29122] team_slave_1: entered allmulticast mode [ 547.259484][T29122] team0: entered promiscuous mode [ 547.265969][T29122] team_slave_0: entered promiscuous mode [ 547.279260][T29122] team_slave_1: entered promiscuous mode [ 547.302987][T29122] bridge0: port 3(team0) entered blocking state [ 547.310398][T29122] bridge0: port 3(team0) entered forwarding state [ 547.372682][T29133] netlink: 'syz.0.10924': attribute type 1 has an invalid length. [ 547.473823][T29133] 8021q: adding VLAN 0 to HW filter on device bond2 [ 547.512077][T29137] bond2: (slave geneve3): making interface the new active one [ 547.524728][T29137] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 547.536498][T29139] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10925'. [ 547.576343][T29141] netlink: 'syz.2.10926': attribute type 15 has an invalid length. [ 548.230950][T29181] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10939'. [ 548.770948][T29207] netlink: 'syz.1.10947': attribute type 1 has an invalid length. [ 548.908318][T29210] netlink: 'syz.2.10948': attribute type 15 has an invalid length. [ 548.932919][T29211] bond6: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 548.943583][T29211] bond6: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 548.959339][T29211] bond6: (slave ip6gre1): making interface the new active one [ 548.969625][T29211] bond6: (slave ip6gre1): Enslaving as an active interface with an up link [ 548.989670][T29217] netlink: 'syz.3.10950': attribute type 1 has an invalid length. [ 549.011885][ T3392] netdevsim netdevsim2 netdevsim0: set [0, 1] type 1 family 0 port 2816 - 0 [ 549.012307][T29210] netlink: 'syz.2.10948': attribute type 15 has an invalid length. [ 549.030149][ T3392] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 549.045764][ T3392] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 549.147658][T29217] 8021q: adding VLAN 0 to HW filter on device bond4 [ 549.172557][ T3392] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 2816 - 0 [ 549.332170][T29232] xt_hashlimit: size too large, truncated to 1048576 [ 549.785225][T29253] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 549.808921][T29253] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 549.922659][T29261] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.379097][T29290] netlink: 'syz.4.10981': attribute type 12 has an invalid length. [ 550.456967][T29290] netlink: 'syz.4.10981': attribute type 12 has an invalid length. [ 550.475467][T19628] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.492742][T19628] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.512889][T19628] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.625554][T19628] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 550.752938][T29303] trusted_key: syz.3.10988 sent an empty control message without MSG_MORE. [ 551.016120][T29320] bridge0: port 1(bridge_slave_0) entered listening state [ 551.161015][T29329] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 551.201703][T29330] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 551.267884][T29334] netlink: 'syz.0.11003': attribute type 1 has an invalid length. [ 551.277073][T29334] __nla_validate_parse: 6 callbacks suppressed [ 551.277091][T29334] netlink: 96 bytes leftover after parsing attributes in process `syz.0.11003'. [ 551.293340][T29334] netlink: 1 bytes leftover after parsing attributes in process `syz.0.11003'. [ 551.342092][T29336] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11004'. [ 551.393067][T29338] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11005'. [ 551.405220][T29338] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11005'. [ 551.416137][T29338] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11005'. [ 551.425583][T29338] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11005'. [ 551.573689][T29344] netlink: 51 bytes leftover after parsing attributes in process `syz.0.11008'. [ 551.740418][T29352] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.11011'. [ 551.856025][T29359] netlink: 'syz.2.11013': attribute type 8 has an invalid length. [ 551.905437][T29359] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11013'. [ 552.144771][T29375] netlink: 'syz.4.11021': attribute type 1 has an invalid length. [ 552.254814][T29375] 8021q: adding VLAN 0 to HW filter on device bond3 [ 552.502066][ T151] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 552.508588][ T151] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 553.366177][T29442] netlink: 'syz.1.11049': attribute type 4 has an invalid length. [ 553.398100][T29442] netlink: 'syz.1.11049': attribute type 4 has an invalid length. [ 553.527572][T29450] netlink: Conntrack attr has 3 unknown bytes [ 553.613160][T29456] atomic_op ffff8880777aa198 conn xmit_atomic 0000000000000000 [ 553.758542][T29462] syzkaller1: entered promiscuous mode [ 553.773226][T29462] syzkaller1: entered allmulticast mode [ 553.821924][T29464] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 553.836814][T29464] syzkaller1: Refused to change device type [ 555.025742][T29536] syzkaller1: entered promiscuous mode [ 555.045824][T29536] syzkaller1: entered allmulticast mode [ 555.531915][T29567] netlink: 'syz.0.11106': attribute type 11 has an invalid length. [ 555.745701][T29582] netlink: 'syz.3.11113': attribute type 4 has an invalid length. [ 555.756526][T29582] netlink: 'syz.3.11113': attribute type 4 has an invalid length. [ 555.885792][T29591] netlink: 'syz.0.11117': attribute type 1 has an invalid length. [ 555.961543][T29591] 8021q: adding VLAN 0 to HW filter on device bond3 [ 555.988093][T29596] bond3: (slave geneve4): making interface the new active one [ 555.999655][T29596] bond3: (slave geneve4): Enslaving as an active interface with an up link [ 556.008992][ T151] netdevsim netdevsim0 eth0: set [1, 2] type 2 family 0 port 20004 - 0 [ 556.020114][ T151] netdevsim netdevsim0 eth1: set [1, 2] type 2 family 0 port 20004 - 0 [ 556.029115][ T151] netdevsim netdevsim0 eth2: set [1, 2] type 2 family 0 port 20004 - 0 [ 556.038076][ T151] netdevsim netdevsim0 eth3: set [1, 2] type 2 family 0 port 20004 - 0 [ 556.580345][T29625] netlink: 'syz.3.11131': attribute type 4 has an invalid length. [ 556.780412][T29639] __nla_validate_parse: 5 callbacks suppressed [ 556.780434][T29639] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.11138'. [ 556.830514][T29641] netlink: 208240 bytes leftover after parsing attributes in process `syz.2.11139'. [ 556.991713][T29648] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 557.002243][T29651] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11144'. [ 557.004599][ T809] syzkaller1: tun_net_xmit 90 [ 557.024014][T29648] syzkaller1: Linktype set failed because interface is up [ 557.363794][T29661] nbd3: detected capacity change from 0 to 63 [ 557.383138][T29666] block nbd3: NBD_DISCONNECT [ 557.412974][T29666] block nbd3: Disconnected due to user request. [ 557.424473][T29666] block nbd3: shutting down sockets [ 557.442202][ C0] blk_print_req_error: 138 callbacks suppressed [ 557.442221][ C0] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.457632][ C0] buffer_io_error: 138 callbacks suppressed [ 557.457650][ C0] Buffer I/O error on dev nbd3, logical block 0, async page read [ 557.482812][ C1] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.491943][ C1] Buffer I/O error on dev nbd3, logical block 1, async page read [ 557.499799][ C1] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.508896][ C1] Buffer I/O error on dev nbd3, logical block 2, async page read [ 557.516773][ C1] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.525881][ C1] Buffer I/O error on dev nbd3, logical block 3, async page read [ 557.539530][T29672] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.564708][T29672] Buffer I/O error on dev nbd3, logical block 0, async page read [ 557.587449][T29676] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11154'. [ 557.600125][T29672] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.614090][T29676] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11154'. [ 557.615451][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 557.625266][T29676] netlink: 'syz.1.11154': attribute type 15 has an invalid length. [ 557.641756][T19628] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 557.648273][T19628] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 557.673113][T29672] Buffer I/O error on dev nbd3, logical block 1, async page read [ 557.684463][T29672] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.694761][T29672] Buffer I/O error on dev nbd3, logical block 2, async page read [ 557.702764][T29672] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.714470][T29672] Buffer I/O error on dev nbd3, logical block 3, async page read [ 557.730341][T29672] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.746657][T29672] Buffer I/O error on dev nbd3, logical block 0, async page read [ 557.761653][T29672] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 557.785180][T29672] Buffer I/O error on dev nbd3, logical block 1, async page read [ 557.809753][T29672] ldm_validate_partition_table(): Disk read failed. [ 557.827370][T29672] Dev nbd3: unable to read RDB block 0 [ 557.842464][T29672] nbd3: unable to read partition table [ 557.887692][T29672] ldm_validate_partition_table(): Disk read failed. [ 557.907580][T29672] Dev nbd3: unable to read RDB block 0 [ 557.924370][T29672] nbd3: unable to read partition table [ 558.138959][T29676] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11154'. [ 558.164557][T29676] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11154'. [ 558.184700][T29676] netlink: 'syz.1.11154': attribute type 15 has an invalid length. [ 559.049657][T29722] bond7: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 559.140617][T29722] bond7: (slave lo): Enslaving as an active interface with an up link [ 559.181400][T29722] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 560.398321][T29772] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11195'. [ 560.408160][T29772] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11195'. [ 560.541439][T29778] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 560.685828][T29783] netlink: 'syz.4.11202': attribute type 7 has an invalid length. [ 560.694838][T29783] netlink: 'syz.4.11202': attribute type 7 has an invalid length. [ 560.857654][T29792] netlink: 'syz.3.11205': attribute type 21 has an invalid length. [ 560.885175][T29792] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11205'. [ 560.897382][T29792] netlink: 'syz.3.11205': attribute type 21 has an invalid length. [ 561.038605][T29805] veth1_macvtap: entered allmulticast mode [ 561.072062][T29805] veth1_macvtap (unregistering): left allmulticast mode [ 561.194860][T29810] syzkaller1: entered promiscuous mode [ 561.200774][T29810] syzkaller1: entered allmulticast mode [ 561.854404][T29844] __nla_validate_parse: 3 callbacks suppressed [ 561.854423][T29844] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11226'. [ 561.911588][T29848] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11228'. [ 562.278944][T29868] syzkaller1: entered promiscuous mode [ 562.293133][T29868] syzkaller1: entered allmulticast mode [ 562.430066][T29875] netlink: 'syz.4.11240': attribute type 4 has an invalid length. [ 562.595638][T29883] gretap0: entered promiscuous mode [ 562.602778][T29883] batman_adv: batadv0: Adding interface: gretap0 [ 562.618271][T29883] batman_adv: batadv0: The MTU of interface gretap0 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 562.661637][T29883] batman_adv: batadv0: Not using interface gretap0 (retrying later): interface not active [ 562.674392][T29887] veth0: entered promiscuous mode [ 562.680318][T29887] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11245'. [ 562.740251][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.971480][T29899] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11249'. [ 562.993840][T29899] netlink: 'syz.1.11249': attribute type 7 has an invalid length. [ 563.022057][T29899] netlink: 'syz.1.11249': attribute type 8 has an invalid length. [ 563.043894][T29899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11249'. [ 563.376185][ T151] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 563.382727][ T151] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 565.178531][T29977] 8021q: adding VLAN 0 to HW filter on device .` [ 565.321823][T29977] 8021q: adding VLAN 0 to HW filter on device bond0 [ 565.347859][T29977] 8021q: adding VLAN 0 to HW filter on device bond3 [ 565.359096][T29977] A link change request failed with some changes committed already. Interface pimreg may have been left with an inconsistent configuration, please check. [ 565.488711][T29888] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 565.759973][T29994] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11291'. [ 565.798373][T29996] netlink: 'syz.0.11294': attribute type 29 has an invalid length. [ 565.807100][T29994] openvswitch: netlink: Unknown nsh attribute 0 [ 565.817643][T29996] netlink: 'syz.0.11294': attribute type 29 has an invalid length. [ 565.826775][T29996] netlink: 500 bytes leftover after parsing attributes in process `syz.0.11294'. [ 565.972438][T19626] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x3e [ 565.987287][T30007] bridge3: entered promiscuous mode [ 565.992713][T30007] bridge3: entered allmulticast mode [ 566.082823][T30014] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11299'. [ 566.354666][T30026] ref_ctr_offset mismatch. inode: 0x46 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x6 [ 566.378589][T30030] IPv6: sit1: Disabled Multicast RS [ 566.825492][T30053] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11316'. [ 566.835776][T30053] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11316'. [ 566.966619][T30062] netlink: 'syz.4.11317': attribute type 19 has an invalid length. [ 566.991747][T30062] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11317'. [ 567.021601][T30062] netlink: 'syz.4.11317': attribute type 19 has an invalid length. [ 567.046386][T30062] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11317'. [ 567.338728][T30083] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.11328'. [ 567.560973][T30098] netlink: 207952 bytes leftover after parsing attributes in process `syz.0.11335'. [ 567.786889][T30109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11340'. [ 567.803185][T30109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11340'. [ 567.905835][T30114] netlink: 'syz.3.11342': attribute type 7 has an invalid length. [ 567.915031][T30114] netlink: 'syz.3.11342': attribute type 7 has an invalid length. [ 567.997673][T30119] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11344'. [ 568.157403][T30123] 8021q: adding VLAN 0 to HW filter on device bond5 [ 568.278928][T30133] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11348'. [ 568.289403][T30133] netem: invalid attributes len -5 [ 568.295394][T30133] netem: change failed [ 568.651746][T30152] netlink: 32 bytes leftover after parsing attributes in process `syz.3.11357'. [ 568.766446][T30163] ip6tnl3: entered promiscuous mode [ 569.016956][T30176] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11368'. [ 569.142624][T19625] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 569.149192][T19625] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 569.579065][T30199] netlink: 'syz.0.11377': attribute type 1 has an invalid length. [ 569.613025][T30198] tls_set_device_offload: netdev not found [ 569.750483][T30206] netlink: 'syz.2.11381': attribute type 6 has an invalid length. [ 569.786769][T30206] netlink: 'syz.2.11381': attribute type 6 has an invalid length. [ 569.935108][T30219] netlink: 'syz.2.11385': attribute type 2 has an invalid length. [ 570.059533][T30227] netlink: 'syz.3.11389': attribute type 13 has an invalid length. [ 570.081966][T30227] netlink: 'syz.3.11389': attribute type 13 has an invalid length. [ 570.330707][T30241] lo: left allmulticast mode [ 570.719868][T30257] IPVS: Scheduler module ip_vs_sip not found [ 570.788667][T30267] xt_hashlimit: size too large, truncated to 1048576 [ 570.868768][T30274] bridge_slave_0: invalid flags given to default FDB implementation [ 572.031284][T30339] __nla_validate_parse: 13 callbacks suppressed [ 572.031299][T30339] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11426'. [ 572.306261][ T1022] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x1 [ 572.648510][T30370] vlan2: entered allmulticast mode [ 572.662771][T30370] bond0: entered allmulticast mode [ 572.668181][T30370] bond_slave_0: entered allmulticast mode [ 572.693529][T30370] netlink: 14 bytes leftover after parsing attributes in process `syz.0.11436'. [ 572.772980][T30370] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 572.789805][T30370] bond_slave_0: left allmulticast mode [ 572.823653][T30370] bond0 (unregistering): Released all slaves [ 572.978102][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 573.020261][T30385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11442'. [ 573.061741][T30392] netlink: 'syz.0.11445': attribute type 14 has an invalid length. [ 573.079220][T30392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11445'. [ 573.124217][T30392] netlink: 'syz.0.11445': attribute type 14 has an invalid length. [ 573.143137][T30392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11445'. [ 573.332410][T30404] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11450'. [ 573.491181][T30410] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11454'. [ 574.073472][T30426] pim6reg1: entered promiscuous mode [ 574.101769][T30426] pim6reg1: entered allmulticast mode [ 574.210223][T30435] netlink: 'syz.2.11463': attribute type 22 has an invalid length. [ 574.227836][T30435] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11463'. [ 574.240369][T30435] netlink: 'syz.2.11463': attribute type 22 has an invalid length. [ 574.248962][T30435] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11463'. [ 574.258980][ T1022] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 574.265474][ T1022] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 574.382887][T30441] syzkaller1: entered promiscuous mode [ 574.389731][T30441] syzkaller1: entered allmulticast mode [ 574.775349][T30464] netlink: 68 bytes leftover after parsing attributes in process `syz.3.11475'. [ 575.022232][T30474] netlink: 'syz.2.11480': attribute type 16 has an invalid length. [ 575.257469][T30443] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 575.275367][T30443] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 576.809155][ T3392] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 576.837899][ T3392] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 576.867052][ T3392] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 576.895021][ T1022] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.078152][T30557] netlink: 'syz.3.11512': attribute type 22 has an invalid length. [ 577.111739][T30557] __nla_validate_parse: 7 callbacks suppressed [ 577.111760][T30557] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11512'. [ 577.210414][ T1022] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.220827][T30557] netlink: 'syz.3.11512': attribute type 22 has an invalid length. [ 577.237865][ T1022] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.249666][T30557] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11512'. [ 577.259244][ T1022] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.268823][ T1022] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 577.305880][T30566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11517'. [ 577.347231][T30566] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11517'. [ 577.366842][T30566] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11517'. [ 577.526740][T30566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11517'. [ 577.560607][T30566] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11517'. [ 577.596348][T30566] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11517'. [ 577.738816][T30579] netlink: 'syz.4.11523': attribute type 1 has an invalid length. [ 577.805422][T30579] 8021q: adding VLAN 0 to HW filter on device bond4 [ 577.829485][T30579] bond4: (slave gretap3): making interface the new active one [ 577.839625][T30579] bond4: (slave gretap3): Enslaving as an active interface with an up link [ 578.328946][T30604] xt_hashlimit: size too large, truncated to 1048576 [ 578.457219][T30611] netlink: 'syz.4.11537': attribute type 1 has an invalid length. [ 579.175661][T30617] netlink: 'syz.4.11539': attribute type 62 has an invalid length. [ 579.376233][ T48] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 579.382747][ T48] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 579.699746][T30639] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11546'. [ 579.837698][T30648] netlink: 'syz.0.11551': attribute type 1 has an invalid length. [ 579.905580][T30648] bond0: (slave gretap1): making interface the new active one [ 579.916183][T30648] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 579.982700][T30653] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11552'. [ 580.028346][T30653] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 580.540138][ T1022] nci: nci_ntf_packet: unknown ntf opcode 0x101 [ 580.712121][T30695] sock: sock_set_timeout: `syz.3.11569' (pid 30695) tries to set negative timeout [ 581.178668][T30725] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 581.322628][T30732] sctp: [Deprecated]: syz.2.11586 (pid 30732) Use of int in maxseg socket option. [ 581.322628][T30732] Use struct sctp_assoc_value instead [ 581.952758][T30749] syzkaller1: entered promiscuous mode [ 582.002576][T30749] syzkaller1: entered allmulticast mode [ 582.797381][T30782] netdevsim netdevsim1: Direct firmware load for r1 failed with error -2 [ 582.817901][T30782] netdevsim netdevsim1: Falling back to sysfs fallback for: r1 [ 582.891274][T30785] xt_hashlimit: size too large, truncated to 1048576 [ 583.089682][T30786] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 583.319373][T30803] netlink: 'syz.0.11612': attribute type 1 has an invalid length. [ 583.422211][T30803] bond4: (slave geneve5): making interface the new active one [ 583.441030][T30803] bond4: (slave geneve5): Enslaving as an active interface with an up link [ 583.458794][T19628] netdevsim netdevsim0 eth0: set [1, 3] type 2 family 0 port 20000 - 0 [ 583.477985][T19628] netdevsim netdevsim0 eth1: set [1, 3] type 2 family 0 port 20000 - 0 [ 583.567682][T19628] netdevsim netdevsim0 eth2: set [1, 3] type 2 family 0 port 20000 - 0 [ 583.601012][T19628] netdevsim netdevsim0 eth3: set [1, 3] type 2 family 0 port 20000 - 0 [ 584.050995][T30833] netlink: 'syz.1.11623': attribute type 1 has an invalid length. [ 584.059660][T30833] netlink: 'syz.1.11623': attribute type 4 has an invalid length. [ 584.068119][T30833] __nla_validate_parse: 5 callbacks suppressed [ 584.068134][T30833] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.11623'. [ 585.012901][T30872] syz_tun: entered allmulticast mode [ 585.020701][T30871] syz_tun: left allmulticast mode [ 585.135150][T19628] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 585.141671][T19628] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 585.274966][T30880] netlink: 'syz.0.11642': attribute type 1 has an invalid length. [ 585.308978][T30880] 8021q: adding VLAN 0 to HW filter on device bond5 [ 585.336531][T30880] bond5: (slave gretap2): making interface the new active one [ 585.346286][T30880] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 586.761282][T30815] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 587.058336][T30909] GUP no longer grows the stack in syz.1.11655 (30909): 200000003000-20000000a000 (200000001000) [ 587.088109][T30909] CPU: 0 UID: 0 PID: 30909 Comm: syz.1.11655 Not tainted syzkaller #0 PREEMPT(full) [ 587.088142][T30909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 587.088158][T30909] Call Trace: [ 587.088167][T30909] [ 587.088177][T30909] dump_stack_lvl+0xe8/0x150 [ 587.088211][T30909] __get_user_pages+0x2378/0x2720 [ 587.088243][T30909] ? __gup_longterm_locked+0xc4e/0x1630 [ 587.088295][T30909] ? __gup_longterm_locked+0xc4e/0x1630 [ 587.088321][T30909] ? down_read_killable+0x1bb/0x340 [ 587.088352][T30909] __gup_longterm_locked+0xdcf/0x1630 [ 587.088385][T30909] ? lock_acquire+0x106/0x350 [ 587.088431][T30909] gup_fast_fallback+0x1d84/0x20d0 [ 587.088496][T30909] ? __pfx_gup_fast_fallback+0x10/0x10 [ 587.088526][T30909] ? is_valid_gup_args+0x11f/0x200 [ 587.088555][T30909] ? get_user_pages_fast+0x4d/0xb0 [ 587.088585][T30909] __iov_iter_get_pages_alloc+0x370/0xa10 [ 587.088627][T30909] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 587.088672][T30909] iov_iter_get_pages2+0x5e/0xa0 [ 587.088709][T30909] __se_sys_vmsplice+0x7c7/0x1620 [ 587.088763][T30909] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 587.088798][T30909] ? __pfx_futex_wake+0x10/0x10 [ 587.088840][T30909] ? lockdep_hardirqs_on+0x7a/0x110 [ 587.088935][T30909] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.088960][T30909] do_syscall_64+0x15f/0xf80 [ 587.088991][T30909] ? trace_irq_disable+0x3b/0x140 [ 587.089025][T30909] ? clear_bhb_loop+0x40/0x90 [ 587.089053][T30909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.089076][T30909] RIP: 0033:0x7fd31d59cdd9 [ 587.089098][T30909] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 587.089117][T30909] RSP: 002b:00007fd31e3d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 587.089142][T30909] RAX: ffffffffffffffda RBX: 00007fd31d815fa0 RCX: 00007fd31d59cdd9 [ 587.089159][T30909] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000005 [ 587.089173][T30909] RBP: 00007fd31d632d69 R08: 0000000000000000 R09: 0000000000000000 [ 587.089188][T30909] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 587.089201][T30909] R13: 00007fd31d816038 R14: 00007fd31d815fa0 R15: 00007ffc6fec2278 [ 587.089239][T30909] [ 588.360268][T30959] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11673'. [ 589.104199][T30997] netlink: 'syz.1.11691': attribute type 1 has an invalid length. [ 589.220970][T30997] bond8: (slave gretap4): making interface the new active one [ 589.229689][T30997] bond8: (slave gretap4): Enslaving as an active interface with an up link [ 589.428922][T31009] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11697'. [ 589.694300][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 589.782040][T31023] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 589.834323][T31023] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 589.845025][T31023] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 589.872925][T31023] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 589.913645][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 589.928989][T19628] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.936275][T19628] bridge0: port 2(bridge_slave_1) entered forwarding state [ 589.961919][T26084] syz2: Port: 1 Link ACTIVE [ 590.149020][T31033] netlink: 132 bytes leftover after parsing attributes in process `syz.0.11706'. [ 590.351480][T31041] netlink: 40 bytes leftover after parsing attributes in process `syz.3.11710'. [ 590.535863][T31049] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.11713'. [ 590.655658][T31053] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11716'. [ 590.717762][T31056] only policy match revision 0 supported [ 590.717785][T31056] unable to load match [ 590.889372][T31068] netlink: 'syz.0.11722': attribute type 1 has an invalid length. [ 590.896043][T19624] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 590.903742][T19624] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 590.933584][T31068] netlink: 'syz.0.11722': attribute type 4 has an invalid length. [ 590.954337][T31068] netlink: 9422 bytes leftover after parsing attributes in process `syz.0.11722'. [ 591.672763][T31116] netlink: 'syz.1.11742': attribute type 1 has an invalid length. [ 591.793196][T31120] bond9: (slave bridge5): making interface the new active one [ 591.819861][T31120] bond9: (slave bridge5): Enslaving as an active interface with an up link [ 592.060592][T31129] netlink: 'syz.4.11748': attribute type 18 has an invalid length. [ 592.084980][T31129] netlink: 'syz.4.11748': attribute type 18 has an invalid length. [ 593.947453][T31210] syzkaller1: entered promiscuous mode [ 593.953157][T31210] syzkaller1: entered allmulticast mode [ 594.262707][T31188] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 594.397822][T31225] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11778'. [ 594.446678][T31228] tipc: Failed to remove unknown binding: 66,1,1/10005162:1547969382/1547969384 [ 594.456512][T31225] team0: entered promiscuous mode [ 594.459454][T31228] tipc: Failed to remove unknown binding: 66,1,1/10005162:1547969382/1547969384 [ 594.464912][T31225] team0: entered allmulticast mode [ 594.901729][T31249] netlink: 'syz.2.11787': attribute type 1 has an invalid length. [ 594.999740][T31249] bond3: entered promiscuous mode [ 595.005664][T31249] 8021q: adding VLAN 0 to HW filter on device bond3 [ 595.037593][T31254] 8021q: adding VLAN 0 to HW filter on device bond3 [ 595.044972][T31254] bond3: (slave vti0): The slave device specified does not support setting the MAC address [ 595.055286][T31254] bond3: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 595.071401][T31254] bond3: (slave vti0): making interface the new active one [ 595.079930][T31254] vti0: entered promiscuous mode [ 595.086607][T31254] bond3: (slave vti0): Enslaving as an active interface with an up link [ 595.271111][T31264] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11793'. [ 595.307169][T31264] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11793'. [ 595.355232][T31266] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11794'. [ 595.433239][T31270] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11796'. [ 595.456967][T31270] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11796'. [ 595.971749][T31293] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 595.991145][T31293] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 596.656307][ T1022] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 596.662845][ T1022] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 596.941376][T31325] netlink: 184 bytes leftover after parsing attributes in process `syz.1.11819'. [ 597.169331][T31337] netlink: 'syz.0.11825': attribute type 1 has an invalid length. [ 597.324940][T31337] bond6: entered promiscuous mode [ 597.330786][T31337] 8021q: adding VLAN 0 to HW filter on device bond6 [ 597.370541][T31342] 8021q: adding VLAN 0 to HW filter on device bond6 [ 597.385555][T31342] bond6: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 597.404951][T31342] bond6: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 597.418579][T31342] bond6: (slave ip6gre2): making interface the new active one [ 597.426371][T31342] ip6gre2: entered promiscuous mode [ 597.436259][T31342] bond6: (slave ip6gre2): Enslaving as an active interface with an up link [ 597.606106][T31357] netlink: 'syz.1.11832': attribute type 1 has an invalid length. [ 597.721334][T31357] 8021q: adding VLAN 0 to HW filter on device bond10 [ 597.738096][T31363] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11835'. [ 597.749775][T31353] netlink: 'syz.3.11831': attribute type 1 has an invalid length. [ 597.759357][T31363] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11835'. [ 598.350893][T31394] syzkaller1: entered promiscuous mode [ 598.368994][T31394] syzkaller1: entered allmulticast mode [ 598.971714][T31425] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11853'. [ 599.111793][T31425] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11853'. [ 599.239766][T31437] netlink: 'syz.3.11855': attribute type 7 has an invalid length. [ 599.271697][T31437] netlink: 'syz.3.11855': attribute type 8 has an invalid length. [ 599.488031][T31449] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 599.973708][T31468] netlink: 'syz.3.11868': attribute type 21 has an invalid length. [ 600.001189][T31468] netlink: 'syz.3.11868': attribute type 22 has an invalid length. [ 600.014810][T31468] netlink: 'syz.3.11868': attribute type 23 has an invalid length. [ 600.053138][T31468] netlink: 'syz.3.11868': attribute type 25 has an invalid length. [ 600.436158][T31493] __nla_validate_parse: 4 callbacks suppressed [ 600.436177][T31493] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.11879'. [ 600.550072][T31499] netlink: 'syz.1.11884': attribute type 29 has an invalid length. [ 600.560218][T31499] netlink: 'syz.1.11884': attribute type 29 has an invalid length. [ 600.570278][T31499] netlink: 'syz.1.11884': attribute type 32 has an invalid length. [ 600.672577][T31502] bond4: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 600.696660][T31502] bond4 (unregistering): Released all slaves [ 601.561466][T31554] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11906'. [ 601.640326][T31554] 8021q: adding VLAN 0 to HW filter on device bond11 [ 601.692301][T31561] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11908'. [ 601.721832][T31554] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11906'. [ 601.735480][T31557] 8021q: adding VLAN 0 to HW filter on device bond12 [ 601.745520][T31557] bond11: (slave bond12): Enslaving as an active interface with an up link [ 601.782604][T31554] bond11 (unregistering): (slave bond12): Releasing backup interface [ 601.808418][T31554] bond11 (unregistering): Released all slaves [ 601.844762][T31561] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11908'. [ 601.994580][T31567] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.11911'. [ 602.419136][T19624] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 602.425654][T19624] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 602.747531][T31607] netlink: 'syz.4.11928': attribute type 1 has an invalid length. [ 602.797027][T31607] macvlan0: entered promiscuous mode [ 602.802395][T31607] macvlan0: entered allmulticast mode [ 602.809025][T31607] bond5: entered promiscuous mode [ 602.819080][T31607] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 602.838933][T31607] bond5: left promiscuous mode [ 602.978503][T31618] "syz.4.11935" (31618) uses obsolete ecb(arc4) skcipher [ 603.259213][T31634] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11942'. [ 603.350892][T31634] hsr_slave_1 (unregistering): left promiscuous mode [ 603.729232][T31659] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11948'. [ 604.015740][T31670] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 604.060470][T31670] xt_hashlimit: size too large, truncated to 1048576 [ 604.917404][T31712] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11968'. [ 605.328076][T31727] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11974'. [ 605.956407][T31750] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11983'. [ 606.245559][T31756] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11985'. [ 607.242501][T31769] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11990'. [ 607.362862][T31684] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 607.491704][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807b135800: rx timeout, send abort [ 607.567450][T31769] vcan0 (unregistering): left allmulticast mode [ 607.574320][T31773] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11992'. [ 607.732683][T31781] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11996'. [ 607.899480][T31789] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12000'. [ 608.177920][T19624] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 608.184541][T19624] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 608.336607][T31808] netlink: 'syz.1.12006': attribute type 1 has an invalid length. [ 608.491709][T31808] 8021q: adding VLAN 0 to HW filter on device bond11 [ 608.635179][T31820] bond11: (slave veth0_to_bond): making interface the new active one [ 608.672306][T31820] bond11: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 608.730368][T31822] bond11: entered promiscuous mode [ 608.750617][T31822] veth0_to_bond: entered promiscuous mode [ 608.784464][T31822] bond11: entered allmulticast mode [ 608.826738][T31822] veth0_to_bond: entered allmulticast mode [ 609.333005][T31844] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12014'. [ 609.338648][T31816] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.0.12009:31816 [ 609.357389][T31844] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12014'. [ 609.742885][T31853] scsi_nl_rcv_msg: discarding partial skb [ 609.900645][T31868] netlink: 56 bytes leftover after parsing attributes in process `syz.1.12022'. [ 610.042671][T31872] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12024'. [ 610.470849][T31885] xt_hashlimit: size too large, truncated to 1048576 [ 612.616673][T31906] netlink: 14544 bytes leftover after parsing attributes in process `syz.0.12036'. [ 612.771129][T31917] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12038'. [ 613.090089][T31941] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12046'. [ 613.351354][T31947] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12049'. [ 613.613069][T31954] netlink: 'syz.2.12052': attribute type 1 has an invalid length. [ 613.643277][T31956] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12053'. [ 613.679121][T31954] bond4: entered promiscuous mode [ 613.684155][T31960] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12054'. [ 613.705844][T31954] 8021q: adding VLAN 0 to HW filter on device bond4 [ 613.764601][T31959] bond4: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 613.778832][T31959] bond4: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 613.791816][T31959] bond4: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 613.937629][T19625] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 613.944127][T19625] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 614.051206][T31976] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12058'. [ 614.264668][T31983] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12061'. [ 614.308698][T31983] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12061'. [ 614.833852][T32000] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12068'. [ 614.881501][T32000] bond0: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 615.358585][T32023] netlink: 'syz.0.12078': attribute type 1 has an invalid length. [ 615.442006][T32019] bridge0: entered promiscuous mode [ 615.466898][T32019] bridge0: entered allmulticast mode [ 615.876860][T31927] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 616.169753][T32043] sctp: [Deprecated]: syz.1.12085 (pid 32043) Use of int in maxseg socket option. [ 616.169753][T32043] Use struct sctp_assoc_value instead [ 616.976887][T32066] netlink: 'syz.0.12095': attribute type 1 has an invalid length. [ 617.070468][T32066] bond7: entered promiscuous mode [ 617.099782][T32066] bond7: entered allmulticast mode [ 617.148887][T32066] 8021q: adding VLAN 0 to HW filter on device bond7 [ 617.181615][T32070] macvlan2: entered promiscuous mode [ 617.213056][T32070] macvlan2: entered allmulticast mode [ 617.244741][T32070] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 617.999409][T32094] __nla_validate_parse: 3 callbacks suppressed [ 617.999427][T32094] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12105'. [ 618.600592][T32111] syzkaller1: entered promiscuous mode [ 618.613569][T32111] syzkaller1: entered allmulticast mode [ 618.671249][T32097] netlink: 'syz.0.12108': attribute type 13 has an invalid length. [ 619.091133][T32121] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 619.134225][T32121] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 619.418977][T32139] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12120'. [ 619.603024][T32146] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12123'. [ 619.695611][T19623] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 619.702109][T19623] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 619.737764][T32148] netlink: 92 bytes leftover after parsing attributes in process `syz.1.12123'. [ 621.143040][T32185] netlink: 'syz.1.12136': attribute type 1 has an invalid length. [ 621.202442][T32185] bond13: entered promiscuous mode [ 621.208080][T32189] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12136'. [ 621.208118][T32189] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12136'. [ 621.230997][T32185] 8021q: adding VLAN 0 to HW filter on device bond13 [ 621.328552][T32185] bond13: (slave bridge7): making interface the new active one [ 621.349821][T32185] bridge7: entered promiscuous mode [ 621.358144][T32185] bond13: (slave bridge7): Enslaving as an active interface with an up link [ 621.501877][T32199] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12142'. [ 621.872523][T32215] syzkaller0: entered promiscuous mode [ 621.878640][T32215] syzkaller0: entered allmulticast mode [ 621.961264][T32214] syzkaller0: entered promiscuous mode [ 621.969356][T32214] syzkaller0: entered allmulticast mode [ 622.106582][T32124] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 622.821133][T32233] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12153'. [ 624.179755][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.459191][ T1180] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 625.465696][ T1180] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 626.924155][T32235] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 627.140753][T32271] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12166'. [ 627.656663][T32297] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12176'. [ 627.940234][T32304] tipc: Enabled bearer , priority 0 [ 628.059567][T32304] syzkaller0: entered promiscuous mode [ 628.067547][T32304] syzkaller0: entered allmulticast mode [ 628.074603][T32304] tipc: Resetting bearer [ 628.109626][T32303] tipc: Resetting bearer [ 628.345161][T32317] netlink: 'syz.0.12185': attribute type 1 has an invalid length. [ 628.978937][T32326] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12188'. [ 629.045427][ T5632] block nbd3: Receive control failed (result -107) [ 630.389696][T32341] sctp: Trying to GSO but underlying device doesn't support it. [ 630.469705][T32303] tipc: Disabling bearer [ 630.491114][T32317] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 630.494812][T19623] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 630.509616][T19623] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 630.585036][T32348] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12196'. [ 630.778381][T32350] bridge_slave_0: left allmulticast mode [ 630.800800][T32350] bridge_slave_0: left promiscuous mode [ 630.827908][T32350] bridge0: port 1(bridge_slave_0) entered disabled state [ 630.868289][T32350] bridge_slave_1: left allmulticast mode [ 630.908549][T32350] bridge_slave_1: left promiscuous mode [ 630.926158][T32350] bridge0: port 2(bridge_slave_1) entered disabled state [ 630.988880][T32350] team0: Port device team_slave_0 removed [ 631.046731][T32350] team0: Port device team_slave_1 removed [ 631.054656][T32350] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 631.083060][T32350] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 631.106016][T32350] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 631.118730][T32350] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 631.130566][T32350] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 631.170356][T32356] ip6gre3: entered allmulticast mode [ 631.181095][T32356] team0: Port device ip6gre3 added [ 631.302788][T32380] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12210'. [ 631.332654][T32380] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12210'. [ 632.287609][T32418] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12221'. [ 632.315279][T32417] tipc: Enabled bearer , priority 0 [ 632.322990][T32418] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12221'. [ 632.400524][T32417] syzkaller0: entered promiscuous mode [ 632.406536][T32417] syzkaller0: entered allmulticast mode [ 632.412886][T32417] tipc: Resetting bearer [ 632.447417][T32425] bridge8: port 1(vlan4) entered blocking state [ 632.465490][T32425] bridge8: port 1(vlan4) entered disabled state [ 632.477936][T32425] vlan4: entered allmulticast mode [ 632.483216][T32425] bridge8: entered allmulticast mode [ 632.506139][T32425] vlan4: left allmulticast mode [ 632.520940][T32425] bridge8: left allmulticast mode [ 632.591553][T32415] tipc: Resetting bearer [ 632.764846][T32434] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12226'. [ 634.536507][T32415] tipc: Disabling bearer [ 634.973002][T32468] netlink: 'syz.3.12236': attribute type 1 has an invalid length. [ 635.080797][T32468] 8021q: adding VLAN 0 to HW filter on device bond7 [ 635.138491][T32470] vlan0: entered allmulticast mode [ 635.166527][T32474] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12238'. [ 635.172887][T32470] veth0_to_bond: entered allmulticast mode [ 635.176189][T32474] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12238'. [ 635.230666][T32470] bond7: (slave vlan0): Enslaving as an active interface with a down link [ 635.507682][T32486] netlink: 'syz.1.12243': attribute type 1 has an invalid length. [ 635.704177][T32494] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12247'. [ 635.775604][T32494] netlink: 40 bytes leftover after parsing attributes in process `syz.1.12247'. [ 635.951629][T32508] [ 635.954025][T32508] ====================================================== [ 635.961166][T32508] WARNING: possible circular locking dependency detected [ 635.968219][T32508] syzkaller #0 Not tainted [ 635.972647][T32508] ------------------------------------------------------ [ 635.979686][T32508] syz.1.12251/32508 is trying to acquire lock: [ 635.985852][T32508] ffffffff8ea85520 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x40/0x660 [ 635.995204][T32508] [ 635.995204][T32508] but task is already holding lock: [ 636.002593][T32508] ffff888075a10f60 (k-sk_lock-AF_INET/1){+.+.}-{0:0}, at: mptcp_subflow_create_socket+0x142/0x800 [ 636.013274][T32508] [ 636.013274][T32508] which lock already depends on the new lock. [ 636.013274][T32508] [ 636.023700][T32508] [ 636.023700][T32508] the existing dependency chain (in reverse order) is: [ 636.032818][T32508] [ 636.032818][T32508] -> #7 (k-sk_lock-AF_INET/1){+.+.}-{0:0}: [ 636.040848][T32508] lock_sock_nested+0x41/0x100 [ 636.046153][T32508] mptcp_subflow_create_socket+0x142/0x800 [ 636.052512][T32508] __mptcp_nmpc_sk+0x155/0x790 [ 636.057809][T32508] mptcp_setsockopt+0xf12/0x3520 [ 636.063292][T32508] do_sock_setsockopt+0x17c/0x1b0 [ 636.068861][T32508] __x64_sys_setsockopt+0x13d/0x1b0 [ 636.074600][T32508] do_syscall_64+0x15f/0xf80 [ 636.079729][T32508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.086154][T32508] [ 636.086154][T32508] -> #6 (sk_lock-AF_INET){+.+.}-{0:0}: [ 636.093833][T32508] lock_sock_nested+0x41/0x100 [ 636.099130][T32508] inet_shutdown+0x6a/0x390 [ 636.104169][T32508] nbd_mark_nsock_dead+0x2e9/0x560 [ 636.109821][T32508] recv_work+0x1c2e/0x1d40 [ 636.114787][T32508] process_scheduled_works+0xb5d/0x1860 [ 636.120866][T32508] worker_thread+0xa53/0xfc0 [ 636.125985][T32508] kthread+0x388/0x470 [ 636.130599][T32508] ret_from_fork+0x514/0xb70 [ 636.135725][T32508] ret_from_fork_asm+0x1a/0x30 [ 636.141036][T32508] [ 636.141036][T32508] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 636.148697][T32508] __mutex_lock+0x1a3/0x1550 [ 636.153837][T32508] nbd_queue_rq+0x37b/0x1100 [ 636.158973][T32508] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 636.165061][T32508] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 636.171934][T32508] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 636.178458][T32508] blk_mq_run_hw_queue+0x348/0x4f0 [ 636.184107][T32508] blk_mq_dispatch_list+0xd16/0xe10 [ 636.189845][T32508] blk_mq_flush_plug_list+0x48d/0x570 [ 636.195756][T32508] __blk_flush_plug+0x3ed/0x4d0 [ 636.201153][T32508] __submit_bio+0x28d/0x580 [ 636.206192][T32508] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 636.212364][T32508] block_read_full_folio+0x599/0x830 [ 636.218181][T32508] filemap_read_folio+0x137/0x3b0 [ 636.223744][T32508] do_read_cache_folio+0x358/0x590 [ 636.229408][T32508] read_part_sector+0xb6/0x2b0 [ 636.234709][T32508] adfspart_check_ICS+0xb1/0x960 [ 636.240194][T32508] bdev_disk_changed+0x817/0x1770 [ 636.245760][T32508] blkdev_get_whole+0x380/0x510 [ 636.251151][T32508] bdev_open+0x31e/0xd30 [ 636.255934][T32508] blkdev_open+0x470/0x610 [ 636.260889][T32508] do_dentry_open+0x785/0x14e0 [ 636.266186][T32508] vfs_open+0x3b/0x340 [ 636.270792][T32508] path_openat+0x2e08/0x3860 [ 636.275931][T32508] do_file_open+0x23e/0x4a0 [ 636.280973][T32508] do_sys_openat2+0x113/0x200 [ 636.286182][T32508] __x64_sys_openat+0x138/0x170 [ 636.291568][T32508] do_syscall_64+0x15f/0xf80 [ 636.296697][T32508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.303126][T32508] [ 636.303126][T32508] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 636.310364][T32508] __mutex_lock+0x1a3/0x1550 [ 636.315498][T32508] nbd_queue_rq+0xc6/0x1100 [ 636.320540][T32508] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 636.326677][T32508] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 636.333570][T32508] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 636.340117][T32508] blk_mq_run_hw_queue+0x348/0x4f0 [ 636.345782][T32508] blk_mq_dispatch_list+0xd16/0xe10 [ 636.351528][T32508] blk_mq_flush_plug_list+0x48d/0x570 [ 636.357471][T32508] __blk_flush_plug+0x3ed/0x4d0 [ 636.362873][T32508] __submit_bio+0x28d/0x580 [ 636.367907][T32508] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 636.374080][T32508] block_read_full_folio+0x599/0x830 [ 636.379900][T32508] filemap_read_folio+0x137/0x3b0 [ 636.385472][T32508] do_read_cache_folio+0x358/0x590 [ 636.391141][T32508] read_part_sector+0xb6/0x2b0 [ 636.396480][T32508] adfspart_check_ICS+0xb1/0x960 [ 636.401966][T32508] bdev_disk_changed+0x817/0x1770 [ 636.407532][T32508] blkdev_get_whole+0x380/0x510 [ 636.412933][T32508] bdev_open+0x31e/0xd30 [ 636.417715][T32508] blkdev_open+0x470/0x610 [ 636.422663][T32508] do_dentry_open+0x785/0x14e0 [ 636.427963][T32508] vfs_open+0x3b/0x340 [ 636.432563][T32508] path_openat+0x2e08/0x3860 [ 636.437700][T32508] do_file_open+0x23e/0x4a0 [ 636.442743][T32508] do_sys_openat2+0x113/0x200 [ 636.447959][T32508] __x64_sys_openat+0x138/0x170 [ 636.453348][T32508] do_syscall_64+0x15f/0xf80 [ 636.458497][T32508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.464930][T32508] [ 636.464930][T32508] -> #3 (set->srcu){.+.+}-{0:0}: [ 636.472074][T32508] __synchronize_srcu+0xca/0x300 [ 636.477547][T32508] elevator_switch+0x1e8/0x7a0 [ 636.482858][T32508] elevator_change+0x2cc/0x450 [ 636.488166][T32508] elevator_set_default+0x36c/0x430 [ 636.493907][T32508] blk_register_queue+0x3e9/0x4e0 [ 636.499467][T32508] __add_disk+0x677/0xd50 [ 636.504331][T32508] add_disk_fwnode+0xfb/0x480 [ 636.509557][T32508] nbd_dev_add+0x72c/0xb50 [ 636.514519][T32508] nbd_init+0x168/0x1f0 [ 636.519217][T32508] do_one_initcall+0x250/0x870 [ 636.524515][T32508] do_initcall_level+0x104/0x190 [ 636.529992][T32508] do_initcalls+0x59/0xa0 [ 636.534855][T32508] kernel_init_freeable+0x2a6/0x3e0 [ 636.540596][T32508] kernel_init+0x1d/0x1d0 [ 636.545462][T32508] ret_from_fork+0x514/0xb70 [ 636.550594][T32508] ret_from_fork_asm+0x1a/0x30 [ 636.555903][T32508] [ 636.555903][T32508] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 636.563753][T32508] __mutex_lock+0x1a3/0x1550 [ 636.568894][T32508] elevator_change+0x1b3/0x450 [ 636.574202][T32508] elevator_set_none+0xb5/0x140 [ 636.579591][T32508] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 636.585933][T32508] nbd_start_device+0x17f/0xb10 [ 636.591338][T32508] nbd_genl_connect+0x165b/0x1cf0 [ 636.596899][T32508] genl_family_rcv_msg_doit+0x22a/0x330 [ 636.602976][T32508] genl_rcv_msg+0x61c/0x7a0 [ 636.608011][T32508] netlink_rcv_skb+0x232/0x4b0 [ 636.613322][T32508] genl_rcv+0x28/0x40 [ 636.617850][T32508] netlink_unicast+0x75c/0x8e0 [ 636.623153][T32508] netlink_sendmsg+0x813/0xb40 [ 636.628457][T32508] ____sys_sendmsg+0x972/0x9f0 [ 636.633761][T32508] ___sys_sendmsg+0x2a5/0x360 [ 636.638981][T32508] __x64_sys_sendmsg+0x1bd/0x2a0 [ 636.644468][T32508] do_syscall_64+0x15f/0xf80 [ 636.649605][T32508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.656072][T32508] [ 636.656072][T32508] -> #1 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 636.664803][T32508] blk_alloc_queue+0x546/0x680 [ 636.670127][T32508] __blk_mq_alloc_disk+0x197/0x390 [ 636.675780][T32508] nbd_dev_add+0x499/0xb50 [ 636.680728][T32508] nbd_init+0x168/0x1f0 [ 636.685424][T32508] do_one_initcall+0x250/0x870 [ 636.690738][T32508] do_initcall_level+0x104/0x190 [ 636.696222][T32508] do_initcalls+0x59/0xa0 [ 636.701087][T32508] kernel_init_freeable+0x2a6/0x3e0 [ 636.706824][T32508] kernel_init+0x1d/0x1d0 [ 636.711788][T32508] ret_from_fork+0x514/0xb70 [ 636.716916][T32508] ret_from_fork_asm+0x1a/0x30 [ 636.722221][T32508] [ 636.722221][T32508] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 636.729449][T32508] __lock_acquire+0x15a5/0x2cf0 [ 636.734850][T32508] lock_acquire+0x106/0x350 [ 636.739887][T32508] fs_reclaim_acquire+0x71/0x100 [ 636.745363][T32508] __kmalloc_cache_noprof+0x40/0x660 [ 636.751187][T32508] ref_tracker_alloc+0x15a/0x4c0 [ 636.756671][T32508] get_net_track+0x16e/0x230 [ 636.761806][T32508] sk_net_refcnt_upgrade+0xb2/0x130 [ 636.767581][T32508] mptcp_subflow_create_socket+0x32b/0x800 [ 636.773936][T32508] __mptcp_nmpc_sk+0x155/0x790 [ 636.779229][T32508] mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 636.785484][T32508] genl_family_rcv_msg_doit+0x22a/0x330 [ 636.791564][T32508] genl_rcv_msg+0x61c/0x7a0 [ 636.796592][T32508] netlink_rcv_skb+0x232/0x4b0 [ 636.801891][T32508] genl_rcv+0x28/0x40 [ 636.806410][T32508] netlink_unicast+0x75c/0x8e0 [ 636.811709][T32508] netlink_sendmsg+0x813/0xb40 [ 636.817009][T32508] ____sys_sendmsg+0x972/0x9f0 [ 636.822306][T32508] ___sys_sendmsg+0x2a5/0x360 [ 636.827524][T32508] __x64_sys_sendmsg+0x1bd/0x2a0 [ 636.833004][T32508] do_syscall_64+0x15f/0xf80 [ 636.838134][T32508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.844641][T32508] [ 636.844641][T32508] other info that might help us debug this: [ 636.844641][T32508] [ 636.854875][T32508] Chain exists of: [ 636.854875][T32508] fs_reclaim --> sk_lock-AF_INET --> k-sk_lock-AF_INET/1 [ 636.854875][T32508] [ 636.867854][T32508] Possible unsafe locking scenario: [ 636.867854][T32508] [ 636.875329][T32508] CPU0 CPU1 [ 636.880715][T32508] ---- ---- [ 636.886092][T32508] lock(k-sk_lock-AF_INET/1); [ 636.890891][T32508] lock(sk_lock-AF_INET); [ 636.897846][T32508] lock(k-sk_lock-AF_INET/1); [ 636.905165][T32508] lock(fs_reclaim); [ 636.909171][T32508] [ 636.909171][T32508] *** DEADLOCK *** [ 636.909171][T32508] [ 636.917334][T32508] 4 locks held by syz.1.12251/32508: [ 636.922627][T32508] #0: ffffffff8fe3f0e8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 636.930836][T32508] #1: ffffffff8fe3ef20 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 636.939823][T32508] #2: ffff8880360c0260 (msk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_pm_nl_add_addr_doit+0xdc7/0x1420 [ 636.950549][T32508] #3: ffff888075a10f60 (k-sk_lock-AF_INET/1){+.+.}-{0:0}, at: mptcp_subflow_create_socket+0x142/0x800 [ 636.961651][T32508] [ 636.961651][T32508] stack backtrace: [ 636.967653][T32508] CPU: 1 UID: 0 PID: 32508 Comm: syz.1.12251 Not tainted syzkaller #0 PREEMPT(full) [ 636.967681][T32508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 636.967696][T32508] Call Trace: [ 636.967707][T32508] [ 636.967718][T32508] dump_stack_lvl+0xe8/0x150 [ 636.967750][T32508] print_circular_bug+0x2e1/0x300 [ 636.967777][T32508] check_noncircular+0x12e/0x150 [ 636.967804][T32508] __lock_acquire+0x15a5/0x2cf0 [ 636.967824][T32508] ? genl_rcv_msg+0x61c/0x7a0 [ 636.967841][T32508] ? netlink_rcv_skb+0x232/0x4b0 [ 636.967864][T32508] ? genl_rcv+0x28/0x40 [ 636.967879][T32508] ? ____sys_sendmsg+0x972/0x9f0 [ 636.967904][T32508] ? ___sys_sendmsg+0x2a5/0x360 [ 636.967927][T32508] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 636.967952][T32508] ? do_syscall_64+0x15f/0xf80 [ 636.967977][T32508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.968001][T32508] ? __kmalloc_cache_noprof+0x40/0x660 [ 636.968027][T32508] lock_acquire+0x106/0x350 [ 636.968045][T32508] ? __kmalloc_cache_noprof+0x40/0x660 [ 636.968077][T32508] fs_reclaim_acquire+0x71/0x100 [ 636.968103][T32508] ? __kmalloc_cache_noprof+0x40/0x660 [ 636.968128][T32508] __kmalloc_cache_noprof+0x40/0x660 [ 636.968153][T32508] ? lockdep_hardirqs_on+0x7a/0x110 [ 636.968178][T32508] ? ref_tracker_alloc+0x15a/0x4c0 [ 636.968206][T32508] ref_tracker_alloc+0x15a/0x4c0 [ 636.968232][T32508] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 636.968255][T32508] ? ref_tracker_free+0x522/0x840 [ 636.968281][T32508] ? __pfx_ref_tracker_free+0x10/0x10 [ 636.968305][T32508] ? sk_net_refcnt_upgrade+0x8c/0x130 [ 636.968330][T32508] ? mptcp_subflow_create_socket+0x32b/0x800 [ 636.968358][T32508] ? __mptcp_nmpc_sk+0x155/0x790 [ 636.968374][T32508] ? mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 636.968398][T32508] ? genl_family_rcv_msg_doit+0x22a/0x330 [ 636.968418][T32508] ? net_passive_dec+0x177/0x250 [ 636.968438][T32508] ? __pfx_net_passive_dec+0x10/0x10 [ 636.968461][T32508] get_net_track+0x16e/0x230 [ 636.968487][T32508] sk_net_refcnt_upgrade+0xb2/0x130 [ 636.968515][T32508] mptcp_subflow_create_socket+0x32b/0x800 [ 636.968548][T32508] ? __pfx_mptcp_subflow_create_socket+0x10/0x10 [ 636.968579][T32508] ? do_raw_spin_lock+0x12b/0x2f0 [ 636.968604][T32508] ? lock_sock_nested+0x6a/0x100 [ 636.968624][T32508] __mptcp_nmpc_sk+0x155/0x790 [ 636.968642][T32508] ? __pfx___mptcp_nmpc_sk+0x10/0x10 [ 636.968658][T32508] ? mptcp_pm_nl_add_addr_doit+0xdc7/0x1420 [ 636.968683][T32508] ? __local_bh_enable_ip+0xd0/0x130 [ 636.968704][T32508] mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 636.968734][T32508] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 636.968781][T32508] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 636.968800][T32508] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 636.968823][T32508] genl_family_rcv_msg_doit+0x22a/0x330 [ 636.968843][T32508] ? __asan_memcpy+0x40/0x70 [ 636.968866][T32508] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 636.968891][T32508] ? bpf_lsm_capable+0x9/0x20 [ 636.968908][T32508] ? security_capable+0x7e/0x2c0 [ 636.968935][T32508] genl_rcv_msg+0x61c/0x7a0 [ 636.968955][T32508] ? __pfx_genl_rcv_msg+0x10/0x10 [ 636.968972][T32508] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 636.968997][T32508] ? __pfx_ref_tracker_free+0x10/0x10 [ 636.969026][T32508] netlink_rcv_skb+0x232/0x4b0 [ 636.969050][T32508] ? __pfx_genl_rcv_msg+0x10/0x10 [ 636.969068][T32508] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 636.969099][T32508] ? down_read+0x270/0x2e0 [ 636.969114][T32508] ? genl_rcv+0xd/0x40 [ 636.969130][T32508] genl_rcv+0x28/0x40 [ 636.969145][T32508] netlink_unicast+0x75c/0x8e0 [ 636.969171][T32508] netlink_sendmsg+0x813/0xb40 [ 636.969200][T32508] ? __pfx_netlink_sendmsg+0x10/0x10 [ 636.969226][T32508] ? aa_sock_msg_perm+0xf1/0x1b0 [ 636.969251][T32508] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 636.969278][T32508] ____sys_sendmsg+0x972/0x9f0 [ 636.969303][T32508] ? __might_fault+0xaf/0x130 [ 636.969329][T32508] ? __pfx_____sys_sendmsg+0x10/0x10 [ 636.969359][T32508] ? import_iovec+0x73/0xa0 [ 636.969387][T32508] ___sys_sendmsg+0x2a5/0x360 [ 636.969411][T32508] ? __lock_acquire+0x6b5/0x2cf0 [ 636.969432][T32508] ? __pfx____sys_sendmsg+0x10/0x10 [ 636.969460][T32508] ? futex_wait+0x2a2/0x390 [ 636.969516][T32508] ? __fget_files+0x2a/0x420 [ 636.969538][T32508] ? __fget_files+0x3a0/0x420 [ 636.969564][T32508] __x64_sys_sendmsg+0x1bd/0x2a0 [ 636.969591][T32508] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 636.969621][T32508] ? rcu_is_watching+0x15/0xb0 [ 636.969647][T32508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.969665][T32508] do_syscall_64+0x15f/0xf80 [ 636.969690][T32508] ? trace_irq_disable+0x3b/0x140 [ 636.969718][T32508] ? clear_bhb_loop+0x40/0x90 [ 636.969739][T32508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.969763][T32508] RIP: 0033:0x7fd31d59cdd9 [ 636.969780][T32508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 636.969796][T32508] RSP: 002b:00007fd31e3d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 636.969815][T32508] RAX: ffffffffffffffda RBX: 00007fd31d815fa0 RCX: 00007fd31d59cdd9 [ 636.969829][T32508] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 636.969840][T32508] RBP: 00007fd31d632d69 R08: 0000000000000000 R09: 0000000000000000 [ 636.969852][T32508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 636.969862][T32508] R13: 00007fd31d816038 R14: 00007fd31d815fa0 R15: 00007ffc6fec2278 [ 636.969884][T32508] [ 637.517115][T19625] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 637.523593][T19625] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 642.574079][T19625] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 642.580500][T19625] hsr_slave_1: hsr_addr_subst_dest: Unknown node