last executing test programs: 4.097048325s ago: executing program 0 (id=6448): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000000000ae3ff62791c38e3d14ec66e16bf69f66"], 0x28}}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000001800010280000000fcdbdf250a148000ff01fd07"], 0x1c}}, 0x0) sendmmsg$alg(r4, &(0x7f00000000c0), 0x492492492492627, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x18, &(0x7f0000000840)=ANY=[@ANYBLOB="180000008f000000000000000902048018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000007b7030000000800008500000086002000bf092000000000003609010000000000950000000000000018010000786c6c2500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b7030000080000008500000006000000bd0af4ff00000000bf91000000000000b702000003000000850000002a000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0xb, 0x1000, &(0x7f0000000cc0)=""/4096, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) sendmsg$NL80211_CMD_RELOAD_REGDB(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x2004}, 0x80080) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYRES8=r1, @ANYRESHEX=r1, @ANYRES16, @ANYRESOCT=r0, @ANYRESDEC=0x0, @ANYRES8, @ANYRES16, @ANYRESHEX=r0], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x12, 0xffffffffffffffff, 0x0) ioctl(r0, 0x8b29, &(0x7f0000000240)="d8d8a02b10ff70e7c5ae954382d45e34229082b3c91d4c9a6a4eb22c258738e11e184507ca6eeb936ff3e9dc0aa7773e0592ea2fe50c6f2dda198f8b183f6c51675e5702badfe81ccbff2f76546db604080509b58de1e9fbe50ad9293e9eb1de1f46624c877d7dd1701e66ad107e1bc4a7027973aa14990000") 3.903938124s ago: executing program 4 (id=6454): r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000600)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {}, {}, {0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x8, 0x3}}]}}]}, 0x3c}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000009000600000009000000000000002f5cbaa06435"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x2000, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.838264765s ago: executing program 4 (id=6455): mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0), 0x80080, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r0, 0x5201) ioctl$RFKILL_IOCTL_NOINPUT(r0, 0x5201) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 3.791146787s ago: executing program 0 (id=6456): r0 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x17a, 0x0) epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_wait(r3, &(0x7f0000000240), 0x0, 0x7fffffff) unshare(0x2c020400) socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x0, 0x0) r4 = socket$inet6(0xa, 0x4, 0x8010800000000084) sendmmsg$inet6(r4, &(0x7f0000000200), 0x0, 0x20000000) pselect6(0x40, &(0x7f0000000000)={0xa, 0x7ffffffe, 0x2, 0x10000000000006, 0xf, 0x8, 0x80000002, 0x8}, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_mreq(r5, 0x29, 0x14, &(0x7f0000000080)={@remote}, 0x14) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f00000000c0)={0x1d, r7}, 0x10) sendmsg$can_bcm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0100"/16, @ANYRES64, @ANYRES64, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="ecff000001"], 0x48}}, 0x0) r8 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r8, 0x110, 0x2, &(0x7f0000000500)='\x00\xe7(\xe0\xd5c\xd0a\x16\xca\x03$\x18i\x15\xc6\xf3Sf\x8dS8\xb4\"\xc5\xaecF\xa4!\t\x1fxd\xae\xb4\x90\xd3\xe6\xa2\xfbli\xd0\xa6H\xd6\x1dO\"\xbc\xda\x80\xbd\xa2\xdb\xff\x00\x00{\\\xd7\xbc*M\xd6\xe1\xdb\xe4\x00\x1a\xa2\x8a\x01\b\xc5\xe2+\xe2\x1e\xe9$d\xac[Z\x17\xb2\xab\x81\a\xbe\x17\x84\xfd\xadL7\xca\xe5\x8f\xb2\x9fv=L', 0xff09) sendmsg$can_bcm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000220900"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64, @ANYBLOB="0000000001"], 0x80}}, 0x0) sendmsg$can_bcm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="020000"], 0x48}, 0x1, 0x0, 0x0, 0x20040805}, 0x8000) pipe(&(0x7f0000000040)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r9, 0x0, r10, 0x0, 0x8000000000025a5, 0x0) 3.674958961s ago: executing program 3 (id=6457): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a31000000001500"], 0x5c}}, 0x20084884) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a31000000001500"], 0x5c}}, 0x20084884) socket$inet_smc(0x2b, 0x1, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) r2 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)}, 0x0) (async) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r3, &(0x7f00000003c0)={0x0, 0xfffffffffffffd90, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r4, 0x701, 0x74bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x3, 0xfa, &(0x7f00000007c0)=""/250, 0x0, 0x8}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x3, 0xfa, &(0x7f00000007c0)=""/250, 0x0, 0x8}, 0x94) syz_genetlink_get_family_id$nbd(&(0x7f0000001100), r3) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000001100), r3) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000fcfffff7000000000000000018200000", @ANYRES32=r7, @ANYBLOB="0000000004000000c30000000000000095"], &(0x7f0000000080)='GPL\x00', 0x8, 0xc2, &(0x7f00000002c0)=""/194, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) bind$packet(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001700)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/215, 0xd7}], 0x1}, 0xffff}], 0x1, 0x0, 0x0) (async) recvmmsg(r1, &(0x7f0000001700)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/215, 0xd7}], 0x1}, 0xffff}], 0x1, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0x503, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x40, 0x2200}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}]}, 0x40}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) 3.400576232s ago: executing program 3 (id=6460): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x8}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) r1 = epoll_create1(0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000100)={0x2a, 0xe, 0x14, 0x3, 0x80000003, 0x2c0, 0x4baf, 0x2}, 0x0, 0x0, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)) (async) read(r3, &(0x7f0000000080)=""/103, 0x67) (async) shutdown(r2, 0x1) (async) socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfbffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000180)=@newtfilter={0x94, 0x2c, 0xd27, 0x30bd29, 0x25dfdc02, {0x0, 0x0, 0x0, r10, {0xffff, 0x5}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x2, [@m_ife={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x8, 0x8, 0x4, 0xa, 0x3}, 0x1}}, @TCA_IFE_METALST={0x10, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x3}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x94}}, 0x800) (async) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) (async) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) (async) r12 = socket$kcm(0x11, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r12, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r13, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x24000040}, 0x8000) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000200)={'ip6tnl0\x00', &(0x7f00000000c0)={'ip6gre0\x00', r5, 0x4, 0xa9, 0x2, 0x3, 0x18, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x7, 0x10, 0x80, 0x8000}}) 3.139451601s ago: executing program 1 (id=6461): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000300)=r3) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000840)='\'', 0x1}], 0x1}, 0x4) 2.857465652s ago: executing program 3 (id=6462): r0 = socket$igmp6(0xa, 0x3, 0x3a) syz_emit_ethernet(0x3e, &(0x7f0000000700)={@broadcast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @rand_addr=0xe0000000}}}}}}, 0x0) (async) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, 0x0, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) (async, rerun: 32) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0xffffffffffffffa8, &(0x7f0000000200)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWOBJ={0x0, 0x12, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, @NFT_OBJECT_QUOTA=@NFTA_OBJ_TYPE}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x28}}, 0x24000040) (async, rerun: 32) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0xe0}}, 0x0) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)={0x14, 0x7, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x20004840}, 0x20008000) (async) recvmmsg(r1, &(0x7f0000001e40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, &(0x7f0000000100)) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0xfffd, 0x101, @local}, {0xa, 0x4e22, 0x1, @private0, 0x5}, 0xfffe, {[0x400000, 0x0, 0x0, 0x0, 0x8, 0x1, 0x400, 0x2]}}, 0x5c) 2.777963183s ago: executing program 4 (id=6463): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000000), 0xffffff6a) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c0000001800090400000001fedbdf250a0000000000000000000b8008001e0001000000080008"], 0x2c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x5) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0x8f4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x8c0, 0x2, [@TCA_MATCHALL_ACT={0x8bc, 0x2, [@m_police={0x8b8, 0x1, 0x0, 0x0, {{0xb}, {0x88c, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0x5, 0x4, 0x2, 0x4, 0x5, 0x2234, 0x83, 0x81b, 0x800, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x800004, 0x58b, 0x85a, 0x3ff, 0x46, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x5, 0x1, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x3, 0x3, 0x5b1f, 0x7b0, 0x7, 0x100, 0x2, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x11ff, 0x80, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x2, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffef9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0x3, 0x6, 0x7, 0x8, 0x100, 0xc0000000, 0x6, 0x6, 0x6, 0x8, 0x80000001, 0x8, 0x1d24, 0x2, 0x7, 0x80000000, 0x7f, 0x7, 0x9, 0xff, 0x24, 0x5, 0x7, 0x6, 0x10007a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0x0, 0x4, 0x10009, 0x61, 0x200, 0x6, 0x2, 0x2, 0x6, 0x10003, 0x8, 0x7, 0x11, 0xda56, 0x7ffffffe, 0x80, 0x2f0cb955, 0x100007, 0xfed, 0xf, 0x6ae, 0x9, 0xfffffffd, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0x9, 0x18, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x7, 0xf7800000, 0xac, 0x8, 0x3, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0x0, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0xa, 0x1, 0x0, 0xa, 0x300, 0x5, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x5, 0xb, 0x399d, 0x6, 0x8ab6, 0x18000, 0x2, 0x97b, 0x2, 0x2, 0x528c, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x80001, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x7, 0x0, 0x177, 0x7, 0x0, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x4b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x107e, 0x9, 0xec2, 0x5e6f2ae1, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0x4, 0x5, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x3, 0x4, 0x5, 0x7, 0x12, 0x2, 0x8, 0x101, 0xfffeffff, 0x2, 0xffff, 0xa6, 0x3, 0x10000, 0x1000, 0x4, 0x0, 0x3, 0x0, 0x2, 0x6, 0xf9, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94b, 0x9, 0x8, 0x6, 0x100, 0x2, 0xffff, 0x4, 0x2, 0x3ff, 0x2, 0xb828, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7ffb, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x2, 0x0, 0x2, 0x8, 0x1, 0x3, 0x9, 0xc, 0xff, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x101, 0xadd9, 0x1, 0x0, 0x7, 0x7fffffff, 0x40, 0x4, 0x0, 0x5, 0x4, 0x1, 0x8, 0x9, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x9, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x1, 0x1f6, 0x751, 0x7, 0x40000000, 0x1, 0x8, 0x50, 0xf, 0xf, 0xe, 0x6, 0x0, 0x81, 0xfff80000, 0x0, 0x1, 0x6, 0x3, 0x7ef8, 0x7, 0x5, 0x2, 0x0, 0x4e8, 0x80, 0x0, 0x8, 0x5, 0x0, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0x4000fff, 0x8, 0x7, 0x3, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x400003, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0x7, 0x59, 0x9, 0x2, 0x101, 0x5f502dc7, 0x6, 0x0, 0x4, 0x6, 0x80000001, 0xc000, 0xffffff97, 0x2, 0x40, 0x1, 0x40, 0x8, 0x3, 0x710, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0xfff, 0xe, 0x3, 0x9, 0xa, 0x7, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x20000000, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0xb}, {0x6, 0x2, 0xd, 0xfff9, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x49}, @TCA_POLICE_TBF={0x3c, 0x1, {0xd7, 0x8, 0x7ff, 0x7, 0x10, {0x7, 0x2, 0x6, 0x3, 0x3, 0xfffffff8}, {0x0, 0x1, 0x80, 0x0, 0x2, 0x7}, 0xff, 0x84, 0x7}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x8f4}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x10440}}}}}}]}, 0x48}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000000c0), 0x492492492492627, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r10, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="0000000400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000009000000000000000000bd32c7be618db5d6fea769a0d83f9c71e4745c23c2fd13091885975b64fea19841b2b949de382d4c5ce444e9"], 0x50) r13 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=r12, @ANYBLOB="ff0f000000dd16c64b", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r13}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r12}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8, 0x9, 0x20}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001280)=@newlink={0x58, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x20, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}}]}}}, @IFLA_LINK={0x8, 0x5, r11}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r14 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r14, 0x0, 0x0, 0x2040, 0x0) 2.691178733s ago: executing program 3 (id=6464): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r1, &(0x7f0000002480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002080)=""/46, 0x2e}, 0x7fffffff}], 0x765, 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$inet6_int(r1, 0x29, 0x31, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha384)\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmsg$xdp(r3, 0x0, 0x5880) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r4 = socket$kcm(0x2, 0x3, 0x2) r5 = socket$packet(0x11, 0x3, 0x300) bind$packet(r5, &(0x7f0000000240)={0x11, 0xc, 0x0, 0x1, 0x0, 0x6, @random="00eb7e41ef71"}, 0x14) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[], 0xfdef) 2.686739191s ago: executing program 2 (id=6465): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002980)={&(0x7f0000002640)=ANY=[@ANYBLOB="180000000083c119df13ba800b1f0000000000000000"], 0x18}}, 0x40) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r2, 0x1, 0x37, 0xfffffffffffffffd, &(0x7f00000003c0)) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000080)=0x6, 0x4) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x40, r4, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r6, 0x12, 0x3, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 2.573403782s ago: executing program 0 (id=6466): r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f40108807000008048000980282100f8060001000a00000014000200fe8000000000000000000000000000aa05000300030000001c000080060001000200000908000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a034e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d40009", @ANYRES8=r1, @ANYRES8=r1, @ANYBLOB="7c133144ddfb8bf1e4b57abee5675b368299154ad69f605923a6a6a9b3d38b89960b16959afc377520d001d494ab73710d8af99286c2dbe22abad341a4277651278d403223e54a746a9a988aceb596cf777e03b1c85b19b87bcae2cabc4ad3c0fcab45dd9fdba77565de9ab10daabf086ed3da89a29fc6d079b3d75600cd95cd5d52025652f9c17d3f7179e0eb824b63b4b820eb8e3c27e66296c3e12e5d03ddc78fa16b0a613328bc805082b5504c71e349c2c1573c87963a9410a6a3976c4f76c1000256ea3b647aa31830bb584910f172ecfd62b19812f81331d1ca8c7477feb8f4a3c6e3743c1e68ce4f4df2ef707afd"], 0x21c}, 0x1, 0x0, 0x0, 0x20040010}, 0x4008804) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000005, 0x12, r2, 0x0) unshare(0x20000400) r3 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r3, &(0x7f0000000040)={0x2a, 0x1, 0xfffffffe}, 0xc) 865.432411ms ago: executing program 1 (id=6467): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_pressure(r1, &(0x7f0000000100)='cpu.pressure\x00', 0x2, 0x0) vmsplice(r2, &(0x7f0000000540), 0x0, 0xf) preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000240)=""/66, 0x42}], 0x1, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000140)={0xffffffffffffffff}) syz_init_net_socket$llc(0x1a, 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)={0x18, 0x78, 0x601, 0x0, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str=']\a\x00'}]}, 0x18}], 0x1}, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e40)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x50}, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@delchain={0x2c, 0x66, 0x221, 0x70bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0x0, 0xfff3}, {}, {0xb, 0xfff3}}, [@TCA_CHAIN={0x8, 0xb, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004800) bind$alg(r3, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(aes)\x00'}, 0x58) bind$alg(r6, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(ctr-aes-aesni,sha3-224-ce)\x00'}, 0x58) syz_extract_tcp_res(&(0x7f00000002c0), 0x6, 0x4) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="640000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7b8a050000000000440012800b000100697036746e6c00003400028008000100", @ANYRES32, @ANYBLOB="140003000000000000000000000000000000003414000200fe88"], 0x64}}, 0x24008010) 756.502576ms ago: executing program 0 (id=6468): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x3000c041) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f0000000240)={0x2, &(0x7f0000000000)=[{0x48, 0x3, 0xbc, 0x66}, {0x6, 0x1, 0xfb, 0x2}]}) (async) write(r1, &(0x7f0000000280)="73a39012", 0x4) (async) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="89000000120081ae08061cdc030ec080000000060000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e398517c254fd440fba036b1e7010c8285dcdf12f2130809d78f0a948be2b49e33538afa8af92300514f0b56a20ff27fff00000000000000000012360e854b0bc3e8b76bb13b030000f21c38ecce226c01d606db", 0xb0}], 0x1}, 0x0) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000000c0)=""/84, 0x54}, {&(0x7f0000000240)=""/218, 0xda}], 0x2}, 0x10120) 755.904819ms ago: executing program 2 (id=6469): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) read$alg(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb}, {0x65}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x4, 0x1, 0x4, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x15}}], {{0x7, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x3, 0xc, &(0x7f0000000540)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x9b}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x101}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 754.639771ms ago: executing program 4 (id=6470): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000002100010000000000000000000200000000000000000000000c0014"], 0x28}, 0x1, 0x0, 0x0, 0x20008840}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="02000000040000000800400001"], 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000000000)={0x2, 'vlan0\x00', {0x4}, 0x6}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={r2, &(0x7f0000000500), &(0x7f0000000080)=""/12}, 0x20) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0x84}}, 0x0) ioctl$FIONCLEX(r4, 0x5450) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000487bc1e39dc038bc00000a74000000060a010400000000000000000200000048000480440001800c0001007061796c6f616400340002800800044000000000080005400000000a08000340000000610800024000000002080006400000000208000740000000080900010073797a30000000000900020073797a32"], 0x9c}}, 0x4) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="44000000100600040000000000000000200000007eed5b7484f6bc65e065e85c1a79b88dd648763dd093ef89c13d7b5109550de88ab5ebf3cd11aaa3d4650b6b894fccf6154805c7b631344dcfe69ac07a2bb343913c6cf0", @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028005001100000000000500100000000000"], 0x44}}, 0x0) 675.495973ms ago: executing program 3 (id=6471): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCGPGRP(r3, 0x8904, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socket(0x10, 0x80002, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000004740)=[{{0x0, 0x0, &(0x7f00000026c0)=[{&(0x7f0000001440)="116123724ee03a", 0x7}], 0x1, 0x0, 0x0, 0x10}}], 0x1, 0x810) write$tun(r2, &(0x7f0000001400)=ANY=[@ANYBLOB="000086dd0000110000000000000060ec97000f982c00fe80000000"], 0xfce) r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r4, 0x800442d3, &(0x7f000000eec0)={0x6, 0x7, 0x2a4, @random="d60fea76ac0e", 'veth1_vlan\x00'}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0f000000040000000400000006000000020800", @ANYRES32=0xffffffffffffffff, @ANYBLOB="060000000000000000", @ANYRES32], 0x50) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="9402000021000100fcffffff00000000ac1414aae5fffff8b49ed9825133a900fc0100000000000000000000000000000000add500200000000000801aeaaec1", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r7], 0x294}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newtclass={0x48, 0x28, 0x8, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x4, 0xe}, {0x8, 0xf}, {0xffff, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0xf, 0x2}}, @tclass_kind_options=@c_tbf={0x8}, @tclass_kind_options=@c_clsact={0xb}, @TCA_RATE={0x6, 0x5, {0xa1, 0x2}}]}, 0x48}}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), r5) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r10, &(0x7f0000001100)={0xffffffffffffffff, 0x0, &(0x7f00000010c0)={&(0x7f0000000900)={0x78c, r11, 0x12b, 0x70bd2b, 0x0, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x2b0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x5}, @ETHTOOL_A_BITSET_VALUE={0x82, 0x4, "61b59aa5bc3cb5694c806df2a58f15b0fe8bb7ba41df21a4a55f167b931d6d317c676a320d03b1009fc588cba17520401ef8da6f793f9ed9230200d06ae4737e9a8bc862ee2cddf67fc9b1c85463acce9115eb88deb452e463274873268cd9d4360bbcbbc15f7d28fab61e5fb071a7af957576aca55a3f38860efef92814"}, @ETHTOOL_A_BITSET_BITS={0x1bc, 0x3, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x82}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'team0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'ns/net\x00'}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '#]}^%\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'tbf\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '-$*\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x10}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'tbf\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '[##&:\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '@%!\xa9%#\xfc$@(\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'tbf\x00'}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '\\,(/#]:\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7fff}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80000001}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'tbf\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '.\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x42}]}, {0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xb}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffffd}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '}.\x1d\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x10000}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x28}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xff}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_MASK={0x62, 0x5, "7aae142c0455f67720413185837449266f6733fb727ce766b716a2e09cc8196c9cf277b8f9d433fcda06f09ad95accdf16ca98e9d007d94b33ad80eb52ed0d4636b9739218edd1fbf16677baff2d38bc9b22aef7521edc4fb9f64169d031"}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x148, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x140, 0x3, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\x83\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x40}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'ns/net\x00'}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc30b}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xee}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, '*!].\xfd+\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, '#t!\xa4/+\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8000}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80000001}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, ','}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '}/\x00'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, ')%$\x00'}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80000000}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x19, 0x2, ']%}#}}\xbf@-.\\@}$/-\\b^-\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x23c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x118, 0x3, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffff7f}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '^^%$!-*\x00'}]}, {0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4432}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\xd1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'team0\x00'}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'ns/net\x00'}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffffff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x800}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '\\:}%%\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'clsact\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '$-\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8001}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_MASK={0xc, 0x5, "8030be6c44f49883"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x7fffffff}, @ETHTOOL_A_BITSET_BITS={0x108, 0x3, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '.\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'tbf\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80000001}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'team0\x00'}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'team0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7c9}]}, {0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80000000}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffff8a6b}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, ')\\#\\//\x1b&'}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'team0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '!,@:\x00'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'tbf\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x4}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0xc, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x9c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}]}, 0x78c}, 0x1, 0x0, 0x0, 0x10}, 0x8010) unshare(0x2c020400) r12 = syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') ioctl$NS_GET_NSTYPE(r12, 0xb703, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delchain={0x24, 0x2e, 0x501, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x1, 0x6}, {0x7, 0x9}, {0x0, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x48011}, 0x0) 674.027551ms ago: executing program 2 (id=6472): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8864}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="05000000000000007111af00000000008510000002000000850000000a00000095000000000000009500a5050000a05c3a3f19a578c06c500000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 551.610907ms ago: executing program 2 (id=6473): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x74, r1, 0x300, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xf7}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x5e}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond0\x00'}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4004001}, 0x40040) ioctl$EXT4_IOC_GETFSUUID(r0, 0x8008662c, &(0x7f0000000180)) ioctl$OCFS2_IOC_UNRESVSP64(r0, 0x4030582b, &(0x7f00000001c0)={0x1, 0x1, 0x0, 0x8, 0x447b, 0xffffff00}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000200)={0x0, @remote, @empty}, &(0x7f0000000240)=0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@bloom_filter={0x1e, 0x8b, 0x80000001, 0x3, 0x20040, 0x1, 0x5, '\x00', r2, 0xffffffffffffffff, 0x5, 0x0, 0x3, 0xf}, 0x50) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f00000006c0)={&(0x7f0000000640)=[{&(0x7f0000000300)="62eadb39f80b91fc625396bdf65957762b5c6301ef4537527cb5afda22db9e8487ae7f53d479bd3087893d347c14ef53abcaa1954fd8847a4f9fd0be432577947ea56d06eec257bb30f3e2ceefcd184803eb4c2b", 0x54}, {&(0x7f0000000380)="ba4155a38320dd37da40f7b24f95d592fef18cca918b5959e186ec2779bb84430dbdf273679606ded01801c91e95df24d13988954ab4251507a60ca4a8afd8e6c74a2b56c6a327d70be2ee9e1254b6aa214a951c8711797bd046dbf61d627839701efcb12ff4696c4ce9427cc22a3ad66738a545e591ec0d3e1a2f8f4485c93bf6486cbc918a4b986cdee781c08c0cde0e0a2a7c0047b4d988924a6fd3fb41d579ee86b7eb9610f31d1ddf793cb6d98ea1afbf6325d7f0ec4ff56f951098f385b96fdcfac0b8e17bf1cc724ae81bbec67d2ab585c338b51c7bbad4d83a9c0995563ccbe7ec", 0xe5}, {&(0x7f0000000480)="ffc717ca3a13ecc57d413bb308a78e1fb71a0763a887106ab7eab14e037b5d78c7f92c21dc7c9b54579b4f6f3012f8977dbd0fbc7db5910e299404f84435c3ec19285ed37c3a845b69f5a6bdbe385df591d656ae3f6bf28801446bd4dd7a2b136d31d5da57e06a10a681de2ca2c143b5d0e2f66f0b9bcc430eedbf4906b42046d841e8bd250bfbd4e297d0fb5efa46600e4f3fda0e8036094cf47618c6", 0x9d}, {&(0x7f0000000540)="28bd5e3ccf2c8e5af3055cb502afff3f4841272c99e485ea1f8c1c8df647a73a727ecb4e4f97eb4f318dbba1cde8e1167a9842e434b1ed72264884c37734ae31403b53c857e4bd0bd90c21b0d19e50596f4cd6646ac0fa8fe228245b1c7cf908daec60920b5e7c3564bb15ad9533e1aeb34cbc636ff129b1d7b6f8", 0x7b}, {&(0x7f00000005c0)="1ce382a1f6405cb4190dcd0a816f455dd3d4a3245d2e1021b4eed10c4b29920bb07c1e2c3c6290f772c296b2d2387559241797e3c9f42254beffab09c56400e4aff27336445d9c02c3adb9f4273ac4aa927316587e00f76dc52551fb25614d7ff91ef6c8944605e02dcb359bb8", 0x6d}], 0x5, 0x0, 0x0, 0x2, 0x4, 0x3, 0x3}) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000880)=@bpf_tracing={0x1a, 0x7, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0xffffffff}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x4}, @ldst={0x0, 0x3, 0x4, 0x0, 0x7, 0x18, 0x4}]}, &(0x7f0000000780)='GPL\x00', 0xd2c8, 0x0, 0x0, 0x40f00, 0x0, '\x00', r2, 0x1c, 0xffffffffffffffff, 0x8, &(0x7f00000007c0)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000000800)={0x1, 0x7, 0x6, 0xa}, 0x10, 0x22979, 0xffffffffffffffff, 0x0, &(0x7f0000000840)=[r3, r3, r3, r3, r3, r0, r3, r3, r3]}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001a80)={r4, 0x0, 0x22, 0x1000, &(0x7f0000000940)="235a6d437a5a7d93c21dc1a06b5574451777dc058412fb97ef57603994fc86994c27", &(0x7f0000000980)=""/4096, 0x8, 0x0, 0x37, 0x9a, &(0x7f0000001980)="92c96fef5a6aedcebe58c96277a64caea9673bf8ffc232f70ebae657b7b9d8834cfee59ddf56ed18a5ebd64c939e94f4feb058bfb79bb9", &(0x7f00000019c0)="f4ad9bb3f43d299de5dc97627e3f9723854578d44921e554a94ddf6aaaaaac9bc4dc7c13bab0fcca623a5b7ffd5f82687a7662bf95b69b9b6b4a0cc8006673abcb7a9c6484e08c40e925bca1970e78faa907bba614e55a9152e4299aa62cba8eea965b13df9e59d6df78804711777ad806445eca593ce2ae8a5a4f0218978611d57ccff18414102ff27254aa719b121df431c0f1f23845c43b28", 0x5, 0x0, 0xcb}, 0x50) ioctl$XFS_IOC_FD_TO_HANDLE(r3, 0xc038586a, &(0x7f0000001c00)={0xffffffffffffffff, &(0x7f0000001b00)='GPL\x00', 0x50000, &(0x7f0000001b40)={@align=0x7, {0x1, 0x6, 0x19, 0x8}}, 0xb3, &(0x7f0000001b80), &(0x7f0000001bc0)=0xfffff001}) getsockopt$netrom_NETROM_T2(r5, 0x103, 0x2, &(0x7f0000001c40)=0x2, &(0x7f0000001c80)=0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) readv(r3, &(0x7f0000001e40)=[{&(0x7f0000001cc0)=""/77, 0x4d}, {&(0x7f0000001d40)=""/16, 0x10}, {&(0x7f0000001d80)=""/131, 0x83}], 0x3) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NFT_BATCH(r5, &(0x7f0000002040)={&(0x7f0000001e80)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000002000)={&(0x7f0000001ec0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x1}, @NFT_OBJECT_SECMARK=@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}}, @NFT_MSG_DELFLOWTABLE={0x44, 0x18, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELTABLE={0x98, 0x2, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_USERDATA={0x58, 0x6, "f8d7fd618580e0dceb2774cb145e0872f4dcf81654d51971203e36932c6675fc20890c567bbc96934b783e099445dad138e48a5b01b0604e97ddec0fba5a64629a19bc1b2b448851f928a99067af963658e8a4f2"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWTABLE={0x1c, 0x0, 0xa, 0x301, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x140}}, 0x800) ioctl$BTRFS_IOC_SEND(r6, 0x40489426, &(0x7f00000020c0)={{r4}, 0x4, &(0x7f0000002080)=[0x4, 0x5, 0xe, 0x8], 0x7fff, 0x4, 0x1}) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000002140)={r5}, 0x8) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r7, 0x40189429, &(0x7f0000002180)={0x1, 0xffffffff80000000, 0x2}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000021c0)='./cgroup/syz0\x00', 0x1ff) r8 = accept4$x25(r7, &(0x7f0000002200)={0x9, @remote}, &(0x7f0000002240)=0x12, 0x80000) ioctl$SIOCX25SFACILITIES(r8, 0x89e3, &(0x7f0000002280)={0x6f, 0xd, 0x8, 0x5, 0xa}) ioctl$NILFS_IOCTL_GET_SUSTAT(0xffffffffffffffff, 0x80306e85, &(0x7f00000022c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000002300), 0x400500, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r7, 0x84, 0x1, &(0x7f0000002340)={0x0, 0x7ff, 0x7, 0x8, 0x0, 0x2}, &(0x7f0000002380)=0x14) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r5, 0x84, 0x78, &(0x7f00000023c0)=r9, 0x4) clock_gettime(0x5, &(0x7f0000002400)) close(r5) ioctl$XFS_IOC_ERROR_CLEARALL(r5, 0x40085875) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000029c0)={r9, 0xb, 0x3, [0x101, 0x3, 0x6]}, 0xe) 527.510489ms ago: executing program 1 (id=6474): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) syz_emit_ethernet(0x5e, &(0x7f00000004c0)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0180f2", 0x28, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8000, {[@generic={0x1, 0xa, "0000000000f1cba4"}, @window={0x3, 0x3}, @fastopen={0x22, 0x4, "97d7"}]}}}}}}}}, 0x0) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000), 0xc) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r0}, 0x8) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x56c, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x5c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}}, 0x40000120) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000080)="09000000e700140000007e7bfbf788a83baa9900d6f18f8e950088a800dd8600", 0x20, 0x24040011, &(0x7f0000000300)={0x11, 0x1, r4, 0x1, 0x6, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}, 0x14) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x19, 0x11, &(0x7f0000000200)=ANY=[@ANYRES16=0x0, @ANYRES32=r0, @ANYRESDEC=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) socket$inet(0x2, 0x3, 0x30) sendto$phonet(r1, &(0x7f0000000540)="78661068a08c503d70f503f778e4aaa838894cfd54e4e3da3fe79c3026b3bcc5124ebad85f37dd9212a44cbabbe0877c6a3a81bdeb17591e54d97aa27cd7445702942cbb488ea772124732e2a5bec18b6bc4ef7fe3a18590c3957c8c4f8a5a580421bd3bafacf8ae69dcc028", 0x6c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x38, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYRESOCT=r3, @ANYRES16=r6, @ANYBLOB="030000d60019d1002800616e00"/22], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22c8a61c04}, 0xc4055) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 471.778725ms ago: executing program 0 (id=6475): r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x6f89c659e9b3087f) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000140)=ANY=[@ANYBLOB='c 75:*\tm'], 0xa) sendfile(r2, r2, 0x0, 0x7f) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@gettaction={0x24, 0x32, 0x201, 0x70bd28, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x133000, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="28000000120001000000000000000000080041"], 0x28}], 0x1}, 0x0) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000000)={'veth0_to_batadv\x00', 0x400}) socket$can_j1939(0x1d, 0x2, 0x7) unshare(0x2040400) bind$can_j1939(r3, 0x0, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r3) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r6, 0x20, 0x70bd25, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x7, 0xd, 0x7, 0x8}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x40040) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) socket$can_bcm(0x1d, 0x2, 0x2) bind$bt_hci(r7, &(0x7f0000000000)={0x27}, 0x62) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000001400001c001280090001006f6e64000000000c000280050016000000000000"], 0x3c}}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000800) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) 420.483586ms ago: executing program 3 (id=6476): socket(0xa, 0x1, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b040000000000000000020000002400048020000180070001006374000014000280080002400000000f08000140000000020900010073797a30000000000900020073797a320000000014000000110001"], 0x78}}, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x39}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockname$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) unshare(0x6a040000) getsockname(r2, &(0x7f0000000100)=@alg, &(0x7f0000000180)=0x80) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x84, @private=0xa010101, 0x15, 0x3, 'sh\x00', 0x2e, 0x5, 0x72}, 0x2c) socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) unshare(0x2010100) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) 372.7146ms ago: executing program 2 (id=6477): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000300)=r3) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000840)='\'', 0x1}], 0x1}, 0x4) 299.401794ms ago: executing program 1 (id=6478): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3e, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@private2, @in6=@mcast2, 0x0, 0x1, 0x1000, 0xfffe, 0xa}, {0x0, 0xffffffffffffffff}, {0x0, 0xfffffffffffffffd, 0xb5, 0x1}, 0x800, 0x0, 0x1, 0x1}, {{@in=@remote, 0x0, 0x32}, 0x2, @in=@multicast1, 0x0, 0x2, 0x3}}, 0xe4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in=@multicast2, @in=@remote, 0x3, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2c}, {0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x3ff}}, {{@in6=@mcast2, 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3, 0x0, 0x80000, 0x9, 0x3}}, 0xe8) close(r0) 238.862416ms ago: executing program 0 (id=6479): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x21, 0x0, 0x0) r3 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_MAKE_EQUIV(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x3f7, 0x100, 0x70bd25, 0x25dfdbfc, {0x7, 0x7, './file0', './file0'}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x2004c845}, 0x4004001) setsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f0000000040)=0x7, 0x4) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @private2, 0x52}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000000100)={r6}, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0xffff, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffdba, 0x1, [@default, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x4000009, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x82e, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x2, 'syz1\x00', @null, 0x40005, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default]}) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x5, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000fdffffde18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001900000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 232.574059ms ago: executing program 1 (id=6480): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xa, 0xb, 0x42, 0x3e, 0x42}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x1005, &(0x7f0000002500)=""/4101, 0x0, 0xe}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xec}}, 0x0) 163.506989ms ago: executing program 4 (id=6481): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaac437bf8cb64c86dd6bcce16400000000000000000001000000000000000000000000000000002c020000000000000502000905"], 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="180000006a00010029bd5a00fcdbdf250a000000000800"], 0x18}, 0x1, 0x0, 0x0, 0x2000011}, 0x810) 126.424682ms ago: executing program 2 (id=6482): r0 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000)=0x4011, 0x4) (async) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f00000001c0)=0x7f, 0x4) (async) recvmmsg(r0, &(0x7f00000099c0)=[{{0x0, 0x0, 0x0}, 0x4251}, {{0x0, 0x0, &(0x7f0000007040)=[{&(0x7f0000006040)=""/4086, 0x1000}], 0x1}, 0x8000}], 0x3fffffffffffdfc, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xd, 0x20000000ec071, 0xffffffffffffffff, 0x0) (async) syz_emit_ethernet(0x15f, &(0x7f0000000880)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x129, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, [{0xe, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000000050000000026000400"}, {0x22, 0x17, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39e"}]}}}}}}, 0x0) (async) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000180)=0x2, 0x4) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) 123.10788ms ago: executing program 1 (id=6483): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_getrule={0x1c, 0x22, 0x4, 0x70bd2a, 0x25dfdbfe, {0xa, 0x80, 0x80, 0x0, 0xc5, 0x0, 0x0, 0x0, 0x14}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x2) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000140)=0x1c) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000001c0)={@ipv4={'\x00', '\xff\xff', @multicast2}, @mcast1, @private2, 0x3, 0x7f, 0x1, 0x100, 0x0, 0x200, r2}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x400, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4010}, 0x20040804) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000380)={0x0, ""/256, 0x0}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000580), r3) (async) r6 = accept4$netrom(0xffffffffffffffff, &(0x7f00000005c0)={{0x3, @null}, [@netrom, @bcast, @bcast, @bcast, @netrom, @netrom, @netrom, @bcast]}, &(0x7f0000000640)=0x48, 0x80000) setsockopt$netrom_NETROM_T2(r6, 0x103, 0x2, &(0x7f0000000680)=0xff, 0x4) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000001bc0)={{r0, &(0x7f00000006c0)='team0\x00', 0x701001, &(0x7f0000000700)={@align=0xffffffffffffffff, {0x6f, 0x8, 0x1ff, 0x2}}, 0x40, &(0x7f0000000740)={@_ha_fsid}, &(0x7f0000000780)=0x3}, 0x4, &(0x7f0000001b40)=[{0x3, 0x688, &(0x7f00000007c0)='\x00', &(0x7f0000000800)="a5ac06e20256c1a0a9abda96fb6ce35eaf640c389280ec59cf41916753016caba53e5b2c81f8fc1ac3e4aec6b41bb243f541dd253f97fc005a7ffa2c06b382878c6fa362b941ea18ac336bbbe7215ba2bb9b9a34536e6279000dff2ba4e3e12ee26be7a0ae15fa9f781b1c06f9d0589e413d8908115060fa0c55a778454b78581a52e877dd5aa9245ce79a8b60dab7847d1c6a3fb6cba7ff6537cb8d75cfa1bcff9bcc8e659a29110ec85c88c75daa2f6817679d24c8b8dd5a9a65167c276c8b15b5cbc06b700f6b5416882a7ed89ea4463a448bd65ac7581a77764c14d2cf4dcf5d17a7073bec36aaca3f3ceafc5dbf8062cd26ce33038751a22728e8eb6d9b52bcf22d19138a638bfe141d166b6c66f87247ff851b45d3e5d2cadc0e43f4e723b5289e575ae7af5f84f20c32b683fb39affdff61ac0b7bd3596ccb8b7b2e5e2970976e087fb1b4e0b331e56e2f80c9ff27d6b284626c04dd0a3463407702fc47df0eb0b7441ea63aaf3cee8e12e3be6f80fa35813d2b0aac4a53996a61a66e99a3c8fda23d4d3ce81fe7bfb32ebca28ce2949fc299d5454c35a3723706bb87451011dde57f116ecf8be35dc9e9d3399eb8a03a0b1feed404036a9db41064b701fcc11ecf21f54dd6d507a68abc234838a2e3859a355cd9b2ac9705fff53a2b11df9cdcfc4bd0b4a606cf83e407e15c6f43aa974b265ae18d6cd91c799e983b6dfcb09375346c0318f1a97d22f59f99359ec1e8ae106b613515429aa7406565af04b4d4f46698e9f45ebf1687d72d0c886996fb3709d293cc5dfdc1b8b789a30f294370c305120372463c55b11b3ce57bbc81b35efb6fbfe8e8aec981d8252675050ad809460215b0b7a130cf23d5b2615418a031a49dede7cc1690f0fabe89fccbad7c2d7d57efef5b1008b51ca49caf76c908949f3da7bbe24ced7335b649112f444de1adb18178b7f08a9492a97623e044644b47f9117ccfb68840aa18b5a585594f4f06bf67f0200a636e0daea5f48a05d36f2f1c02a37d4e4cf102143e9b2019c1df435ab9c14c38f7dfb67ab8487b1f52a8a44a35ec7293445386c4e0f83bd10f32743868aae9f4a17923ce0152d599d45c2e11c69d7d0726a48e81b44f005f2d58bd7bc077bd40c07346e4ab9ff3908b2fbcbeb3606aabd3e95724fd69a0119d3623407c5e0c99e7bd15760a05dd4f11a4c68c63a5996e25401eb78fa26dea9bc7e85efabefc06c535ee3e1d99bd0490f44e19e8e87a94af73c40bf86789f270fb1854fd71d9d8494673f6f739facb0f2839f82a485b279c84e37bce0c46e4d18745541e5bedc8ba1cf4ffb570e7e2c9b04db28e8cac1b3001978ff0553291fca969ee33c1b9bd459a24688736a0bada8c7b106cb144ba74c5157b4849bc88a711bc6b04218a3d017aada5a1212fc0dc5ab589a6ef64bf6ffe9a3ebfc8595904d2b9121ac1cfd05d2d26c062999976dd2f21493c6c1487a8b1dddbcffe13f468f6517be89ca42392e2c8d7ba573386f963b5972d6c0fc33fb6ad71f58b3cd08cd6ff7065b92fee8fdbcab3944014385cc49005cde9372812855651e407b670c44610c9a4554f16901be0b8ed2d645598ab324994100097ad059a53ee214d92f9f68d380d46a8911b87a1d19462fe842979ceac205a6f9b9100d01605207c6a8e153b3c6b7185b1d8b7c0c8f68a8efa43cdf7053c070ab64992411a75bb7bc0ec10b36362462eddea54d74af1456dd3c2a04657d6ffd849ad4058ae6553e41ce858e36bffc7c24c6f9069b12bbe12c51c464e6427e76e78b13731f6b6d0657da1890b37015edfee5402a71062a00cbea44bcbcb8fe97757110745dc66e8f2e8c6e3ef89395d7678f5b66083cf5a03e7639812541e66eaf11595f70673da70f4663dbd6e587aa406a2f63065b971aa8e783120355dd84d7441169fabacd012246ad1fcf8afb7ddd8a1365458a3b9a08bccf258d667225d76bb1f9d9407ee8d91ae5626f2c15150c10bf3ea46f3e1b1d8c2b5b5409978f17c7b72ab9e3a34739cbb4dba4a0a2cf45658a777db1ce26f8e0e55a29ee204dfaaf2f66e4f6a647529c12c2cf2c4390dd0eb38d15fb332bf0bb43b299b4cdddadd50af60d0b27b37ddcedbf544c8b0d82290213650e75f1ef44521510eb45bef5ed0520c37be71a3e34d629b6dc014af2894a536e6679eb32f2eef3b9ac3ae7910f0eb929866943108670e3afe8d48a7bdf23570cd1206a3cc7542f45b3a7e17ea3d0a31a8cc8ce3abf820031775a9a3ec6cc33a9827a39b4c4e1bc7635dbc3913053d35f02d13caae6032443bf62da8aaa268d702444546ef548c1a3964c43e868a7e112456b7ad09811e6d40720c46ef5883f757eb3a7487f464ed545ed0149078b865e0d130b13eafc2261afac9668157452640df4f6cd0614b528833425407dcaff85ce2d35234d41f1f47f3321b70c6d2ae5c7dceba0ed4f375c003c5d1bbd5868cbf8101c5b802417337e2f46ff665f280f432b00060579c87159e384b692360373c7063caad09805ebc80390cc716911b02c24c6be7b14468d775cacaf9bbd6c0aba1e25e9f3fe1529de1f18b6465c73683ddd368f4a9ad6510fe659155fe4be3d521f7238b2458adf323fdca867ba7bb5c67de51fff247842afee42155249dbaf1698d203cd65952c8c13dab8d16ad4e97903ad16ff92bfed3256e84b9b2e8443dea372d0dd343155496db3c343cea01e17e5a9f11a294728ca65dfd5b844f8a6a325c2edac4b1d245cf02d6b786a91e1f517bbe2a70d0f783f2473da898f7f1d311f174d7a15d44023f111af63d31079b15835e1f262df5866950a8d7906367b64a0a606964fbe536125387dcafbfcc80a132da876eb7820cb0d370ea691090bb29a64cbbae11e79142938fa4109a3c541ee0f2d902ab1e41c15fe4febd85e1856738752d13dd372c11829ab6328d3573de61ee13da697c9f7bbccfdc13c597e8fe14b136cf9ef22ec0d6872177349bca353feb68ad7667614e125b9bd987df79ce0ac29f628db5443fae0cb6fb5b84218f1cbd4f2b11f416773a4e9b79a845b42cc243387d342a8b1bcc2c77ee22b657448e03a34fc79e4fd2adc57a3e6e92ce6d61059731a5abe8364a496a1fbee8b10dcda97cf58b152f020816dcf4bb994c331b291f5db40beeb09af1e0106ffa361858e0c863bb97a9c67e97a5744f555d53c38de03e946e6893af3f015a88ba53f0be9154cd5150440627e3ff9514a09eb05371894a94d27dd61655c83090516f0b9576ad06019a1bd3979a6c5308f71e277114c7f821f21273dcd0aad16ce15e5422464a20889e3af2e33e703cbe4db675a41af0554ea15f93eab234cf94baca98fe7509d356b490660b40aa82ae700c2e00ecf4e90b32e79b5bd9722df48aa1c63af274e3ca652a0f09a8c88cbb072604eebcfd307eafd507039eb363af2b238894b6ece6e34429f0ad222ac3d2f8d74e671928fbfdbac24d9d344022facaf9adbf61f8dfb5d0aacc579f6e08d9af513f2e097fd64854d66cad962c8942532a86048a234b5b87305d3554a4c855ade56d4665b30b78102d8403b3d48f7630d4b8f2d42f74b12114c5910bc451e4f2ecaf1f9956069f971f47ddde6aa8b334f11a6f7ee1594217c5c414bfedc0216362617f6c170b4b03d92dee8dd89d5ba40ca286913af4eea85c631cb3610e38222b69b48baa4506bfb08e79c0ed30093eeee94f2c88a8d85b523204d41c455f4fe370e5ba241bbae8f723f5b05145be038fec21daefa0084cf3477f5a97f70e79f1d93c6705511bf777adaac0da55c12fe687f2019767ad1d2a91d7dfb279fa972a3739cb858bd812050078cf995e5f9d2e173ad0c79e635e09d4a9380dc8017499046f5ec38694fa0f58d90e9ac98cfb3f6efc7d3591cb5ecc11bb490fd5cef780ecca3d085876e6a2fd89ad42c67eacf17371e9b47aaac8e3db497ef24222459e36be8a05d52099575f0ffb2a823a9600b9599c8fe21bcf9a275ebad32542ff670d448edb966430c860b6f4cf5dba587cba4247cfd3a3f4ca58c4930228f2b9f8d02f66cfce62563b0ca21e0ee9c98b13eafa0958fc964ac6d871795502d0a8ee425bd8761c7a55316888cc04ac97cf5a79e693c125b5d6bc8ebe6104593cdd2b0100e8d310931ac0d0182a2b03d96dce142086888ef055e95beb1afc98a278a48aa1e357e6090cb114440caf4634c53029ad429edc3f69781140235148cf6bcb2e032fb9d2d14bfa65ad1b660152a33ad3f6e3428eebbe0a1901a19a56d1b2ff2d2bf9aeb440a066cfaf6eacbf00f17f15a2b723ec9c9fd6501fb37014bf55fb598d9ae5b1356c15800f8aa0ec0d1cf25d97b669bba5ca66affe7d0304328bd52ec3d873d737f23c47be8b4316796d866b9868da361d948efdb45abc250a9fc6c31ff55348e4d078ce0c99237958c671eaa45eda80f0771ccd176670f2dcb63b32845110f894b592a4b6db210936c1c25dc13d32b8343f194527768d2610f931d9e5fe9f0c288f03aa1c96ff5ffe497fb1923bdcc1b9ef7ddd837938632604d7829fcacc8e4da1e3621bd84a06d79162f4b6298b2f415b3fb5e861510e95173516e3d15d59c4368d6ec19169104c5f57ec09f2cfc21fc49379bf4512747b447d763bfc355d85636cb4d9dbf75c86b73af22fc2615bd16b323eaf62e8a7572b29b9e02842fbfea19f4f1fb912cfb1ed6c3529543949103f41beb91d52a260a62061bb5b3cfdb6b52340bd994790ff71fad1acf8693e360303f790ce60120df95951a8a0c0501cc09117aaf6213ad1fb1338add470fe10c7acc14cfedb45bef7fd2f74aa34fa1a47d62cc842e9aa89dc6f94cf13332cc82eddf05e8a0164099dce07ec9cd397e9fca0d039f7d3477e8cb47321b5d14200f2e7c83e1ebef118f61aae1761093f18f4fb20fc916301ef3aefd28cf8c762d9137955db71db1baec6d4becd2d46058473c4c782ec0de8def0901ca9a4f6132f80c54bd0c5eba6ee776058d5dc0362dce094aba3eb49ebe249589dfcc48a25b36ebe57ced67499d42b42dcd586a96a68827f774a5ea81c6c8754d7fc7f04826577b3df737002e23b7d1c7064e3270a940aa4efd91f1fa5459b7a1745feea28bcc0ce24e257f01843ff9e25cb5aacaade9cd2b3663d8d61048d0efc08cc8c5deff310b1cb1b0be090cd55a0d29286a66b2547bc4cedebe961b05494e6de66d9c580f7d5aacc461b365e0b336c42eb6b1e04769b7ba1a07bd19009666fc6d2f12b77fa542af61cdde7454fd36974fdb51378c1f361619717b889e1bf0df2e1f9b635c213876c843fb72a6d73239cf15b186cb73031fd7a11dd712395fbffe67a459eb8ec3d0f131ee20fca761a49b01fa2332be1e1cf25eaf06d29f293b29ebc525abe1825dc4f6ff0b9ccf867c952d7c797d1d93019dd4b2a371ff80560b5eac5a73868d89c6d3e33a19e38a95ad8c9b9f2e67471dc814f42936a256334a547ce28846334ec949aeac211b6137a5b6f8b2874a800d9b376d07df2cee82cb67e1511da81154ee4e48c2e46ef254bc88bff8e422f6bddebbdcdfd037ff40bdc97e5ace300d99f8f4b90821210f023db1c8fe8c1b46ef15d468c3030b72cd680216e22fc066adbb3ae742be1b1073017efb2bd8fa54b4c31eed9fb7dfca8d9720e7dc03a0df23da6550eb5b9566a41edfb418d618a5671170d1b27be3c8757c9b98af55c15ba336283aeac791031cf96cf77e56ef2e3115791aa9683eb2cec8cb01289fb69ffa0c13de10a1c41", 0x1000, 0x3a}, {0x2, 0x800, &(0x7f0000001800)='*@@#\x00', &(0x7f0000001840)="844b2ec4bd48dca06d084a7e3db63a5d826fc7a2eb3f016697822763d3284f7dd876e4435f0e7a9ea00fde4a80437f747288a11259c75491961e01958825dfbe6a506ce005426e29cd2d02b26eb5a06dc0263be96e68621c1670a2899bbd1ff844d4e60b99570eda4c98dd5e0da30c5f0aa0452b55fb11d9815ebe40d66244f73cb83b8328e97e948d06e2c36f5ac0562cc1bb2e9b508f2f80dd33c47c86fbdd270705634a9f34d01bb27c38620b579c8c4d6c265a2b7e72c2e7be0091d8b75bae3414b713e8d604c0c247723999e800ee3fd7fa6aec602aa29f29d37d5dcb97b77ac7c2ca29", 0xe6, 0x2}, {0x2, 0x80000000, &(0x7f0000001940)='team0\x00', &(0x7f0000001980)="99a3701eabc51d12fd3593f0ec0cc7abd81676adc96804675bf93ad8918dbf0f3b76601f865f4772ddf0957ef1a023eadce67cf8049eedc930b13bc7d7cd7668a6af23b0", 0x44}, {0x3, 0x6, &(0x7f0000001a00)='mptcp_pm\x00', &(0x7f0000001a40)="61c14cfc9ef20a18af9d46f38720e827e09222bc02b9a50fd19c0863e59926edcfaab3932f97f8c1add26a4ad7c052070d7cc0d5db1e38f93e28c757977099c2ecb128dcc9e682734d3446208c9525f2da38ab14f9bfbfae905b6bc6658a17c556268a29b78a17733bc30fecaa9b3eedd1fdb4e3197d9cde8702fe93300aba07fbb46b0a2360f5691a18edf47380d61785e51aeec83a54f713c6d2381f5f63e1709a71edc62f8118346b2031d8354dfeb8733e3de3bc2853da06bf9b143af5b92b510d49cbbe7645c5c083dc3f91460959be20faaffedee467c41d3ed29936df60c0489d287df931e91ce357d53857a12681e2dc97a9bc0a2cf603fa61a8", 0xfe, 0x2}]}) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000001c40)) (async) sendmsg$AUDIT_TTY_SET(r7, &(0x7f0000001d40)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001d00)={&(0x7f0000001cc0)={0x18, 0x3f9, 0x300, 0x70bd2d, 0x25dfdbff, {0x1, 0x1}, ["", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x41}, 0x4040005) (async) ioctl$BTRFS_IOC_TREE_SEARCH(r7, 0xd0009411, &(0x7f0000001d80)={{r5, 0x7, 0x8000000000000000, 0x8000, 0xb, 0x6, 0x1ff, 0x6, 0xffff, 0xd3, 0x5, 0x2, 0xa, 0x9, 0x936}}) socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg(r7, &(0x7f00000032c0)={&(0x7f0000002d80)=@tipc=@name, 0x80, &(0x7f0000003180)=[{&(0x7f0000002e00)=""/102, 0x66}, {&(0x7f0000002e80)=""/166, 0xa6}, {&(0x7f0000002f40)=""/171, 0xab}, {&(0x7f0000003000)=""/194, 0xc2}, {&(0x7f0000003100)=""/71, 0x47}], 0x5, &(0x7f0000003200)=""/179, 0xb3}, 0x40) (async) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, &(0x7f0000003300)={0x0, @in6={{0xa, 0x4e22, 0x0, @mcast2, 0x8000}}}, &(0x7f00000033c0)=0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000003400)={0x39, 0x20b, 0x526, 0x0, r8}, 0x10) (async) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000003440), &(0x7f0000003480)=0x8) (async) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCDELRT(r9, 0x890c, &(0x7f0000003500)={0x0, {0x2, 0x4e23, @empty}, {0x2, 0x4e23, @remote}, {0x2, 0x4e21, @broadcast}, 0x2, 0x0, 0x0, 0x0, 0xd, &(0x7f00000034c0)='veth0_to_team\x00', 0x6c, 0x7, 0x4}) (async) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000035c0), r7) sendmsg$NL80211_CMD_FLUSH_PMKSA(r3, &(0x7f0000003680)={&(0x7f0000003580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000003640)={&(0x7f0000003600)={0x28, r10, 0x200, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x3b}}}}, ["", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x20000000) (async) mmap(&(0x7f0000ff4000/0x9000)=nil, 0x9000, 0x9, 0x110, r1, 0x28ea6000) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r7, 0x89f8, &(0x7f00000037c0)={'erspan0\x00', &(0x7f00000036c0)={'gretap0\x00', r2, 0x10, 0x7800, 0x0, 0x8, {{0x29, 0x4, 0x0, 0x1, 0xa4, 0x67, 0x0, 0xf, 0x4, 0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@noop, @cipso={0x86, 0x3d, 0xffffffffffffffff, [{0x7, 0xb, "6b923267bb7300d7ca"}, {0x2, 0x9, "2ab52ca02cd7e8"}, {0x5, 0x12, "64d4f096d7686d0650801559fe9d58ea"}, {0x2, 0x11, "c1d3253b6704ab4d5730cc0257db29"}]}, @lsrr={0x83, 0x1f, 0xbc, [@rand_addr=0x64010101, @empty, @broadcast, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010100, @loopback]}, @lsrr={0x83, 0x2b, 0x3d, [@loopback, @multicast2, @remote, @remote, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x34}, @loopback, @multicast2, @multicast1]}, @ra={0x94, 0x4}, @noop]}}}}}) (async) setsockopt$netrom_NETROM_T2(r6, 0x103, 0x2, &(0x7f0000003800)=0x7fffffff, 0x4) (async) recvfrom$rxrpc(r7, &(0x7f0000003840)=""/4096, 0x1000, 0x10002, &(0x7f0000004840)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e20, 0x401, @dev={0xfe, 0x80, '\x00', 0x39}, 0xffff8000}}, 0x24) bind$can_j1939(r7, &(0x7f0000004880)={0x1d, r2, 0x0, {0x1, 0x0, 0x2}, 0xfe}, 0x18) 0s ago: executing program 4 (id=6484): bind$phonet(0xffffffffffffffff, &(0x7f0000000040)={0x23, 0x14}, 0x10) socket$rxrpc(0x21, 0x2, 0x2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000200)=0xc) socket$netlink(0x10, 0x3, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'wlc\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f0000000600)=ANY=[@ANYRES8=r0], &(0x7f0000000040)='GPL\x00'}, 0x94) clock_gettime(0x0, &(0x7f0000000000)) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) r6 = socket(0x10, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, 0x0, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3}, {}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) readv(r4, &(0x7f0000000200)=[{&(0x7f0000001b80)=""/4096, 0x1000}], 0x1) sendmsg$can_bcm(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES64=0x0], 0x80}}, 0x0) r8 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): icast mode [ 591.581771][T25337] hsr_slave_1: left allmulticast mode [ 591.593608][T25337] veth1_virt_wifi: left allmulticast mode [ 591.599810][T25337] veth0_virt_wifi: left allmulticast mode [ 591.606076][T25337] veth1_vlan: left allmulticast mode [ 591.612507][T25337] vlan0: left allmulticast mode [ 591.617636][T25337] vlan1: left allmulticast mode [ 591.623162][T25337] macvlan0: left allmulticast mode [ 591.628520][T25337] macvlan1: left allmulticast mode [ 591.634177][T25337] ipvlan0: left allmulticast mode [ 591.639467][T25337] ipvlan1: left allmulticast mode [ 591.645122][T25337] veth0_vlan: left allmulticast mode [ 591.650663][T25337] veth1_macvtap: left allmulticast mode [ 591.656686][T25337] veth0_macvtap: left allmulticast mode [ 591.688690][T25337] geneve0: left allmulticast mode [ 591.703611][T25337] geneve1: left allmulticast mode [ 591.708850][T25337] mac80211_hwsim hwsim47 wlan0: left allmulticast mode [ 591.725641][T25337] mac80211_hwsim hwsim48 wlan1: left allmulticast mode [ 591.746025][T25337] bridge1: left allmulticast mode [ 591.751919][T25337] bridge2: left promiscuous mode [ 591.756884][T25337] bridge2: left allmulticast mode [ 591.776675][T25337] bond3: left promiscuous mode [ 591.789162][T25337] bond4: left promiscuous mode [ 591.801644][T25337] bond5: left promiscuous mode [ 591.878412][T25364] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5071'. [ 591.889120][T25364] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5071'. [ 592.057158][T25374] netlink: 'syz.0.5073': attribute type 39 has an invalid length. [ 592.564257][T25392] lo speed is unknown, defaulting to 1000 [ 592.690695][T25402] netlink: 'syz.1.5082': attribute type 11 has an invalid length. [ 592.698755][T25402] netlink: 'syz.1.5082': attribute type 23 has an invalid length. [ 592.707013][T25402] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5082'. [ 592.834892][T25409] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5084'. [ 593.054802][T25416] netlink: 'syz.3.5086': attribute type 2 has an invalid length. [ 593.084238][T25416] netlink: 'syz.3.5086': attribute type 2 has an invalid length. [ 593.141858][T25422] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 593.401005][T25427] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5087'. [ 593.446215][T25441] netlink: 256 bytes leftover after parsing attributes in process `syz.2.5089'. [ 593.528900][T25445] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 593.704806][T25451] openvswitch: netlink: Flow key attr not present in new flow. [ 594.422116][T25474] x_tables: duplicate underflow at hook 2 [ 594.990936][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 594.999050][ C1] lec:lec_tx_timeout: lec0 [ 595.003933][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 595.164351][T25497] __nla_validate_parse: 3 callbacks suppressed [ 595.164371][T25497] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5101'. [ 595.471102][T25500] gretap4: entered promiscuous mode [ 595.486753][T25504] lo speed is unknown, defaulting to 1000 [ 595.487353][T25512] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5106'. [ 595.525289][T25501] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5102'. [ 595.609758][T25519] delete_channel: no stack [ 595.670126][T25518] 8021q: adding VLAN 0 to HW filter on device bond0 [ 595.679776][T25518] bridge0: port 3(vlan4) entered blocking state [ 595.686225][T25518] bridge0: port 3(vlan4) entered forwarding state [ 595.689673][T25522] syz.4.5108: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null) [ 595.708875][T25522] ,cpuset=/,mems_allowed=0-1 [ 595.715178][T25518] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 595.722223][T25522] CPU: 1 UID: 0 PID: 25522 Comm: syz.4.5108 Not tainted syzkaller #0 PREEMPT(full) [ 595.722249][T25522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 595.722270][T25522] Call Trace: [ 595.722340][T25522] [ 595.722348][T25522] dump_stack_lvl+0xe8/0x150 [ 595.722485][T25522] warn_alloc+0x249/0x340 [ 595.722532][T25522] ? stack_trace_save+0xa9/0x100 [ 595.722607][T25522] ? __pfx_warn_alloc+0x10/0x10 [ 595.722637][T25522] ? kasan_save_track+0x4f/0x80 [ 595.722662][T25522] ? kasan_save_track+0x3e/0x80 [ 595.722682][T25522] ? __kasan_kmalloc+0x93/0xb0 [ 595.722703][T25522] ? __kmalloc_cache_noprof+0x31c/0x660 [ 595.722730][T25522] ? xskq_create+0x56/0x170 [ 595.722849][T25522] ? xsk_setsockopt+0x54c/0x990 [ 595.722872][T25522] ? do_sock_setsockopt+0x17c/0x1b0 [ 595.722976][T25522] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 595.723002][T25522] ? do_syscall_64+0x14d/0xf80 [ 595.723056][T25522] __vmalloc_node_range_noprof+0x132/0x1730 [ 595.723105][T25522] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 595.723135][T25522] ? __kasan_kmalloc+0x93/0xb0 [ 595.723163][T25522] vmalloc_user_noprof+0xad/0xe0 [ 595.723184][T25522] ? xskq_create+0xbf/0x170 [ 595.723212][T25522] xskq_create+0xbf/0x170 [ 595.723244][T25522] xsk_init_queue+0x8a/0xe0 [ 595.723272][T25522] xsk_setsockopt+0x54c/0x990 [ 595.723299][T25522] ? __pfx_xsk_setsockopt+0x10/0x10 [ 595.723325][T25522] ? __pfx_aa_sk_perm+0x10/0x10 [ 595.723419][T25522] ? aa_sock_opt_perm+0xff/0x1a0 [ 595.723440][T25522] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 595.723480][T25522] ? __pfx_xsk_setsockopt+0x10/0x10 [ 595.723506][T25522] do_sock_setsockopt+0x17c/0x1b0 [ 595.723538][T25522] __x64_sys_setsockopt+0x13d/0x1b0 [ 595.723571][T25522] do_syscall_64+0x14d/0xf80 [ 595.723588][T25522] ? trace_irq_disable+0x3b/0x150 [ 595.723615][T25522] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.723653][T25522] ? clear_bhb_loop+0x40/0x90 [ 595.723675][T25522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.723698][T25522] RIP: 0033:0x7f8632f9c819 [ 595.723745][T25522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.723762][T25522] RSP: 002b:00007f8633e15028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 595.723844][T25522] RAX: ffffffffffffffda RBX: 00007f8633216090 RCX: 00007f8632f9c819 [ 595.723859][T25522] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 595.723871][T25522] RBP: 00007f8633032c91 R08: 0000000000000004 R09: 0000000000000000 [ 595.723883][T25522] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 595.723896][T25522] R13: 00007f8633216128 R14: 00007f8633216090 R15: 00007fff83559938 [ 595.723927][T25522] [ 595.726179][T25522] Mem-Info: [ 596.006022][T25522] active_anon:9859 inactive_anon:0 isolated_anon:0 [ 596.006022][T25522] active_file:3159 inactive_file:40492 isolated_file:0 [ 596.006022][T25522] unevictable:768 dirty:140 writeback:0 [ 596.006022][T25522] slab_reclaimable:14059 slab_unreclaimable:145192 [ 596.006022][T25522] mapped:31586 shmem:1497 pagetables:3514 [ 596.006022][T25522] sec_pagetables:0 bounce:0 [ 596.006022][T25522] kernel_misc_reclaimable:0 [ 596.006022][T25522] free:1244827 free_pcp:24872 free_cma:0 [ 596.051876][T25522] Node 0 active_anon:39436kB inactive_anon:0kB active_file:12636kB inactive_file:161748kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:126344kB dirty:556kB writeback:0kB shmem:4452kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15300kB pagetables:13892kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 596.084462][T25522] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 596.121970][T25522] Node 0 DMA free:15280kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:80kB local_pcp:36kB free_cma:0kB [ 596.152468][T25522] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 596.158345][T25522] Node 0 DMA32 free:1152016kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:39336kB inactive_anon:0kB active_file:12636kB inactive_file:161748kB unevictable:1536kB writepending:556kB zspages:0kB present:3129332kB managed:2552184kB mlocked:0kB bounce:0kB free_pcp:44588kB local_pcp:25900kB free_cma:0kB [ 596.198975][T25522] lowmem_reserve[]: 0 0 0 0 0 [ 596.204396][T25522] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:872kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 596.234715][T25522] lowmem_reserve[]: 0 0 0 0 0 [ 596.239660][T25522] Node 1 Normal free:3811684kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:56004kB local_pcp:24912kB free_cma:0kB [ 596.276647][T25522] lowmem_reserve[]: 0 0 0 0 0 [ 596.281799][T25522] Node 0 DMA: 2*4kB (U) 3*8kB (U) 1*16kB (U) 0*32kB 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 1*2048kB (M) 2*4096kB (U) = 15280kB [ 596.297721][T25522] Node 0 DMA32: 6126*4kB (UM) 6235*8kB (UM) 3071*16kB (UME) 1260*32kB (UME) 574*64kB (UME) 460*128kB (UME) 752*256kB (UM) 466*512kB (UM) 277*1024kB (UM) 47*2048kB (UE) 20*4096kB (U) = 1152384kB [ 596.341196][T25522] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 596.402665][T25522] Node 1 Normal: 5*4kB (U) 4*8kB (UM) 11*16kB (UM) 14*32kB (UM) 9*64kB (UM) 7*128kB (UM) 11*256kB (UM) 7*512kB (UM) 6*1024kB (UM) 2*2048kB (U) 926*4096kB (UM) = 3811684kB [ 596.442544][T25538] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5112'. [ 596.461201][T25522] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 596.461962][T25538] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.5112'. [ 596.470787][T25522] Node 0 hugepages_total=6 hugepages_free=0 hugepages_surp=4 hugepages_size=2048kB [ 596.499407][T25522] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 596.516271][T25522] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 596.527331][T25522] 45144 total pagecache pages [ 596.532394][T25522] 0 pages in swap cache [ 596.536796][T25522] Free swap = 124996kB [ 596.555361][T25522] Total swap = 124996kB [ 596.559518][T25522] 2097051 pages RAM [ 596.575319][T25522] 0 pages HighMem/MovableOnly [ 596.585050][T25522] 427172 pages reserved [ 596.593651][T25522] 0 pages cma reserved [ 596.607909][T25546] IPVS: Unknown mcast interface: netdevsim0 [ 596.766280][T25554] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5116'. [ 596.856065][T25555] 8021q: VLANs not supported on nlmon0 [ 596.993727][T25564] syzkaller0: entered promiscuous mode [ 596.999477][T25564] syzkaller0: entered allmulticast mode [ 597.242140][T25575] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5123'. [ 597.300522][T25575] netlink: 'syz.2.5123': attribute type 1 has an invalid length. [ 597.325252][T25579] netlink: 'syz.1.5125': attribute type 8 has an invalid length. [ 597.391002][T25582] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5124'. [ 597.492999][T25587] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5126'. [ 598.757551][T25577] tunl0: Caught tx_queue_len zero misconfig [ 598.765793][T25575] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 598.770710][T25582] ipvlan2: entered allmulticast mode [ 598.784523][T25582] syz_tun: entered allmulticast mode [ 598.923601][T25595] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 599.117090][T25609] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5132'. [ 599.557809][T25634] lo speed is unknown, defaulting to 1000 [ 600.010853][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 600.018913][ C1] lec:lec_tx_timeout: lec0 [ 600.023562][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 600.888294][T25680] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5152'. [ 601.481081][T25694] syzkaller0: entered promiscuous mode [ 601.491083][T25694] syzkaller0: entered allmulticast mode [ 601.826109][T25712] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5161'. [ 601.964417][T25730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5167'. [ 601.989696][T25730] : entered promiscuous mode [ 602.012853][T25730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5167'. [ 602.034020][T25730] openvswitch: : Dropping previously announced user features [ 602.090778][T25736] netlink: 5 bytes leftover after parsing attributes in process `syz.1.5168'. [ 602.251578][T25754] netlink: 'syz.1.5173': attribute type 1 has an invalid length. [ 602.262619][T25757] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5174'. [ 602.265410][T25759] netlink: 'syz.0.5175': attribute type 9 has an invalid length. [ 602.292140][T25754] 8021q: adding VLAN 0 to HW filter on device bond6 [ 602.372220][T25754] bond6: (slave veth15): Enslaving as an active interface with a down link [ 602.393704][T25754] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5173'. [ 602.419428][T25754] bond6: (slave bridge7): Enslaving as an active interface with a down link [ 602.466652][T25763] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 602.931232][T21709] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.948945][T21709] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.979960][T25794] tipc: Started in network mode [ 603.011206][T25794] tipc: Node identity e2e2222f8d74, cluster identity 4711 [ 603.018547][T25794] tipc: Enabled bearer , priority 0 [ 603.109722][T25795] syzkaller0: entered promiscuous mode [ 603.117254][T25795] syzkaller0: entered allmulticast mode [ 603.124332][T25795] tipc: Resetting bearer [ 603.131981][T21709] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.144203][T25808] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5184'. [ 603.164862][T21709] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.201495][T25781] tipc: Resetting bearer [ 603.220404][T25813] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5188'. [ 604.841483][T25781] tipc: Disabling bearer [ 604.854219][T25808] ipvlan3: entered promiscuous mode [ 604.976020][ T9612] tipc: Node number set to 1872110127 [ 605.030888][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 605.038951][ C1] lec:lec_tx_timeout: lec0 [ 605.043841][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 605.082262][T25845] syzkaller0: entered promiscuous mode [ 605.089174][T25845] syzkaller0: entered allmulticast mode [ 605.136922][T25845] tipc: Enabled bearer , priority 0 [ 605.160001][T25845] tipc: Resetting bearer [ 605.181269][T25844] tipc: Resetting bearer [ 605.260152][T25844] tipc: Disabling bearer [ 605.519245][T25873] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5203'. [ 605.575868][T25876] openvswitch: netlink: EtherType 0 is less than min 600 [ 605.643710][T25882] IPVS: set_ctl: invalid protocol: 50 127.0.0.1:20001 [ 605.936255][T25889] netlink: 'syz.3.5207': attribute type 1 has an invalid length. [ 605.988450][T25889] bond11: (slave vxcan1): The slave device specified does not support setting the MAC address [ 605.999740][T25889] bond11: (slave vxcan1): Error -95 calling set_mac_address [ 606.073510][T25894] __nla_validate_parse: 3 callbacks suppressed [ 606.073535][T25894] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5208'. [ 606.098027][T25894] : entered promiscuous mode [ 606.129454][T25900] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5210'. [ 606.137060][T25899] tipc: Enabling of bearer rejected, failed to enable media [ 606.157096][T25894] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5208'. [ 606.177386][T25894] openvswitch: : Dropping previously announced user features [ 606.186606][T25899] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5209'. [ 606.663458][T25921] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 606.868809][T25945] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5221'. [ 606.881871][T25945] netlink: 'syz.3.5221': attribute type 10 has an invalid length. [ 606.923178][T25951] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5224'. [ 607.112750][T25960] lo speed is unknown, defaulting to 1000 [ 607.158991][T17838] IPVS: starting estimator thread 0... [ 607.261089][T25964] IPVS: using max 37 ests per chain, 88800 per kthread [ 607.577927][T25972] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5229'. [ 607.793052][T25978] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5232'. [ 607.803286][T25978] netlink: 'syz.0.5232': attribute type 1 has an invalid length. [ 607.812697][T25978] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5232'. [ 607.831087][T25978] netlink: 658 bytes leftover after parsing attributes in process `syz.0.5232'. [ 608.247907][T25990] bond7: option lacp_rate: invalid value (128) [ 608.255930][T25990] bond7 (unregistering): Released all slaves [ 608.488274][T26001] bond0: entered allmulticast mode [ 608.504581][T25997] syzkaller1: entered allmulticast mode [ 608.595788][T26012] netlink: 'syz.1.5244': attribute type 1 has an invalid length. [ 608.606693][T26017] sctp: [Deprecated]: syz.4.5241 (pid 26017) Use of int in max_burst socket option. [ 608.606693][T26017] Use struct sctp_assoc_value instead [ 608.785221][T26024] lo: Caught tx_queue_len zero misconfig [ 608.990381][T26032] syzkaller1: entered promiscuous mode [ 608.997307][T26032] syzkaller1: entered allmulticast mode [ 609.068514][T26026] lo speed is unknown, defaulting to 1000 [ 609.244053][T26047] bridge0: port 3(vlan4) entered disabled state [ 609.309638][T26051] x_tables: duplicate underflow at hook 1 [ 609.586392][T26061] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 609.779232][T26079] netlink: 'syz.4.5261': attribute type 6 has an invalid length. [ 609.861877][T26063] lo speed is unknown, defaulting to 1000 [ 610.050890][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 610.058963][ C1] lec:lec_tx_timeout: lec0 [ 610.063653][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 610.724297][T26095] dvmrp1: entered allmulticast mode [ 610.736095][T26096] dvmrp1: left allmulticast mode [ 611.164180][T26117] openvswitch: netlink: Message has 496 unknown bytes. [ 611.188084][T26117] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 611.213326][T26120] __nla_validate_parse: 114 callbacks suppressed [ 611.213343][T26120] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5273'. [ 611.288664][T26123] netlink: 'syz.1.5275': attribute type 1 has an invalid length. [ 611.298015][T26123] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 611.576239][T26137] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5276'. [ 611.663166][T26139] netlink: 100 bytes leftover after parsing attributes in process `syz.1.5279'. [ 611.701783][T26139] netlink: 100 bytes leftover after parsing attributes in process `syz.1.5279'. [ 611.857476][T26144] netlink: 4356 bytes leftover after parsing attributes in process `syz.4.5281'. [ 611.939408][T26144] netlink: 4356 bytes leftover after parsing attributes in process `syz.4.5281'. [ 612.042315][T26148] netlink: 260 bytes leftover after parsing attributes in process `syz.0.5283'. [ 612.060558][T26149] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5283'. [ 612.532388][T26158] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5286'. [ 612.546573][T26158] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5286'. [ 612.561242][T26158] netlink: 'syz.4.5286': attribute type 19 has an invalid length. [ 612.569838][T26158] netlink: 'syz.4.5286': attribute type 20 has an invalid length. [ 613.038254][T26174] sch_tbf: burst 0 is lower than device sit0 mtu (1480) ! [ 613.093252][T26178] syzkaller1: entered promiscuous mode [ 613.098912][T26178] syzkaller1: entered allmulticast mode [ 613.176243][T26176] netlink: 'syz.0.5291': attribute type 13 has an invalid length. [ 613.184258][T26176] netlink: 'syz.0.5291': attribute type 17 has an invalid length. [ 613.234902][T26183] netlink: 'syz.2.5293': attribute type 1 has an invalid length. [ 613.290084][T26176] 8021q: adding VLAN 0 to HW filter on device team0 [ 613.333327][T26176] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 613.391659][T26183] 8021q: adding VLAN 0 to HW filter on device bond7 [ 613.423113][T26184] veth9: entered promiscuous mode [ 613.444751][T26184] bond7: (slave veth9): Enslaving as an active interface with an up link [ 613.624053][T26200] syzkaller0: entered promiscuous mode [ 613.650627][T26200] syzkaller0: entered allmulticast mode [ 614.042157][T26216] x_tables: duplicate underflow at hook 2 [ 614.362723][T26235] netem: incorrect gi model size [ 614.386699][T26235] netem: change failed [ 614.485836][T26240] vlan3: entered promiscuous mode [ 614.499951][T26240] 0{X: entered promiscuous mode [ 615.070927][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 615.079012][ C1] lec:lec_tx_timeout: lec0 [ 615.083666][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 615.741510][T26327] netlink: 'syz.1.5325': attribute type 2 has an invalid length. [ 615.952543][T26343] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 615.958625][T26343] syzkaller1: linktype set to 825 [ 617.124048][T26382] __nla_validate_parse: 11 callbacks suppressed [ 617.124071][T26382] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5344'. [ 617.168828][T26399] syzkaller0: entered promiscuous mode [ 617.188209][T26399] syzkaller0: entered allmulticast mode [ 617.243637][T26401] netlink: 71 bytes leftover after parsing attributes in process `syz.4.5348'. [ 617.253338][T26401] SET target dimension over the limit! [ 617.257900][T26405] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5349'. [ 617.366190][T26414] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5350'. [ 617.465436][T26414] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5350'. [ 617.480767][T26414] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5350'. [ 617.556622][T26422] lo speed is unknown, defaulting to 1000 [ 617.581909][T26425] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5353'. [ 617.793960][T26433] sch_tbf: burst 1 is lower than device syzkaller0 mtu (1500) ! [ 617.825324][T26433] syzkaller0: entered promiscuous mode [ 617.849197][T26433] syzkaller0: entered allmulticast mode [ 618.411789][T26452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5359'. [ 618.471204][T26456] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5359'. [ 618.533671][T26452] erspan1: entered promiscuous mode [ 618.571225][T26452] erspan1: entered allmulticast mode [ 618.955428][T26472] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5363'. [ 619.033039][T26479] netlink: 'syz.2.5366': attribute type 1 has an invalid length. [ 619.209879][T26476] 8021q: adding VLAN 0 to HW filter on device bond8 [ 619.338213][T26498] netlink: 'syz.0.5369': attribute type 20 has an invalid length. [ 619.416718][T21709] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 619.451376][T21709] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 619.477839][T21709] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 619.492838][T26509] netlink: 'syz.3.5373': attribute type 1 has an invalid length. [ 619.501536][T26509] netlink: 'syz.3.5373': attribute type 1 has an invalid length. [ 619.529166][T21709] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 619.564450][T26509] netlink: 'syz.3.5373': attribute type 3 has an invalid length. [ 619.569144][T26502] lo speed is unknown, defaulting to 1000 [ 620.091496][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 620.099558][ C1] lec:lec_tx_timeout: lec0 [ 620.104159][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 620.220677][T26565] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 620.935968][T26570] syzkaller0: entered promiscuous mode [ 620.948252][T26570] syzkaller0: entered allmulticast mode [ 621.002912][T26570] tipc: Enabled bearer , priority 0 [ 621.062411][T26570] tipc: Resetting bearer [ 621.088248][T26569] tipc: Resetting bearer [ 621.151418][T26569] tipc: Disabling bearer [ 621.423612][T26614] syzkaller1: entered promiscuous mode [ 621.429142][T26614] syzkaller1: entered allmulticast mode [ 621.438360][T26614] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 621.498928][T26617] 8021q: VLANs not supported on caif0 [ 621.669857][T26622] nbd: must specify a device to reconfigure [ 621.745110][T26624] syzkaller0: entered promiscuous mode [ 621.763008][T26624] syzkaller0: entered allmulticast mode [ 621.971018][ T29] audit: type=1800 audit(1776053963.779:10): pid=26642 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5412" name="e" dev="tmpfs" ino=2216 res=0 errno=0 [ 622.277730][T26687] __nla_validate_parse: 26 callbacks suppressed [ 622.277743][T26687] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5423'. [ 622.295174][T26687] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5423'. [ 622.357644][T26689] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5423'. [ 622.393141][T26689] bond8: (slave geneve2): Enslaving as an active interface with an up link [ 622.401919][T21709] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 622.410450][T21709] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 622.419457][ T9644] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 622.428288][ T9644] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 622.870304][T26657] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 623.077311][T26706] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5426'. [ 623.180763][T26700] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5426'. [ 623.319201][T26715] netlink: 'syz.0.5428': attribute type 10 has an invalid length. [ 623.336074][T26715] team0: Port device dummy0 added [ 623.357100][T26715] netlink: 'syz.0.5428': attribute type 10 has an invalid length. [ 623.393495][T26715] team0: Port device dummy0 removed [ 623.969949][T26735] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5434'. [ 624.321311][T26735] vlan0: entered promiscuous mode [ 624.591709][T26747] xt_CT: No such helper "syz0" [ 624.951755][T26771] bond12: option miimon: invalid value (18446744073709551607) [ 624.988342][T26771] bond12: option miimon: allowed values 0 - 2147483647 [ 625.011214][T26771] bond12 (unregistering): Released all slaves [ 625.110906][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 625.118990][ C1] lec:lec_tx_timeout: lec0 [ 625.123687][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 625.186977][T26778] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.228813][T26778] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 625.371927][T26778] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.401558][T26778] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 625.516972][T26778] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.559578][T26795] netlink: 'syz.2.5450': attribute type 1 has an invalid length. [ 625.593072][T26778] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 625.613698][T26795] netlink: 'syz.2.5450': attribute type 2 has an invalid length. [ 625.693866][T26807] syzkaller1: entered promiscuous mode [ 625.704946][T26807] syzkaller1: entered allmulticast mode [ 625.724769][T26778] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 625.760925][T26778] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 625.943656][T21705] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.978457][T21705] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 626.031828][T26822] bridge12: entered promiscuous mode [ 626.040976][T26822] bridge12: entered allmulticast mode [ 626.059362][T26822] team0: Failed to send port change of device bridge12 via netlink (err -105) [ 626.095459][T26822] team0: Failed to send options change via netlink (err -105) [ 626.115506][T26822] team0: Port device bridge12 added [ 626.149800][T21705] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 626.166047][T26832] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5459'. [ 626.166348][T21705] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 626.265078][T21709] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 626.281262][T21709] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 626.321967][ T9644] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 626.330528][ T9644] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 626.455852][T26848] netlink: 2 bytes leftover after parsing attributes in process `syz.0.5465'. [ 626.464861][T26848] netlink: 2 bytes leftover after parsing attributes in process `syz.0.5465'. [ 626.474701][T26848] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5465'. [ 627.421453][T26871] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 627.633191][T26881] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5469'. [ 628.410608][T26809] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 628.652979][T26888] bond7: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 628.664981][T26888] bond7 (unregistering): Released all slaves [ 628.690572][T26894] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5473'. [ 628.709541][T26897] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5474'. [ 628.939408][T26911] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5470'. [ 629.012074][T26893] lo speed is unknown, defaulting to 1000 [ 629.125998][T26919] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5480'. [ 629.236085][T26919] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5480'. [ 629.482604][T26930] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5482'. [ 629.647600][T26938] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5484'. [ 629.698313][T26939] netlink: 112 bytes leftover after parsing attributes in process `syz.2.5484'. [ 629.720201][T26930] team0: Port device team_slave_0 removed [ 629.892002][T26946] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5486'. [ 630.031729][T21705] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.045496][T21705] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.157869][T21705] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.166181][T21705] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.395000][T26959] dvmrp0: entered allmulticast mode [ 630.427556][T26958] tipc: Enabled bearer , priority 0 [ 630.517597][T26958] syzkaller0: entered promiscuous mode [ 630.530913][T26958] syzkaller0: entered allmulticast mode [ 630.541915][T26958] tipc: Resetting bearer [ 630.646697][T26951] tipc: Resetting bearer [ 631.450837][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6330 ms [ 631.458916][ C1] lec:lec_tx_timeout: lec0 [ 631.463977][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 633.117849][T26951] tipc: Disabling bearer [ 633.223139][T11531] tipc: Node number set to 4294967295 [ 633.390409][T26982] tipc: Enabling of bearer rejected, already enabled [ 633.434329][T26987] netlink: 'syz.3.5497': attribute type 1 has an invalid length. [ 633.523608][T26987] 8021q: adding VLAN 0 to HW filter on device bond12 [ 633.549465][T26994] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 633.613528][T26994] bond12: (slave batadv1): making interface the new active one [ 633.644420][T26987] __nla_validate_parse: 3 callbacks suppressed [ 633.644439][T26987] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5497'. [ 633.682389][T26994] bond12: (slave batadv1): Enslaving as an active interface with an up link [ 633.771114][T26987] bond12 (unregistering): (slave batadv1): Releasing active interface [ 633.826168][T26987] bond12 (unregistering): Released all slaves [ 633.867327][T27011] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5501'. [ 634.042104][T27012] netlink: 208 bytes leftover after parsing attributes in process `syz.0.5500'. [ 634.161445][T27025] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5505'. [ 634.191072][T27023] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 634.263703][T27029] tipc: Enabling of bearer rejected, failed to enable media [ 634.809105][T27054] syzkaller0: entered promiscuous mode [ 634.811234][T27056] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5519'. [ 634.824790][T27054] syzkaller0: entered allmulticast mode [ 635.280395][T27073] netlink: 'syz.4.5526': attribute type 10 has an invalid length. [ 635.294316][T27073] team0: Device vxcan1 is of different type [ 635.335479][T27075] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5528'. [ 635.404259][T27075] ipvlan2: entered allmulticast mode [ 635.599993][T27088] mac80211_hwsim hwsim47 syzkaller0: entered promiscuous mode [ 635.632866][T27088] mac80211_hwsim hwsim47 syzkaller0: entered allmulticast mode [ 635.694109][T27090] mac80211_hwsim hwsim45 syzkaller0: left allmulticast mode [ 635.723436][T27093] syzkaller0: entered promiscuous mode [ 635.730130][T27093] syzkaller0: entered allmulticast mode [ 636.047998][T27112] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5542'. [ 636.162869][T27112] team0: Port device team_slave_1 removed [ 636.194785][T27122] netlink: 'syz.0.5545': attribute type 39 has an invalid length. [ 636.485269][T27133] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5551'. [ 636.682870][T27151] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5560'. [ 636.732783][T27151] macvtap1: entered promiscuous mode [ 636.733744][T27155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5560'. [ 636.779716][T27151] bond0: entered promiscuous mode [ 636.786299][T27151] macvtap1: entered allmulticast mode [ 636.792389][T27151] bond0: entered allmulticast mode [ 636.798170][T27151] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 636.815326][T27155] bond0: left allmulticast mode [ 636.825639][T27155] bond0: left promiscuous mode [ 637.210827][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 637.218880][ C1] lec:lec_tx_timeout: lec0 [ 637.223677][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 637.384136][T27183] mac80211_hwsim hwsim45 syzkaller0: entered allmulticast mode [ 637.824939][T27207] 8021q: adding VLAN 0 to HW filter on device bond1 [ 638.397848][T27237] syzkaller0: entered promiscuous mode [ 638.408608][T27237] syzkaller0: entered allmulticast mode [ 638.857490][T27251] mac80211_hwsim hwsim47 syzkaller0: left promiscuous mode [ 638.886456][T27251] mac80211_hwsim hwsim47 syzkaller0: left allmulticast mode [ 639.155944][T27274] syzkaller0: entered promiscuous mode [ 639.190871][T27274] syzkaller0: entered allmulticast mode [ 639.279036][T27286] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 639.554802][T27296] netlink: 'syz.1.5619': attribute type 3 has an invalid length. [ 639.598218][T27296] __nla_validate_parse: 6 callbacks suppressed [ 639.598237][T27296] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5619'. [ 639.657496][T27298] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5621'. [ 639.708803][T27299] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5621'. [ 640.002093][T27306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5623'. [ 641.831198][T27298] macvtap1: entered promiscuous mode [ 641.836537][T27298] dummy0: entered promiscuous mode [ 641.842377][T27298] macvtap1: entered allmulticast mode [ 641.847835][T27298] dummy0: entered allmulticast mode [ 641.871147][T27299] dummy0: left allmulticast mode [ 641.880621][T27299] dummy0: left promiscuous mode [ 642.020421][T27318] netlink: 'syz.1.5629': attribute type 29 has an invalid length. [ 642.036941][T27318] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5629'. [ 642.057919][T27318] bond0: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 642.116589][T27326] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5632'. [ 642.125734][T27327] netlink: 'syz.0.5631': attribute type 10 has an invalid length. [ 642.175083][T27326] ipvlan2: entered allmulticast mode [ 642.194876][T27326] syz_tun: entered allmulticast mode [ 642.426389][T27341] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5637'. [ 642.907161][T27375] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5644'. [ 642.940494][T27375] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5644'. [ 642.970834][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 642.976543][T27379] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5648'. [ 642.978897][ C1] lec:lec_tx_timeout: lec0 [ 642.980040][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 643.065648][T27375] 8021q: adding VLAN 0 to HW filter on device bond0 [ 643.084794][T27375] bond1: (slave bond0): Enslaving as an active interface with a down link [ 643.269392][T27390] lo speed is unknown, defaulting to 1000 [ 643.579849][T27401] lo speed is unknown, defaulting to 1000 [ 644.057383][T27414] netlink: 'syz.4.5657': attribute type 1 has an invalid length. [ 644.294998][T27414] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 644.771741][T27446] __nla_validate_parse: 3 callbacks suppressed [ 644.771762][T27446] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5667'. [ 644.896879][T27448] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5667'. [ 645.096849][T27439] bond9 (unregistering): Released all slaves [ 645.356115][T27454] netlink: 240 bytes leftover after parsing attributes in process `syz.1.5670'. [ 645.535462][T27453] 8021q: adding VLAN 0 to HW filter on device team0 [ 645.556940][T27453] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 645.706610][T27459] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 645.797992][T27464] syzkaller0: entered promiscuous mode [ 645.811416][T27464] syzkaller0: entered allmulticast mode [ 645.845213][T27474] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5674'. [ 645.904177][T27474] : entered promiscuous mode [ 646.206297][T27484] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 646.755278][T27498] bridge0: vlan filtering disabled, automatically disabling multicast vlan snooping [ 646.895291][T27494] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5681'. [ 646.928928][T27514] netlink: 272 bytes leftover after parsing attributes in process `syz.1.5686'. [ 646.958321][T27515] tipc: Enabled bearer , priority 0 [ 646.965905][T27515] mac80211_hwsim hwsim47 syzkaller0: entered promiscuous mode [ 646.973665][T27515] mac80211_hwsim hwsim47 syzkaller0: entered allmulticast mode [ 646.983494][T27515] tipc: Resetting bearer [ 647.124161][T27527] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.5690'. [ 647.212738][T27527] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5690'. [ 647.272870][T27514] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5686'. [ 647.335680][T27514] hsr_slave_0: left promiscuous mode [ 647.351189][T27514] hsr_slave_1: left promiscuous mode [ 647.391937][T27539] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5693'. [ 647.927842][T27545] tipc: Enabling of bearer rejected, already enabled [ 647.967407][T27547] veth0_to_batadv: entered promiscuous mode [ 647.973938][T27547] veth0_to_batadv: entered allmulticast mode [ 647.998526][T17838] tipc: Node number set to 3590766203 [ 648.000837][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 648.011939][ C1] lec:lec_tx_timeout: lec0 [ 648.016893][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 648.510403][T27575] lo speed is unknown, defaulting to 1000 [ 648.614137][T27578] syzkaller0: entered promiscuous mode [ 648.619658][T27578] syzkaller0: entered allmulticast mode [ 648.794064][T27585] netem: change failed [ 649.054689][T27590] lo speed is unknown, defaulting to 1000 [ 649.651114][T27605] lo speed is unknown, defaulting to 1000 [ 650.623651][T27631] tipc: Enabled bearer , priority 0 [ 650.642887][T27631] mac80211_hwsim hwsim42 syzkaller0: entered promiscuous mode [ 650.650387][T27631] mac80211_hwsim hwsim42 syzkaller0: entered allmulticast mode [ 650.972816][T27636] __nla_validate_parse: 4 callbacks suppressed [ 650.972833][T27636] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5719'. [ 651.895799][T27647] netlink: 240 bytes leftover after parsing attributes in process `syz.3.5723'. [ 651.968663][T27647] netlink: 'syz.3.5723': attribute type 12 has an invalid length. [ 652.079993][T27647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5723'. [ 652.152223][T27647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 652.199707][T27648] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 652.232835][T27655] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 652.528537][T27664] 8021q: adding VLAN 0 to HW filter on device bond0 [ 652.581796][T27664] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 652.684759][T27665] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 652.928564][T27680] sctp: [Deprecated]: syz.1.5731 (pid 27680) Use of int in maxseg socket option. [ 652.928564][T27680] Use struct sctp_assoc_value instead [ 653.002538][T27681] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5730'. [ 653.013087][T27680] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5731'. [ 653.030855][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 653.038922][ C1] lec:lec_tx_timeout: lec0 [ 653.043874][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 653.420978][T27698] netlink: 'syz.1.5736': attribute type 29 has an invalid length. [ 653.448542][T27692] netlink: 'syz.1.5736': attribute type 29 has an invalid length. [ 653.472941][T27696] lo speed is unknown, defaulting to 1000 [ 653.543977][T27704] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5739'. [ 653.545658][T27706] x_tables: ip_tables: osf match: only valid for protocol 6 [ 653.781870][T27720] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5742'. [ 654.020869][T27728] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5744'. [ 654.443121][T27748] pim6reg: entered allmulticast mode [ 654.534816][T27745] pim6reg: left allmulticast mode [ 655.958103][T27763] lo speed is unknown, defaulting to 1000 [ 655.970290][T27792] bridge_slave_0: default FDB implementation only supports local addresses [ 658.050828][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 658.058869][ C1] lec:lec_tx_timeout: lec0 [ 658.063913][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 663.070848][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 663.078869][ C1] lec:lec_tx_timeout: lec0 [ 663.083960][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 668.090862][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 668.098886][ C1] lec:lec_tx_timeout: lec0 [ 668.103495][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 673.110922][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 673.118926][ C1] lec:lec_tx_timeout: lec0 [ 673.123545][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 679.450853][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6330 ms [ 679.458984][ C1] lec:lec_tx_timeout: lec0 [ 679.464071][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 685.210874][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 685.218935][ C1] lec:lec_tx_timeout: lec0 [ 685.223762][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 690.970852][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 690.978902][ C1] lec:lec_tx_timeout: lec0 [ 690.983572][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 695.990859][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 695.998877][ C1] lec:lec_tx_timeout: lec0 [ 696.003536][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 701.010884][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 701.018905][ C1] lec:lec_tx_timeout: lec0 [ 701.023469][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 706.030891][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 706.038910][ C1] lec:lec_tx_timeout: lec0 [ 706.044027][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 711.050952][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 711.058975][ C1] lec:lec_tx_timeout: lec0 [ 711.063548][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 714.318192][T27821] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5761'. [ 714.345985][T27821] vlan3: entered promiscuous mode [ 714.460636][T27829] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5764'. [ 714.471880][T27820] delete_channel: no stack [ 714.521986][T27836] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5766'. [ 714.622701][T27839] netlink: 'syz.1.5765': attribute type 1 has an invalid length. [ 714.655824][T27839] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 714.832608][T27851] bond9: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 714.867664][T27851] bond9 (unregistering): Released all slaves [ 714.935545][T27864] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 714.942044][T27864] syzkaller1: linktype set to 1 [ 715.033583][T27860] lo speed is unknown, defaulting to 1000 [ 715.162399][T27879] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5780'. [ 715.411177][T27895] FAULT_INJECTION: forcing a failure. [ 715.411177][T27895] name failslab, interval 1, probability 0, space 0, times 0 [ 715.446283][T27895] CPU: 0 UID: 0 PID: 27895 Comm: syz.1.5783 Not tainted syzkaller #0 PREEMPT(full) [ 715.446307][T27895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 715.446319][T27895] Call Trace: [ 715.446326][T27895] [ 715.446334][T27895] dump_stack_lvl+0xe8/0x150 [ 715.446369][T27895] should_fail_ex+0x412/0x560 [ 715.446517][T27895] should_failslab+0xa8/0x100 [ 715.446542][T27895] __kmalloc_noprof+0xe8/0x760 [ 715.446564][T27895] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 715.446641][T27895] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 715.446666][T27895] genl_family_rcv_msg_doit+0xd9/0x330 [ 715.446688][T27895] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 715.446712][T27895] ? apparmor_capable+0x126/0x170 [ 715.446766][T27895] ? bpf_lsm_capable+0x9/0x20 [ 715.446789][T27895] ? security_capable+0x7e/0x2c0 [ 715.446864][T27895] genl_rcv_msg+0x61c/0x7a0 [ 715.446887][T27895] ? __pfx_genl_rcv_msg+0x10/0x10 [ 715.446901][T27895] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 715.446997][T27895] ? __pfx_nl80211_new_interface+0x10/0x10 [ 715.447020][T27895] ? __pfx_nl80211_post_doit+0x10/0x10 [ 715.447042][T27895] ? __lock_acquire+0x6b5/0x2cf0 [ 715.447081][T27895] netlink_rcv_skb+0x232/0x4b0 [ 715.447104][T27895] ? __pfx_genl_rcv_msg+0x10/0x10 [ 715.447125][T27895] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 715.447164][T27895] ? down_read+0x272/0x2e0 [ 715.447212][T27895] ? genl_rcv+0xd/0x40 [ 715.447232][T27895] genl_rcv+0x28/0x40 [ 715.447248][T27895] netlink_unicast+0x80f/0x9b0 [ 715.447278][T27895] ? __pfx_netlink_unicast+0x10/0x10 [ 715.447300][T27895] ? netlink_sendmsg+0x650/0xb40 [ 715.447321][T27895] ? skb_put+0x11b/0x210 [ 715.447380][T27895] netlink_sendmsg+0x813/0xb40 [ 715.447412][T27895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 715.447437][T27895] ? aa_sock_msg_perm+0xf1/0x1b0 [ 715.447460][T27895] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 715.447484][T27895] ____sys_sendmsg+0x972/0x9f0 [ 715.447518][T27895] ? __pfx_____sys_sendmsg+0x10/0x10 [ 715.447551][T27895] ? import_iovec+0x73/0xa0 [ 715.447610][T27895] ___sys_sendmsg+0x2a5/0x360 [ 715.447640][T27895] ? __pfx____sys_sendmsg+0x10/0x10 [ 715.447700][T27895] ? __fget_files+0x2a/0x420 [ 715.447729][T27895] ? __fget_files+0x3a0/0x420 [ 715.447757][T27895] __x64_sys_sendmsg+0x1bd/0x2a0 [ 715.447784][T27895] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 715.447819][T27895] ? __pfx_ksys_write+0x10/0x10 [ 715.447859][T27895] do_syscall_64+0x14d/0xf80 [ 715.447877][T27895] ? trace_irq_disable+0x3b/0x150 [ 715.447893][T27895] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.447912][T27895] ? clear_bhb_loop+0x40/0x90 [ 715.447939][T27895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.447957][T27895] RIP: 0033:0x7f500d19c819 [ 715.447975][T27895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 715.447989][T27895] RSP: 002b:00007f500e08c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 715.448009][T27895] RAX: ffffffffffffffda RBX: 00007f500d415fa0 RCX: 00007f500d19c819 [ 715.448023][T27895] RDX: 0000000024044884 RSI: 0000200000000300 RDI: 0000000000000005 [ 715.448034][T27895] RBP: 00007f500e08c090 R08: 0000000000000000 R09: 0000000000000000 [ 715.448045][T27895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 715.448056][T27895] R13: 00007f500d416038 R14: 00007f500d415fa0 R15: 00007ffd79fe7268 [ 715.448085][T27895] [ 715.800428][T27900] lo speed is unknown, defaulting to 1000 [ 716.074249][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 716.082303][ C1] lec:lec_tx_timeout: lec0 [ 716.088014][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 716.120921][T27909] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5786'. [ 716.133916][T27909] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5786'. [ 716.192596][T27914] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5786'. [ 716.233995][T27914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5786'. [ 716.776513][T27952] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5795'. [ 716.787761][T27952] netlink: 'syz.4.5795': attribute type 13 has an invalid length. [ 716.792687][T27954] netlink: 'syz.0.5796': attribute type 9 has an invalid length. [ 716.795883][T27952] netlink: 'syz.4.5795': attribute type 17 has an invalid length. [ 716.977374][T27961] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5795'. [ 717.027743][T27952] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 717.233642][T27954] netlink: 'syz.0.5796': attribute type 9 has an invalid length. [ 717.379230][T27954] netlink: 'syz.0.5796': attribute type 9 has an invalid length. [ 717.524456][T27954] netlink: 'syz.0.5796': attribute type 9 has an invalid length. [ 717.534698][T27981] team0 (unregistering): left allmulticast mode [ 717.541825][T27981] team0 (unregistering): left promiscuous mode [ 717.548491][T27981] bridge0: port 1(team0) entered disabled state [ 717.576215][T27981] team0 (unregistering): Port device bridge8 removed [ 717.611055][T27981] team0 (unregistering): Port device bridge12 removed [ 718.536662][T28037] syzkaller0: entered promiscuous mode [ 718.543089][T28037] syzkaller0: entered allmulticast mode [ 718.615527][T28041] netlink: 'syz.1.5818': attribute type 1 has an invalid length. [ 718.631022][T28040] : renamed from bond_slave_0 [ 718.777357][T28052] syzkaller0: entered promiscuous mode [ 718.789073][T28052] syzkaller0: entered allmulticast mode [ 720.368627][T28056] __nla_validate_parse: 10 callbacks suppressed [ 720.368646][T28056] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.5822'. [ 720.451203][T28077] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5827'. [ 720.499718][T28080] xt_TCPMSS: Only works on TCP SYN packets [ 720.520736][T28082] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5829'. [ 720.527775][T28087] tipc: Failed to remove unknown binding: 66,1,1/2886997007:4019899766/4019899768 [ 720.549746][T28082] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5829'. [ 720.561424][T28088] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1500) ! [ 720.576057][T28088] syzkaller0: entered promiscuous mode [ 720.594578][T28088] syzkaller0: entered allmulticast mode [ 720.615321][T28087] tipc: Failed to remove unknown binding: 66,1,1/2886997007:4019899766/4019899768 [ 720.646904][T28088] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5831'. [ 720.647268][T28087] tipc: Failed to remove unknown binding: 66,1,1/2886997007:4019899766/4019899768 [ 720.667086][T28095] tipc: Enabled bearer , priority 10 [ 720.851740][T28104] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5836'. [ 720.872386][T28104] tipc: Enabled bearer , priority 14 [ 720.888525][T28104] netlink: 3 bytes leftover after parsing attributes in process `syz.3.5836'. [ 720.898862][T28104] 0X: renamed from caif0 [ 720.916594][T28104] tipc: Disabling bearer [ 720.926819][T28104] 0X: entered allmulticast mode [ 720.932934][T28104] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 721.100840][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 721.108904][ C1] lec:lec_tx_timeout: lec0 [ 721.114005][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 721.164726][T28138] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5844'. [ 721.264396][T28127] netlink: 'syz.2.5843': attribute type 1 has an invalid length. [ 721.277733][T28127] netlink: 1 bytes leftover after parsing attributes in process `syz.2.5843'. [ 721.311135][T28145] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5846'. [ 721.499977][T28158] veth7: entered allmulticast mode [ 721.685752][T28169] 8021q: adding VLAN 0 to HW filter on device bond12 [ 721.800201][T28175] netlink: 'syz.2.5854': attribute type 1 has an invalid length. [ 721.922209][T28179] lo speed is unknown, defaulting to 1000 [ 721.928633][T28188] netlink: 'syz.2.5858': attribute type 13 has an invalid length. [ 722.202562][T28194] ip6tnl6: entered allmulticast mode [ 722.753661][T28203] veth1_to_bridge: left allmulticast mode [ 722.765589][T28203] veth0_to_batadv: left promiscuous mode [ 722.772357][T28203] veth0_to_batadv: left allmulticast mode [ 722.786073][T28203] vlan0: left promiscuous mode [ 722.793172][T28203] bridge3: left promiscuous mode [ 722.798281][T28203] bridge3: left allmulticast mode [ 722.808574][T28203] macvtap1: left promiscuous mode [ 722.819105][T28203] macvtap1: left allmulticast mode [ 722.832315][T28203] bond4: left promiscuous mode [ 722.832490][T28219] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 722.837492][T28203] veth9: left allmulticast mode [ 722.838141][T28203] macsec1: left promiscuous mode [ 722.857199][T28203] bond6: left promiscuous mode [ 722.862154][T28203] bridge8: left promiscuous mode [ 722.867273][T28203] bond6: left allmulticast mode [ 722.872229][T28203] bridge8: left allmulticast mode [ 722.877548][T28203] gretap4: left promiscuous mode [ 722.901785][T28214] tipc: Enabling of bearer rejected, failed to enable media [ 722.923661][ T5957] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 722.934083][ T5957] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 722.964712][T28219] mac80211_hwsim hwsim45 syzkaller0: Caught tx_queue_len zero misconfig [ 723.037500][ T5957] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 723.057381][ T5957] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 723.300401][T28239] netlink: 'syz.3.5872': attribute type 13 has an invalid length. [ 723.479902][ T5826] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 723.491519][ T5826] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 723.501515][ T5826] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 723.511287][ T5826] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 723.520249][ T5826] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 723.731454][T28246] lo speed is unknown, defaulting to 1000 [ 724.114617][T28265] macvtap0: entered promiscuous mode [ 724.119953][T28265] veth1_to_hsr: entered promiscuous mode [ 724.146334][T28265] macvtap0: entered allmulticast mode [ 724.161200][T28265] veth1_to_hsr: entered allmulticast mode [ 724.252333][T28270] netlink: 'syz.2.5883': attribute type 1 has an invalid length. [ 724.281130][T28274] netlink: 'syz.1.5885': attribute type 8 has an invalid length. [ 724.459233][T28286] sctp: [Deprecated]: syz.2.5887 (pid 28286) Use of int in maxseg socket option. [ 724.459233][T28286] Use struct sctp_assoc_value instead [ 724.658216][T21704] bridge_slave_1: left allmulticast mode [ 724.671681][T21704] bridge_slave_1: left promiscuous mode [ 724.699253][T21704] bridge0: port 2(bridge_slave_1) entered disabled state [ 724.784586][T21704] bridge_slave_0: left allmulticast mode [ 724.832236][T21704] bridge_slave_0: left promiscuous mode [ 724.838024][T21704] bridge0: port 1(bridge_slave_0) entered disabled state [ 724.921244][T21704] pimreg: left allmulticast mode [ 725.393004][T21704] bond3 (unregistering): (slave geneve2): Releasing active interface [ 725.610901][ T5826] Bluetooth: hci2: command tx timeout [ 725.794502][T21704] bond6 (unregistering): (slave bridge8): Removing an active aggregator [ 725.803992][T21704] bond6 (unregistering): (slave bridge8): Releasing backup interface [ 725.894740][T21704] bond1 (unregistering): (slave bond0): Releasing active interface [ 725.904599][T21704] bond0 (unregistering): Released all slaves [ 725.917022][T21704] bond1 (unregistering): Released all slaves [ 725.933170][T21704] bond2 (unregistering): Released all slaves [ 725.948909][T21704] bond3 (unregistering): Released all slaves [ 725.963857][T21704] bond4 (unregistering): Released all slaves [ 725.979125][T21704] bond5 (unregistering): Released all slaves [ 725.998793][T21704] bond6 (unregistering): Released all slaves [ 726.012784][T28298] netlink: 'syz.2.5892': attribute type 12 has an invalid length. [ 726.031750][T28305] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 726.214700][T21704] 5n: left promiscuous mode [ 726.294168][T28347] tipc: Invalid UDP bearer configuration [ 726.294216][T28347] tipc: Enabling of bearer rejected, failed to enable media [ 726.329869][T28343] netlink: 'syz.2.5898': attribute type 1 has an invalid length. [ 726.348741][T21704] : left promiscuous mode [ 726.350540][T28343] __nla_validate_parse: 13 callbacks suppressed [ 726.350554][T28343] netlink: 256 bytes leftover after parsing attributes in process `syz.2.5898'. [ 726.354589][T28347] netlink: 232 bytes leftover after parsing attributes in process `syz.1.5901'. [ 726.434610][T21704] : left promiscuous mode [ 726.598174][T21704] tipc: Left network mode [ 726.747450][T28366] netlink: 'syz.2.5904': attribute type 16 has an invalid length. [ 726.756226][T28366] netlink: 'syz.2.5904': attribute type 17 has an invalid length. [ 726.785026][T28366] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 726.807359][T21697] bridge0: port 3(vlan4) entered blocking state [ 726.813756][T21697] bridge0: port 3(vlan4) entered forwarding state [ 726.888998][T28381] mac80211_hwsim hwsim45 syzkaller0: left promiscuous mode [ 726.896298][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5780 ms [ 726.896326][ C1] lec:lec_tx_timeout: lec0 [ 726.904837][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 726.917794][T28381] mac80211_hwsim hwsim45 syzkaller0: left allmulticast mode [ 726.952826][T28246] chnl_net:caif_netlink_parms(): no params data found [ 727.435687][T28246] bridge0: port 1(bridge_slave_0) entered blocking state [ 727.444938][T28246] bridge0: port 1(bridge_slave_0) entered disabled state [ 727.455403][T28246] bridge_slave_0: entered allmulticast mode [ 727.463266][T28246] bridge_slave_0: entered promiscuous mode [ 727.499029][T28246] bridge0: port 2(bridge_slave_1) entered blocking state [ 727.508986][T28246] bridge0: port 2(bridge_slave_1) entered disabled state [ 727.516926][T28246] bridge_slave_1: entered allmulticast mode [ 727.531298][T28246] bridge_slave_1: entered promiscuous mode [ 727.622953][T28246] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 727.635789][T28246] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 727.691245][ T5826] Bluetooth: hci2: command tx timeout [ 727.709416][T28246] team0: Port device team_slave_0 added [ 727.715593][T28424] netlink: 'syz.3.5914': attribute type 10 has an invalid length. [ 727.715716][T28426] netlink: 'syz.0.5915': attribute type 12 has an invalid length. [ 727.727486][T28424] netlink: 228 bytes leftover after parsing attributes in process `syz.3.5914'. [ 727.779492][T28246] team0: Port device team_slave_1 added [ 727.881863][T28246] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 727.896024][T28434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5917'. [ 727.899139][T28246] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 727.966374][T28246] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 728.011134][T28246] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 728.022113][T28246] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 728.066571][T28246] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 728.271723][T28246] hsr_slave_0: entered promiscuous mode [ 728.285037][T28246] hsr_slave_1: entered promiscuous mode [ 728.338396][T28246] debugfs: 'hsr0' already exists in 'hsr' [ 728.344509][T28246] Cannot create hsr debugfs directory [ 728.818991][T21704] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 728.827157][T21704] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 728.850330][T28478] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5922'. [ 728.944807][T28482] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5925'. [ 729.171375][T28485] netlink: 'syz.2.5925': attribute type 4 has an invalid length. [ 729.230021][T28482] netlink: 'syz.2.5925': attribute type 4 has an invalid length. [ 729.285734][T28482] mac80211_hwsim hwsim45 syzkaller0: entered promiscuous mode [ 729.293615][T28482] mac80211_hwsim hwsim45 syzkaller0: entered allmulticast mode [ 729.373431][T28490] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5927'. [ 729.409298][T28490] veth1_to_bond: entered promiscuous mode [ 729.430553][T28493] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5927'. [ 729.566507][T21704] IPVS: stop unused estimator thread 0... [ 729.724481][T21704] vlan3: left allmulticast mode [ 729.729412][T21704] ip6gretap0: left allmulticast mode [ 729.736857][T21704] vlan3: left promiscuous mode [ 729.742522][T21704] ip6gretap0: left promiscuous mode [ 729.747979][T21704] bridge0: port 1(vlan3) entered disabled state [ 729.755967][T21704] bridge_slave_1: left promiscuous mode [ 729.762419][T21704] bridge0: port 2(bridge_slave_1) entered disabled state [ 729.782652][ T5835] Bluetooth: hci2: command tx timeout [ 729.900605][T21704] batman_adv: batadv0: Removing interface: gretap2 [ 730.104656][T21704] bond4 (unregistering): (slave bridge4): Releasing backup interface [ 730.112911][T21704] bridge4 (unregistering): left promiscuous mode [ 730.305275][T21706] smc: removing ib device syz1 [ 730.311543][T21704] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 730.320478][T21704] bond_slave_0: left promiscuous mode [ 730.328202][T21704] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 730.337844][T21704] bond_slave_1: left promiscuous mode [ 730.343741][T21704] bond0 (unregistering): Released all slaves [ 730.353525][T21704] bond1 (unregistering): Released all slaves [ 730.366194][T21704] bond2 (unregistering): Released all slaves [ 730.378677][T21704] bond3 (unregistering): Released all slaves [ 730.391310][T21704] bond4 (unregistering): Released all slaves [ 730.412168][T21704] bond5 (unregistering): Released all slaves [ 730.424370][T21704] bond6 (unregistering): Released all slaves [ 730.436631][T21704] bond7 (unregistering): Released all slaves [ 730.454387][T21704] bond8 (unregistering): Released all slaves [ 730.467085][T21704] bond9 (unregistering): (slave veth9): Releasing active interface [ 730.476400][T21704] bond9 (unregistering): Released all slaves [ 730.489761][T21704] bond10 (unregistering): Released all slaves [ 730.502038][T21704] bond11 (unregistering): Released all slaves [ 730.525411][T21704] bond12 (unregistering): (slave veth13): Releasing backup interface [ 730.535601][T21704] bond12 (unregistering): (slave veth15): Releasing backup interface [ 730.546885][T21704] bond12 (unregistering): Released all slaves [ 731.315297][T28452] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 731.390576][T28246] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 731.465553][T28246] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 731.536121][T28246] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 731.567058][T28246] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 731.665024][T21704] : left promiscuous mode [ 731.859412][ T5835] Bluetooth: hci2: command 0x0419 tx timeout [ 731.929879][T21704] tipc: Disabling bearer [ 731.941495][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5040 ms [ 731.949553][ C1] lec:lec_tx_timeout: lec0 [ 731.951994][T21704] tipc: Disabling bearer [ 731.954221][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 731.966899][T21704] tipc: Left network mode [ 732.023769][T28533] netlink: 'syz.0.5939': attribute type 5 has an invalid length. [ 732.095290][T28548] macsec0: entered promiscuous mode [ 732.100544][T28548] macsec0: entered allmulticast mode [ 732.463566][T28557] tipc: Enabling of bearer rejected, already enabled [ 732.499749][T28557] veth1_virt_wifi: mtu less than device minimum [ 732.624564][T28560] syzkaller1: entered promiscuous mode [ 732.630136][T28560] syzkaller1: entered allmulticast mode [ 732.749479][T28246] 8021q: adding VLAN 0 to HW filter on device bond0 [ 732.859563][T28585] tipc: Enabled bearer , priority 14 [ 732.884579][T28585] netlink: 23 bytes leftover after parsing attributes in process `syz.2.5948'. [ 732.912983][T28246] 8021q: adding VLAN 0 to HW filter on device team0 [ 732.940416][T28585] caif0: entered allmulticast mode [ 732.986785][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.993995][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 733.055067][T28592] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5952'. [ 733.114452][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 733.121620][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 733.155599][T28594] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5951'. [ 733.473414][T28612] syzkaller1: entered promiscuous mode [ 733.503222][T28612] syzkaller1: entered allmulticast mode [ 733.509259][T28619] netlink: 'syz.1.5958': attribute type 2 has an invalid length. [ 733.540907][T28619] netlink: 'syz.1.5958': attribute type 1 has an invalid length. [ 733.548814][T28619] netlink: 152 bytes leftover after parsing attributes in process `syz.1.5958'. [ 733.574933][T28624] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 733.937215][ T5826] Bluetooth: hci2: command 0x0419 tx timeout [ 734.519301][T21704] hsr_slave_0: left promiscuous mode [ 734.578525][T21704] hsr_slave_1: left promiscuous mode [ 734.599603][T21704] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 734.609697][T28673] netlink: 92 bytes leftover after parsing attributes in process `syz.1.5969'. [ 734.677579][T28674] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5970'. [ 735.107631][T21704] team0 (unregistering): Port device 76 removed [ 735.130201][T21704] team0 (unregistering): Port device team_slave_0 removed [ 735.229604][ T35] smc: removing ib device syz0 [ 735.238910][T28246] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 735.251127][T28679] lo speed is unknown, defaulting to 1000 [ 735.257869][T28707] mac80211_hwsim hwsim51 syzkaller0: entered promiscuous mode [ 735.298740][T28707] mac80211_hwsim hwsim51 syzkaller0: entered allmulticast mode [ 735.338018][T28679] lo speed is unknown, defaulting to 1000 [ 735.364374][T28679] lo speed is unknown, defaulting to 1000 [ 735.445575][T28679] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 735.648684][T28679] lo speed is unknown, defaulting to 1000 [ 735.695403][T28679] lo speed is unknown, defaulting to 1000 [ 735.739084][T28679] lo speed is unknown, defaulting to 1000 [ 735.828642][T28679] lo speed is unknown, defaulting to 1000 [ 735.878729][T28679] lo speed is unknown, defaulting to 1000 [ 735.977162][T28679] lo speed is unknown, defaulting to 1000 [ 736.205251][T28246] veth0_vlan: entered promiscuous mode [ 736.266762][T28246] veth1_vlan: entered promiscuous mode [ 736.398588][T28246] veth0_macvtap: entered promiscuous mode [ 736.455367][T28246] veth1_macvtap: entered promiscuous mode [ 736.536076][T28246] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 736.579719][T28246] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 736.618291][ T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.641330][ T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.674934][ T49] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.723158][ T49] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.970926][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 736.978988][ C1] lec:lec_tx_timeout: lec0 [ 736.984125][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 737.015826][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 737.035072][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 737.089456][T28775] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5992'. [ 737.125435][T28775] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5992'. [ 737.191159][T28775] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5992'. [ 737.255906][T28775] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5992'. [ 737.406099][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 737.414602][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 737.427491][T28789] gre0: entered promiscuous mode [ 737.444400][T28789] gre0: entered allmulticast mode [ 737.611277][T28793] tipc: Enabled bearer , priority 0 [ 737.624296][T28793] tipc: Enabling of bearer rejected, already enabled [ 738.300143][ T5835] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 738.310451][ T5835] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 738.319223][ T5835] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 738.327333][ T5835] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 738.336516][ T5835] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 738.384251][T21704] IPVS: stop unused estimator thread 0... [ 738.450244][T28833] lo speed is unknown, defaulting to 1000 [ 738.468714][T28842] __nla_validate_parse: 1 callbacks suppressed [ 738.468732][T28842] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6006'. [ 738.524600][T28837] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6005'. [ 738.994982][T28858] can: request_module (can-proto-0) failed. [ 739.135845][T28833] chnl_net:caif_netlink_parms(): no params data found [ 739.502695][T28833] bridge0: port 1(bridge_slave_0) entered blocking state [ 739.517271][T28833] bridge0: port 1(bridge_slave_0) entered disabled state [ 739.536342][T28833] bridge_slave_0: entered allmulticast mode [ 739.551252][T28833] bridge_slave_0: entered promiscuous mode [ 739.572547][T28833] bridge0: port 2(bridge_slave_1) entered blocking state [ 739.589925][T28833] bridge0: port 2(bridge_slave_1) entered disabled state [ 739.604304][T28833] bridge_slave_1: entered allmulticast mode [ 739.642581][T28833] bridge_slave_1: entered promiscuous mode [ 739.865498][T28898] bond7 (unregistering): Released all slaves [ 739.982744][T28833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 740.012050][T28833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 740.118113][T28833] team0: Port device team_slave_0 added [ 740.143641][T28833] team0: Port device team_slave_1 added [ 740.218602][T28922] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6023'. [ 740.237666][T28833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 740.246827][T28833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 740.286044][T28833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 740.300727][T28925] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.6024'. [ 740.316672][T28925] netlink: 656 bytes leftover after parsing attributes in process `syz.1.6024'. [ 740.329464][T28833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 740.342357][T28833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 740.375137][T28833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 740.410918][ T5835] Bluetooth: hci1: command tx timeout [ 740.488801][T28936] sit3: entered allmulticast mode [ 740.692408][T28833] hsr_slave_0: entered promiscuous mode [ 740.708793][T28833] hsr_slave_1: entered promiscuous mode [ 740.946401][T28957] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6029'. [ 741.341425][T28976] netlink: 'syz.2.6035': attribute type 31 has an invalid length. [ 741.493848][T28985] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6038'. [ 741.496655][T28986] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6037'. [ 741.511556][T28985] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6038'. [ 741.552339][T28993] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6039'. [ 741.602424][T28993] SET target dimension over the limit! [ 741.926787][T28833] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 741.990783][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 741.998839][ C1] lec:lec_tx_timeout: lec0 [ 742.003708][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 742.020568][T28833] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 742.106665][T28833] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 742.208696][T28833] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 742.537759][ T5835] Bluetooth: hci1: command tx timeout [ 742.668636][T28833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 742.774196][T29056] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 742.781510][T29056] IPv6: NLM_F_CREATE should be set when creating new route [ 742.788790][T29056] IPv6: NLM_F_CREATE should be set when creating new route [ 742.796089][T29056] IPv6: NLM_F_CREATE should be set when creating new route [ 742.854941][T29056] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 742.905385][T29037] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 743.026703][T28833] 8021q: adding VLAN 0 to HW filter on device team0 [ 743.052331][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 743.059547][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 743.077001][T21697] bridge0: port 2(bridge_slave_1) entered blocking state [ 743.084200][T21697] bridge0: port 2(bridge_slave_1) entered forwarding state [ 743.099432][T29062] netlink: 'syz.1.6055': attribute type 1 has an invalid length. [ 743.165002][T29062] bond7: entered promiscuous mode [ 743.176748][T29062] 8021q: adding VLAN 0 to HW filter on device bond7 [ 743.524067][T29082] openvswitch: netlink: Missing key (keys=40, expected=80) [ 743.555814][T29086] __nla_validate_parse: 5 callbacks suppressed [ 743.555832][T29086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6059'. [ 743.744586][T29094] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6061'. [ 743.761053][T29091] IPVS: set_ctl: invalid protocol: 92 127.0.0.1:3 [ 743.804202][T28833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 743.908795][T28833] veth0_vlan: entered promiscuous mode [ 743.947563][T28833] veth1_vlan: entered promiscuous mode [ 743.983339][T29105] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6064'. [ 744.030388][T28833] veth0_macvtap: entered promiscuous mode [ 744.148776][T28833] veth1_macvtap: entered promiscuous mode [ 744.195936][T29113] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6067'. [ 744.212081][T29115] netlink: 'syz.2.6066': attribute type 1 has an invalid length. [ 744.225010][T28833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 744.288392][T29115] 8021q: adding VLAN 0 to HW filter on device bond10 [ 744.303301][T28833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 744.329589][T21697] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.359988][T21697] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.423961][T21697] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.452805][T21697] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.571043][ T5835] Bluetooth: hci1: command tx timeout [ 744.605055][T21706] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.623079][T21706] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.655407][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.685908][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.717496][T29132] netlink: 'syz.2.6073': attribute type 2 has an invalid length. [ 744.727089][T29132] netlink: 'syz.2.6073': attribute type 11 has an invalid length. [ 744.753892][T29132] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6073'. [ 744.784826][T29135] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6072'. [ 744.822837][T29135] tipc: Invalid UDP bearer configuration [ 744.822889][T29135] tipc: Enabling of bearer rejected, failed to enable media [ 744.856252][T29135] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6072'. [ 744.875775][T29137] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 744.902460][T29137] netlink: 'syz.1.6071': attribute type 10 has an invalid length. [ 745.183749][T29152] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 745.249592][ T5826] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 745.259602][ T5826] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 745.273712][ T5826] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 745.291250][ T5826] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 745.298819][ T5826] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 745.408341][T29154] lo speed is unknown, defaulting to 1000 [ 745.412306][T29158] netlink: 'syz.3.6078': attribute type 3 has an invalid length. [ 745.511995][ T35] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.530633][ T35] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 745.632412][ T35] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.657177][ T35] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 745.753181][ T35] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.766629][ T35] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 745.884288][T29177] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6084'. [ 745.887111][ T35] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.905194][T29177] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6084'. [ 745.917386][ T35] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 746.117597][T29192] syzkaller1: entered promiscuous mode [ 746.145844][T29192] syzkaller1: entered allmulticast mode [ 746.319312][ T35] bridge_slave_1: left allmulticast mode [ 746.338728][ T35] bridge_slave_1: left promiscuous mode [ 746.353729][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 746.386316][ T35] bridge_slave_0: left allmulticast mode [ 746.400578][ T35] bridge_slave_0: left promiscuous mode [ 746.415202][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 746.446963][T29211] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6091'. [ 746.654818][ T5835] Bluetooth: hci1: command tx timeout [ 746.897549][ T35] bond8 (unregistering): (slave geneve2): Releasing backup interface [ 747.010828][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 747.018895][ C1] lec:lec_tx_timeout: lec0 [ 747.023541][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 747.033881][ T35] team0: Port device bridge2 removed [ 747.240964][T21697] af_packet: tpacket_rcv: packet too big, clamped from 46 to 4294967272. macoff=96 [ 747.324609][ T35] bond1 (unregistering): Released all slaves [ 747.336945][ T35] bond2 (unregistering): Released all slaves [ 747.349624][ T35] bond3 (unregistering): Released all slaves [ 747.361836][ T35] bond4 (unregistering): Released all slaves [ 747.371170][ T5835] Bluetooth: hci5: command tx timeout [ 747.379130][ T35] bond5 (unregistering): Released all slaves [ 747.395592][ T35] bond6 (unregistering): Released all slaves [ 747.418522][ T35] bond0 (unregistering): Released all slaves [ 747.433591][ T35] bond7 (unregistering): Released all slaves [ 747.449460][ T35] bond8 (unregistering): Released all slaves [ 747.466190][T29154] chnl_net:caif_netlink_parms(): no params data found [ 747.478751][T29206] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 747.511294][T29206] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 747.531330][T29206] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 747.798782][ T35] : left promiscuous mode [ 747.882551][T29252] netlink: 'syz.3.6098': attribute type 10 has an invalid length. [ 747.993392][T29252] team0: Port device dummy0 added [ 748.004794][ T35] tipc: Disabling bearer [ 748.033186][ T35] tipc: Disabling bearer [ 748.072343][ T35] tipc: Left network mode [ 748.079586][T29154] bridge0: port 1(bridge_slave_0) entered blocking state [ 748.141042][T29154] bridge0: port 1(bridge_slave_0) entered disabled state [ 748.169628][T29154] bridge_slave_0: entered allmulticast mode [ 748.196480][T29154] bridge_slave_0: entered promiscuous mode [ 748.231571][T29154] bridge0: port 2(bridge_slave_1) entered blocking state [ 748.240047][T29154] bridge0: port 2(bridge_slave_1) entered disabled state [ 748.247863][T29154] bridge_slave_1: entered allmulticast mode [ 748.265663][T29154] bridge_slave_1: entered promiscuous mode [ 748.347666][T29154] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 748.369659][T29154] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 748.498624][T29154] team0: Port device team_slave_0 added [ 748.508885][T29154] team0: Port device team_slave_1 added [ 748.707518][T29154] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 748.729675][T29154] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 748.798810][T29154] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 748.853957][T29154] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 748.861133][T29154] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 748.897266][T29154] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 749.056694][T29154] hsr_slave_0: entered promiscuous mode [ 749.076415][T29154] hsr_slave_1: entered promiscuous mode [ 749.123029][T29154] debugfs: 'hsr0' already exists in 'hsr' [ 749.131537][T29154] Cannot create hsr debugfs directory [ 749.157913][T29324] __nla_validate_parse: 3 callbacks suppressed [ 749.157929][T29324] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6112'. [ 749.190956][ T35] hsr_slave_0: left promiscuous mode [ 749.207440][ T35] hsr_slave_1: left promiscuous mode [ 749.322064][T29338] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6116'. [ 749.385087][T29347] netlink: 'syz.4.6114': attribute type 10 has an invalid length. [ 749.400580][T29347] openvswitch: netlink: Flow key attr not present in new flow. [ 749.439456][T29349] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 749.451409][ T5835] Bluetooth: hci5: command tx timeout [ 749.558161][ T35] team0 (unregistering): Port device team_slave_1 removed [ 749.571892][ T35] team0 (unregistering): Port device team_slave_0 removed [ 749.683850][T29350] tun0: tun_chr_ioctl cmd 1074025675 [ 749.699182][T29350] tun0: persist enabled [ 749.746649][T29347] tun0: tun_chr_ioctl cmd 1074025675 [ 749.755489][T29357] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6118'. [ 749.772943][T29347] tun0: persist enabled [ 749.786006][T29353] tun0: tun_chr_ioctl cmd 1074025673 [ 750.180152][T29376] geneve2: entered allmulticast mode [ 750.294859][T29382] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6128'. [ 750.311267][T29380] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6127'. [ 750.323901][ T35] IPVS: stop unused estimator thread 0... [ 750.326745][T29385] netlink: 'syz.2.6129': attribute type 1 has an invalid length. [ 750.338704][T29382] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6128'. [ 750.351807][T29380] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6127'. [ 750.367088][T29380] netlink: 'syz.1.6127': attribute type 14 has an invalid length. [ 750.399216][T29380] netlink: 'syz.1.6127': attribute type 15 has an invalid length. [ 750.716674][T29400] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6133'. [ 750.793402][T29406] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6134'. [ 751.021246][T29400] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6133'. [ 751.057074][T29400] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 751.072402][T29400] ip6gretap1: entered allmulticast mode [ 751.255780][T29154] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 751.274837][T29154] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 751.308270][T29154] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 751.315889][T29434] netlink: 'syz.3.6139': attribute type 30 has an invalid length. [ 751.360170][T29154] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 751.530873][ T5835] Bluetooth: hci5: command tx timeout [ 751.547947][T29447] netlink: 'syz.1.6140': attribute type 16 has an invalid length. [ 751.591016][T29447] netlink: 'syz.1.6140': attribute type 17 has an invalid length. [ 751.614820][T29447] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 751.684693][T29154] 8021q: adding VLAN 0 to HW filter on device bond0 [ 751.775788][T29154] 8021q: adding VLAN 0 to HW filter on device team0 [ 751.806673][T21706] bridge0: port 1(bridge_slave_0) entered blocking state [ 751.813854][T21706] bridge0: port 1(bridge_slave_0) entered forwarding state [ 751.847897][T21704] bridge0: port 2(bridge_slave_1) entered blocking state [ 751.855159][T21704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 751.942169][T29466] bond8: (slave vcan0): refused to change device type [ 752.000264][T29423] lec:lec_atm_close: lec0: Shut down! [ 752.365650][T29154] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 752.566194][T29492] bond1: entered promiscuous mode [ 752.584304][T29492] bond1: entered allmulticast mode [ 752.597270][T29505] : renamed from bond0 (while UP) [ 752.747091][T29154] veth0_vlan: entered promiscuous mode [ 752.766810][T29154] veth1_vlan: entered promiscuous mode [ 752.889524][T29154] veth0_macvtap: entered promiscuous mode [ 752.927316][T29154] veth1_macvtap: entered promiscuous mode [ 752.973748][T29154] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 753.008109][T29535] netlink: 'syz.2.6155': attribute type 8 has an invalid length. [ 753.014934][T29536] openvswitch: netlink: IPv4 tun info is not correct [ 753.027437][T29540] netlink: 'syz.4.6156': attribute type 1 has an invalid length. [ 753.029739][T29154] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 753.055966][T29540] netlink: 'syz.4.6156': attribute type 11 has an invalid length. [ 753.125819][T21704] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 753.152553][T21704] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 753.180258][T21704] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 753.368390][T29548] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 753.408136][T21704] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 753.610957][ T5835] Bluetooth: hci5: command tx timeout [ 753.668925][T21707] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 753.692507][T21707] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 753.760963][T21706] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 753.801259][T21706] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 754.239767][T29588] xt_hashlimit: size too large, truncated to 1048576 [ 754.481329][T29609] __nla_validate_parse: 7 callbacks suppressed [ 754.481347][T29609] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6170'. [ 754.531481][T29609] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6170'. [ 754.820630][T29621] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6175'. [ 754.927035][T29616] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6172'. [ 755.026927][ T5826] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 755.041715][ T5826] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 755.057551][ T5826] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 755.065658][ T5826] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 755.073934][ T5826] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 755.184254][T29629] lo speed is unknown, defaulting to 1000 [ 755.622567][T29659] IPVS: set_ctl: invalid protocol: 8 172.20.20.187:20000 [ 755.657607][T29663] netlink: 'syz.3.6184': attribute type 10 has an invalid length. [ 755.698304][T29663] 8021q: adding VLAN 0 to HW filter on device team0 [ 755.711525][T29663] : (slave team0): Enslaving as an active interface with an up link [ 755.725681][T29629] chnl_net:caif_netlink_parms(): no params data found [ 755.806400][ T12] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 755.894698][ T12] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.133662][ T12] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.170549][ T12] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.374983][T29629] bridge0: port 1(bridge_slave_0) entered blocking state [ 756.406832][T29629] bridge0: port 1(bridge_slave_0) entered disabled state [ 756.424560][T29629] bridge_slave_0: entered allmulticast mode [ 756.442805][T29629] bridge_slave_0: entered promiscuous mode [ 756.459480][ T12] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.481658][ T12] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.531230][T29690] lo speed is unknown, defaulting to 1000 [ 756.549405][T29629] bridge0: port 2(bridge_slave_1) entered blocking state [ 756.556760][T29629] bridge0: port 2(bridge_slave_1) entered disabled state [ 756.577913][T29629] bridge_slave_1: entered allmulticast mode [ 756.587030][T29629] bridge_slave_1: entered promiscuous mode [ 756.677136][ T12] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.695828][ T12] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.790651][T29629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 756.851982][T29629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 756.886984][T29722] netlink: 'syz.3.6195': attribute type 1 has an invalid length. [ 756.966514][T29722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 757.000805][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 757.008857][ C1] lec:lec_tx_timeout: lec0 [ 757.013861][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 757.047168][T29629] team0: Port device team_slave_0 added [ 757.063827][T29629] team0: Port device team_slave_1 added [ 757.131937][ T5826] Bluetooth: hci3: command tx timeout [ 757.163990][T29629] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 757.171143][T29629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 757.175963][T29730] xt_connbytes: Forcing CT accounting to be enabled [ 757.199163][T29629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 757.258396][T29629] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 757.318728][T29629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 757.350310][T29629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 757.527540][ T12] vlan4: left allmulticast mode [ 757.556297][ T12] dummy0: left allmulticast mode [ 757.570909][ T12] vlan4: left promiscuous mode [ 757.582180][ T12] dummy0: left promiscuous mode [ 757.611785][ T12] bridge0: port 3(vlan4) entered disabled state [ 757.677272][ T12] dvmrp0: left allmulticast mode [ 758.214078][ T12] bond3 (unregistering): (slave geneve2): Releasing active interface [ 758.224629][ T12] geneve2 (unregistering): left allmulticast mode [ 758.448511][ T12] bond0 (unregistering): Released all slaves [ 758.458424][ T12] bond1 (unregistering): Released all slaves [ 758.475413][ T12] bond2 (unregistering): Released all slaves [ 758.491367][ T12] bond3 (unregistering): Released all slaves [ 758.509542][ T12] bond4 (unregistering): Released all slaves [ 758.529767][ T12] bond5 (unregistering): Released all slaves [ 758.543107][ T12] bond6 (unregistering): Released all slaves [ 758.556489][ T12] bond7 (unregistering): (slave veth9): Releasing backup interface [ 758.566140][ T12] bond7 (unregistering): Released all slaves [ 758.585513][ T12] bond8 (unregistering): Released all slaves [ 758.597335][ T12] bond9 (unregistering): Released all slaves [ 758.609501][ T12] bond10 (unregistering): Released all slaves [ 758.627349][T29629] hsr_slave_0: entered promiscuous mode [ 758.634121][T29629] hsr_slave_1: entered promiscuous mode [ 758.643004][T29629] debugfs: 'hsr0' already exists in 'hsr' [ 758.648744][T29629] Cannot create hsr debugfs directory [ 758.668394][T29762] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6203'. [ 758.847520][ T12] tipc: Disabling bearer [ 758.902415][ T12] tipc: Disabling bearer [ 758.942805][ T12] tipc: Left network mode [ 759.213458][ T5826] Bluetooth: hci3: command tx timeout [ 760.214647][T29838] netlink: 'syz.1.6216': attribute type 7 has an invalid length. [ 760.297407][T29840] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 760.449899][ T12] veth1_to_bond: left promiscuous mode [ 761.060938][T29863] tipc: Enabling of bearer rejected, failed to enable media [ 761.176588][T29884] netlink: 'syz.4.6224': attribute type 1 has an invalid length. [ 761.290884][ T5826] Bluetooth: hci3: command tx timeout [ 761.321282][T29629] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 761.338901][T29629] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 761.374756][T29894] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6226'. [ 761.386731][T29888] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 761.406804][T29629] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 761.416476][T29888] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 761.426770][T29888] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 761.461829][T29629] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 761.543530][T29907] x_tables: duplicate underflow at hook 1 [ 761.577495][T29907] netlink: 184 bytes leftover after parsing attributes in process `syz.1.6229'. [ 761.594643][ T12] IPVS: stop unused estimator thread 0... [ 761.722837][T29629] 8021q: adding VLAN 0 to HW filter on device bond0 [ 761.807832][T29629] 8021q: adding VLAN 0 to HW filter on device team0 [ 761.831691][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 761.838875][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 761.847933][T29920] netlink: 356 bytes leftover after parsing attributes in process `syz.3.6233'. [ 761.871832][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 761.873223][T29923] netlink: 'syz.1.6235': attribute type 10 has an invalid length. [ 761.879025][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 761.935888][T29924] syzkaller0: entered promiscuous mode [ 761.950204][T29924] syzkaller0: entered allmulticast mode [ 762.020831][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 762.028875][ C1] lec:lec_tx_timeout: lec0 [ 762.033713][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 762.119813][T29932] netlink: 7 bytes leftover after parsing attributes in process `syz.1.6237'. [ 762.385690][T29629] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 762.484709][T29629] veth0_vlan: entered promiscuous mode [ 762.503995][T29949] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6242'. [ 762.508301][T29629] veth1_vlan: entered promiscuous mode [ 762.568685][T29629] veth0_macvtap: entered promiscuous mode [ 762.599328][T29629] veth1_macvtap: entered promiscuous mode [ 762.649207][T29629] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 762.652892][T29959] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6245'. [ 762.682411][T29629] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 762.748079][T21707] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.795021][T21707] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.829161][T21707] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 762.846268][T21707] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 763.026612][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 763.051883][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 763.175647][T21706] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 763.197578][T21706] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 763.247853][T29985] xt_socket: unknown flags 0x50 [ 763.373651][ T5826] Bluetooth: hci3: command tx timeout [ 763.629299][T30001] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6257'. [ 763.640490][T30001] netlink: 'syz.0.6257': attribute type 7 has an invalid length. [ 763.648835][T30001] netlink: 'syz.0.6257': attribute type 8 has an invalid length. [ 763.659513][T30001] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6257'. [ 763.701533][T30001] team0: entered promiscuous mode [ 763.718238][T30001] team_slave_0: entered promiscuous mode [ 763.730138][T30004] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6256'. [ 763.751299][T30001] team_slave_1: entered promiscuous mode [ 763.759949][ T5835] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 763.762262][T30001] bond0: entered promiscuous mode [ 763.775707][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 763.777767][T30001] bond_slave_0: entered promiscuous mode [ 763.790385][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 763.796223][T30001] bond_slave_1: entered promiscuous mode [ 763.805106][T30006] x_tables: duplicate underflow at hook 1 [ 763.824505][ T5835] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 763.842722][T30001] erspan0: entered promiscuous mode [ 763.850157][T30001] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 763.859267][T30002] netlink: 'syz.2.6256': attribute type 12 has an invalid length. [ 763.868540][ T5835] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 764.015469][T30003] lo speed is unknown, defaulting to 1000 [ 764.162860][T30014] smc: net device wlan0 erased user defined pnetid SYZ0 [ 764.401304][T30026] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6265'. [ 764.506227][T30036] netlink: 'syz.2.6266': attribute type 25 has an invalid length. [ 764.540325][T30003] chnl_net:caif_netlink_parms(): no params data found [ 764.548019][T30036] netlink: 'syz.2.6266': attribute type 3 has an invalid length. [ 764.650012][T30043] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 764.684926][T30045] netlink: 'syz.0.6269': attribute type 1 has an invalid length. [ 764.765279][T30045] 8021q: adding VLAN 0 to HW filter on device bond1 [ 764.799254][T30049] bond1: (slave geneve2): making interface the new active one [ 764.820125][T30049] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 764.835222][ T49] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 764.861543][ T49] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 764.937761][ T49] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 764.948232][ T49] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 764.957960][T30003] bridge0: port 1(bridge_slave_0) entered blocking state [ 764.965591][T30003] bridge0: port 1(bridge_slave_0) entered disabled state [ 764.973865][T30003] bridge_slave_0: entered allmulticast mode [ 764.981757][T30003] bridge_slave_0: entered promiscuous mode [ 765.015968][T30003] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.038187][T30003] bridge0: port 2(bridge_slave_1) entered disabled state [ 765.052402][T30003] bridge_slave_1: entered allmulticast mode [ 765.063338][T30003] bridge_slave_1: entered promiscuous mode [ 765.153697][T30003] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 765.180233][T30003] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 765.251013][T30003] team0: Port device team_slave_0 added [ 765.265138][T30083] Bluetooth: MGMT ver 1.23 [ 765.278377][T30003] team0: Port device team_slave_1 added [ 765.387672][T30003] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 765.403731][T30003] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 765.432129][T30003] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 765.463203][T30088] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 765.483589][T30003] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 765.490559][T30003] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 765.496406][T30091] openvswitch: netlink: Flow key attr not present in new flow. [ 765.527489][T30003] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 765.609908][T30003] hsr_slave_0: entered promiscuous mode [ 765.630594][T30003] hsr_slave_1: entered promiscuous mode [ 765.650601][T30003] debugfs: 'hsr0' already exists in 'hsr' [ 765.660922][T30003] Cannot create hsr debugfs directory [ 765.865841][T30100] veth1: entered promiscuous mode [ 765.879400][T30100] veth1: entered allmulticast mode [ 765.892872][T30100] team0: Port device veth1 added [ 765.935544][T30003] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 765.945576][ T5826] Bluetooth: hci0: command tx timeout [ 766.053533][T30003] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.159226][ T5938] IPVS: starting estimator thread 0... [ 766.161179][T30003] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.210203][T30114] netlink: 'syz.4.6287': attribute type 40 has an invalid length. [ 766.266943][T30119] IPVS: using max 34 ests per chain, 81600 per kthread [ 766.275344][T30003] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 766.450234][T30133] geneve3: entered promiscuous mode [ 766.479274][T30133] geneve3: entered allmulticast mode [ 766.720927][T30174] x9: renamed from bridge_slave_0 (while UP) [ 766.721886][T30171] __nla_validate_parse: 4 callbacks suppressed [ 766.721902][T30171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6294'. [ 766.752237][T30003] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 766.787686][T30003] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 766.819503][T30003] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 766.867464][T30003] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 767.040833][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 767.048866][ C1] lec:lec_tx_timeout: lec0 [ 767.055181][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 767.112168][T30202] : renamed from bond_slave_0 (while UP) [ 767.189508][T30003] 8021q: adding VLAN 0 to HW filter on device bond0 [ 767.220518][T30003] 8021q: adding VLAN 0 to HW filter on device team0 [ 767.262298][T21702] bridge0: port 1(bridge_slave_0) entered blocking state [ 767.269477][T21702] bridge0: port 1(bridge_slave_0) entered forwarding state [ 767.324459][T30165] bridge0: port 2(bridge_slave_1) entered blocking state [ 767.331640][T30165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 767.454168][T30222] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6311'. [ 767.662229][T30233] netlink: 332 bytes leftover after parsing attributes in process `syz.0.6313'. [ 767.743763][T30234] syzkaller0: entered promiscuous mode [ 767.754208][T30234] syzkaller0: entered allmulticast mode [ 767.796156][T30003] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 768.015654][ T5835] Bluetooth: hci0: command tx timeout [ 768.214634][T30256] syzkaller0: entered promiscuous mode [ 768.234729][T30256] syzkaller0: entered allmulticast mode [ 768.250228][T30003] veth0_vlan: entered promiscuous mode [ 768.345392][T30265] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1514) ! [ 768.359745][T30263] netlink: 'syz.4.6325': attribute type 1 has an invalid length. [ 768.369319][T30263] Bluetooth: MGMT ver 1.23 [ 768.404047][T30003] veth1_vlan: entered promiscuous mode [ 768.410522][T30256] tipc: Started in network mode [ 768.421190][T30256] tipc: Node identity 26b980bcf7b, cluster identity 4711 [ 768.428682][T30256] tipc: Enabled bearer , priority 0 [ 768.438487][T30255] tipc: Resetting bearer [ 768.466337][T30255] tipc: Disabling bearer [ 768.509488][T30268] batman_adv: batadv0: Adding interface: macvtap1 [ 768.531710][T30268] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 768.561460][T30268] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 768.609365][T30003] veth0_macvtap: entered promiscuous mode [ 768.644490][T30003] veth1_macvtap: entered promiscuous mode [ 768.692072][T30003] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 768.707681][T30003] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 768.727772][T21702] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.737292][T21702] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.786023][T30282] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6332'. [ 768.786206][T21702] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.795519][T30282] openvswitch: netlink: Flow actions attr not present in new flow. [ 768.847259][T21702] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.967421][T30163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.990944][T30163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 769.163178][T21702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 769.172712][T21702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 769.400339][T30304] x_tables: duplicate underflow at hook 3 [ 769.572423][T30311] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6340'. [ 769.593737][T30311] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6340'. [ 769.631016][T30313] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6341'. [ 769.638166][T30311] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6340'. [ 769.724527][T30317] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.800970][ T9644] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.822888][ T9644] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.922442][T30317] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.968935][T30335] netlink: 'syz.1.6346': attribute type 29 has an invalid length. [ 769.980428][T30335] netlink: 'syz.1.6346': attribute type 29 has an invalid length. [ 770.006197][T30335] netlink: 500 bytes leftover after parsing attributes in process `syz.1.6346'. [ 770.042378][T30335] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6346'. [ 770.092647][ T5835] Bluetooth: hci0: command 0x040f tx timeout [ 770.142548][T30331] lo speed is unknown, defaulting to 1000 [ 770.192610][T30346] 8021q: VLANs not supported on vxcan0 [ 770.634369][T30374] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 770.637876][T30376] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 770.657697][T30376] IPv6: NLM_F_CREATE should be set when creating new route [ 770.664990][T30376] IPv6: NLM_F_CREATE should be set when creating new route [ 770.672265][T30376] IPv6: NLM_F_CREATE should be set when creating new route [ 770.792168][T30376] syzkaller0: entered promiscuous mode [ 770.797775][T30376] syzkaller0: entered allmulticast mode [ 771.327519][T30428] netlink: 'syz.4.6373': attribute type 8 has an invalid length. [ 771.347430][T30428] bond0: entered promiscuous mode [ 771.353610][T30428] bond_slave_0: entered promiscuous mode [ 771.359457][T30428] bond_slave_1: entered promiscuous mode [ 771.380360][T30428] gretap0: entered promiscuous mode [ 771.398433][T30428] debugfs: 'hsr1' already exists in 'hsr' [ 771.407321][T30428] Cannot create hsr debugfs directory [ 771.414571][T30428] hsr1: entered promiscuous mode [ 771.461713][T30430] tls_set_device_offload: netdev not found [ 771.683338][T30317] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.700927][T30317] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 771.736659][T30449] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 771.781611][T30462] __nla_validate_parse: 11 callbacks suppressed [ 771.781632][T30462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6382'. [ 771.794205][T30455] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 771.809276][T30455] bond2 (unregistering): Released all slaves [ 771.837155][T30465] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6384'. [ 771.851854][T30462] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6382'. [ 771.914964][T30317] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.961267][T30317] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 772.055079][T30477] netlink: 'syz.2.6387': attribute type 1 has an invalid length. [ 772.070781][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 772.078838][ C1] lec:lec_tx_timeout: lec0 [ 772.083758][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 772.093408][T30477] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 772.170059][T30166] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.189374][ T5835] Bluetooth: hci0: command 0x040f tx timeout [ 772.197280][T30166] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 772.220007][T30490] xt_l2tp: v2 sid > 0xffff: 4294967293 [ 772.225182][T30491] netlink: 'syz.2.6391': attribute type 1 has an invalid length. [ 772.242524][T30166] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.258902][T30166] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 772.296318][T30491] 8021q: adding VLAN 0 to HW filter on device bond1 [ 772.304498][T30498] bond1: up delay (105) is not a multiple of miimon (100), value rounded to 100 ms [ 772.357355][T30498] bond1: entered allmulticast mode [ 772.404681][T21702] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.414813][T21702] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 772.475651][T30498] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 772.480079][T30516] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6396'. [ 772.504265][T21702] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 772.521775][T21702] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 772.577039][T30518] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6398'. [ 772.593446][T30520] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6398'. [ 772.677365][T30529] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6399'. [ 772.823942][T30532] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6399'. [ 772.916781][T30545] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.925208][T30545] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.964116][T30545] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6403'. [ 773.086194][T30555] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6405'. [ 773.235775][T30569] IPVS: set_ctl: invalid protocol: 58 127.0.0.1:20004 [ 773.292461][T30574] netlink: 'syz.2.6412': attribute type 1 has an invalid length. [ 773.341517][T30571] netlink: 'syz.4.6411': attribute type 1 has an invalid length. [ 773.434318][T30571] 8021q: adding VLAN 0 to HW filter on device bond2 [ 773.468804][T30574] lo speed is unknown, defaulting to 1000 [ 773.898866][T30587] syzkaller0: entered promiscuous mode [ 773.904866][T30587] syzkaller0: entered allmulticast mode [ 773.912992][T30589] tipc: Started in network mode [ 773.917869][T30589] tipc: Node identity , cluster identity 4711 [ 773.948930][T30589] tipc: Failed to obtain node identity [ 773.979091][T30589] tipc: Enabling of bearer rejected, failed to enable media [ 774.052944][T30600] gretap1: entered promiscuous mode [ 774.062436][T30600] batman_adv: batadv0: Adding interface: gretap1 [ 774.064794][T30599] netlink: 'syz.3.6417': attribute type 21 has an invalid length. [ 774.074189][T30600] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 774.114133][T30600] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 774.145081][T30607] bridge1: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 774.724653][T30626] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 776.236842][T30638] bond1: entered promiscuous mode [ 776.261103][T30638] bond1: entered allmulticast mode [ 776.325655][T30644] vlan2: entered allmulticast mode [ 776.341602][T30644] bond0: entered allmulticast mode [ 776.354125][T30644] : entered allmulticast mode [ 776.359020][T30644] bond_slave_1: entered allmulticast mode [ 776.439096][T30657] bond0 (unregistering): left promiscuous mode [ 776.456652][T30657] : left promiscuous mode [ 776.473427][T30657] bond_slave_1: left promiscuous mode [ 776.505040][T30657] bond0 (unregistering): (slave c5): Releasing backup interface [ 776.527250][T30668] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 776.539992][T30657] : left allmulticast mode [ 776.551504][T30657] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 776.563297][T30657] bond_slave_1: left allmulticast mode [ 776.578130][T30657] bond0 (unregistering): Released all slaves [ 776.785083][T30674] syzkaller0: entered promiscuous mode [ 776.790601][T30674] syzkaller0: entered allmulticast mode [ 777.093544][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 777.101643][ C1] lec:lec_tx_timeout: lec0 [ 777.106325][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 778.618381][T30723] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 778.625689][T30723] IPv6: NLM_F_CREATE should be set when creating new route [ 778.632966][T30723] IPv6: NLM_F_CREATE should be set when creating new route [ 778.640193][T30723] IPv6: NLM_F_CREATE should be set when creating new route [ 778.678835][T30723] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 778.775754][T30739] __nla_validate_parse: 9 callbacks suppressed [ 778.775763][T30737] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6451'. [ 778.775771][T30739] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6454'. [ 779.029652][T30754] netlink: 112 bytes leftover after parsing attributes in process `syz.1.6458'. [ 779.041117][T30758] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6457'. [ 779.057584][T30754] netlink: 'syz.1.6458': attribute type 5 has an invalid length. [ 779.161819][T30764] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6458'. [ 779.926925][T30780] syzkaller0: entered promiscuous mode [ 779.940968][T30780] syzkaller0: entered allmulticast mode [ 781.758463][T30792] team_slave_0: entered promiscuous mode [ 781.764498][T30792] team_slave_1: entered promiscuous mode [ 781.773104][T30792] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 781.848312][T30809] ip6tnl1: entered allmulticast mode [ 781.858900][T21702] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 781.893397][ T9] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 781.901288][T21702] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 782.044481][T30816] netlink: 580 bytes leftover after parsing attributes in process `syz.3.6471'. [ 782.054166][T30816] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6471'. [ 782.220471][T30826] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6474'. [ 782.414432][T30836] mac80211_hwsim hwsim86 syzkaller0: entered promiscuous mode [ 782.444026][T30836] mac80211_hwsim hwsim86 syzkaller0: entered allmulticast mode [ 782.503971][T30832] lo speed is unknown, defaulting to 1000 [ 782.553710][ T5938] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 782.630879][T30853] [ 782.633257][T30853] ====================================================== [ 782.640277][T30853] WARNING: possible circular locking dependency detected [ 782.647428][T30853] syzkaller #0 Not tainted [ 782.651851][T30853] ------------------------------------------------------ [ 782.658868][T30853] syz.0.6479/30853 is trying to acquire lock: [ 782.664926][T30853] ffffffff8fd47c18 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 782.674378][T30853] [ 782.674378][T30853] but task is already holding lock: [ 782.681731][T30853] ffff8880347f5f70 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 782.691133][T30853] [ 782.691133][T30853] which lock already depends on the new lock. [ 782.691133][T30853] [ 782.701528][T30853] [ 782.701528][T30853] the existing dependency chain (in reverse order) is: [ 782.710566][T30853] [ 782.710566][T30853] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 782.718623][T30853] _raw_spin_lock_bh+0x36/0x50 [ 782.723950][T30853] nr_rt_ioctl+0x215/0xf90 [ 782.728896][T30853] sock_do_ioctl+0x101/0x320 [ 782.734000][T30853] sock_ioctl+0x5c6/0x7f0 [ 782.738841][T30853] __se_sys_ioctl+0xfc/0x170 [ 782.743943][T30853] do_syscall_64+0x14d/0xf80 [ 782.749044][T30853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.755534][T30853] [ 782.755534][T30853] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 782.763342][T30853] _raw_spin_lock_bh+0x36/0x50 [ 782.768619][T30853] nr_rt_device_down+0xbe/0x860 [ 782.773980][T30853] nr_device_event+0x137/0x150 [ 782.779291][T30853] notifier_call_chain+0x1be/0x400 [ 782.784952][T30853] __dev_notify_flags+0x16d/0x310 [ 782.790561][T30853] netif_change_flags+0xe8/0x1a0 [ 782.796013][T30853] dev_change_flags+0x130/0x260 [ 782.801416][T30853] dev_ioctl+0x7b4/0x1150 [ 782.806293][T30853] sock_do_ioctl+0x23e/0x320 [ 782.811393][T30853] sock_ioctl+0x5c6/0x7f0 [ 782.816235][T30853] __se_sys_ioctl+0xfc/0x170 [ 782.821338][T30853] do_syscall_64+0x14d/0xf80 [ 782.826433][T30853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.832831][T30853] [ 782.832831][T30853] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 782.840726][T30853] __lock_acquire+0x15a5/0x2cf0 [ 782.846095][T30853] lock_acquire+0xf0/0x2e0 [ 782.851020][T30853] _raw_spin_lock_bh+0x36/0x50 [ 782.856295][T30853] nr_remove_neigh+0x25/0xe0 [ 782.861395][T30853] nr_add_node+0x1e41/0x2630 [ 782.866492][T30853] nr_rt_ioctl+0xe59/0xf90 [ 782.871416][T30853] sock_do_ioctl+0x101/0x320 [ 782.876512][T30853] sock_ioctl+0x5c6/0x7f0 [ 782.881348][T30853] __se_sys_ioctl+0xfc/0x170 [ 782.886448][T30853] do_syscall_64+0x14d/0xf80 [ 782.891546][T30853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.897948][T30853] [ 782.897948][T30853] other info that might help us debug this: [ 782.897948][T30853] [ 782.908281][T30853] Chain exists of: [ 782.908281][T30853] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 782.908281][T30853] [ 782.922097][T30853] Possible unsafe locking scenario: [ 782.922097][T30853] [ 782.929601][T30853] CPU0 CPU1 [ 782.930765][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5820 ms [ 782.934949][T30853] ---- ---- [ 782.942929][ C1] lec:lec_tx_timeout: lec0 [ 782.948258][T30853] lock(&nr_node->node_lock); [ 782.957395][T30853] lock(nr_node_list_lock); [ 782.964497][T30853] lock(&nr_node->node_lock); [ 782.971798][T30853] lock(nr_neigh_list_lock); [ 782.976462][T30853] [ 782.976462][T30853] *** DEADLOCK *** [ 782.976462][T30853] [ 782.984617][T30853] 1 lock held by syz.0.6479/30853: [ 782.989728][T30853] #0: ffff8880347f5f70 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 782.999553][T30853] [ 782.999553][T30853] stack backtrace: [ 783.005441][T30853] CPU: 0 UID: 0 PID: 30853 Comm: syz.0.6479 Not tainted syzkaller #0 PREEMPT(full) [ 783.005459][T30853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 783.005470][T30853] Call Trace: [ 783.005477][T30853] [ 783.005484][T30853] dump_stack_lvl+0xe8/0x150 [ 783.005508][T30853] print_circular_bug+0x2e1/0x300 [ 783.005533][T30853] check_noncircular+0x12e/0x150 [ 783.005556][T30853] __lock_acquire+0x15a5/0x2cf0 [ 783.005583][T30853] lock_acquire+0xf0/0x2e0 [ 783.005601][T30853] ? nr_remove_neigh+0x25/0xe0 [ 783.005621][T30853] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 783.005636][T30853] ? nr_remove_neigh+0x25/0xe0 [ 783.005655][T30853] _raw_spin_lock_bh+0x36/0x50 [ 783.005675][T30853] ? nr_remove_neigh+0x25/0xe0 [ 783.005693][T30853] nr_remove_neigh+0x25/0xe0 [ 783.005714][T30853] nr_add_node+0x1e41/0x2630 [ 783.005734][T30853] ? nr_call_to_digi+0x126/0x1b0 [ 783.005752][T30853] nr_rt_ioctl+0xe59/0xf90 [ 783.005773][T30853] ? kasan_quarantine_put+0xbb/0x1f0 [ 783.005790][T30853] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 783.005811][T30853] ? apparmor_capable+0x126/0x170 [ 783.005833][T30853] ? capable+0x88/0xe0 [ 783.005877][T30853] ? nr_ioctl+0x1b1/0x3b0 [ 783.005893][T30853] sock_do_ioctl+0x101/0x320 [ 783.005912][T30853] ? __pfx_sock_do_ioctl+0x10/0x10 [ 783.005926][T30853] ? do_futex+0x395/0x420 [ 783.005954][T30853] sock_ioctl+0x5c6/0x7f0 [ 783.005970][T30853] ? __pfx_sock_ioctl+0x10/0x10 [ 783.005984][T30853] ? __fget_files+0x2a/0x420 [ 783.005998][T30853] ? __fget_files+0x3a0/0x420 [ 783.006010][T30853] ? __fget_files+0x2a/0x420 [ 783.006023][T30853] ? bpf_lsm_file_ioctl+0x9/0x20 [ 783.006044][T30853] ? __pfx_sock_ioctl+0x10/0x10 [ 783.006057][T30853] __se_sys_ioctl+0xfc/0x170 [ 783.006075][T30853] do_syscall_64+0x14d/0xf80 [ 783.006090][T30853] ? trace_irq_disable+0x3b/0x150 [ 783.006103][T30853] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.006117][T30853] ? clear_bhb_loop+0x40/0x90 [ 783.006134][T30853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.006148][T30853] RIP: 0033:0x7f761499c819 [ 783.006163][T30853] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 783.006177][T30853] RSP: 002b:00007f761582d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 783.006192][T30853] RAX: ffffffffffffffda RBX: 00007f7614c16090 RCX: 00007f761499c819 [ 783.006209][T30853] RDX: 0000200000000300 RSI: 000000000000890b RDI: 0000000000000004 [ 783.006219][T30853] RBP: 00007f7614a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 783.006229][T30853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 783.006238][T30853] R13: 00007f7614c16128 R14: 00007f7614c16090 R15: 00007ffcb7b54dc8 [ 783.006254][T30853] [ 783.276792][ T5938] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 783.323909][T30862] netlink: 'syz.4.6484': attribute type 13 has an invalid length. [ 783.331864][T30862] netlink: 'syz.4.6484': attribute type 17 has an invalid length. [ 783.421046][T30861] bridge0: port 2(bridge_slave_1) entered disabled state [ 783.428353][T30861] bridge0: port 1(bridge_slave_0) entered disabled state [ 783.455280][T30861] team_slave_0: left promiscuous mode [ 783.460831][T30861] team_slave_1: left promiscuous mode [ 783.668333][T30861] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 783.697162][T30861] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 784.001564][T30862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 784.009919][T30862] 8021q: adding VLAN 0 to HW filter on device team0 [ 784.042324][T30862] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 784.051296][T30862] caif:caif_disconnect_client(): nothing to disconnect [ 784.058204][T30862] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 784.066995][T30862] chnl_net:chnl_net_open(): state disconnected [ 784.073375][T30862] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 784.091957][T21702] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.112573][T21702] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.121640][T21702] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.130497][T21702] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 785.702409][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!