last executing test programs: 3.920519127s ago: executing program 1 (id=10364): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x4}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r6, &(0x7f00000005c0)="bad386dd", 0x5dc, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r5, 0x1, 0xd8, 0x6, @multicast}, 0x14) 2.632930428s ago: executing program 4 (id=10373): getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x99, 0xb, 0x4, 0x11, 0x5392, 0xfb9d, 0x9, {0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x81, 0x0, 0xc, 0x4b, 0x9}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r1, 0x0, 0x8000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, 0x0, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x9, @ipv4={'\x00', '\xff\xff', @local}, 0x800001}, 0x1c) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1a3a700080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) close(0x3) 2.50228623s ago: executing program 1 (id=10374): sendmsg(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@in={0x2, 0xffff, @rand_addr=0x64010102}, 0x80, 0x0, 0x0, 0x0, 0x20}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000520001002bbd70"], 0x1c}}, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 2.493322366s ago: executing program 4 (id=10375): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r3, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0xff, r3}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) r5 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) setsockopt$inet_msfilter(r4, 0x0, 0x29, &(0x7f0000000380)={@multicast2, @local, 0x1, 0x2, [@local, @loopback]}, 0x18) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x13, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}}}, 0x24}}, 0x0) 2.335616055s ago: executing program 1 (id=10377): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3e}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x61d0, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000280)={'raw\x00', 0x0, [0x6, 0x4a3, 0xdb4, 0x40000004, 0x3ff]}, &(0x7f0000000240)=0x54) 2.262254819s ago: executing program 3 (id=10378): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x4000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0xffffff6a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r0, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) 1.907522095s ago: executing program 4 (id=10382): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) socket$key(0xf, 0x3, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000000c0), 0x40) 1.416269584s ago: executing program 0 (id=10387): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x6}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f00000001c0)=@xdp={0x2c, 0x0, r3, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600006fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x20000010) 1.373586321s ago: executing program 3 (id=10388): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0xe22}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e20, 0x3, @local, 0x1}, 0x1c) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 1.296909288s ago: executing program 1 (id=10389): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x24, r2, 0x209, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e20}]}, 0x24}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r3) r5 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x80000) bind$inet6(r5, &(0x7f0000000280)={0xa, 0x4e24, 0x4, @loopback, 0x9}, 0x1c) sendmsg$NLBL_CALIPSO_C_REMOVE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010025bd7000fffbdf25024000000800010002000000ced585"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x4c, r2, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @empty}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x87}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @empty}]}, 0x4c}}, 0x45) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x4, &(0x7f00000001c0)=@framed={{}, [@ldst={0x1, 0x1, 0x4, 0x9, 0xa, 0x50}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x1005, &(0x7f00000014c0)=""/4101, 0x0, 0xc}, 0x94) 1.292896895s ago: executing program 2 (id=10390): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d5000/0x3000)=nil, 0x3000, 0x0, 0x13, r2, 0x3000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x1000000, 0x12, r3, 0x80000000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r5, 0x0) mmap(&(0x7f0000692000/0x1000)=nil, 0x1000, 0x0, 0x12, r4, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305829, &(0x7f0000000540)={0x1100, 0x0, 0x52, 0x10000}) 1.123919722s ago: executing program 1 (id=10391): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r3, r4, 0x8f5, 0x100000000000000) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 1.070481035s ago: executing program 3 (id=10392): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24000084) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x4}, {0xffff, 0xffff}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4005c}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x2, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xcebc}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 1.061554408s ago: executing program 2 (id=10393): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24000084) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x4}, {0xffff, 0xffff}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4005c}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff, 0xffff}, {0x0, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 1.003172447s ago: executing program 0 (id=10394): close(0x4) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, 0x0, &(0x7f00000000c0)) syz_open_procfs$namespace(0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x4e1e, 0x3, 'fo\x00', 0x13, 0x5, 0xe}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e20, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@loopback, 0x4e20, 0x10000, 0x2, 0x2}}, 0x44) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) 873.552803ms ago: executing program 0 (id=10395): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r2, 0xaa0f4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000004, 0x12, r4, 0xe6905000) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r3, 0x1000) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0xfffff000) mmap(&(0x7f00008b7000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) 853.628263ms ago: executing program 4 (id=10396): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) 812.62723ms ago: executing program 3 (id=10397): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000022c0)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r4, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x8, 0x9, 0x0, 0x1, 0x200, 0x0, 0x4, 0x7, 0x10001, 0x81, 0x1, 0x80000001, 0x8, 0x2, 0x1ff, 0x7, 0x7, 0xfffffffb, 0x3ff, 0x4, 0x3, 0x7, 0xffffffff, 0x434, 0x6, 0x1, 0x9, 0x9, 0x3, 0xffff, 0xfffffffb, 0x8000, 0x7, 0x7fff, 0x3, 0x101, 0x6, 0x7fffffff, 0xe, 0x4, 0x4, 0x8, 0x40, 0x9, 0x6, 0xa, 0x215, 0x8001, 0x7, 0x1, 0x0, 0x2e6, 0x4, 0xffffff7f, 0x2, 0x1, 0x8000, 0x5, 0x0, 0x9, 0x10, 0x6, 0x200, 0x32, 0x7, 0x7f80000, 0x6, 0x8b, 0x8, 0x3, 0x0, 0x2, 0x7, 0x7, 0x4641ebda, 0x9, 0x2, 0x0, 0xff, 0x0, 0x8319, 0x29e4, 0x200, 0x6, 0x10001, 0xc, 0xa, 0x3, 0x0, 0x2, 0x80000001, 0x7, 0x1, 0x1fe, 0x0, 0xd, 0x5, 0xf, 0x10, 0x0, 0x0, 0x1, 0x80000000, 0xa, 0x8, 0xffff, 0x6, 0x7, 0x9, 0x100, 0x7, 0x2, 0x6, 0x10, 0x0, 0x6, 0x7, 0x240, 0x8, 0x5, 0x81, 0xaeb, 0xff, 0x0, 0x80000001, 0x8, 0xc17, 0x80, 0xffffff03, 0xef3, 0x1, 0x3, 0x400, 0x7ff, 0xffff, 0x1, 0x4, 0x7, 0x7, 0x4, 0x1, 0x40, 0x0, 0xfffffff7, 0x0, 0x8, 0x5588, 0x40, 0x4, 0x3ff, 0x89e48883, 0x8, 0x281, 0x8, 0x8, 0x40, 0xffffffff, 0x4, 0x293d8b13, 0x45, 0xfe, 0x3ff, 0xfb1, 0xfffffffe, 0xc5, 0x9, 0x11d, 0x3, 0x9, 0x81, 0x73c2, 0x5, 0x1, 0x3, 0x4, 0x5, 0x81, 0x2, 0x40, 0x400, 0x7, 0x56e2, 0x31, 0xfffffffc, 0x5, 0x3, 0xd, 0xdb51, 0x2, 0x1, 0x8, 0x2, 0x1, 0x8a, 0x9, 0x8cb6, 0xb637, 0x4, 0x9, 0x7, 0x5b03, 0xfff, 0x8, 0x5, 0x81, 0x0, 0x4, 0x5d, 0x80000000, 0x0, 0x2, 0x4, 0x10001, 0xc7, 0x5, 0x3, 0x6, 0x8, 0x80000001, 0x3, 0x6, 0x6, 0x800, 0x5, 0x7, 0x1, 0x1fd8, 0x0, 0x7, 0xa, 0x7, 0x1, 0x82c, 0x84, 0x0, 0x95, 0x8, 0x6, 0x3, 0xd99, 0x40, 0x0, 0x4, 0x9, 0x6, 0x1, 0x7, 0x4, 0x7000000, 0x7, 0x9, 0x3, 0xffffff5a, 0x20000000, 0x7, 0x8]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x4040098}, 0x8000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 775.520478ms ago: executing program 2 (id=10398): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24000084) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x4}, {0xffff, 0xffff}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4005c}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 671.525882ms ago: executing program 4 (id=10399): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x1, 0x2, 0x6}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0x2}, {0x0, 0xfff1}, {0x4, 0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0xdb, 0x7ff, 0x2, 0x9, 0x6, 0x2, 0xfffffffb, 0xc00000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40098}, 0x4000000) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x3}, {0x2, 0xfff1}, {0x2, 0x9}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x10, 0x1, {0x0, 0xdb, 0x7ff, 0x2, 0x9, 0x6, 0x2, 0xfffffffb, 0xc00000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40098}, 0x4000000) 593.69262ms ago: executing program 0 (id=10400): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d63", 0x3b}, {&(0x7f0000000900)}], 0x5}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, 0x0}}], 0x2, 0x20000044) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r1 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x4008054) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 503.623808ms ago: executing program 2 (id=10401): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) r6 = socket(0x2000000000000021, 0x2, 0x10000000000002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) accept4$bt_l2cap(r6, 0x0, 0x0, 0x80000) 374.937497ms ago: executing program 2 (id=10402): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffff7, 0x2, {{0x4, 0x10, 0x6, 0x8, 0xfbee}, 0x3, 0x1, 0x3, 0x5, 0xe, 0x4, 0xd, 0x18, 0x5, 0x2, {0x6, 0x8, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) getsockopt$nfc_llcp(0xffffffffffffffff, 0x3a, 0x1, 0x0, 0x20000000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000480)="05", 0x1, 0x4009, &(0x7f0000000140)={0x11, 0x86dd, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 328.545494ms ago: executing program 0 (id=10403): socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_sctp(0xa, 0x5, 0x84) socket$alg(0x26, 0x5, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0xffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) close(0xffffffffffffffff) accept4(r0, 0x0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r1}, &(0x7f0000000340), &(0x7f0000000380)=r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 320.334239ms ago: executing program 3 (id=10404): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x7d4165c9) listen(0xffffffffffffffff, 0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, '\x00', 0x21}, 0x6}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af9219a1e18c488e827c1bbec", 0x89}], 0x1}, 0x0) 287.629356ms ago: executing program 4 (id=10405): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x2, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x6}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f00000001c0)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600006fb96d", 0xe}], 0x1}, 0x20000010) 194.436053ms ago: executing program 1 (id=10406): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000480)="c1858aec1d0a21756f66b4805f3a", 0xe, 0x40000, &(0x7f0000000240)={0x11, 0xf8, r6, 0x1, 0x5, 0x6, @random="24f51e8e0a5a"}, 0x14) 150.12198ms ago: executing program 0 (id=10407): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000000)=@ccm_128={{0x304}, "b39625e03be22ead", "8da0640c9e8f6b81143f1a1a6d81ee2b", "3b0e7088", "19a4216dfdbf6602"}, 0x28) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af9219a1e18c488e827c1bbec", 0x89}], 0x1}, 0x0) r3 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f00000004c0), 0x80800) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, 0x0, 0xc080) 96.564744ms ago: executing program 2 (id=10408): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r0, &(0x7f00000000c0)={0x11, 0x18, r2, 0x1, 0x81}, 0x14) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) 0s ago: executing program 3 (id=10409): r0 = socket$kcm(0x29, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) kernel console output (not intermixed with test programs): 6794][T15088] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 293.373845][T15126] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4489'. [ 293.523183][T15132] xt_TPROXY: Can be used only with -p tcp or -p udp [ 293.887393][T15154] netlink: 'syz.2.4502': attribute type 3 has an invalid length. [ 293.983613][T15160] netlink: 'syz.0.4505': attribute type 7 has an invalid length. [ 294.000181][T15160] netlink: 'syz.0.4505': attribute type 8 has an invalid length. [ 294.244559][T15174] sctp: [Deprecated]: syz.1.4511 (pid 15174) Use of struct sctp_assoc_value in delayed_ack socket option. [ 294.244559][T15174] Use struct sctp_sack_info instead [ 294.542935][T15190] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 295.119901][T15225] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4535'. [ 295.185783][T15230] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4537'. [ 295.410395][T15244] netlink: 'syz.2.4543': attribute type 58 has an invalid length. [ 295.421752][T15244] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4543'. [ 295.605037][T15254] openvswitch: netlink: Invalid VLAN frame [ 296.385884][T15300] netlink: 'syz.2.4572': attribute type 8 has an invalid length. [ 296.674859][T15312] netlink: 'syz.0.4578': attribute type 1 has an invalid length. [ 296.699898][T15312] netlink: 244 bytes leftover after parsing attributes in process `syz.0.4578'. [ 296.728021][T15318] --map-set only usable from mangle table [ 296.924143][T15330] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4587'. [ 296.945328][T15330] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4587'. [ 297.111541][T15341] SET target dimension over the limit! [ 297.194270][T15343] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4593'. [ 297.316198][T15353] openvswitch: netlink: Multiple metadata blocks provided [ 297.414121][T15357] openvswitch: netlink: Missing key (keys=40, expected=100) [ 297.470230][T15361] IPv6: sit1: Disabled Multicast RS [ 297.483499][T15361] sit1: entered allmulticast mode [ 297.555111][T15363] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4603'. [ 297.566476][T15369] netlink: 'syz.3.4606': attribute type 1 has an invalid length. [ 297.693034][T15371] netlink: 'syz.4.4607': attribute type 2 has an invalid length. [ 298.130668][T15399] netlink: 'syz.4.4620': attribute type 1 has an invalid length. [ 298.182124][T15399] netlink: 'syz.4.4620': attribute type 11 has an invalid length. [ 298.212503][T15399] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4620'. [ 298.236175][T15402] netlink: 'syz.3.4622': attribute type 10 has an invalid length. [ 298.255116][T15402] vlan0: left promiscuous mode [ 298.283453][T15402] team0: Port device vlan0 added [ 298.368718][T15408] bond5: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 298.726024][T15431] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 298.939622][T15444] netlink: 'syz.2.4642': attribute type 11 has an invalid length. [ 299.413912][T15473] xt_hashlimit: overflow, try lower: 3/0 [ 299.484218][T15479] C: renamed from lo (while UP) [ 299.506914][T15479] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 299.797349][T15494] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 299.887383][T15500] openvswitch: netlink: IP tunnel dst address not specified [ 300.329242][T15527] xt_TCPMSS: Only works on TCP SYN packets [ 300.550713][T15539] netlink: 'syz.1.4683': attribute type 10 has an invalid length. [ 300.613698][T15539] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 300.666859][T15539] bond0: (slave netdevsim1): Enslaving as an active interface with a down link [ 301.208536][T15568] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 301.483628][T15586] netlink: 'syz.4.4705': attribute type 1 has an invalid length. [ 301.509089][T15586] netlink: 'syz.4.4705': attribute type 3 has an invalid length. [ 301.540564][T15586] __nla_validate_parse: 1 callbacks suppressed [ 301.540584][T15586] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4705'. [ 301.805325][T15608] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4717'. [ 301.821334][T15606] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4715'. [ 302.215465][T15631] netlink: 'syz.0.4726': attribute type 1 has an invalid length. [ 302.440257][T15642] netlink: 228 bytes leftover after parsing attributes in process `syz.0.4732'. [ 302.962796][T15676] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4748'. [ 302.983507][T15676] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4748'. [ 303.676054][T15714] openvswitch: netlink: Missing key (keys=40, expected=80) [ 304.004864][T15727] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4773'. [ 305.246471][T15804] netlink: 272 bytes leftover after parsing attributes in process `syz.1.4809'. [ 305.268669][T15806] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4812'. [ 305.589927][T15827] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 305.599696][T15827] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 305.735596][T15836] validate_nla: 1 callbacks suppressed [ 305.735617][T15836] netlink: 'syz.1.4824': attribute type 2 has an invalid length. [ 306.027640][T15851] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4832'. [ 306.324262][T15869] xt_hashlimit: size too large, truncated to 1048576 [ 307.093366][T15912] __nla_validate_parse: 3 callbacks suppressed [ 307.093386][T15912] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4862'. [ 307.443728][T15932] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4871'. [ 307.855701][T15956] netlink: 'syz.4.4882': attribute type 3 has an invalid length. [ 307.983589][T15960] netlink: 13 bytes leftover after parsing attributes in process `syz.3.4885'. [ 308.833623][T16014] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4910'. [ 309.656642][T16059] netlink: 'syz.2.4932': attribute type 3 has an invalid length. [ 309.664972][T16059] netlink: 766 bytes leftover after parsing attributes in process `syz.2.4932'. [ 310.109341][T16087] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4946'. [ 310.131897][T16087] Zero length message leads to an empty skb [ 310.478047][T16104] rdma_rxe: rxe_newlink: failed to add lo [ 310.997958][T16135] netlink: 'syz.4.4968': attribute type 1 has an invalid length. [ 311.054893][T16135] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4968'. [ 311.065176][T16135] netlink: 658 bytes leftover after parsing attributes in process `syz.4.4968'. [ 311.077776][T16135] netlink: 'syz.4.4968': attribute type 1 has an invalid length. [ 311.738603][T16176] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 311.992407][T16190] netlink: 'syz.4.4994': attribute type 32 has an invalid length. [ 312.024521][T16190] netlink: 776 bytes leftover after parsing attributes in process `syz.4.4994'. [ 312.365180][T16211] netlink: 'syz.0.5006': attribute type 25 has an invalid length. [ 312.466240][T16214] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5007'. [ 312.646813][T16227] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5012'. [ 312.741590][T16227] bond0: Invalid ad_actor_system MAC address. [ 312.750756][T16227] bond0: option ad_actor_system: invalid value (1) [ 312.768523][T16227] bond0 (unregistering): Released all slaves [ 313.054672][T16238] lo speed is unknown, defaulting to 1000 [ 313.377055][T16252] xt_hashlimit: size too large, truncated to 1048576 [ 313.426245][T16255] netlink: 'syz.0.5025': attribute type 1 has an invalid length. [ 314.145239][T16284] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5038'. [ 314.340348][T16294] netlink: 'syz.3.5039': attribute type 1 has an invalid length. [ 314.345073][T16295] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 314.444495][T16297] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 314.478363][T16297] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 314.554154][T16302] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5047'. [ 314.834112][T16317] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5052'. [ 314.888193][T16317] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5052'. [ 315.037064][T16313] bond0: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 315.086052][T16313] bond0 (unregistering): Released all slaves [ 315.112642][T16329] netlink: 'syz.4.5059': attribute type 1 has an invalid length. [ 315.132262][T16329] netlink: 236 bytes leftover after parsing attributes in process `syz.4.5059'. [ 315.897326][T16370] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 315.934611][T16376] Bluetooth: MGMT ver 1.23 [ 316.129769][T16387] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5086'. [ 316.217270][T16393] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5090'. [ 317.455605][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.062568][T16483] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5133'. [ 318.113009][T16488] netlink: 9 bytes leftover after parsing attributes in process `syz.3.5136'. [ 318.143337][T16488] 1·: renamed from c0· (while UP) [ 318.160204][T16488] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 318.174038][ T5048] IPVS: starting estimator thread 0... [ 318.182711][T16491] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 318.264687][T16497] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5140'. [ 318.296148][T16492] IPVS: using max 26 ests per chain, 62400 per kthread [ 318.368313][T11172] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 318.399951][ T5632] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 318.412015][T11172] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 318.481295][ T42] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 318.854792][T16529] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 318.864404][T16530] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5156'. [ 319.450986][ T5822] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 319.522664][T16558] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5169'. [ 319.852310][T16580] netlink: 'syz.1.5178': attribute type 1 has an invalid length. [ 319.863431][T16580] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 319.875319][T16578] netlink: 100 bytes leftover after parsing attributes in process `syz.4.5180'. [ 319.875461][T16579] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5179'. [ 320.151868][T16595] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 320.386222][T16611] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 320.451091][T16613] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5195'. [ 320.471538][T16613] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5195'. [ 320.612797][T16621] netlink: 'syz.3.5199': attribute type 1 has an invalid length. [ 320.660859][T16621] netlink: 'syz.3.5199': attribute type 2 has an invalid length. [ 320.685103][T16621] netlink: 'syz.3.5199': attribute type 1 has an invalid length. [ 320.699245][T16621] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5199'. [ 320.926196][T16643] nftables ruleset with unbound set [ 321.119632][T16645] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 321.875463][T16692] Bluetooth: MGMT ver 1.23 [ 322.208486][T16715] sctp: [Deprecated]: syz.0.5243 (pid 16715) Use of int in max_burst socket option deprecated. [ 322.208486][T16715] Use struct sctp_assoc_value instead [ 322.573680][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 322.587983][T16733] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 324.254914][T16829] __nla_validate_parse: 5 callbacks suppressed [ 324.254938][T16829] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.5298'. [ 324.736925][T16857] netlink: 'syz.2.5312': attribute type 3 has an invalid length. [ 324.761089][T16859] netlink: 'syz.3.5313': attribute type 2 has an invalid length. [ 325.373957][T16891] xt_hashlimit: size too large, truncated to 1048576 [ 325.681144][T16905] netlink: 216 bytes leftover after parsing attributes in process `syz.0.5334'. [ 325.713905][T16905] netlink: 'syz.0.5334': attribute type 2 has an invalid length. [ 325.735919][T16905] netlink: 'syz.0.5334': attribute type 1 has an invalid length. [ 325.780278][T16911] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5337'. [ 326.525839][T16955] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5359'. [ 327.367437][T16993] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5376'. [ 327.768065][T17021] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5390'. [ 327.909028][T17025] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 327.927891][T17029] IPv6: NLM_F_CREATE should be specified when creating new route [ 327.956421][T17029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5393'. [ 329.113467][T17099] macsec1: entered promiscuous mode [ 329.274151][T17108] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5431'. [ 329.598818][T17129] pim6reg: entered allmulticast mode [ 329.619277][T17129] pim6reg: left allmulticast mode [ 330.224840][T17165] tipc: Started in network mode [ 330.240613][T17165] tipc: Node identity aaaaaaaaaa3, cluster identity 4711 [ 330.259808][T17165] tipc: Enabled bearer , priority 10 [ 330.556635][T17181] netlink: 'syz.0.5466': attribute type 1 has an invalid length. [ 330.679891][T17187] tipc: Cannot configure node identity twice [ 330.877997][T17197] wireguard: wg0: Could not create IPv4 socket [ 330.890703][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 331.097715][T17212] veth3: entered allmulticast mode [ 331.376074][ T5048] tipc: Node number set to 10136234 [ 332.279037][T17284] Cannot find add_set index 46338 as target [ 333.091608][T17333] netlink: 'syz.3.5539': attribute type 4 has an invalid length. [ 333.115133][T17333] netlink: 240 bytes leftover after parsing attributes in process `syz.3.5539'. [ 333.476960][T17351] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5547'. [ 333.523388][T17351] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5547'. [ 334.377252][T17393] netlink: 'syz.4.5569': attribute type 1 has an invalid length. [ 334.401536][T17393] netlink: 216 bytes leftover after parsing attributes in process `syz.4.5569'. [ 334.719114][T17415] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5581'. [ 334.950876][T17430] netlink: 'syz.2.5586': attribute type 1 has an invalid length. [ 334.980214][T17430] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5586'. [ 335.002353][T17430] netlink: 'syz.2.5586': attribute type 1 has an invalid length. [ 335.011065][T17430] netlink: 'syz.2.5586': attribute type 8 has an invalid length. [ 335.019111][T17430] netlink: 606 bytes leftover after parsing attributes in process `syz.2.5586'. [ 335.646165][T17468] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5606'. [ 335.700180][T17470] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5607'. [ 336.965341][T17543] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5637'. [ 337.004221][T17543] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5637'. [ 337.135693][T17551] IPVS: length: 8 != 1152 [ 337.275338][T17561] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5651'. [ 337.279578][T17559] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5650'. [ 337.967984][T17605] netlink: 'syz.4.5672': attribute type 3 has an invalid length. [ 338.259193][T17623] netlink: 'syz.0.5682': attribute type 1 has an invalid length. [ 338.279085][T17623] netlink: 'syz.0.5682': attribute type 1 has an invalid length. [ 338.518827][T17639] tipc: Started in network mode [ 338.531962][T17639] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 338.555497][T17639] tipc: Enabled bearer , priority 24 [ 338.847067][T17657] netlink: 'syz.4.5698': attribute type 2 has an invalid length. [ 339.672153][ T42] tipc: Node number set to 10005162 [ 339.730309][T17712] __nla_validate_parse: 3 callbacks suppressed [ 339.730330][T17712] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5722'. [ 340.709364][T17771] netlink: 'syz.0.5750': attribute type 11 has an invalid length. [ 340.952861][T17786] tipc: Started in network mode [ 340.979425][T17786] tipc: Node identity faa445f5de7, cluster identity 4711 [ 341.004111][T17786] tipc: Enabled bearer , priority 11 [ 341.283438][T17808] netlink: 'syz.0.5769': attribute type 4 has an invalid length. [ 341.335069][T17808] netlink: 17 bytes leftover after parsing attributes in process `syz.0.5769'. [ 341.461961][T17815] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 341.503828][T17821] netlink: 'syz.3.5775': attribute type 29 has an invalid length. [ 342.076429][T17857] netlink: 'syz.3.5792': attribute type 32 has an invalid length. [ 342.107889][T17857] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5792'. [ 342.157435][ T5048] tipc: Node number set to 617891317 [ 342.204319][T17866] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 342.208022][T17857] bond1: Setting coupled_control to off (0) [ 342.465455][ T5048] IPVS: starting estimator thread 0... [ 342.570787][T17880] IPVS: using max 25 ests per chain, 60000 per kthread [ 342.816664][T17902] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5813'. [ 343.012604][T17912] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5815'. [ 343.478892][T17937] lo: entered allmulticast mode [ 343.491769][T17937] lo: left allmulticast mode [ 343.656813][T17946] tipc: Started in network mode [ 343.680652][T17946] tipc: Node identity ac141441, cluster identity 4711 [ 343.701319][T17946] tipc: Enabling of bearer rejected, failed to enable media [ 343.738557][T17953] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 344.605775][T18002] sctp: [Deprecated]: syz.0.5860 (pid 18002) Use of int in maxseg socket option. [ 344.605775][T18002] Use struct sctp_assoc_value instead [ 345.376117][T18027] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5873'. [ 345.956631][T18055] netlink: 'syz.4.5886': attribute type 1 has an invalid length. [ 345.971150][T18055] netlink: 'syz.4.5886': attribute type 3 has an invalid length. [ 345.983084][T18055] netlink: 172 bytes leftover after parsing attributes in process `syz.4.5886'. [ 345.995288][T18055] NCSI netlink: No device for ifindex 813332851 [ 346.217842][T18072] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 346.307243][T18074] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5896'. [ 346.482063][T18091] netlink: 10 bytes leftover after parsing attributes in process `syz.2.5903'. [ 346.739173][T18102] vlan2: entered promiscuous mode [ 346.753619][T18102] bridge0: entered promiscuous mode [ 346.823606][T18109] netlink: 165 bytes leftover after parsing attributes in process `syz.0.5911'. [ 346.940602][T18114] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5915'. [ 347.238521][T18130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5922'. [ 347.386197][T18141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5928'. [ 347.728437][T18159] netlink: 'syz.4.5936': attribute type 3 has an invalid length. [ 348.173317][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 348.322730][T18201] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 348.454315][T18208] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5958'. [ 348.503925][T18212] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 348.595262][T18216] netlink: 'syz.1.5963': attribute type 12 has an invalid length. [ 348.644377][T18221] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5966'. [ 349.629724][T18281] netlink: 'syz.1.5991': attribute type 3 has an invalid length. [ 350.351910][T18322] netlink: 'syz.4.6008': attribute type 1 has an invalid length. [ 350.646334][T18340] netlink: 220 bytes leftover after parsing attributes in process `syz.1.6016'. [ 350.665895][T18340] netlink: 'syz.1.6016': attribute type 2 has an invalid length. [ 351.145052][T18371] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6032'. [ 352.025251][T18418] netlink: 'syz.1.6054': attribute type 11 has an invalid length. [ 352.042575][T18418] netlink: 199788 bytes leftover after parsing attributes in process `syz.1.6054'. [ 352.125347][T18422] syz.4.6057 (18422) used obsolete PPPIOCDETACH ioctl [ 352.224747][T18430] netlink: 'syz.3.6061': attribute type 11 has an invalid length. [ 352.242626][T18430] netlink: 'syz.3.6061': attribute type 4 has an invalid length. [ 352.254628][T18430] netlink: 199768 bytes leftover after parsing attributes in process `syz.3.6061'. [ 352.817915][T18466] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 353.975009][T18539] netlink: 'syz.4.6114': attribute type 1 has an invalid length. [ 354.071736][T18541] netlink: 'syz.2.6116': attribute type 178 has an invalid length. [ 354.459878][T18566] tipc: Enabling of bearer rejected, failed to enable media [ 354.804486][T18587] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6139'. [ 354.833319][T18590] RDS: rds_bind could not find a transport for 400:0:1200:0:1030:0:ffff:ffff, load rds_tcp or rds_rdma? [ 354.848926][T18591] tipc: Started in network mode [ 354.869680][T18591] tipc: Node identity e0000001, cluster identity 4711 [ 354.882713][T18591] tipc: Enabling of bearer rejected, failed to enable media [ 354.962226][T18595] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6143'. [ 355.158026][T18607] xt_limit: Overflow, try lower: 271964/0 [ 355.411194][T18623] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6156'. [ 355.460025][T18623] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6156'. [ 356.147847][T18670] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6181'. [ 356.156615][T18668] xt_hashlimit: size too large, truncated to 1048576 [ 356.169349][T18670] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6181'. [ 356.220337][ T1171] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.242680][ T1171] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.282360][ T1171] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.633425][T18694] netlink: 'syz.1.6189': attribute type 58 has an invalid length. [ 356.652665][T18694] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6189'. [ 356.846194][T18705] bridge: RTM_NEWNEIGH with invalid state 0x20 [ 357.327372][T18737] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6206'. [ 357.527656][T18749] netlink: 'syz.0.6213': attribute type 58 has an invalid length. [ 357.537532][T18749] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6213'. [ 357.603585][T18753] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 358.271797][T18791] xt_cgroup: invalid path, errno=-2 [ 358.409016][T18798] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6236'. [ 358.435053][T18798] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 359.086738][T18836] netlink: 168 bytes leftover after parsing attributes in process `syz.3.6256'. [ 359.393068][T18859] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6266'. [ 359.624640][T18870] nbd: must specify a size in bytes for the device [ 359.850726][T18884] netlink: 216 bytes leftover after parsing attributes in process `syz.3.6278'. [ 359.863849][T18884] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6278'. [ 361.199257][T18959] netlink: 'syz.3.6314': attribute type 4 has an invalid length. [ 361.209075][T18959] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6314'. [ 361.526569][T18979] netlink: 'syz.4.6324': attribute type 83 has an invalid length. [ 361.612372][T18981] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 2621 [ 361.676166][T18984] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6325'. [ 362.198861][T19018] xt_HMARK: proto mask must be zero with L3 mode [ 362.482319][T19034] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 362.999466][T19069] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6366'. [ 363.027856][T19069] netlink: 43 bytes leftover after parsing attributes in process `syz.2.6366'. [ 363.055214][T19069] netlink: 'syz.2.6366': attribute type 5 has an invalid length. [ 363.082225][T19069] netlink: 43 bytes leftover after parsing attributes in process `syz.2.6366'. [ 363.328220][T19084] sit1: entered promiscuous mode [ 363.341082][T19084] sit1: entered allmulticast mode [ 363.629553][T19106] netlink: 'syz.1.6385': attribute type 2 has an invalid length. [ 363.640134][T19106] netlink: 188 bytes leftover after parsing attributes in process `syz.1.6385'. [ 363.912678][T19123] batadv0: entered promiscuous mode [ 363.923031][T19123] macsec1: entered promiscuous mode [ 363.939396][T19123] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 363.965510][T19123] batadv0: left promiscuous mode [ 364.265080][T19143] netlink: 'syz.0.6404': attribute type 62 has an invalid length. [ 364.365543][T19147] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6405'. [ 364.705059][T19166] netlink: 1 bytes leftover after parsing attributes in process `syz.1.6414'. [ 364.717727][T19166] xt_policy: neither incoming nor outgoing policy selected [ 364.922383][T19182] xt_connbytes: Forcing CT accounting to be enabled [ 365.495861][T19215] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6437'. [ 365.514176][T19214] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6436'. [ 365.913490][T19239] tipc: Enabling of bearer rejected, failed to enable media [ 366.726547][T19291] __nla_validate_parse: 1 callbacks suppressed [ 366.726569][T19291] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6475'. [ 366.741916][T19289] netlink: 'syz.0.6474': attribute type 1 has an invalid length. [ 366.787561][T19291] macsec1: entered promiscuous mode [ 366.793349][T19291] macsec1: entered allmulticast mode [ 366.798967][T19291] bridge0: entered allmulticast mode [ 366.805660][T19291] bridge0: port 1(macsec1) entered blocking state [ 366.812822][T19291] bridge0: port 1(macsec1) entered disabled state [ 366.826865][T19291] bridge0: left allmulticast mode [ 367.037618][T19307] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.6482'. [ 367.565047][T19337] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6496'. [ 367.614309][T19337] netlink: 43 bytes leftover after parsing attributes in process `syz.4.6496'. [ 367.636606][T19337] netlink: 'syz.4.6496': attribute type 6 has an invalid length. [ 367.655326][T19337] netlink: 'syz.4.6496': attribute type 5 has an invalid length. [ 367.655496][T19342] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.6500'. [ 367.670504][T19337] netlink: 43 bytes leftover after parsing attributes in process `syz.4.6496'. [ 367.870935][T19352] pimreg3: entered allmulticast mode [ 367.884460][T19355] netlink: 96 bytes leftover after parsing attributes in process `syz.1.6506'. [ 367.951370][T19355] vlan0: entered allmulticast mode [ 367.966340][T19355] gretap0: entered allmulticast mode [ 368.383719][T19383] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6518'. [ 368.416754][T19383] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6518'. [ 368.438582][T19383] netlink: 'syz.1.6518': attribute type 12 has an invalid length. [ 368.468171][T19383] netlink: 'syz.1.6518': attribute type 11 has an invalid length. [ 368.613637][T19394] netlink: 'syz.2.6522': attribute type 2 has an invalid length. [ 368.623148][T19398] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6524'. [ 370.498293][T19495] tipc: Enabling of bearer rejected, failed to enable media [ 371.487672][T19556] tipc: Enabled bearer , priority 10 [ 371.499682][T19559] netlink: 'syz.1.6601': attribute type 23 has an invalid length. [ 371.583226][T19564] netlink: 'syz.2.6603': attribute type 29 has an invalid length. [ 371.973203][T19584] netlink: 'syz.4.6613': attribute type 10 has an invalid length. [ 372.228496][T19603] netlink: 'syz.2.6623': attribute type 1 has an invalid length. [ 372.244929][T19603] netlink: 'syz.2.6623': attribute type 1 has an invalid length. [ 372.353728][T19611] __nla_validate_parse: 1 callbacks suppressed [ 372.353749][T19611] netlink: 640 bytes leftover after parsing attributes in process `syz.0.6624'. [ 372.390554][T19611] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 372.509230][T19617] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6629'. [ 372.590551][ T10] tipc: Node number set to 3758096385 [ 372.793120][T19636] xt_hashlimit: size too large, truncated to 1048576 [ 372.991500][T19648] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6642'. [ 373.347606][T19666] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6651'. [ 374.044201][T19708] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6672'. [ 374.996013][T19761] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6698'. [ 375.024124][T19761] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6698'. [ 375.843359][T19799] bridge0: port 3(gretap0) entered disabled state [ 376.416692][T19799] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 376.531574][T19835] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6732'. [ 376.929191][T19859] netlink: 204 bytes leftover after parsing attributes in process `syz.2.6744'. [ 377.271011][T19876] netlink: 240 bytes leftover after parsing attributes in process `syz.2.6752'. [ 377.665508][T19903] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.6766'. [ 377.697213][T19903] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.6766'. [ 378.897938][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.824868][T20016] rdma_op ffff8880331d39f0 conn xmit_rdma 0000000000000000 [ 379.952165][T20022] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6821'. [ 380.329409][T20047] netlink: 'syz.3.6834': attribute type 1 has an invalid length. [ 380.343323][T20047] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 380.639756][T20066] netlink: 100 bytes leftover after parsing attributes in process `syz.4.6843'. [ 381.756284][T20121] netlink: 88 bytes leftover after parsing attributes in process `syz.2.6870'. [ 381.786445][T20121] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6870'. [ 381.801064][T20121] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6870'. [ 382.089681][T20143] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6881'. [ 382.099943][T20143] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6881'. [ 382.110343][T20143] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6881'. [ 382.727109][T20177] netlink: 'syz.3.6898': attribute type 3 has an invalid length. [ 382.730815][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 382.771625][T20181] __nla_validate_parse: 2 callbacks suppressed [ 382.771645][T20181] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6900'. [ 383.340184][T20218] netlink: 'syz.0.6918': attribute type 10 has an invalid length. [ 383.623638][T20234] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6925'. [ 383.936467][T20254] netlink: 'syz.3.6937': attribute type 4 has an invalid length. [ 384.205783][T20269] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6942'. [ 385.052276][T20313] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6963'. [ 385.557477][T20331] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6972'. [ 386.661858][T20370] netlink: 'syz.0.6991': attribute type 29 has an invalid length. [ 386.742857][T20370] netlink: 'syz.0.6991': attribute type 29 has an invalid length. [ 387.185053][T20386] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6999'. [ 387.458781][T20400] netlink: 'syz.1.7006': attribute type 1 has an invalid length. [ 387.509199][T20404] netlink: 204 bytes leftover after parsing attributes in process `syz.0.7008'. [ 387.817214][T20420] netlink: 'syz.1.7016': attribute type 83 has an invalid length. [ 388.368503][T20452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7031'. [ 388.526208][T20464] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7038'. [ 388.614581][T20467] netem: unknown loss type 8 [ 388.642256][T20467] netem: change failed [ 388.872092][T20480] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.7045'. [ 388.902252][T20481] netlink: 'syz.4.7046': attribute type 2 has an invalid length. [ 389.406796][T20504] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7055'. [ 389.595987][T20516] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.7062'. [ 389.622276][T20516] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.7062'. [ 390.189159][T20546] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7075'. [ 390.227985][T20545] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7075'. [ 390.254169][T20545] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7075'. [ 390.281402][T20545] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7075'. [ 390.879731][T20583] ipvlan3: entered allmulticast mode [ 390.887998][T20583] batadv_slave_1: entered allmulticast mode [ 390.903942][T20583] batman_adv: batadv0: Adding interface: ipvlan3 [ 390.911119][T20583] batman_adv: batadv0: The MTU of interface ipvlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 390.947704][T20583] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 390.989288][T20583] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 391.032102][T20583] batman_adv: batadv0: Interface activated: ipvlan3 [ 391.947225][T20641] netlink: 'syz.2.7122': attribute type 1 has an invalid length. [ 393.447470][ T5289] veth0_macvtap: left promiscuous mode [ 394.676605][T20775] Bluetooth: MGMT ver 1.23 [ 394.704643][T20775] Bluetooth: hci1: too big key_count value 32778 [ 394.833423][T20782] tipc: New replicast peer: 255.255.255.255 [ 394.868855][T20782] tipc: Enabled bearer , priority 10 [ 395.778413][T20825] bond0 (unregistering): Released all slaves [ 395.990593][ T5048] tipc: Node number set to 2886997057 [ 396.159739][T20844] netlink: 'syz.4.7201': attribute type 11 has an invalid length. [ 396.499045][T20864] vcan0: tx drop: invalid da for name 0x0000800000000015 [ 396.585252][T20868] __nla_validate_parse: 36 callbacks suppressed [ 396.585275][T20868] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7214'. [ 396.959766][T20887] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7223'. [ 396.973663][T20887] netlink: 176 bytes leftover after parsing attributes in process `syz.4.7223'. [ 396.983040][T20887] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7223'. [ 397.603835][T20914] vlan2: entered allmulticast mode [ 397.640140][T20914] bond0: entered allmulticast mode [ 397.657308][T20914] bond_slave_0: entered allmulticast mode [ 397.664331][T20914] bond_slave_1: entered allmulticast mode [ 397.700867][T20923] netlink: 'syz.4.7240': attribute type 1 has an invalid length. [ 397.750633][T20923] netlink: 'syz.4.7240': attribute type 2 has an invalid length. [ 397.788485][T20923] netlink: 'syz.4.7240': attribute type 1 has an invalid length. [ 397.824215][T20923] netlink: 'syz.4.7240': attribute type 3 has an invalid length. [ 397.835692][T20923] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7240'. [ 398.593526][T20975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7263'. [ 399.411278][T21021] netlink: 'syz.4.7285': attribute type 4 has an invalid length. [ 399.578595][T21030] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7289'. [ 399.603331][T21030] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7289'. [ 399.623452][T21032] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7290'. [ 399.756520][T21043] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7296'. [ 400.483853][T21084] netlink: 'syz.4.7315': attribute type 10 has an invalid length. [ 400.543586][T21084] dummy0: entered promiscuous mode [ 400.572952][T21084] team0: Port device dummy0 added [ 400.833345][T21095] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.284785][T21125] tap0: tun_chr_ioctl cmd 1074025672 [ 401.303071][T21125] tap0: ignored: set checksum disabled [ 401.887476][T21163] netlink: 'syz.2.7352': attribute type 83 has an invalid length. [ 401.931526][T21168] __nla_validate_parse: 3 callbacks suppressed [ 401.931548][T21168] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.7354'. [ 402.152394][T21180] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7361'. [ 402.346123][T21188] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7364'. [ 402.373472][T21192] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7365'. [ 402.401157][T21194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7367'. [ 403.082672][T21233] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7385'. [ 403.729695][T21261] netlink: 'syz.2.7399': attribute type 9 has an invalid length. [ 404.240067][T21290] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7412'. [ 404.385211][T21296] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.698413][T21317] netlink: 'syz.2.7424': attribute type 33 has an invalid length. [ 404.839400][T21317] bond4: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 404.885824][T21317] bond4 (unregistering): Released all slaves [ 406.170102][T21397] tipc: Enabling of bearer rejected, failed to enable media [ 406.392685][T21412] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7467'. [ 406.444189][T21412] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7467'. [ 406.574899][T21423] netem: incorrect ge model size [ 406.607045][T21423] netem: change failed [ 406.783877][T21436] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7476'. [ 407.223712][T21459] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7486'. [ 407.472421][T21473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7492'. [ 407.597018][T21477] netlink: 232 bytes leftover after parsing attributes in process `syz.3.7493'. [ 407.729623][T21485] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7497'. [ 407.757535][T21485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7497'. [ 407.768769][T21485] netlink: 2 bytes leftover after parsing attributes in process `syz.4.7497'. [ 407.778892][T21485] veth1_to_bridge: entered allmulticast mode [ 407.786037][T21485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7497'. [ 407.795989][T21485] netlink: 2 bytes leftover after parsing attributes in process `syz.4.7497'. [ 408.693476][T21538] netdevsim netdevsim0: Direct firmware load for r1 failed with error -2 [ 408.708872][T21538] netdevsim netdevsim0: Falling back to sysfs fallback for: r1 [ 409.043719][T21560] gretap0: entered promiscuous mode [ 409.050879][T21560] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7527'. [ 409.059869][T21560] gretap0: left promiscuous mode [ 409.343025][T21574] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 409.803778][T21580] nbd1: detected capacity change from 0 to 63 [ 409.851028][ T5641] block nbd1: Receive control failed (result -32) [ 409.861277][ T4944] block nbd1: Receive control failed (result -32) [ 409.862173][T21544] block nbd1: Send control failed (result -32) [ 409.875476][T21544] block nbd1: Request send failed, requeueing [ 409.929671][ T1660] block nbd1: Dead connection, failed to find a fallback [ 409.939764][ T1660] block nbd1: shutting down sockets [ 409.945957][ T1660] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 409.959225][ T1660] Buffer I/O error on dev nbd1, logical block 0, async page read [ 409.968246][T21544] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 409.985533][T21544] Buffer I/O error on dev nbd1, logical block 1, async page read [ 409.995919][T21544] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.005529][T21544] Buffer I/O error on dev nbd1, logical block 2, async page read [ 410.015842][T21544] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.025793][T21544] Buffer I/O error on dev nbd1, logical block 3, async page read [ 410.035891][T21544] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.045516][T21544] Buffer I/O error on dev nbd1, logical block 0, async page read [ 410.058239][T21544] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.069107][T21544] Buffer I/O error on dev nbd1, logical block 1, async page read [ 410.078091][T21544] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.084877][T21599] netlink: 48 bytes leftover after parsing attributes in process `syz.1.7545'. [ 410.087528][T21544] Buffer I/O error on dev nbd1, logical block 2, async page read [ 410.106856][T21544] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.128567][T21544] Buffer I/O error on dev nbd1, logical block 3, async page read [ 410.144037][T21599] unsupported nla_type 7424 [ 410.146750][T21544] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.190831][T21544] Buffer I/O error on dev nbd1, logical block 0, async page read [ 410.200122][T21544] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 410.225442][T21544] Buffer I/O error on dev nbd1, logical block 1, async page read [ 410.274427][T21544] ldm_validate_partition_table(): Disk read failed. [ 410.305266][T21544] Dev nbd1: unable to read RDB block 0 [ 410.329591][T21544] nbd1: unable to read partition table [ 410.453835][T21544] ldm_validate_partition_table(): Disk read failed. [ 410.490304][T21544] Dev nbd1: unable to read RDB block 0 [ 410.515968][T21544] nbd1: unable to read partition table [ 411.257370][T21659] erspan0: entered promiscuous mode [ 411.668888][T21684] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 413.991831][ T5641] block nbd2: Receive control failed (result -32) [ 414.160762][T21807] __nla_validate_parse: 4 callbacks suppressed [ 414.160785][T21807] netlink: 220 bytes leftover after parsing attributes in process `syz.3.7641'. [ 414.186599][T21812] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7637'. [ 414.656707][T21832] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.7650'. [ 414.889066][T21846] netlink: 64 bytes leftover after parsing attributes in process `syz.4.7656'. [ 416.974177][T21940] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7699'. [ 417.107955][T21946] netlink: 'syz.3.7700': attribute type 83 has an invalid length. [ 418.507491][T22027] macvtap1: entered allmulticast mode [ 418.521222][T22027] veth0_macvtap: entered allmulticast mode [ 418.639728][T22039] netlink: 'syz.1.7739': attribute type 4 has an invalid length. [ 419.030075][T22060] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7749'. [ 419.362864][T22078] netlink: 'syz.0.7756': attribute type 83 has an invalid length. [ 419.672914][T22097] netem: change failed [ 419.839455][T22105] netlink: 'syz.0.7768': attribute type 6 has an invalid length. [ 419.962639][T22111] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7773'. [ 420.009124][T22117] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7774'. [ 420.031494][T22117] macvlan2: entered allmulticast mode [ 420.049025][T22117] dummy0: entered allmulticast mode [ 421.216372][T22187] netlink: 'syz.1.7807': attribute type 21 has an invalid length. [ 421.225750][T22187] netlink: 128 bytes leftover after parsing attributes in process `syz.1.7807'. [ 421.244142][T22187] netlink: 'syz.1.7807': attribute type 4 has an invalid length. [ 421.265949][T22187] netlink: 'syz.1.7807': attribute type 5 has an invalid length. [ 421.288749][T22194] netlink: 'syz.1.7807': attribute type 21 has an invalid length. [ 421.313205][T22187] netlink: 3 bytes leftover after parsing attributes in process `syz.1.7807'. [ 421.333630][T22196] netlink: zone id is out of range [ 421.341146][T22194] netlink: 128 bytes leftover after parsing attributes in process `syz.1.7807'. [ 421.363253][T22196] netlink: zone id is out of range [ 421.376667][T22194] netlink: 'syz.1.7807': attribute type 4 has an invalid length. [ 421.396437][T22194] netlink: 'syz.1.7807': attribute type 5 has an invalid length. [ 421.415492][T22194] netlink: 3 bytes leftover after parsing attributes in process `syz.1.7807'. [ 421.435692][T22191] netlink: set zone limit has 4 unknown bytes [ 422.209823][T22239] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7829'. [ 422.644951][T22258] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7839'. [ 423.469098][T22309] netlink: 'syz.4.7860': attribute type 3 has an invalid length. [ 423.507307][T22309] netlink: 'syz.4.7860': attribute type 3 has an invalid length. [ 423.614273][T22309] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7860'. [ 423.813121][T22322] nbd3: detected capacity change from 0 to 127 [ 423.866750][ T5641] block nbd3: Receive control failed (result -32) [ 423.884325][T22219] block nbd3: Dead connection, failed to find a fallback [ 423.905413][T22219] block nbd3: shutting down sockets [ 423.912304][T22219] blk_print_req_error: 138 callbacks suppressed [ 423.912322][T22219] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 423.933149][T22219] buffer_io_error: 138 callbacks suppressed [ 423.933167][T22219] Buffer I/O error on dev nbd3, logical block 0, async page read [ 423.954152][T22219] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 423.964168][T22219] Buffer I/O error on dev nbd3, logical block 1, async page read [ 423.973492][T22219] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 423.983081][T22219] Buffer I/O error on dev nbd3, logical block 2, async page read [ 423.991569][T22219] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 424.009487][T22219] Buffer I/O error on dev nbd3, logical block 3, async page read [ 424.010957][ T29] audit: type=1804 audit(1777888063.822:3): pid=22334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.7872" name="/newroot/1600/cgroup.controllers" dev="tmpfs" ino=8036 res=1 errno=0 [ 424.029387][T22219] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 424.087693][T22219] Buffer I/O error on dev nbd3, logical block 0, async page read [ 424.103099][ T29] audit: type=1800 audit(1777888063.822:4): pid=22334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.7872" name="cgroup.controllers" dev="tmpfs" ino=8036 res=0 errno=0 [ 424.132643][T22219] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 424.137368][T22338] netlink: 'syz.2.7875': attribute type 21 has an invalid length. [ 424.173813][T22338] netlink: 152 bytes leftover after parsing attributes in process `syz.2.7875'. [ 424.176199][T22219] Buffer I/O error on dev nbd3, logical block 1, async page read [ 424.221327][T22219] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 424.253087][T22219] Buffer I/O error on dev nbd3, logical block 2, async page read [ 424.277705][T22219] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 424.305177][T22219] Buffer I/O error on dev nbd3, logical block 3, async page read [ 424.322311][T22219] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 424.349844][T22219] Buffer I/O error on dev nbd3, logical block 0, async page read [ 424.382456][T22219] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 424.410523][T22219] Buffer I/O error on dev nbd3, logical block 1, async page read [ 424.441983][T22219] ldm_validate_partition_table(): Disk read failed. [ 424.473028][T22219] Dev nbd3: unable to read RDB block 0 [ 424.496377][T22219] nbd3: unable to read partition table [ 424.536756][T22219] ldm_validate_partition_table(): Disk read failed. [ 424.574311][T22219] Dev nbd3: unable to read RDB block 0 [ 424.595882][T22219] nbd3: unable to read partition table [ 424.630836][T22361] netlink: 'syz.2.7884': attribute type 4 has an invalid length. [ 426.273338][T22459] netlink: 'syz.2.7929': attribute type 3 has an invalid length. [ 426.429579][T22468] __nla_validate_parse: 1 callbacks suppressed [ 426.429604][T22468] netlink: 190972 bytes leftover after parsing attributes in process `syz.1.7934'. [ 426.508485][T22474] netlink: 'syz.2.7935': attribute type 4 has an invalid length. [ 426.530845][T22474] netlink: 17 bytes leftover after parsing attributes in process `syz.2.7935'. [ 426.565605][T22474] netlink: 14601 bytes leftover after parsing attributes in process `syz.2.7935'. [ 427.037789][T22503] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7951'. [ 427.133509][T22507] netlink: 10 bytes leftover after parsing attributes in process `syz.3.7953'. [ 427.707185][T22546] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7971'. [ 428.571039][T22593] netlink: 'syz.4.7994': attribute type 1 has an invalid length. [ 428.591774][T22593] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7994'. [ 428.704235][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805918f800: rx timeout, send abort [ 428.755031][T22604] netlink: 'syz.2.8000': attribute type 12 has an invalid length. [ 428.766671][T22604] netlink: 190972 bytes leftover after parsing attributes in process `syz.2.8000'. [ 428.939932][T22613] netlink: 'syz.3.8004': attribute type 83 has an invalid length. [ 429.094504][T22623] xt_hashlimit: size too large, truncated to 1048576 [ 429.148459][T22626] –: renamed from vxcan1 (while UP) [ 429.200281][T22628] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8011'. [ 429.214663][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805918f800: abort rx timeout. Force session deactivation [ 429.232984][T22628] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8011'. [ 430.060106][T22669] IPv6: NLM_F_CREATE should be specified when creating new route [ 431.144984][T22728] netlink: 'syz.2.8055': attribute type 5 has an invalid length. [ 431.931507][T22745] netdevsim netdevsim2 netdevsim0: Unsupported IPsec algorithm - please use rfc4106(gcm(aes)) [ 432.887610][T22811] __nla_validate_parse: 4 callbacks suppressed [ 432.887630][T22811] netlink: 48 bytes leftover after parsing attributes in process `syz.3.8088'. [ 432.891420][T22810] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8089'. [ 432.957454][T22816] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8091'. [ 433.009217][T22810] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8089'. [ 433.055905][T22818] netlink: 'syz.0.8092': attribute type 14 has an invalid length. [ 433.337796][T22835] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8100'. [ 433.365454][T22835] netlink: 'syz.4.8100': attribute type 30 has an invalid length. [ 433.410475][T22835] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8100'. [ 433.459963][T22839] netlink: 196 bytes leftover after parsing attributes in process `syz.0.8103'. [ 433.494563][T22842] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8104'. [ 433.536530][T22842] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8104'. [ 433.562563][T22842] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8104'. [ 433.702497][T22854] bond0: entered promiscuous mode [ 433.721257][T22854] bond_slave_0: entered promiscuous mode [ 433.727556][T22854] bond_slave_1: entered promiscuous mode [ 433.743270][T22854] netdevsim netdevsim1 netdevsim1: entered promiscuous mode [ 433.785271][T22854] batadv0: entered promiscuous mode [ 433.812374][T22854] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 433.853403][T22854] bond0: left promiscuous mode [ 433.858810][T22854] bond_slave_0: left promiscuous mode [ 433.869864][T22854] bond_slave_1: left promiscuous mode [ 433.878474][T22854] netdevsim netdevsim1 netdevsim1: left promiscuous mode [ 433.888183][T22854] batadv0: left promiscuous mode [ 435.241946][T22942] sch_fq: defrate 0 ignored. [ 436.370814][T23011] sctp: [Deprecated]: syz.1.8182 (pid 23011) Use of struct sctp_assoc_value in delayed_ack socket option. [ 436.370814][T23011] Use struct sctp_sack_info instead [ 436.439919][T23016] netlink: 'syz.4.8185': attribute type 8 has an invalid length. [ 436.448100][T23016] sch_fq: defrate 0 ignored. [ 436.703407][T23030] netlink: 'syz.4.8191': attribute type 2 has an invalid length. [ 437.561000][T23078] netlink: 'syz.0.8213': attribute type 5 has an invalid length. [ 437.623478][T23085] sctp: [Deprecated]: syz.1.8215 (pid 23085) Use of struct sctp_assoc_value in delayed_ack socket option. [ 437.623478][T23085] Use struct sctp_sack_info instead [ 438.435535][T23130] xt_hashlimit: size too large, truncated to 1048576 [ 438.970000][T23158] __nla_validate_parse: 10 callbacks suppressed [ 438.970022][T23158] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8248'. [ 439.032458][T23158] 8021q: VLANs not supported on wlan0 [ 439.430086][T23178] tap0: tun_chr_ioctl cmd 1074025676 [ 439.455669][T23178] tap0: owner set to 0 [ 439.518727][T23183] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 439.558284][T23183] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 439.989913][T23209] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8272'. [ 440.349853][T23226] netlink: 'syz.4.8279': attribute type 1 has an invalid length. [ 440.359681][T23226] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8279'. [ 440.627394][T23243] tipc: Enabling of bearer rejected, already enabled [ 440.779944][T23255] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8293'. [ 441.397123][T23291] veth1_macvtap: left promiscuous mode [ 441.506116][T23297] netlink: 84 bytes leftover after parsing attributes in process `syz.1.8313'. [ 441.847354][T23316] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8322'. [ 442.258454][T23339] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8334'. [ 442.817453][T23370] h: entered promiscuous mode [ 444.025986][T23442] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 444.592579][T23474] macvlan0: entered promiscuous mode [ 445.079144][T23494] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.8404'. [ 445.109146][T23496] erspan0: left allmulticast mode [ 445.127977][T23496] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8405'. [ 445.336002][T23507] netlink: 'syz.2.8409': attribute type 29 has an invalid length. [ 445.368812][T23510] netlink: 'syz.2.8409': attribute type 29 has an invalid length. [ 445.388125][T23510] netlink: 264 bytes leftover after parsing attributes in process `syz.2.8409'. [ 445.489911][T23514] macvlan0: entered promiscuous mode [ 445.521055][T23514] macvlan0: entered allmulticast mode [ 445.531098][T23514] team0: Device macvlan0 is already an upper device of the team interface [ 446.032572][T23541] syzkaller1: entered promiscuous mode [ 446.047604][T23541] syzkaller1: entered allmulticast mode [ 446.339582][T23560] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8430'. [ 446.574415][T23569] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8437'. [ 446.600049][T23569] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8437'. [ 447.099411][T23597] geneve2: entered promiscuous mode [ 447.120333][T11178] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 50072 - 0 [ 447.142380][T11178] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 50072 - 0 [ 447.155634][T23601] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8450'. [ 447.180039][T11178] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 50072 - 0 [ 447.203961][T11178] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 50072 - 0 [ 447.582607][T23629] netlink: 16215 bytes leftover after parsing attributes in process `syz.2.8463'. [ 447.603993][T23630] netlink: 27 bytes leftover after parsing attributes in process `syz.4.8464'. [ 448.073044][T23655] netlink: 256 bytes leftover after parsing attributes in process `syz.0.8474'. [ 448.216472][T23661] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 449.993204][T23759] tipc: Resetting bearer [ 450.031328][T23755] nbd: device at index 64 is going down [ 450.040313][T23759] veth1_macvtap: entered promiscuous mode [ 450.058348][T23759] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 450.155982][T23759] 8021q: adding VLAN 0 to HW filter on device bond1 [ 450.183670][T23759] 8021q: adding VLAN 0 to HW filter on device bond2 [ 450.211552][T23759] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 450.262639][T23759] 8021q: adding VLAN 0 to HW filter on device bond3 [ 450.308696][T23759] 8021q: adding VLAN 0 to HW filter on device bond4 [ 450.328116][T23762] udevd[23762]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 450.337019][T23759] 8021q: adding VLAN 0 to HW filter on device bond5 [ 450.385822][ T776] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.393194][ T776] bridge0: port 2(bridge_slave_1) entered forwarding state [ 450.404422][T23760] udevd[23760]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 450.456131][ T47] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 450.570849][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 450.835582][T23795] __nla_validate_parse: 5 callbacks suppressed [ 450.835604][T23795] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.8532'. [ 450.959683][T23798] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.8534'. [ 450.984745][T23798] netlink: ct family unspecified [ 451.183347][T23812] netlink: 'syz.1.8542': attribute type 12 has an invalid length. [ 451.195955][T23812] netlink: 'syz.1.8542': attribute type 29 has an invalid length. [ 451.212768][T23812] netlink: 148 bytes leftover after parsing attributes in process `syz.1.8542'. [ 451.232104][T23812] netlink: 'syz.1.8542': attribute type 3 has an invalid length. [ 451.240140][T23812] netlink: 'syz.1.8542': attribute type 2 has an invalid length. [ 451.248065][T23812] netlink: 35 bytes leftover after parsing attributes in process `syz.1.8542'. [ 451.639227][T23834] syzkaller1: entered promiscuous mode [ 451.653598][T23834] syzkaller1: entered allmulticast mode [ 452.034864][T23848] netlink: 104 bytes leftover after parsing attributes in process `syz.3.8557'. [ 452.289529][T23863] syzkaller1: entered promiscuous mode [ 452.310681][T23863] syzkaller1: entered allmulticast mode [ 452.733020][T23892] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 453.058353][T23910] IPv6: NLM_F_CREATE should be specified when creating new route [ 453.639889][T23937] syzkaller1: entered promiscuous mode [ 453.647596][T23937] syzkaller1: entered allmulticast mode [ 453.890334][T23950] bridge0: port 3(batadv1) entered blocking state [ 453.900137][T23950] bridge0: port 3(batadv1) entered disabled state [ 453.907949][T23950] batadv1: entered allmulticast mode [ 453.919133][T23950] batadv1: entered promiscuous mode [ 454.075887][T23957] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8605'. [ 454.396750][ T47] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 454.406958][ T47] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 454.490700][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 454.822177][T23994] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.8620'. [ 455.397004][T24021] netlink: 27 bytes leftover after parsing attributes in process `syz.2.8631'. [ 456.105390][T24052] bridge0: port 1(bridge_slave_0) entered learning state [ 456.566124][T24077] netlink: 68 bytes leftover after parsing attributes in process `syz.0.8655'. [ 456.612103][T24077] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8655'. [ 456.905596][T24096] netlink: 'syz.4.8662': attribute type 11 has an invalid length. [ 457.233634][T24108] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8668'. [ 457.255647][T24108] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8668'. [ 457.285642][T24108] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8668'. [ 457.318982][T24108] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8668'. [ 457.379940][T24115] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8671'. [ 457.416524][T24115] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8671'. [ 457.565037][T24117] syzkaller1: entered promiscuous mode [ 457.578567][T24117] syzkaller1: entered allmulticast mode [ 457.661026][T24126] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8676'. [ 457.671638][T24126] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8676'. [ 457.916266][T24136] netlink: 'syz.3.8681': attribute type 1 has an invalid length. [ 457.930968][T24136] netlink: 'syz.3.8681': attribute type 1 has an invalid length. [ 459.797415][T24241] bridge0: port 4(veth0_to_bridge) entered blocking state [ 459.825246][T24241] bridge0: port 4(veth0_to_bridge) entered disabled state [ 459.849297][T24241] veth0_to_bridge: entered allmulticast mode [ 459.874188][T24241] veth0_to_bridge: entered promiscuous mode [ 459.887894][T24241] bridge0: port 4(veth0_to_bridge) entered blocking state [ 459.897217][T24241] bridge0: port 4(veth0_to_bridge) entered forwarding state [ 461.259828][T24322] veth0: entered promiscuous mode [ 461.314658][T24321] veth0: left promiscuous mode [ 461.646217][T24344] __nla_validate_parse: 10 callbacks suppressed [ 461.646240][T24344] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8777'. [ 461.668715][T24344] netlink: 'syz.0.8777': attribute type 7 has an invalid length. [ 461.684448][T24344] netlink: 'syz.0.8777': attribute type 8 has an invalid length. [ 461.698429][T24344] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8777'. [ 461.872356][T24354] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 462.090724][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 462.751914][T24407] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8807'. [ 463.268124][ T29] audit: type=1800 audit(1777888103.082:5): pid=24429 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.8817" name="memory.events" dev="tmpfs" ino=8673 res=0 errno=0 [ 463.473225][T24441] netlink: 64 bytes leftover after parsing attributes in process `syz.2.8822'. [ 463.702726][T24451] sctp: [Deprecated]: syz.2.8827 (pid 24451) Use of int in max_burst socket option. [ 463.702726][T24451] Use struct sctp_assoc_value instead [ 464.208515][T24480] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 464.233266][T24480] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 464.291153][T24480] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 464.327736][T24490] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8844'. [ 464.383941][T24480] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 464.717542][ T148] smbdirect: ib_dev[syz2] removed [ 464.906307][T24518] netlink: 84 bytes leftover after parsing attributes in process `syz.0.8854'. [ 465.616368][T24558] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8872'. [ 465.685091][T24558] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8872'. [ 465.712278][T24558] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8872'. [ 465.888696][T24573] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8880'. [ 466.830785][T24618] __nla_validate_parse: 1 callbacks suppressed [ 466.830808][T24618] netlink: 207952 bytes leftover after parsing attributes in process `syz.2.8901'. [ 467.333879][T24633] syzkaller1: entered promiscuous mode [ 467.355084][T24633] syzkaller1: entered allmulticast mode [ 467.813336][T24660] netlink: 68 bytes leftover after parsing attributes in process `syz.0.8917'. [ 467.846415][T24663] netlink: 'syz.1.8918': attribute type 39 has an invalid length. [ 468.452415][T24696] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8934'. [ 468.609831][T24705] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8938'. [ 468.785463][T24715] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.8942'. [ 468.790325][T24713] netem: change failed [ 469.433028][T24754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8958'. [ 469.442931][T24754] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8958'. [ 469.455659][T24754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8958'. [ 469.466112][T24754] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8958'. [ 469.967812][T24779] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8968'. [ 469.992590][T24779] netlink: 'syz.3.8968': attribute type 7 has an invalid length. [ 470.011777][T24779] netlink: 'syz.3.8968': attribute type 8 has an invalid length. [ 471.649118][T24855] netlink: 'syz.2.9003': attribute type 4 has an invalid length. [ 472.467749][T24905] __nla_validate_parse: 5 callbacks suppressed [ 472.467765][T24905] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9021'. [ 472.483583][T24905] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9021'. [ 472.681858][T24913] atomic_op ffff888077a6b198 conn xmit_atomic 0000000000000000 [ 472.896134][T24926] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.9029'. [ 472.909858][T24926] netlink: Conntrack attr has 3 unknown bytes [ 473.367615][T24952] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9041'. [ 473.387766][T24954] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9042'. [ 473.393174][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.415491][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.427835][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.440370][T24952] bridge0: port 4(veth0_to_bridge) entered disabled state [ 473.450819][T24952] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.474654][T24954] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 473.539487][T24954] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 473.557048][ T148] smc: removing ib device syz1 [ 473.617615][ T5048] syz1: Port: 1 Link DOWN [ 473.663487][ T148] smbdirect: ib_dev[syz1] removed [ 473.873780][ T776] batman_adv: batadv1: IGMP Querier appeared [ 473.881379][ T776] batman_adv: batadv1: MLD Querier appeared [ 473.937588][T24967] netlink: 'syz.2.9048': attribute type 7 has an invalid length. [ 473.963422][T24967] netlink: 'syz.2.9048': attribute type 7 has an invalid length. [ 474.125916][T24971] netlink: 'syz.3.9050': attribute type 1 has an invalid length. [ 474.169440][T24977] netlink: 'syz.0.9053': attribute type 1 has an invalid length. [ 474.304184][T24982] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 474.311002][T24977] 8021q: adding VLAN 0 to HW filter on device bond3 [ 474.316495][T24982] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 474.482969][T24980] bond3: (slave geneve4): making interface the new active one [ 474.499678][T24988] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 474.514709][T24980] bond3: (slave geneve4): Enslaving as an active interface with an up link [ 474.545463][ T47] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 474.566613][ T47] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 474.599599][ T47] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 474.619701][ T47] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 474.764655][T24996] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9059'. [ 475.333183][T25014] af_packet: tpacket_rcv: packet too big, clamped from 4408 to 3952. macoff=96 [ 475.730264][T25025] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9073'. [ 475.891869][T25034] netlink: 'syz.0.9076': attribute type 14 has an invalid length. [ 475.916648][T25034] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9076'. [ 475.950000][T25034] netlink: 'syz.0.9076': attribute type 14 has an invalid length. [ 475.966832][T25034] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9076'. [ 476.270314][T25040] syzkaller1: entered promiscuous mode [ 476.284066][T25040] syzkaller1: entered allmulticast mode [ 476.318808][T25052] trusted_key: syz.1.9082 sent an empty control message without MSG_MORE. [ 476.357072][T25053] netlink: 'syz.0.9081': attribute type 3 has an invalid length. [ 476.810758][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 477.155893][T25095] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 477.165135][T25095] syzkaller1: Refused to change device type [ 477.393076][T25106] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 477.399041][T25106] syzkaller1: Linktype set failed because interface is up [ 477.412041][ T5632] syzkaller1: tun_net_xmit 90 [ 477.458192][T25111] vcan0: tx address claim with different name [ 477.571294][T25117] netlink: 240 bytes leftover after parsing attributes in process `syz.2.9111'. [ 477.986929][T25140] netlink: 212328 bytes leftover after parsing attributes in process `syz.2.9124'. [ 477.996760][T25140] netlink: Unknown conntrack attr (type=2304, max=9) [ 478.066697][T25146] syzkaller1: entered promiscuous mode [ 478.072928][T25146] syzkaller1: entered allmulticast mode [ 478.494241][T25166] syzkaller1: entered promiscuous mode [ 478.499826][T25166] syzkaller1: entered allmulticast mode [ 478.756688][T25177] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9139'. [ 478.778853][T25177] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9139'. [ 479.905781][T25214] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 480.133557][T25225] netlink: 'syz.3.9156': attribute type 13 has an invalid length. [ 480.150683][T25225] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9156'. [ 480.224729][T25225] netlink: 'syz.3.9156': attribute type 13 has an invalid length. [ 480.258190][T25225] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9156'. [ 480.294993][T25231] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.9158'. [ 480.608823][T25244] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9162'. [ 480.638099][T25244] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9162'. [ 480.922238][T25256] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9168'. [ 482.526818][T25326] netlink: 'syz.0.9201': attribute type 1 has an invalid length. [ 482.566882][T25326] 8021q: adding VLAN 0 to HW filter on device bond4 [ 482.607190][T25326] bond4: (slave geneve5): making interface the new active one [ 482.629988][T25326] bond4: (slave geneve5): Enslaving as an active interface with an up link [ 482.844160][T25341] __nla_validate_parse: 1 callbacks suppressed [ 482.844183][T25341] netlink: 212344 bytes leftover after parsing attributes in process `syz.2.9208'. [ 483.083373][ T29] audit: type=1800 audit(1777888122.902:6): pid=25350 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.9211" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=9401 res=0 errno=0 [ 483.260126][T25362] netlink: 68 bytes leftover after parsing attributes in process `syz.4.9218'. [ 483.271906][T25361] veth0: entered promiscuous mode [ 483.312463][T25361] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9217'. [ 483.449934][T25368] xt_hashlimit: size too large, truncated to 1048576 [ 483.973231][T25388] bond6: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 484.006340][T25388] bond6: (slave lo): Enslaving as an active interface with an up link [ 484.038991][T25388] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 484.158499][T25404] syzkaller1: entered promiscuous mode [ 484.176687][T25404] syzkaller1: entered allmulticast mode [ 485.219798][T25439] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 485.237767][T25440] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9248'. [ 485.248147][T25439] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 486.057181][T25461] netlink: 'syz.1.9259': attribute type 25 has an invalid length. [ 486.075695][T25461] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9259'. [ 486.172364][T25461] netlink: 'syz.1.9259': attribute type 25 has an invalid length. [ 486.184145][T25461] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9259'. [ 487.397050][T25484] netlink: 212328 bytes leftover after parsing attributes in process `syz.1.9269'. [ 487.615891][T25492] netlink: 76 bytes leftover after parsing attributes in process `syz.1.9272'. [ 487.633478][T25492] netlink: 320 bytes leftover after parsing attributes in process `syz.1.9272'. [ 488.059031][T25512] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 488.576746][T25538] netlink: 512 bytes leftover after parsing attributes in process `syz.3.9284'. [ 489.086697][T25564] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.9288'. [ 489.532116][T25584] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.9296'. [ 490.307982][T25597] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.567880][T25606] bond6: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 490.602518][T25606] bond6: (slave lo): Enslaving as an active interface with an up link [ 490.621770][T25617] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9306'. [ 490.641088][T25606] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 490.687917][ T5048] lo speed is unknown, defaulting to 1000 [ 490.939754][ T42] lo speed is unknown, defaulting to 1000 [ 490.946244][ T5632] lo speed is unknown, defaulting to 1000 [ 492.682346][T25701] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9332'. [ 492.726044][T25700] syzkaller1: entered promiscuous mode [ 492.743511][T25700] syzkaller1: entered allmulticast mode [ 493.332706][T25726] netlink: 'syz.4.9341': attribute type 15 has an invalid length. [ 493.575650][T25734] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.9345'. [ 493.641350][T25736] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9346'. [ 494.697735][T25779] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 496.695667][T25743] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 496.708112][T25782] netlink: 'syz.3.9362': attribute type 1 has an invalid length. [ 496.745013][T25782] netlink: 224 bytes leftover after parsing attributes in process `syz.3.9362'. [ 496.819448][T25782] workqueue: Failed to create a rescuer kthread for wq "phy2-mac-cmds": -EINTR [ 497.221561][T25813] pim6reg1: entered promiscuous mode [ 497.238163][T25813] pim6reg1: entered allmulticast mode [ 497.497927][T25830] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9382'. [ 497.561980][T25832] ip6erspan0: entered promiscuous mode [ 497.587069][T25835] vcan0: tx drop: invalid da for name 0x0000000000000002 [ 497.698132][T25840] netlink: 212344 bytes leftover after parsing attributes in process `syz.0.9385'. [ 498.016442][T25848] bridge6: entered promiscuous mode [ 498.024977][T25848] bridge6: entered allmulticast mode [ 498.034475][T25848] team0: Port device bridge6 added [ 498.050113][T25848] bridge0: port 4(team0) entered blocking state [ 498.057462][T25848] bridge0: port 4(team0) entered disabled state [ 498.065116][T25848] team0: entered allmulticast mode [ 498.075750][T25848] team_slave_0: entered allmulticast mode [ 498.085701][T25848] team_slave_1: entered allmulticast mode [ 498.116016][T25848] team0: left allmulticast mode [ 498.127529][T25848] team_slave_0: left allmulticast mode [ 498.145322][T25848] team_slave_1: left allmulticast mode [ 498.457904][T25856] IPVS: Scheduler module ip_vs_sip not found [ 498.581796][T25867] netlink: 'syz.3.9396': attribute type 1 has an invalid length. [ 499.388751][T25912] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9410'. [ 499.435342][T25909] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9409'. [ 499.630698][T25920] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.9414'. [ 499.893515][T25937] netlink: 'syz.4.9421': attribute type 11 has an invalid length. [ 499.902377][T25937] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9421'. [ 499.919576][T25937] netlink: 'syz.4.9421': attribute type 11 has an invalid length. [ 499.922813][T11178] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.927808][T25937] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9421'. [ 499.937199][T11178] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.956055][T11178] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.969440][T11178] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 500.417995][T25953] netlink: 'syz.4.9429': attribute type 1 has an invalid length. [ 500.457255][T25953] bond7: (slave ip6gretap1): making interface the new active one [ 500.465926][T25953] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 500.475886][T25953] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 500.483929][T25953] bond7: (slave ip6gretap1): Enslaving as an active interface with an up link [ 502.013454][T25891] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 502.359958][T26017] netlink: 32 bytes leftover after parsing attributes in process `syz.0.9458'. [ 502.381323][T26017] bridge: RTM_NEWNEIGH with invalid ether address [ 502.393594][T26017] netlink: 32 bytes leftover after parsing attributes in process `syz.0.9458'. [ 502.406637][T26017] bridge: RTM_NEWNEIGH with invalid ether address [ 504.182643][T26107] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.9496'. [ 504.384266][T26113] veth0: entered promiscuous mode [ 504.406022][T26112] veth0: left promiscuous mode [ 504.833832][T26131] netlink: 52 bytes leftover after parsing attributes in process `syz.2.9503'. [ 504.870766][T26131] netlink: 52 bytes leftover after parsing attributes in process `syz.2.9503'. [ 505.180190][T26139] veth0_to_bridge: left allmulticast mode [ 505.225446][T26139] veth0_to_bridge: left promiscuous mode [ 505.263665][T26139] bridge0: port 4(veth0_to_bridge) entered disabled state [ 505.307616][T26139] bridge_slave_0: left allmulticast mode [ 505.331924][T26139] bridge_slave_0: left promiscuous mode [ 505.348370][T26139] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.385353][T26139] bridge_slave_1: left promiscuous mode [ 505.404407][T26139] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.437784][T26139] bond0: (slave bond_slave_0): Releasing backup interface [ 505.469277][T26139] bond_slave_0: left allmulticast mode [ 505.503339][T26139] bond0: (slave bond_slave_1): Releasing backup interface [ 505.523580][T26139] bond_slave_1: left allmulticast mode [ 505.544589][T26139] team0: Port device team_slave_0 removed [ 505.563706][T26139] team0: Port device team_slave_1 removed [ 505.571418][T26139] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.579012][T26139] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.589327][T26139] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 505.598226][T26139] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 505.609364][T26139] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 506.250651][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 506.554764][T26180] netlink: 184 bytes leftover after parsing attributes in process `syz.0.9516'. [ 506.828478][T26086] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 508.433823][T26270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9557'. [ 508.443767][T26270] netlink: 'syz.0.9557': attribute type 29 has an invalid length. [ 508.452561][T26270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9557'. [ 508.466576][T26270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9557'. [ 508.478312][T26270] netlink: 'syz.0.9557': attribute type 29 has an invalid length. [ 508.486882][T26270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9557'. [ 509.034950][T26298] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9567'. [ 509.980859][T26341] netlink: 'syz.3.9584': attribute type 1 has an invalid length. [ 510.118987][T26345] bond2: (slave geneve2): making interface the new active one [ 510.127767][T26345] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 510.147760][T11180] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 510.174236][T11180] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 510.209758][T11180] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 510.225617][T11180] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 510.946642][T26362] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.9590'. [ 510.950142][T26360] xt_hashlimit: size too large, truncated to 1048576 [ 512.375108][T26428] netlink: 92 bytes leftover after parsing attributes in process `syz.1.9607'. [ 513.631821][T26475] syzkaller0: entered promiscuous mode [ 513.655263][T26475] syzkaller0: entered allmulticast mode [ 513.678194][T26479] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9621'. [ 514.103609][T26498] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9628'. [ 514.124587][T26498] netlink: 'syz.2.9628': attribute type 7 has an invalid length. [ 514.145454][T26498] netlink: 'syz.2.9628': attribute type 8 has an invalid length. [ 514.175736][T26498] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9628'. [ 514.726059][T26533] tipc: Failed to remove unknown binding: 66,1,1/10005162:3336349842/3336349844 [ 514.738954][T26533] tipc: Failed to remove unknown binding: 66,1,1/10005162:3336349842/3336349844 [ 515.083952][T26556] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9651'. [ 515.094703][T26556] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9651'. [ 515.437689][T26572] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9661'. [ 515.962454][T26583] netlink: 'syz.3.9666': attribute type 1 has an invalid length. [ 516.055626][T26583] 8021q: adding VLAN 0 to HW filter on device bond3 [ 516.165864][T26589] bond3: (slave gretap1): making interface the new active one [ 516.198148][T26589] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 516.421035][T26597] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9670'. [ 516.476248][T11176] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.491020][T26597] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9670'. [ 516.515850][T11176] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.590502][T11176] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.622622][T11176] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.692313][T26608] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9676'. [ 516.702418][T26608] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9676'. [ 516.794413][T26615] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9678'. [ 516.840141][T26615] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9678'. [ 516.945399][T26624] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9681'. [ 517.091409][T26629] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9684'. [ 517.191797][T26635] syzkaller1: entered promiscuous mode [ 517.209448][T26635] syzkaller1: entered allmulticast mode [ 517.580014][T26647] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.9691'. [ 517.768390][T26649] block nbd1: NBD_DISCONNECT [ 517.785491][T26644] syzkaller0: entered promiscuous mode [ 517.794590][T26651] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 517.806495][T26649] block nbd1: Send disconnect failed -32 [ 517.815260][T26644] syzkaller0: entered allmulticast mode [ 517.832251][T26649] block nbd1: Send disconnect failed -32 [ 519.917373][T26691] GUP no longer grows the stack in syz.2.9704 (26691): 200000003000-20000000a000 (200000001000) [ 519.934394][T26691] CPU: 1 UID: 0 PID: 26691 Comm: syz.2.9704 Not tainted syzkaller #0 PREEMPT(full) [ 519.934425][T26691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 519.934437][T26691] Call Trace: [ 519.934445][T26691] [ 519.934453][T26691] dump_stack_lvl+0xe8/0x150 [ 519.934481][T26691] __get_user_pages+0x2378/0x2720 [ 519.934511][T26691] ? __gup_longterm_locked+0xc4e/0x1630 [ 519.934554][T26691] ? __gup_longterm_locked+0xc4e/0x1630 [ 519.934577][T26691] ? down_read_killable+0x1bb/0x340 [ 519.934612][T26691] __gup_longterm_locked+0xdcf/0x1630 [ 519.934642][T26691] ? lock_acquire+0x106/0x350 [ 519.934682][T26691] gup_fast_fallback+0x1d84/0x20d0 [ 519.934742][T26691] ? __pfx_gup_fast_fallback+0x10/0x10 [ 519.934768][T26691] ? is_valid_gup_args+0x11f/0x200 [ 519.934794][T26691] ? get_user_pages_fast+0x4d/0xb0 [ 519.934820][T26691] __iov_iter_get_pages_alloc+0x370/0xa10 [ 519.934857][T26691] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 519.934899][T26691] iov_iter_get_pages2+0x5e/0xa0 [ 519.934931][T26691] __se_sys_vmsplice+0x7c7/0x1620 [ 519.934980][T26691] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 519.935007][T26691] ? __pfx_futex_wait+0x10/0x10 [ 519.935047][T26691] ? lockdep_hardirqs_on+0x7a/0x110 [ 519.935141][T26691] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.935162][T26691] do_syscall_64+0x15f/0xf80 [ 519.935183][T26691] ? trace_irq_disable+0x3b/0x140 [ 519.935210][T26691] ? clear_bhb_loop+0x40/0x90 [ 519.935232][T26691] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.935250][T26691] RIP: 0033:0x7f49c719cdd9 [ 519.935269][T26691] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.935285][T26691] RSP: 002b:00007f49c80d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 519.935305][T26691] RAX: ffffffffffffffda RBX: 00007f49c7415fa0 RCX: 00007f49c719cdd9 [ 519.935319][T26691] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000005 [ 519.935330][T26691] RBP: 00007f49c7232d69 R08: 0000000000000000 R09: 0000000000000000 [ 519.935341][T26691] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 519.935352][T26691] R13: 00007f49c7416038 R14: 00007f49c7415fa0 R15: 00007ffdfa1be3d8 [ 519.935386][T26691] [ 521.687088][T26733] netlink: 'syz.1.9715': attribute type 1 has an invalid length. [ 521.745466][T26735] sctp: [Deprecated]: syz.2.9716 (pid 26735) Use of int in maxseg socket option. [ 521.745466][T26735] Use struct sctp_assoc_value instead [ 521.895318][T26740] netlink: 'syz.0.9717': attribute type 21 has an invalid length. [ 521.907145][T26740] netlink: 'syz.0.9717': attribute type 22 has an invalid length. [ 521.918604][T26740] netlink: 'syz.0.9717': attribute type 23 has an invalid length. [ 521.927616][T26740] netlink: 'syz.0.9717': attribute type 25 has an invalid length. [ 521.936649][T26740] netlink: 96 bytes leftover after parsing attributes in process `syz.0.9717'. [ 522.029300][T26745] netlink: 'syz.0.9719': attribute type 18 has an invalid length. [ 522.093334][T26733] bond7: entered promiscuous mode [ 522.110870][T26733] 8021q: adding VLAN 0 to HW filter on device bond7 [ 522.144331][T26738] 8021q: adding VLAN 0 to HW filter on device bond7 [ 522.162472][T26738] bond7: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 522.190615][T26738] bond7: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 522.236624][T26738] bond7: (slave ip6gre2): making interface the new active one [ 522.251264][T26738] ip6gre2: entered promiscuous mode [ 522.259816][T26738] bond7: (slave ip6gre2): Enslaving as an active interface with an up link [ 522.339251][T26745] netlink: 'syz.0.9719': attribute type 18 has an invalid length. [ 522.374159][ T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.398603][ T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.429504][ T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.455164][ T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 522.717091][T26759] netlink: 'syz.2.9724': attribute type 1 has an invalid length. [ 522.838592][T26761] bond4: (slave gretap1): making interface the new active one [ 522.863029][T26761] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 522.984681][T26764] syzkaller0: entered promiscuous mode [ 522.991866][T26764] syzkaller0: entered allmulticast mode [ 523.509353][T26774] netlink: 'syz.1.9727': attribute type 1 has an invalid length. [ 523.531071][T26774] netlink: 'syz.1.9727': attribute type 4 has an invalid length. [ 523.551082][T26774] netlink: 9491 bytes leftover after parsing attributes in process `syz.1.9727'. [ 524.167194][T26782] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.9730'. [ 524.177500][T26782] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 526.727924][T26820] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9743'. [ 527.317128][T26842] netlink: 7 bytes leftover after parsing attributes in process `syz.3.9753'. [ 527.395772][T26844] netlink: 'syz.2.9754': attribute type 1 has an invalid length. [ 527.437112][T26847] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9755'. [ 527.470100][T26844] 8021q: adding VLAN 0 to HW filter on device bond5 [ 527.689714][T26857] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.9759'. [ 528.203251][T26881] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9767'. [ 528.216902][T26881] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9767'. [ 528.494087][T26894] netlink: 14544 bytes leftover after parsing attributes in process `syz.2.9771'. [ 529.124412][T26922] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9777'. [ 529.419575][T26804] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 529.749247][T26946] syzkaller0: entered promiscuous mode [ 529.756552][T26946] syzkaller0: entered allmulticast mode [ 530.126098][T26963] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9789'. [ 533.389049][T26989] tipc: Resetting bearer [ 533.436459][T27017] netlink: 'syz.4.9806': attribute type 1 has an invalid length. [ 533.477168][T26989] batman_adv: batadv0: Interface deactivated: ipvlan3 [ 533.489826][T26989] veth0_macvtap: left allmulticast mode [ 533.663193][ T79] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.686375][ T79] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.709289][T27018] bond8: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 533.721951][T27018] bond8: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 533.731064][T27024] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9808'. [ 533.743233][T27018] bond8: (slave ip6gre1): making interface the new active one [ 533.752191][T27018] bond8: (slave ip6gre1): Enslaving as an active interface with an up link [ 533.840843][T27030] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9810'. [ 533.886486][ T148] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.901641][ T148] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.920546][ T148] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.940504][ T148] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.049675][ T148] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 534.095945][ T148] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.268119][T27046] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9816'. [ 534.369408][T27049] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9820'. [ 534.578830][T27063] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9822'. [ 534.579988][T27057] lo speed is unknown, defaulting to 1000 [ 534.967377][T27079] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9826'. [ 535.577874][T27066] bridge0: entered promiscuous mode [ 535.597214][T27066] bridge0: entered allmulticast mode [ 535.703923][T27095] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9831'. [ 535.925367][T27097] netlink: 'syz.2.9832': attribute type 1 has an invalid length. [ 536.006870][T27104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9832'. [ 536.099965][T27104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9832'. [ 536.150177][T27097] bond6: entered promiscuous mode [ 536.166535][T27097] 8021q: adding VLAN 0 to HW filter on device bond6 [ 536.192664][T27117] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9837'. [ 536.305813][T27108] bond6: (slave bridge11): making interface the new active one [ 536.314121][T27108] bridge11: entered promiscuous mode [ 536.323596][T27108] bond6: (slave bridge11): Enslaving as an active interface with an up link [ 536.425483][T27126] netlink: 'syz.0.9840': attribute type 1 has an invalid length. [ 536.591099][T27130] netlink: 'syz.1.9842': attribute type 2 has an invalid length. [ 540.031982][T27206] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 540.040227][T27206] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 540.046909][T27206] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 540.053428][T27206] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 540.059969][T27206] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 540.066492][T27206] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 540.073115][T27206] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 540.079705][T27206] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 540.086376][T27206] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 540.092894][T27206] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 540.347315][T27217] __nla_validate_parse: 3 callbacks suppressed [ 540.347336][T27217] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9875'. [ 540.548799][T27227] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9879'. [ 540.979137][T27247] netlink: 'syz.2.9887': attribute type 1 has an invalid length. [ 541.085075][T27247] 8021q: adding VLAN 0 to HW filter on device bond7 [ 541.157586][T27252] 8021q: adding VLAN 0 to HW filter on device bond7 [ 541.167546][T27252] bond7: (slave vcan1): The slave device specified does not support setting the MAC address [ 541.201254][T27252] bond7: (slave vcan1): Error -95 calling set_mac_address [ 541.908862][T27254] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 542.441685][T27301] netlink: 'syz.2.9902': attribute type 1 has an invalid length. [ 542.637515][T27304] bond8: (slave vxcan5): The slave device specified does not support setting the MAC address [ 542.652247][T27304] bond8: (slave vxcan5): Setting fail_over_mac to active for active-backup mode [ 542.706372][T27304] bond8: (slave vxcan5): making interface the new active one [ 542.733572][T27304] bond8: (slave vxcan5): Enslaving as an active interface with an up link [ 542.856728][T27306] bond8: (slave vxcan7): The slave device specified does not support setting the MAC address [ 542.911455][T27306] bond8: (slave vxcan7): Enslaving as a backup interface with an up link [ 543.062994][T27315] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9905'. [ 543.063739][T27317] syzkaller0: entered promiscuous mode [ 543.108001][T27317] syzkaller0: entered allmulticast mode [ 543.143476][T27317] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 543.254436][T27320] syzkaller1: entered promiscuous mode [ 543.267464][T27320] syzkaller1: entered allmulticast mode [ 543.351122][T27308] scsi_nl_rcv_msg: discarding partial skb [ 543.519553][T27324] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9908'. [ 543.577510][T27324] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9908'. [ 543.783349][T27330] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9912'. [ 544.707059][T27371] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9926'. [ 544.975660][T27378] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9929'. [ 545.214160][T27389] net_ratelimit: 14 callbacks suppressed [ 545.214180][T27389] syzkaller0: mtu less than device minimum [ 545.475786][T27398] netlink: 'syz.3.9937': attribute type 1 has an invalid length. [ 545.534471][T27398] bond4: entered promiscuous mode [ 545.540036][T27398] 8021q: adding VLAN 0 to HW filter on device bond4 [ 545.557935][T27403] bond4: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 545.571308][T27403] bond4: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 545.581963][T27403] bond4: (slave ipvlan3): Setting fail_over_mac to active for active-backup mode [ 545.978020][T27422] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9948'. [ 546.107631][T27426] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 546.980019][T27453] vlan2: entered allmulticast mode [ 546.997096][T27339] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 547.020848][T27453] veth1_virt_wifi: entered allmulticast mode [ 547.474424][T27474] : entered promiscuous mode [ 548.270004][T27511] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9979'. [ 548.300109][T27511] 8021q: adding VLAN 0 to HW filter on device bond5 [ 548.324558][T27511] ipvlan2: entered allmulticast mode [ 548.329910][T27511] bond5: entered allmulticast mode [ 548.346309][T27511] bond5: (slave ipip2): refused to change device type [ 548.457181][T27514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9980'. [ 548.468676][T27514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9980'. [ 548.556635][T27518] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 548.618929][T27518] xt_hashlimit: size too large, truncated to 1048576 [ 550.099178][T27546] netlink: 'syz.0.9989': attribute type 2 has an invalid length. [ 550.449457][T27478] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 550.583740][T27555] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9993'. [ 550.676440][T27563] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9996'. [ 552.098342][T27605] netlink: 'syz.2.10010': attribute type 4 has an invalid length. [ 552.132696][T27609] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10012'. [ 552.148974][T27609] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10012'. [ 552.322596][T27620] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10016'. [ 552.368628][T27621] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 552.621516][T27638] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10023'. [ 552.669375][T27638] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10023'. [ 552.697723][T27638] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10023'. [ 552.783170][T27642] bond5: entered promiscuous mode [ 552.797291][T27646] macvlan2: entered promiscuous mode [ 552.802884][T27646] macvlan2: entered allmulticast mode [ 552.809182][T27646] bond5: (slave macvlan2): Opening slave failed [ 553.123440][T27661] tipc: Enabled bearer , priority 0 [ 553.144883][T27663] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10034'. [ 553.214164][T27661] syzkaller0: entered promiscuous mode [ 553.219835][T27661] syzkaller0: entered allmulticast mode [ 553.227248][T27661] tipc: Resetting bearer [ 553.314545][T27659] tipc: Resetting bearer [ 554.309867][T27694] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10043'. [ 554.319251][T27694] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10043'. [ 556.002048][T27659] tipc: Disabling bearer [ 556.160130][T27666] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 556.528252][T27741] netlink: 16150 bytes leftover after parsing attributes in process `syz.2.10063'. [ 556.618074][T27746] bond6: (slave lo): Releasing backup interface [ 556.626506][T27746] bond6: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 556.684766][T27746] dummy0: left promiscuous mode [ 556.702596][T27746] team0: Port device dummy0 removed [ 556.713935][T27746] bridge_slave_0: left allmulticast mode [ 556.719657][T27746] bridge_slave_0: left promiscuous mode [ 556.725746][T27746] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.736199][T27746] bridge_slave_1: left promiscuous mode [ 556.743954][T27746] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.757546][T27746] bond0: (slave bond_slave_0): Releasing backup interface [ 556.777220][T27746] bond0: (slave bond_slave_1): Releasing backup interface [ 556.794869][T27746] team_slave_0: left promiscuous mode [ 556.815881][T27746] team0: Port device team_slave_0 removed [ 556.827177][T27746] team_slave_1: left promiscuous mode [ 556.848991][T27746] team0: Port device team_slave_1 removed [ 556.862251][T27746] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 556.869848][T27746] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 556.880222][T27746] tipc: Resetting bearer [ 556.887471][T27746] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 556.904408][ T5632] lo speed is unknown, defaulting to 1000 [ 556.910910][T25616] lo speed is unknown, defaulting to 1000 [ 556.919058][ T5632] syz0: Port: 1 Link DOWN [ 556.946942][T27756] syzkaller1: entered promiscuous mode [ 556.953704][T27756] syzkaller1: entered allmulticast mode [ 557.143423][T27765] __nla_validate_parse: 2 callbacks suppressed [ 557.143445][T27765] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10070'. [ 557.159633][T27728] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 557.195379][T27767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10071'. [ 557.697400][T27788] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10080'. [ 558.348353][T27819] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10092'. [ 558.873777][T27831] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.10097'. [ 561.090663][T27804] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 561.959320][T27857] netlink: 'syz.0.10106': attribute type 1 has an invalid length. [ 561.996872][T27857] bond6: entered promiscuous mode [ 562.003319][T27857] 8021q: adding VLAN 0 to HW filter on device bond6 [ 562.109894][T27857] bond6: (slave bridge11): making interface the new active one [ 562.118308][T27857] bridge11: entered promiscuous mode [ 562.119463][T27856] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10107'. [ 562.133888][T27857] bond6: (slave bridge11): Enslaving as an active interface with an up link [ 562.242144][T27863] bond6: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 562.261117][T27863] bond6: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 562.347166][T27872] netlink: 'syz.1.10110': attribute type 1 has an invalid length. [ 562.466228][T27878] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10113'. [ 562.629425][T27885] syz_tun: entered allmulticast mode [ 563.099107][T27906] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10125'. [ 563.631853][T27924] netlink: 'syz.0.10133': attribute type 1 has an invalid length. [ 563.682856][T27924] 8021q: adding VLAN 0 to HW filter on device bond7 [ 563.785260][T27931] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 563.787917][T27933] dvmrp0: entered allmulticast mode [ 563.903311][T27940] syzkaller1: entered promiscuous mode [ 563.909045][T27940] syzkaller1: entered allmulticast mode [ 564.698501][T27937] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 565.442205][T27994] bridge0: port 1(vlan2) entered blocking state [ 565.461664][T27994] bridge0: port 1(vlan2) entered disabled state [ 565.498065][T27994] vlan2: entered allmulticast mode [ 565.523865][T27994] geneve0: entered allmulticast mode [ 565.738375][T28006] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10160'. [ 565.896506][T28015] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10161'. [ 566.626080][T28044] netlink: 'syz.3.10170': attribute type 1 has an invalid length. [ 566.737241][T28044] 8021q: adding VLAN 0 to HW filter on device bond6 [ 566.838887][T28046] bond6: (slave bridge5): making interface the new active one [ 566.860204][T28046] bond6: (slave bridge5): Enslaving as an active interface with an up link [ 566.986300][T28054] tipc: Enabled bearer , priority 0 [ 567.012266][T28057] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 567.019567][T28057] IPv6: NLM_F_CREATE should be set when creating new route [ 567.097735][T28054] syzkaller0: entered promiscuous mode [ 567.104023][T28054] syzkaller0: entered allmulticast mode [ 567.126137][T28060] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 567.242746][T28065] erspan0: left promiscuous mode [ 567.821020][T28065] bond4: left promiscuous mode [ 567.827974][T28065] bond5: left promiscuous mode [ 567.849328][T28052] tipc: Resetting bearer [ 568.330618][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 570.246293][T28052] tipc: Disabling bearer [ 570.297669][ T79] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.330468][ T79] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.371961][ T79] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 570.400526][ T79] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.411360][ T79] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.433689][ T79] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 570.471673][ T79] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.485889][ T79] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.521300][ T79] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 570.557726][ T79] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 570.589071][ T79] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 570.620526][ T79] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 570.870035][T28120] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10189'. [ 571.540211][T28134] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10190'. [ 571.648162][T28134] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10190'. [ 571.733670][T28143] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10192'. [ 571.942403][T28141] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 571.969373][T28141] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 572.132682][T28159] netlink: 'syz.1.10196': attribute type 1 has an invalid length. [ 572.195490][T28161] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10197'. [ 572.533581][T28171] 8021q: adding VLAN 0 to HW filter on device bond8 [ 572.580447][T28171] bond8 (unregistering): Released all slaves [ 573.069569][T11180] nci: nci_ntf_packet: unsupported ntf opcode 0xf00 [ 573.513044][T28218] netlink: 'syz.4.10208': attribute type 39 has an invalid length. [ 573.530155][T28219] syzkaller0: entered promiscuous mode [ 573.542025][T28219] syzkaller0: entered allmulticast mode [ 574.569340][T28266] netlink: 576 bytes leftover after parsing attributes in process `syz.4.10218'. [ 574.582518][T28266] tipc: Resetting bearer [ 574.591798][T28266] tipc: Resetting bearer [ 575.254812][T28277] rdma_rxe: rxe_newlink: failed to add veth0_vlan [ 575.379903][T28283] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10223'. [ 575.829264][T28193] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 576.046080][T28296] netlink: 'syz.3.10229': attribute type 4 has an invalid length. [ 576.085073][T28296] netlink: 'syz.3.10229': attribute type 4 has an invalid length. [ 576.094914][T28298] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10230'. [ 576.568993][T28317] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10237'. [ 576.799908][T28331] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10242'. [ 576.802925][T28333] netlink: 'syz.3.10244': attribute type 1 has an invalid length. [ 576.836024][T28335] netlink: 'syz.2.10243': attribute type 2 has an invalid length. [ 576.888723][T28333] bond8: (slave vxcan2): The slave device specified does not support setting the MAC address [ 576.925884][T28333] bond8: (slave vxcan2): Setting fail_over_mac to active for active-backup mode [ 576.958712][T28333] bond8: (slave vxcan2): making interface the new active one [ 576.990814][T28333] bond8: (slave vxcan2): Enslaving as an active interface with an up link [ 576.992576][ T5641] block nbd1: Receive control failed (result -1) [ 577.199658][T28346] syzkaller1: entered promiscuous mode [ 577.212044][T28346] syzkaller1: entered allmulticast mode [ 577.909200][T28366] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.917073][T28366] bridge0: port 1(bridge_slave_0) entered disabled state [ 578.046386][T28366] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 578.064173][T28366] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 578.254792][ T148] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.266544][ T148] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.276284][ T148] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.292750][ T148] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.379987][ T148] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.408733][ T148] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.797728][T28399] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10265'. [ 579.324886][T28410] syzkaller0: entered promiscuous mode [ 579.331559][T28410] syzkaller0: entered allmulticast mode [ 579.547829][T28419] batadv_slave_0: entered promiscuous mode [ 579.924423][T28434] netlink: 'syz.4.10280': attribute type 1 has an invalid length. [ 579.966025][T28434] 8021q: adding VLAN 0 to HW filter on device bond10 [ 579.975751][T28437] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10280'. [ 580.001897][T28438] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10281'. [ 580.017744][T28437] bond10: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 580.032815][T28437] bond10: entered allmulticast mode [ 580.077521][T28438] bond8: entered promiscuous mode [ 580.083278][T28438] 8021q: adding VLAN 0 to HW filter on device bond8 [ 580.112156][T28434] bond10: (slave ip6gretap2): Enslaving as an active interface with an up link [ 580.191356][T28438] 8021q: adding VLAN 0 to HW filter on device bond8 [ 580.211022][T28438] bond8: (slave sit2): The slave device specified does not support setting the MAC address [ 580.229752][T28438] bond8: (slave sit2): Error -95 calling set_mac_address [ 580.247483][T28448] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10284'. [ 580.522602][T28444] syzkaller0: entered promiscuous mode [ 580.539155][T28444] syzkaller0: entered allmulticast mode [ 580.714227][T28460] netlink: 'syz.2.10287': attribute type 1 has an invalid length. [ 583.264154][T28460] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 583.379139][T28475] syzkaller0: entered promiscuous mode [ 583.408349][T28475] syzkaller0: entered allmulticast mode [ 583.558750][T28480] syzkaller0: entered promiscuous mode [ 583.565169][T28480] syzkaller0: entered allmulticast mode [ 583.729593][T28487] netlink: 40 bytes leftover after parsing attributes in process `syz.3.10296'. [ 583.829138][T28489] syzkaller0: entered promiscuous mode [ 583.850586][T28489] syzkaller0: entered allmulticast mode [ 583.928423][T28498] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10301'. [ 583.958979][T28498] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 584.008825][T28498] team1: entered promiscuous mode [ 584.017054][T28498] team1: entered allmulticast mode [ 584.024013][T28501] batadv_slave_0: entered promiscuous mode [ 584.093704][T28505] syzkaller0: entered promiscuous mode [ 584.108664][T28505] syzkaller0: entered allmulticast mode [ 584.240250][T28516] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10307'. [ 584.255368][T28516] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10307'. [ 584.483682][T28520] tipc: Enabled bearer , priority 0 [ 584.584997][T28520] syzkaller0: entered promiscuous mode [ 584.590872][T28520] syzkaller0: entered allmulticast mode [ 584.597354][T28520] tipc: Resetting bearer [ 584.624126][T28526] syzkaller0: entered promiscuous mode [ 584.640175][T28526] syzkaller0: entered allmulticast mode [ 584.653159][T28519] tipc: Resetting bearer [ 585.546735][T28540] netlink: 'syz.3.10315': attribute type 1 has an invalid length. [ 587.243953][T28519] tipc: Disabling bearer [ 587.284706][T28540] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 587.287884][T28542] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 587.312385][T28543] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 587.523561][T28557] syzkaller0: entered promiscuous mode [ 587.553560][T28557] syzkaller0: entered allmulticast mode [ 587.566643][T28557] TC_ACT_REPEAT abuse ? [ 587.630258][T28562] syzkaller0: entered promiscuous mode [ 587.637302][T28562] syzkaller0: entered allmulticast mode [ 587.761143][T28566] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10323'. [ 587.823283][T28566] bond9: entered promiscuous mode [ 587.840548][T28566] bond9: entered allmulticast mode [ 588.109235][T28576] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10327'. [ 588.163642][ T5641] block nbd5: Receive control failed (result -1) [ 588.805461][T28591] syzkaller0: entered promiscuous mode [ 588.816570][T28591] syzkaller0: entered allmulticast mode [ 589.361562][T28621] netlink: 'syz.0.10337': attribute type 1 has an invalid length. [ 589.586770][T28626] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10337'. [ 591.319109][T28581] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 591.459368][T28628] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10338'. [ 591.601608][T28621] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 591.620142][T28628] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10338'. [ 592.167401][T28658] netlink: 'syz.1.10351': attribute type 1 has an invalid length. [ 592.283957][T28665] 8021q: adding VLAN 0 to HW filter on device bond9 [ 592.293376][T28665] bond8: (slave bond9): making interface the new active one [ 592.301798][T28665] bond8: (slave bond9): Enslaving as an active interface with an up link [ 592.336405][T28658] bond8: (slave gretap2): Enslaving as a backup interface with an up link [ 592.339494][T28665] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10351'. [ 592.367662][T28665] 8021q: adding VLAN 0 to HW filter on device bond8 [ 592.480016][T28677] syzkaller0: entered promiscuous mode [ 592.486473][T28677] syzkaller0: entered allmulticast mode [ 592.685691][T28681] syzkaller0: entered promiscuous mode [ 592.693377][T28681] syzkaller0: entered allmulticast mode [ 592.857109][T28685] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10359'. [ 592.897796][T28685] bond10: (slave bridge5): Enslaving as an active interface with an up link [ 592.914872][T28685] macvlan0: entered promiscuous mode [ 592.920439][T28685] macvlan0: entered allmulticast mode [ 592.926716][T28685] bond10: entered promiscuous mode [ 592.932475][T28685] bridge5: entered promiscuous mode [ 592.941659][T28685] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 592.956513][T28685] bond10: left promiscuous mode [ 592.962669][T28685] bridge5: left promiscuous mode [ 593.096742][T28693] syzkaller0: entered promiscuous mode [ 593.102719][T28693] syzkaller0: entered allmulticast mode [ 595.109605][T28651] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 595.340197][T28706] syzkaller0: entered promiscuous mode [ 595.345964][T28706] syzkaller0: entered allmulticast mode [ 595.352227][T28709] netlink: 'syz.0.10366': attribute type 1 has an invalid length. [ 596.164863][T28711] bond9: (slave vxcan1): The slave device specified does not support setting the MAC address [ 596.187507][T28711] bond9: (slave vxcan1): Error -95 calling set_mac_address [ 596.246199][T28739] netlink: 'syz.3.10372': attribute type 1 has an invalid length. [ 596.322804][T28717] bond9: (slave bridge13): Enslaving as an active interface with a down link [ 596.349827][T28722] macvlan7: entered promiscuous mode [ 596.355999][T28722] macvlan7: entered allmulticast mode [ 596.371482][T28722] bond9: entered promiscuous mode [ 596.387674][T28722] 8021q: adding VLAN 0 to HW filter on device macvlan7 [ 596.396787][T28741] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10372'. [ 596.406433][T28722] bond9: left promiscuous mode [ 596.553024][T28740] bond10: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 596.590113][T28741] bond10 (unregistering): (slave ip6gretap1): Releasing backup interface [ 596.636563][T28741] bond10 (unregistering): Released all slaves [ 596.726433][T28749] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10375'. [ 596.921724][T28749] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10375'. [ 597.170863][T28766] block nbd2: NBD_DISCONNECT [ 597.175803][T28766] block nbd2: Send disconnect failed -32 [ 597.194789][T28766] block nbd2: shutting down sockets [ 597.386151][T28768] syzkaller0: entered promiscuous mode [ 597.415504][T28768] syzkaller0: entered allmulticast mode [ 597.761335][T28780] syz_tun: entered allmulticast mode [ 597.835497][T28784] syzkaller0: entered promiscuous mode [ 597.845262][T28784] syzkaller0: entered allmulticast mode [ 598.378741][ T29] audit: type=1804 audit(1777888238.192:7): pid=28806 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.10395" name="/newroot/2071/cgroup.controllers" dev="tmpfs" ino=10425 res=1 errno=0 [ 598.442187][T28812] syzkaller0: entered promiscuous mode [ 598.448553][T28812] syzkaller0: entered allmulticast mode [ 598.482821][ T29] audit: type=1800 audit(1777888238.192:8): pid=28806 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.10395" name="cgroup.controllers" dev="tmpfs" ino=10425 res=0 errno=0 [ 598.512809][T28812] tipc: Enabled bearer , priority 0 [ 598.553848][T28816] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10399'. [ 598.576203][T28811] tipc: Resetting bearer [ 598.629365][T28811] tipc: Disabling bearer [ 598.900031][T28826] netlink: 76 bytes leftover after parsing attributes in process `syz.2.10402'. [ 598.930843][T28832] syzkaller0: entered promiscuous mode [ 598.937259][T28832] syzkaller0: entered allmulticast mode [ 598.983351][T28832] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 599.118394][T28836] syzkaller0: entered promiscuous mode [ 599.139397][ T1122] [ 599.141806][ T1122] ====================================================== [ 599.146124][T28836] syzkaller0: entered allmulticast mode [ 599.148839][ T1122] WARNING: possible circular locking dependency detected [ 599.148853][ T1122] syzkaller #0 Not tainted [ 599.165813][ T1122] ------------------------------------------------------ [ 599.172831][ T1122] kworker/u8:8/1122 is trying to acquire lock: [ 599.178986][ T1122] ffffffff8ea854e0 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x4a/0x690 [ 599.188839][ T1122] [ 599.188839][ T1122] but task is already holding lock: [ 599.196237][ T1122] ffff8880559ac5e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 599.206034][ T1122] [ 599.206034][ T1122] which lock already depends on the new lock. [ 599.206034][ T1122] [ 599.216527][ T1122] [ 599.216527][ T1122] the existing dependency chain (in reverse order) is: [ 599.225641][ T1122] [ 599.225641][ T1122] -> #7 (k-sk_lock-AF_INET6){+.+.}-{0:0}: [ 599.233667][ T1122] lock_sock_nested+0x41/0x100 [ 599.238968][ T1122] do_ipv6_setsockopt+0x851/0x3150 [ 599.244619][ T1122] ipv6_setsockopt+0x59/0x170 [ 599.249849][ T1122] mptcp_setsockopt+0xe7f/0x35d0 [ 599.255434][ T1122] do_sock_setsockopt+0x17c/0x1b0 [ 599.261010][ T1122] __x64_sys_setsockopt+0x13d/0x1b0 [ 599.266767][ T1122] do_syscall_64+0x15f/0xf80 [ 599.271908][ T1122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.278344][ T1122] [ 599.278344][ T1122] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 599.286378][ T1122] lock_sock_nested+0x41/0x100 [ 599.291675][ T1122] inet_shutdown+0x6a/0x390 [ 599.296799][ T1122] nbd_mark_nsock_dead+0x2e9/0x560 [ 599.302439][ T1122] recv_work+0x1c2e/0x1d40 [ 599.307644][ T1122] process_scheduled_works+0xb5d/0x1860 [ 599.313712][ T1122] worker_thread+0xa53/0xfc0 [ 599.318830][ T1122] kthread+0x388/0x470 [ 599.323430][ T1122] ret_from_fork+0x514/0xb70 [ 599.328546][ T1122] ret_from_fork_asm+0x1a/0x30 [ 599.333848][ T1122] [ 599.333848][ T1122] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 599.341502][ T1122] __mutex_lock+0x1a3/0x1550 [ 599.346632][ T1122] nbd_queue_rq+0x37b/0x1100 [ 599.351746][ T1122] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 599.357821][ T1122] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 599.364678][ T1122] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 599.371277][ T1122] blk_mq_run_hw_queue+0x348/0x4f0 [ 599.376916][ T1122] blk_mq_dispatch_list+0xd16/0xe10 [ 599.382910][ T1122] blk_mq_flush_plug_list+0x48d/0x570 [ 599.388819][ T1122] __blk_flush_plug+0x3ed/0x4d0 [ 599.394201][ T1122] __submit_bio+0x28d/0x580 [ 599.399327][ T1122] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 599.405491][ T1122] block_read_full_folio+0x599/0x830 [ 599.411390][ T1122] filemap_read_folio+0x137/0x3b0 [ 599.416952][ T1122] do_read_cache_folio+0x358/0x590 [ 599.422685][ T1122] read_part_sector+0xb6/0x2b0 [ 599.427999][ T1122] adfspart_check_ICS+0xb1/0x960 [ 599.433466][ T1122] bdev_disk_changed+0x817/0x1770 [ 599.439111][ T1122] blkdev_get_whole+0x380/0x510 [ 599.444494][ T1122] bdev_open+0x31e/0xd30 [ 599.449358][ T1122] blkdev_open+0x470/0x610 [ 599.454347][ T1122] do_dentry_open+0x785/0x14e0 [ 599.459644][ T1122] vfs_open+0x3b/0x340 [ 599.464248][ T1122] path_openat+0x2e08/0x3860 [ 599.469370][ T1122] do_file_open+0x23e/0x4a0 [ 599.474403][ T1122] do_sys_openat2+0x113/0x200 [ 599.479611][ T1122] __x64_sys_openat+0x138/0x170 [ 599.485060][ T1122] do_syscall_64+0x15f/0xf80 [ 599.490181][ T1122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.496598][ T1122] [ 599.496598][ T1122] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 599.503814][ T1122] __mutex_lock+0x1a3/0x1550 [ 599.509069][ T1122] nbd_queue_rq+0xc6/0x1100 [ 599.514093][ T1122] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 599.520167][ T1122] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 599.527052][ T1122] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 599.533566][ T1122] blk_mq_run_hw_queue+0x348/0x4f0 [ 599.539302][ T1122] blk_mq_dispatch_list+0xd16/0xe10 [ 599.545205][ T1122] blk_mq_flush_plug_list+0x48d/0x570 [ 599.551205][ T1122] __blk_flush_plug+0x3ed/0x4d0 [ 599.556589][ T1122] __submit_bio+0x28d/0x580 [ 599.561620][ T1122] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 599.567784][ T1122] block_read_full_folio+0x599/0x830 [ 599.573588][ T1122] filemap_read_folio+0x137/0x3b0 [ 599.579146][ T1122] do_read_cache_folio+0x358/0x590 [ 599.584866][ T1122] read_part_sector+0xb6/0x2b0 [ 599.590187][ T1122] adfspart_check_ICS+0xb1/0x960 [ 599.595662][ T1122] bdev_disk_changed+0x817/0x1770 [ 599.601219][ T1122] blkdev_get_whole+0x380/0x510 [ 599.606600][ T1122] bdev_open+0x31e/0xd30 [ 599.611372][ T1122] blkdev_open+0x470/0x610 [ 599.616307][ T1122] do_dentry_open+0x785/0x14e0 [ 599.621594][ T1122] vfs_open+0x3b/0x340 [ 599.626184][ T1122] path_openat+0x2e08/0x3860 [ 599.631304][ T1122] do_file_open+0x23e/0x4a0 [ 599.636426][ T1122] do_sys_openat2+0x113/0x200 [ 599.641628][ T1122] __x64_sys_openat+0x138/0x170 [ 599.647015][ T1122] do_syscall_64+0x15f/0xf80 [ 599.652132][ T1122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.658550][ T1122] [ 599.658550][ T1122] -> #3 (set->srcu){.+.+}-{0:0}: [ 599.665678][ T1122] __synchronize_srcu+0xca/0x300 [ 599.671142][ T1122] elevator_switch+0x1e8/0x7a0 [ 599.676436][ T1122] elevator_change+0x2cc/0x450 [ 599.681732][ T1122] elevator_set_default+0x36c/0x430 [ 599.687463][ T1122] blk_register_queue+0x3e9/0x4e0 [ 599.693021][ T1122] __add_disk+0x677/0xd50 [ 599.697874][ T1122] add_disk_fwnode+0xfb/0x480 [ 599.703256][ T1122] nbd_dev_add+0x72c/0xb50 [ 599.708345][ T1122] nbd_init+0x168/0x1f0 [ 599.713085][ T1122] do_one_initcall+0x250/0x870 [ 599.718378][ T1122] do_initcall_level+0x104/0x190 [ 599.723874][ T1122] do_initcalls+0x59/0xa0 [ 599.728824][ T1122] kernel_init_freeable+0x2a6/0x3e0 [ 599.734552][ T1122] kernel_init+0x1d/0x1d0 [ 599.739422][ T1122] ret_from_fork+0x514/0xb70 [ 599.744537][ T1122] ret_from_fork_asm+0x1a/0x30 [ 599.749832][ T1122] [ 599.749832][ T1122] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 599.757658][ T1122] __mutex_lock+0x1a3/0x1550 [ 599.763037][ T1122] elevator_change+0x1b3/0x450 [ 599.768426][ T1122] elevator_set_none+0xb5/0x140 [ 599.773810][ T1122] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 599.780141][ T1122] nbd_start_device+0x17f/0xb10 [ 599.785691][ T1122] nbd_genl_connect+0x165b/0x1cf0 [ 599.791301][ T1122] genl_family_rcv_msg_doit+0x22a/0x330 [ 599.797466][ T1122] genl_rcv_msg+0x61c/0x7a0 [ 599.802503][ T1122] netlink_rcv_skb+0x232/0x4b0 [ 599.807798][ T1122] genl_rcv+0x28/0x40 [ 599.812315][ T1122] netlink_unicast+0x75c/0x8e0 [ 599.817599][ T1122] netlink_sendmsg+0x813/0xb40 [ 599.822887][ T1122] ____sys_sendmsg+0x972/0x9f0 [ 599.828202][ T1122] ___sys_sendmsg+0x2a5/0x360 [ 599.833405][ T1122] __x64_sys_sendmsg+0x1bd/0x2a0 [ 599.838868][ T1122] do_syscall_64+0x15f/0xf80 [ 599.843981][ T1122] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.850401][ T1122] [ 599.850401][ T1122] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 599.859202][ T1122] blk_alloc_queue+0x546/0x680 [ 599.864497][ T1122] __blk_mq_alloc_disk+0x197/0x390 [ 599.870231][ T1122] nbd_dev_add+0x499/0xb50 [ 599.875179][ T1122] nbd_init+0x168/0x1f0 [ 599.879860][ T1122] do_one_initcall+0x250/0x870 [ 599.885149][ T1122] do_initcall_level+0x104/0x190 [ 599.890627][ T1122] do_initcalls+0x59/0xa0 [ 599.895683][ T1122] kernel_init_freeable+0x2a6/0x3e0 [ 599.901440][ T1122] kernel_init+0x1d/0x1d0 [ 599.906316][ T1122] ret_from_fork+0x514/0xb70 [ 599.911451][ T1122] ret_from_fork_asm+0x1a/0x30 [ 599.916840][ T1122] [ 599.916840][ T1122] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 599.924234][ T1122] __lock_acquire+0x15a5/0x2cf0 [ 599.929794][ T1122] lock_acquire+0x106/0x350 [ 599.934944][ T1122] fs_reclaim_acquire+0x71/0x100 [ 599.940601][ T1122] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 599.946949][ T1122] __alloc_skb+0x1d0/0x7d0 [ 599.951907][ T1122] tcp_stream_alloc_skb+0x3f/0x580 [ 599.957629][ T1122] tcp_connect+0x15a9/0x53a0 [ 599.962837][ T1122] tcp_v6_connect+0x128d/0x1b10 [ 599.968230][ T1122] __inet_stream_connect+0x25a/0xdd0 [ 599.974060][ T1122] inet_stream_connect+0x66/0xa0 [ 599.979905][ T1122] kernel_connect+0x141/0x1c0 [ 599.985124][ T1122] rds_tcp_conn_path_connect+0x6f6/0x930 [ 599.991295][ T1122] rds_connect_worker+0x1d8/0x290 [ 599.996854][ T1122] process_scheduled_works+0xb5d/0x1860 [ 600.002935][ T1122] worker_thread+0xa53/0xfc0 [ 600.008054][ T1122] kthread+0x388/0x470 [ 600.012653][ T1122] ret_from_fork+0x514/0xb70 [ 600.017772][ T1122] ret_from_fork_asm+0x1a/0x30 [ 600.023060][ T1122] [ 600.023060][ T1122] other info that might help us debug this: [ 600.023060][ T1122] [ 600.033287][ T1122] Chain exists of: [ 600.033287][ T1122] fs_reclaim --> sk_lock-AF_INET6 --> k-sk_lock-AF_INET6 [ 600.033287][ T1122] [ 600.046251][ T1122] Possible unsafe locking scenario: [ 600.046251][ T1122] [ 600.053709][ T1122] CPU0 CPU1 [ 600.059341][ T1122] ---- ---- [ 600.064725][ T1122] lock(k-sk_lock-AF_INET6); [ 600.069419][ T1122] lock(sk_lock-AF_INET6); [ 600.076452][ T1122] lock(k-sk_lock-AF_INET6); [ 600.083660][ T1122] lock(fs_reclaim); [ 600.087654][ T1122] [ 600.087654][ T1122] *** DEADLOCK *** [ 600.087654][ T1122] [ 600.095803][ T1122] 4 locks held by kworker/u8:8/1122: [ 600.101087][ T1122] #0: ffff88804e416140 ((wq_completion)krds_cp_wq#22/0){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 600.112844][ T1122] #1: ffffc900057dfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 600.125649][ T1122] #2: ffff888083a58f80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x930 [ 600.136830][ T1122] #3: ffff8880559ac5e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x51/0xa0 [ 600.146945][ T1122] [ 600.146945][ T1122] stack backtrace: [ 600.152961][ T1122] CPU: 0 UID: 0 PID: 1122 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 600.152981][ T1122] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 600.152993][ T1122] Workqueue: krds_cp_wq#22/0 rds_connect_worker [ 600.153019][ T1122] Call Trace: [ 600.153028][ T1122] [ 600.153036][ T1122] dump_stack_lvl+0xe8/0x150 [ 600.153053][ T1122] print_circular_bug+0x2e1/0x300 [ 600.153075][ T1122] check_noncircular+0x12e/0x150 [ 600.153097][ T1122] __lock_acquire+0x15a5/0x2cf0 [ 600.153122][ T1122] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 600.153142][ T1122] lock_acquire+0x106/0x350 [ 600.153158][ T1122] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 600.153178][ T1122] ? ip6_dst_check+0xe2/0x7e0 [ 600.153204][ T1122] fs_reclaim_acquire+0x71/0x100 [ 600.153226][ T1122] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 600.153245][ T1122] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 600.153265][ T1122] ? ip6_default_advmss+0x80/0x3b0 [ 600.153287][ T1122] ? __alloc_skb+0x1d0/0x7d0 [ 600.153306][ T1122] __alloc_skb+0x1d0/0x7d0 [ 600.153324][ T1122] tcp_stream_alloc_skb+0x3f/0x580 [ 600.153338][ T1122] ? __asan_memset+0x22/0x50 [ 600.153357][ T1122] tcp_connect+0x15a9/0x53a0 [ 600.153389][ T1122] ? __pfx_tcp_connect+0x10/0x10 [ 600.153410][ T1122] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 600.153435][ T1122] ? lockdep_hardirqs_on+0x7a/0x110 [ 600.153453][ T1122] ? ktime_get_with_offset+0x93/0x2d0 [ 600.153475][ T1122] ? seqcount_lockdep_reader_access+0xea/0x100 [ 600.153500][ T1122] ? __asan_memset+0x22/0x50 [ 600.153520][ T1122] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 600.153542][ T1122] ? inet6_hash_connect+0xeb/0x170 [ 600.153567][ T1122] tcp_v6_connect+0x128d/0x1b10 [ 600.153596][ T1122] ? __pfx_tcp_v6_connect+0x10/0x10 [ 600.153619][ T1122] ? __local_bh_enable_ip+0xd0/0x130 [ 600.153635][ T1122] ? __bfs+0x153/0x290 [ 600.153650][ T1122] ? __bfs+0x153/0x290 [ 600.153665][ T1122] ? __pfx_hlock_conflict+0x10/0x10 [ 600.153685][ T1122] __inet_stream_connect+0x25a/0xdd0 [ 600.153709][ T1122] ? do_raw_spin_lock+0x12b/0x2f0 [ 600.153730][ T1122] ? lock_sock_nested+0x6a/0x100 [ 600.153744][ T1122] ? __pfx___inet_stream_connect+0x10/0x10 [ 600.153767][ T1122] ? inet_stream_connect+0x51/0xa0 [ 600.153788][ T1122] ? __local_bh_enable_ip+0xd0/0x130 [ 600.153805][ T1122] inet_stream_connect+0x66/0xa0 [ 600.153827][ T1122] kernel_connect+0x141/0x1c0 [ 600.153848][ T1122] ? net_generic+0x1e/0x240 [ 600.153862][ T1122] ? __pfx_kernel_connect+0x10/0x10 [ 600.153889][ T1122] ? __local_bh_enable_ip+0xd0/0x130 [ 600.153905][ T1122] rds_tcp_conn_path_connect+0x6f6/0x930 [ 600.153926][ T1122] ? __pfx_rds_tcp_conn_path_connect+0x10/0x10 [ 600.153945][ T1122] ? process_scheduled_works+0xa70/0x1860 [ 600.153961][ T1122] ? process_scheduled_works+0xa70/0x1860 [ 600.153979][ T1122] rds_connect_worker+0x1d8/0x290 [ 600.154001][ T1122] ? process_scheduled_works+0xa70/0x1860 [ 600.154016][ T1122] process_scheduled_works+0xb5d/0x1860 [ 600.154042][ T1122] ? __pfx_process_scheduled_works+0x10/0x10 [ 600.154059][ T1122] ? assign_work+0x3d5/0x5e0 [ 600.154075][ T1122] worker_thread+0xa53/0xfc0 [ 600.154100][ T1122] kthread+0x388/0x470 [ 600.154119][ T1122] ? __pfx_worker_thread+0x10/0x10 [ 600.154134][ T1122] ? __pfx_kthread+0x10/0x10 [ 600.154153][ T1122] ret_from_fork+0x514/0xb70 [ 600.154170][ T1122] ? __pfx_ret_from_fork+0x10/0x10 [ 600.154185][ T1122] ? __switch_to+0xc79/0x1410 [ 600.154213][ T1122] ? __pfx_kthread+0x10/0x10 [ 600.154233][ T1122] ret_from_fork_asm+0x1a/0x30 [ 600.154257][ T1122]