last executing test programs: 5.119426685s ago: executing program 4 (id=2135): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000040)=0x3, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x1a, &(0x7f0000000240)={0x1, 'veth0_to_team\x00'}, 0x18) syz_emit_ethernet(0xbe, &(0x7f0000000080)={@multicast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x31, 0xb0, 0x0, 0x0, 0xfd, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x24, 0x0, {0x25, 0x4, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3f}, {[@cipso={0x86, 0x71, 0x0, [{0x0, 0xc, "e256b28c0400107938d3"}, {0x0, 0x9, "789607675ca638"}, {0x5, 0xe, "7434954373561de584b703c8"}, {0x2, 0x9, "e706d30bd2fe9d"}, {0x6, 0x7, "cfa11cab1a"}, {0x6, 0x10, "c600"/14}, {0x2, 0xa, "65807fe97612fe82"}, {0x0, 0x12, "73bc00"/16}, {0x6, 0xc, "c8f46976e79e56c7a95e"}]}, @cipso={0x86, 0xc, 0x2, [{0x1, 0x6, "7f36c525"}]}]}}}}}}}, 0x0) 5.112386642s ago: executing program 2 (id=2136): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbb0180c200000086dd6100000000103afefe8000000000000000000000000000aa0000000000000000000000000000000186"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000400)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) (async) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000400)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb}, {0x65}}, [@printk={@lld, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x4, 0x1, 0x4, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x15}}], {{0x7, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3d}, 0x1c) (async) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3d}, 0x1c) recvmmsg(r2, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000140)=""/50, 0x32}], 0x1}}], 0x1, 0x40000000, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'nat\x00', 0x4, [{}, {}, {}, {}]}, 0x68) (async) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f00000000c0)={'nat\x00', 0x4, [{}, {}, {}, {}]}, 0x68) 4.979307454s ago: executing program 0 (id=2137): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000040)={0x23c, 0x12, 0x700, 0x70bd2c, 0x25dfdbff, {0x4}, [@nested={0x21a, 0xe1, 0x0, 0x1, [@nested={0x4, 0x4}, @nested={0x4, 0x5f}, @nested={0x4, 0x3b}, @generic="604af80ef574321a243e63abe0c2d9e5d5b5d70bcf43bfe12f94ad0926c619bcf0f487ddf29449ac45f2a573a7b2924d0580c6da0451cdfb2344e74a35a6143b06df06f696b8137f41069f3ef3ba45c66e6ffc8ba781c956389dd4bc3a9b8932b7d6484b17ac52176092ed1d504ccc4377d161f2f267f97a2cca83a71a6c4bb372ea70a0c27e80c680689cba78a74184c17e3a9fc48f95a336b030909b5d8f03be412b10e5c9e5f89965aaf4db103897c4d0db4466d2b4f1cdb0492178472fb3afa53e57860a1124891bd38f7886cf1427eb7acffeca86ab44ccac0c6ff48c7c1129e445d2e0b09e8a7ec6bbf323f85cf4f92ad17a7610", @typed={0x8, 0x2d, 0x0, 0x0, @u32=0x9ef}, @generic="5c85012bba0d3c343a95e4dd4d709d70588818c6536648e67bd572dacabae6cbe16d7698", @typed={0x72, 0xc2, 0x0, 0x0, @binary="28624b7b5ca5605302970b5fb11ba877c22f5efcf0fd7d9c97607c852596db1021671cc2c8dece0dfc7fc6b20c4a2bea95a302b1cbbf606f7dc0c83424f07800e3250b3e9beb0d70453fd91451741b5ee2cc63d86c2c960c08c361012e8d32d1c9a96f6a3d98503aa25020a3ed99"}, @generic="67d5674cae7a9a9d5621731ab304a0b3daff42514f70bb1594a35163ab9bad36f7669e7af4ebb98845aedfbf54bae3c00ec2708017e04d0a39f0a82244737c6d28e67d3fe8a71643d6deb11784f29be24c2b70a3216d099952de28325cf79b776676d39e7db9f6e6418be767d4315387dee688"]}, @typed={0xa, 0x71, 0x0, 0x0, @str='!\'#@-\x00'}]}, 0x23c}, 0x1, 0x0, 0x0, 0xc000001}, 0xd80cd9b398260853) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x28, r3, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x28}}, 0x10055) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000500)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x245100}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x5c, r3, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x7e}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8881}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r2, &(0x7f0000000980)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000940)={&(0x7f0000000680)={0x2c0, r3, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_DEVKEY={0x1d0, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0xb8, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x50, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_EXTENDED={0xc}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x2c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x40}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x4}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x428}]}, @NL802154_DEVKEY_ATTR_ID={0xa4, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x40, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x30, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xffff}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x8}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}]}, @NL802154_DEVKEY_ATTR_ID={0x10, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0x20, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x3}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x4}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xfffffffc}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_DEVKEY={0x3c, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x30, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xe}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}]}, @NL802154_ATTR_SEC_DEVKEY={0x54, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x34, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x7f}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x5}]}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xffffffff}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x5}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x2c0}, 0x1, 0x0, 0x0, 0x6804}, 0x801) r6 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000000ac0)={r0, &(0x7f00000009c0)='!\'#@-\x00', 0x4000, &(0x7f0000000a00)={@align=0x2, {0xffff, 0x6, 0x2, 0x6}}, 0x1, &(0x7f0000000a40), &(0x7f0000000a80)=0x3}) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000b40), r7) sendmsg$TIPC_NL_LINK_RESET_STATS(r7, &(0x7f0000000ec0)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000e80)={&(0x7f0000000b80)={0x2dc, r8, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x50, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "877bc90315824fe1e366ae0cc221d5df862c1648b006ef24e2d9d92ec8c7ebf4447c5b0a"}}]}, @TIPC_NLA_LINK={0xbc, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xcf8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}, @TIPC_NLA_NET={0x48, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3f}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7fff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x800}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0xd4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "1a48dd23e324af497a883b9f0eca92df57ab0c93a57672a2"}}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "3b1f16be246cda4d61205f09d3b2949b6ac594661225f87a"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "65385cd840527af8738b79d241a0f3f01f27a643b36896622d7ba08e99a480d7ea5bfd88"}}]}]}, 0x2dc}, 0x1, 0x0, 0x0, 0x40004400}, 0x4000010) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000f40), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000f80)=0x0) sendmsg$NFC_CMD_LLC_GET_PARAMS(r9, &(0x7f0000001040)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001000)={&(0x7f0000000fc0)={0x1c, r10, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40041}, 0x24004044) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000001140)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x10050}, 0xc, &(0x7f0000001100)={&(0x7f00000010c0)={0x30, r3, 0x812, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000894}, 0x40) r12 = socket(0x26, 0xa, 0xa2) getsockopt$inet_sctp_SCTP_NODELAY(r12, 0x84, 0x3, &(0x7f0000001180), &(0x7f00000011c0)=0x4) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000001200)={'gre0\x00', 0x200}) socket$key(0xf, 0x3, 0x2) ioctl$BTRFS_IOC_QGROUP_LIMIT(r6, 0x8030942b, &(0x7f0000001240)={0x4, {0x14, 0x5, 0x4, 0x9, 0xc120}}) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) accept4(r13, &(0x7f0000001280)=@sco={0x1f, @none}, &(0x7f0000001300)=0x80, 0x800) r14 = syz_genetlink_get_family_id$nbd(&(0x7f0000001380), r9) sendmsg$NBD_CMD_CONNECT(r9, &(0x7f0000001440)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001400)={&(0x7f00000013c0)={0x34, r14, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7}, @NBD_ATTR_BACKEND_IDENTIFIER={0x5, 0xa, '+'}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x6232}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) r15 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000001480), r15) 4.874770298s ago: executing program 4 (id=2139): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newlink={0x6c, 0x10, 0x400, 0x70bd28, 0x1000000, {0x0, 0x0, 0x0, 0x0, 0x275}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x2c, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_FLOOD={0x5, 0x1b, 0x1}, @IFLA_BRPORT_VLAN_TUNNEL={0x5, 0x1d, 0x1}, @IFLA_BRPORT_BCAST_FLOOD={0x5, 0x1e, 0x1}, @IFLA_BRPORT_NEIGH_SUPPRESS={0x5, 0x20, 0x1}, @IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT={0x8, 0x25, 0xe}]}}}, @IFLA_MTU={0x8, 0x4, 0x5}]}, 0x6c}, 0x1, 0xba01, 0x0, 0x4000080}, 0x20000040) r2 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000013c0)=[{{&(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}, {{&(0x7f0000000c00)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40084}, 0x4000804) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="30000000101401002bbd7000fcdbdf25080001000000000008004a0000000000080003000100000008004b00"], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x8084) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x503, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, 0x38018, 0x201a0}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0xb}]}, 0x44}}, 0x800) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xb0, r7, 0x100, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x1, 0x1e}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xfffffffd}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xd8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x11}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x11}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x971}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1c}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x10}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1da}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x21}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x1ff}]}, 0xb0}, 0x1, 0x0, 0x0, 0x2800}, 0x5) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r6) sendmsg$TIPC_NL_MON_SET(r3, &(0x7f0000000800)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000007c0)={&(0x7f0000000680)={0x108, r9, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffff0000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x800}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000001}]}, @TIPC_NLA_BEARER={0xc0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1000, @mcast2, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {0x14, 0x2, @in={0x2, 0x4e21, @rand_addr=0x64010100}}}}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'gre0\x00'}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa58}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x49}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}]}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x20004081}, 0x4) sendmsg$TIPC_NL_BEARER_ADD(r6, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000380)={0x16c, r9, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x29e8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_NODE={0x118, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}, @TIPC_NLA_NODE_ID={0x6e, 0x3, "8dab0e240da4b3fdb4effc30fa899bd500c5e980b840df9f3da0553b5428ddc5f7204481cfd36ddafa88152fadcab37e7c3aed248fe9845bd3cf3c973a1b2d8fa4bb2c7c29e0561eca6562a5c1af9182d4e768179d66c5638fea6312e9bedaddc090f15360a75ab40faa"}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x6}, @TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "460ff6d725643366973368a654375d096a1b04b35cb2dcea89e4e6e29fed68"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "c3797442584bab128d4c63c0b8957bcca537455e21"}}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7fffffff}]}]}, 0x16c}, 0x1, 0x0, 0x0, 0x173f62d3b5d90767}, 0x880) 4.628353536s ago: executing program 0 (id=2141): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f0000000080)={0x53, 0x0, 0xb, 0xa, 0x7ff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000000600000000000000000000d3000000000000009500"], &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x40}, 0x94) 4.553086562s ago: executing program 4 (id=2143): r0 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43) (async) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r1 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) (async) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r2 = socket$kcm(0x1e, 0x4, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x141841, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, 0x0) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000008c0), 0x43) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) (async) r4 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYRESHEX=r2], 0xfdef) (async) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYRESHEX=r2], 0xfdef) close(r2) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000003a80)=""/4101, 0x1005}], 0x1}, 0x2101) 4.32028834s ago: executing program 0 (id=2145): r0 = socket(0x1f, 0x803, 0x1) sendto(r0, &(0x7f0000000000)="120000003200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) 4.319324662s ago: executing program 1 (id=2146): socket$igmp6(0xa, 0x3, 0x2) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) (async, rerun: 64) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) (rerun: 64) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x50, 0x10, 0x1, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x14318}, [@IFLA_IFNAME={0x14, 0x3, 'erspan0\x00'}, @IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @empty}]}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000884}, 0x4000) (async) r1 = socket(0x1e, 0x1, 0x0) (async, rerun: 32) r2 = socket$inet_icmp(0x2, 0x2, 0x1) (rerun: 32) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000019580)={'filter\x00', 0x7, 0x4, 0x4c8, 0x110, 0x0, 0x110, 0x3e0, 0x3e0, 0x3e0, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0xff000000, 0xff, 0x9, 0x1, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0xff, 0xff, 0xff, 0xff]}}, 0x2, 0x0, 0x8, 0x3ff, 0x2, 0x2, 'veth0_vlan\x00', 'geneve1\x00', {0xff}, {}, 0x0, 0x2}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@multicast, @rand_addr=0x64010100, @loopback, 0xf, 0x1}}}, {{@arp={@local, @empty, 0xff000000, 0xff000000, 0xe, 0x6, {@empty, {[0x0, 0xff, 0xff, 0xff]}}, {@mac=@random="757930b1b98a", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0xffff, 0x4, 0x21, 0x5, 0x2, 'ip_vti0\x00', 'pim6reg1\x00', {0xff}, {0x7f}, 0x0, 0x26c}, 0xc0, 0xe8}, @unspec=@AUDIT={0x28}}, {{@arp={@multicast2, @broadcast, 0xffffff00, 0x0, 0xc, 0x9, {@empty, {[0xff, 0xff, 0x0, 0x0, 0xff, 0xff]}}, {@mac=@random="23fc13b910db", {[0x0, 0xff]}}, 0xfb3, 0x1, 0x2, 0x9, 0x5, 0x3, 'geneve0\x00', 'veth0_to_bond\x00', {}, {0xff}, 0x0, 0xbdffa750df69ccdb}, 0xc0, 0x1e8}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x40, 'system_u:object_r:lost_found_t:s0\x00'}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x518) (async) getsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, 0xffffffffffffffff, &(0x7f0000000580)=0x4e) 4.100679587s ago: executing program 0 (id=2147): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x68, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x80ffffff}}, @IPSET_ATTR_CIDR={0x5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x68}}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000640)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c9", 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r2, &(0x7f0000000540)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0xe}, {&(0x7f0000000440)="9c91753e600650a512109467e89d56fcc2b5d767317f8a16", 0x18}], 0x2) 4.009736769s ago: executing program 3 (id=2148): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x54, 0x10, 0x405, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x45502, 0x4}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_FLAGS={0x6, 0x2, 0x2}, @IFLA_IPVLAN_MODE={0x6, 0x1, 0x2}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x54}, 0x1, 0x0, 0x0, 0x4001}, 0x0) 3.298233609s ago: executing program 2 (id=2149): r0 = socket$igmp(0x2, 0x3, 0x2) getsockopt$inet_opts(r0, 0x0, 0xc, 0x0, &(0x7f0000000780)) (async) getsockopt$inet_opts(r0, 0x0, 0xc, 0x0, &(0x7f0000000780)) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xd}, [@alu={0x7, 0x0, 0x8, 0xa, 0x3, 0x2, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @ldst={0x0, 0x2, 0x2, 0x5, 0x2, 0x20, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x80, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000080)=[0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, r0, 0x1, 0xffffffffffffffff, 0x1], &(0x7f00000000c0)=[{0x2, 0x1, 0x7, 0xc}, {0x2, 0x2, 0x1, 0x1}, {0x2, 0x1, 0x6, 0x8}], 0x10, 0x1}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000001c0)=r1, 0x4) 3.273282865s ago: executing program 3 (id=2150): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000005142106fdffffff00000000080001"], 0x20}}, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)={0x38, 0x140e, 0x54de3c8fcc73395, 0x70bd28, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x3}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x3}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x2}, @RDMA_NLDEV_ATTR_RES_PDN={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000800}, 0x48040) recvfrom(r1, &(0x7f00000000c0)=""/158, 0x9e, 0x0, &(0x7f0000000180)=@sco={0x1f, @none}, 0x80) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000680)="d8000000180081034e81f783db4cb9040a1d020006007c09e8fc55a10a0015000400142603600e120800060000000441a800090004001040040000000c5c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/215, 0xd7}, {&(0x7f00000001c0)=']', 0x1}], 0x2}, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r3, 0x8982, &(0x7f0000000280)={0x6, 'veth1_vlan\x00', {}, 0x3}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r4, 0x25, 0x0, @void}, 0x10) 3.21558313s ago: executing program 1 (id=2151): r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='devices.list\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r0, 0x28, 0x6, &(0x7f0000000280)={r5, r6/1000+10000}, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000040)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010026bd6000000000002d9300000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0xd4}, 0x24008000) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r4, 0x200, 0x70bd26, 0x25dfdbff, {}, [@HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x58692e87c77dd21c}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040804}, 0x4000001) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007040)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2400}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x65}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}}, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f00000002c0)={0x0, @aes128, 0x0, @desc3}) accept4$unix(r0, 0x0, 0x0, 0x0) 3.119488142s ago: executing program 2 (id=2152): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x79, 0x11, 0xc8}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x70) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x3) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e24, 0x8, @private0={0xfc, 0x0, '\x00', 0x1}, 0x69}, 0x1c) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e22, 0xffffffff, @mcast2}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='xfrm0\x00', 0x10) syz_emit_ethernet(0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="b1909890af38aaaaaaaaaaaa0800ee59c3ef8d4de95b1db2fe50e3e096e4066abd495ff83dc60bc2b97c0e6702d84e98fa67669c2eca523885e1bf87b0c6489a5a13b2dcd06e3f6f7e821ece4719e02bd6395d275fa5cfa424ca084a98ebebe14b9431108911330aec634e1a58fcda3d4bb8bf3d29ab52d4b383"], 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000080)={@broadcast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "108f84", 0x18, 0x3a, 0xff, @remote, @local, {[], @ndisc_na={0x92, 0x0, 0x0, 0x0, '\x00', @ipv4={'\x00', '\xff\xff', @multicast2}}}}}}}, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) r3 = socket$nl_crypto(0x10, 0x3, 0x15) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r4, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001840)=r5, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r6, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300), 0x0, 0x200000000000, 0x40}}, 0x40) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x6, 0x8, 0x8}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x80, r7, 0x0, 0x7}, 0x38) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'tunl0\x00', &(0x7f0000000280)=@ethtool_sset_info={0x37, 0x7fff, 0x8, [0x80000001, 0x2]}}) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000040), &(0x7f0000000100)=0x4) 3.031708632s ago: executing program 1 (id=2153): r0 = socket(0x10, 0x3, 0x0) getsockopt$WPAN_WANTACK(r0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) accept4$x25(r0, 0x0, &(0x7f0000000140), 0x800) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x84, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xf}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x54, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xc, 0x8, 0x0, 0x1}}, @TCA_GRED_MAX_P={0x8, 0x4, 0x5}, @TCA_GRED_PARMS={0x38, 0x1, {0x4, 0x7ff, 0x1000, 0x5, 0x800, 0x1, 0x0, 0x4, 0x4, 0x200, 0x1a, 0xc, 0xb, 0x0, 0xa, 0x6}}]}}]}, 0x84}}, 0x20000000) 947.978041ms ago: executing program 3 (id=2154): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448cb, &(0x7f00000012c0)) (async) r1 = socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000340)=ANY=[@ANYRES8], 0x58}}, 0x48081) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="2e00000010008188040f6fec59acbc0435a181003f00000000060000000000000e000d000d6ed60012801900121f", 0x2e}], 0x1}, 0x0) (async) r2 = socket$phonet(0x23, 0x2, 0x1) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x25, 0x2, @void}, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x7, 0x1c, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) (async) bind$phonet(r2, &(0x7f0000000280)={0x23, 0x8, 0x9, 0x6}, 0x10) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000200)={{0x1, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)='%pi6 \x00'}, 0x20) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) (async) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x9}, 0x1c) (async) setsockopt$packet_int(r7, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40080, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r8, &(0x7f0000002780)=ANY=[], 0xfb5) (async) sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)=ANY=[@ANYBLOB="14080000d5b623fbc7d75e2e6ef11708ad2f4cf92a32306e1db818e719268635bcc590ad248926958bd3fcb9c6a6da861f8bcab67b0fc3a982daf8304a2e8b29e073fb697e35313ee35875d7bd0b9ed8a7befead4c434aa3396c545c67df3dcaf6db558543e5e18f5098c1157865ac0756cbca2f3701fbe0f4f7c1ce88dc670a6af7996ef8868e8df59d7cee8679f5868e6d6729c6857bafc36f877f0179a57d081873884779977c5628b9fbb5637ee3f7a432c2b8488e9d0ced85a2e7f5d88b5754b82f5091dda128dbcc955386ee38856e51c17123b3118d95346723b4e26414187f03733ff572aa6d62f77ad6da0e10c687db6028a64c830000000000000000", @ANYRES16=r6, @ANYBLOB="0104000000000000000008000000"], 0x14}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x6, &(0x7f0000000240)=ANY=[@ANYBLOB="85100000f8ffffff85203d3d7190e97acdb80000", @ANYRES32=r4, @ANYBLOB="0000000000000000186a00000500000000001400560c0000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x3}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x4}, 0x10}, 0x94) (async) setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000300)={0x0, @dev={0xac, 0x14, 0x14, 0x14}, @multicast2}, 0xc) 840.747672ms ago: executing program 2 (id=2155): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'macsec0\x00', 0x0}) r2 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000000)) getsockopt$PNPIPE_ENCAP(r2, 0x113, 0x1, &(0x7f0000000080), &(0x7f0000000100)=0x4) r3 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x1194, 0x400}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x4000) 839.94264ms ago: executing program 1 (id=2156): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000440)={@val={0x70}, @void, @eth={@local, @remote, @void, {@generic={0x4305}}}}, 0x12) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0x8, 0x1, 'SET\x00'}, @NFTA_TARGET_INFO={0xc, 0x3, "02b51112d439c592"}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xfea1}}, 0x800) 815.330496ms ago: executing program 0 (id=2157): getsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xe) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) (async) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket(0xa, 0x3, 0x3a) (async) r2 = socket(0xa, 0x3, 0x3a) socket(0xa, 0x3, 0x3a) (async) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r3, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_INIT(r2, 0x29, 0xc8, &(0x7f0000000340), 0x4) ioctl$TUNSETLINK(r1, 0x400454cd, 0x118) (async) ioctl$TUNSETLINK(r1, 0x400454cd, 0x118) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f00000001c0)={'syzkaller1\x00', @broadcast}) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x3) (async) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000080)=0x3) write$tun(r1, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\f'], 0x152) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000240)) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, 0x0) 781.341771ms ago: executing program 4 (id=2158): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000009"], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) (async) r1 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) readv(r1, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/1, 0x1}], 0x1000000000000123) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3800000040000100fcff06ee04000000010000000400488014000180100010800c00008008001e80040001800c0002"], 0x38}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) (async, rerun: 32) socket$inet6_sctp(0xa, 0x5, 0x84) (rerun: 32) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000080000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="e2ffffffffffffff0000000000000000e64ea8ca0000000000000000"], 0x48) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000140)=ANY=[], 0x0, 0x2, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="fcffffff14000100fe8000000000000000000000000000bb"], 0x30}}, 0x0) (async, rerun: 32) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) (async, rerun: 32) sendmsg$TIPC_NL_KEY_FLUSH(r4, &(0x7f0000000600)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="18000000", @ANYBLOB="04002abd7007000000251800be3ed0560480"], 0x18}, 0x1, 0x0, 0x0, 0x20000840}, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) (async) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, r5, 0x215eb000) (async, rerun: 64) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 64) r6 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async, rerun: 64) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0xa, 0x0, 0x2, @remote, 0xfffffffc}, 0x1c) (async, rerun: 64) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r3, &(0x7f0000000300), &(0x7f0000000000)=""/10, 0x3}, 0x20) (async) sendmsg$GTP_CMD_ECHOREQ(r2, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="00000000185372b3c17c5b39436cb8982f0ab030dc7c018fa2fd8a96a5a30e2057375f49cea584d92e2f73345b01d0ee324755b4536474fafa1dd83bf608ec4455581d1face451426ccf9b9c8e96ebe2046b01e4d59e5e5f3b4d5c743f32acc3f4f8b0fa80d136c6a7594ad9b37fab6e8f46c88ad8a2bd545c4103a2a42886d634ccb9eefcbc4b7d5bfb514d", @ANYRES16=0x0, @ANYBLOB="200025bd7000fbdbdf250300000005000d000300000014000b00fc00000000000000000000000000000108000500ac14140c14000b00fe880000000000000000000000000101080005007f0000010c0003000100000000000000080005006401010208000500ac1e0101"], 0x70}, 0x1, 0x0, 0x0, 0x11}, 0x0) 531.273186ms ago: executing program 3 (id=2159): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000008b40)={0x38, 0x40, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0x4, 0xf}, @typed={0x5, 0xb, 0x0, 0x0, @str='\x00'}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x38}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@ipv4_delroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, [@RTA_MULTIPATH={0xc, 0x8, {0x8}}, @RTA_NH_ID={0x8, 0x1e, 0x1197}]}, 0x30}}, 0x0) bind$alg(r1, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f00000035c0)=[{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="b180dccc16eb676ff09b3e4ef26f701d", 0x10}, {&(0x7f0000001ac0)="185f70788926e08ce31809863a7db4d975e887eea5dcd974fef9c6ed45a821773237e5d2d329c07c7e1bb2e75ecccfb76e11781c5daab14253f6959a0400da0bf98a0ab829816250cf32206089785600f7c3ee056ab6fdd436f0c3e71740000000d5d70f35c3c55403e6a22e4560ac69", 0x70}], 0x2, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x10}], 0x1, 0x84) (async) recvmsg$can_raw(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000440)=""/127, 0x7f}, {&(0x7f0000000840)=""/205, 0xcd}], 0x2}, 0x40) (async, rerun: 32) r4 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r3}, 0x8) (rerun: 32) ioctl$VFAT_IOCTL_READDIR_BOTH(r4, 0x82307201, &(0x7f0000000940)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async, rerun: 32) syz_emit_ethernet(0x82, &(0x7f00000005c0)=ANY=[@ANYRES8=r1, @ANYBLOB="97f29d1a056d3580223c7ed2102f1d2a6df7f75a9632fc010d48d65157f99cb461b77727f215aba8843f1c74833f4403baa3e73793691a63824e61a4dc3808337fb5e2b6745df051e494", @ANYBLOB="a82bf9c287ae775b2e26dc72dcb27bbaf602ff71e4644fa99aebcda996307c21cee53ee1272f3e6c046465cdccd9c17018711bcc1035b6c5fb6a7636fccc08850be9f55ab12ab8a622fb2cc8e711d5127f72543f6b758d8d864cac47f7b2514acb3f058ddd62ee1fb378a362206f9734d7b7c6aa69f75cfcb736c792363d1eaced14c2b15cf6109f47231a65bb9f1803c5e8", @ANYBLOB="71e09e32c65ace846b62bfe02e0f66a50e7a1929066cc0c92e45e75d16a6b9dc618d7a8bae1c477089f2e6b6aad739cb6fe66ab7e5edb9ecd4243856c4d45da2c48324df143e70d5b465b857159cbbc1242749b3e1acdbf03d22eb4b9b82e1250d33481b76657a81928c3ea49369bef634718adb9178e39d8394e678c8e3d5ea27aa3d749effd46d4a82b5d15b816dced42958d900bd83ee4a84a76618cc453316fada44225f8a959b1b9de4364c05685a8215f811418a14011a80ad79f0c419badc800d61d85d5f", @ANYRESHEX=r3, @ANYRESHEX=r0, @ANYRESDEC=r0, @ANYRESDEC=r0], 0x0) (rerun: 32) 530.476469ms ago: executing program 2 (id=2160): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, &(0x7f0000000000)=ANY=[], 0x1000d) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x5}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c00000014002101000000000000000023000000", @ANYRESDEC=r2, @ANYBLOB="040002"], 0x2c}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r4, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) r5 = socket$netlink(0x10, 0x3, 0x14) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r7, 0x84, 0x16, &(0x7f00000003c0)={0x2, [0x8, 0x1]}, &(0x7f0000000540)=0x8) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r5) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r5, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="000049ae", @ANYRES16=r6, @ANYBLOB="05002dbd7000fbdbdf251c0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0006000000080001007063690011000200303030303a30303a31302e300000000008000b00020000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0001000000080001007063690011000200303030303a30303a31302e300000000008000b00000000800e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0009000000"], 0xd4}}, 0x805) sendmsg$inet6(r1, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="280000000000000029000000050000000002020100000000fe8400000000000000000000000000bb"], 0x28}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r9 = socket(0x10, 0x3, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newtfilter={0x50, 0x2c, 0xd27, 0x30bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0x0, 0xa}, {}, {0x10, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x401}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1, 0x0, 0x0, {{0xe6a7}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048084}, 0x2008c010) write$cgroup_subtree(r8, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r8, 0x0) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xa, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r13}, {}, {0x85, 0x0, 0x0, 0x88}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r5) socket$unix(0x1, 0x1, 0x0) 351.211015ms ago: executing program 4 (id=2161): socket$inet6(0xa, 0x800000000000002, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0x437, 0x20000000, 0x20000000, {0x0, 0x0, 0x0, r2, 0x42483}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x48080}, 0x4000000) sendmmsg$inet(r0, &(0x7f0000000880)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x104, 0x2, 0x3c8, 0xe8, 0x1f8, 0xe8, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@MARK={0x28}}, {{@arp={@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, {@mac, {[0xff, 0x0, 0x0, 0xff]}}, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 'nicvf0\x00', 'lo\x00'}, 0xc0, 0x110, 0x0, {0xb000000}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @empty, @private=0xa010102, @local, 0x8, 0x1}}}, {{@arp={@rand_addr, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x9, {@empty, {[0xff]}}, {@mac=@remote}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 'veth0_macvtap\x00', 'ipvlan1\x00', {}, {}, 0x0, 0x2}, 0xc0, 0xe8}, @unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x418) sendmmsg$inet6(r3, &(0x7f0000004b40)=[{{&(0x7f0000001140)={0xa, 0x4e23, 0x3, @private2, 0x8}, 0x1c, &(0x7f00000013c0)=[{&(0x7f00000016c0)="99", 0x1}], 0x1}}], 0x1, 0x4000090) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000000), &(0x7f0000001080)=0x8) socket$inet(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'veth1_to_bridge\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r9 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpu.stat\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f0000000100), 0x4) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xca, r8, 0x18}, 0x38) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800c0001006d6163766c616e00100002800a0009000180c2000003000008000500", @ANYRES32=r6], 0x48}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000000), 0x0) 334.525767ms ago: executing program 1 (id=2162): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0xf, 0x4, 0x8, 0x22, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x4, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r2 = socket$inet6(0xa, 0x3, 0xff) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0), 0xe8}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r11, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r3, 0x3, 0x25, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r12 = socket$igmp(0x2, 0x3, 0x2) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r12, 0x942e, 0x0) bind$bt_sco(r0, &(0x7f0000000080)={0x1f, @none}, 0xfffffffffffffef0) 261.151129ms ago: executing program 3 (id=2163): r0 = socket(0x10, 0x80002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000f00000000009500000000004000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x6f, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaa00450000610000000000119078000000000000000000004e20004d90786046bcac7ead75b79a775a498827ca82717eaf2f40827015aa93672637"], 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="c40000000a06010100000000000000000300000908000944800000010900020073797a31000000000500010007000000080009400000000588000880"], 0x13a}, 0x1, 0x0, 0x0, 0x90be2d9b0c93a716}, 0x48084) bpf$BPF_GET_PROG_INFO(0x1c, &(0x7f0000000480)={r1, 0x0, 0x0}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff000065c93adbff3c4f2729f6a4e5151dac6d820a28b7192a903949ab3aad4fc8f4020508656f1a519abc0b2903186599f57d031640a57134d33c51678d797ce7f36a565b06d1aaa65c96780398ef48eede64b1e8fe53f3166e48ba74a3527a1848ec9fa4be207929f3c442e5c928dc0febe32306e14fded96754b5cd9a81fcc2789f60b920d8adfde99f60fb4ec7dbaca929c33e3a1c7b2827c2f6201cc4d1382a41874e5261c139aaacfe", @ANYRES32=0x0, @ANYRES64=r0, @ANYRES8=0x0, @ANYBLOB="fcddfae31a68aae49a7a759427124de87bc52f08918b4f3a675a774bf87023377a3b227f987c57735d565474fd9bd49253e3136e97a3ef5527da5c49cd0c700cbd8f589be48501cfbeb78932afe5980f8cb0189bf3425356d18c11bc29c9355a2f5ad1539dacf2903837b57724f0f6b474e3afdd3bc79b5a999a1b81efd7c9cc2ae04feb8cc524d1c96ef4395dabc91b107fbe97643f70bb97d733479c367fe9671fce0c255cb9e7439a3e73071d90705696ebf6fd710dd18fb6e549ea96c56a4ff15edbae"], 0x48}}, 0x400400c0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 239.447484ms ago: executing program 0 (id=2164): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 64) r2 = socket$unix(0x1, 0x1, 0x0) (rerun: 64) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (rerun: 64) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0xfff2, 0x5}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0x1, 0x7, 0x3}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}}, 0x4800) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$netlink(0x10, 0x3, 0x0) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) (async) r7 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x1}], 0x1}, 0x4) (async, rerun: 64) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="5a34cda7805c6272e71d57fbf4434082ca4bfa2ca3cfa2434ca764e7b1af2cf23382e2242913fd6206a51566b7577098202c290a90377a9142063bab5651f227af7072314a6e999301d6d92bb94e862d987fb74dc96e02d61a49306303976e0dc75110a91fe0ac91c1d11a654847ed9d2ffa34582547bff020b7edb9dd0e337ad855e25e5a3ff1f9471ea16ed16159f38cf995f60e4c6061211dd3d8367f11b390a920fc741794894acee17f2a2dc3b5328979e1233aa8e4"], 0x7c}}, 0x0) (async, rerun: 64) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000f00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a010400000000000000000200000044000480400001800e000100627974656f726465720000002c000280080001400000000108000240000000000800044000000002080003400000000008000540000000080900010073797a30000000000900020073797a32"], 0x98}}, 0x0) 82.142087ms ago: executing program 1 (id=2165): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=ANY=[@ANYBLOB="5c0100000002010300000000000000000700000210010a8008000140000000009c00028006000340000100002c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000000000000000060003400004000014000180080001000000000008000200ac1e00012c00018014000300ff02000000000000000000000000000114000400fc00000000000000000000000000000106000340000200001400018008000100ac1e000108000200ac1e0001080001400000400108000140000000015800028006000300000100002c00018014000300fe80000000000000000000000000002a14000400fe8800000000000000000000000001011400018008000100e000000208000200640101020c000280050001003a00000038000a802c0002801400018008000100ac1414bb08000200e000000106000340000400000c0002800500010001000000080037f9ec7b686c"], 0x15c}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a5"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xad}, 0x94) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x74) sendmmsg$unix(r0, &(0x7f0000000b00)=[{{&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 3.705044ms ago: executing program 3 (id=2166): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000e27f000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000134c2651638af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000e80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x1e, 0x4, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'veth1_to_team\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="400d0000000000003000128008000100687372002400028008000200", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r4], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) r6 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f0000000300)={0x0, {0x2, 0x0, @dev}, {0x2, 0x4e24, @remote}, {0x2, 0x0, @multicast1}, 0xaf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x200}) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r7, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x0, @loopback}, {0x2, 0x0, @remote}, 0x4, 0x0, 0x0, 0xfdffffffffffffff, 0x0, &(0x7f00000001c0)='lo\x00', 0x5, 0x0, 0x3}) ioctl$sock_inet_SIOCADDRT(r7, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0xfffd, @empty}, {0x2, 0x4000, @loopback}, {0x2, 0x0, @private}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001f00)={0xffffffffffffffff, 0x20, &(0x7f0000001ec0)={&(0x7f0000000000)=""/43, 0x2b, 0x0, &(0x7f0000000ec0)=""/4096, 0x1000}}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001f40)={r1, r4, 0x25, 0x0, @val=@tracing={r8, 0x6}}, 0x20) 2.22949ms ago: executing program 2 (id=2167): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r0, 0x10c, 0x6, &(0x7f00000018c0), &(0x7f00000079c0)=0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000400)={'wg1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000c80)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=@setlink={0x34, 0x13, 0x1, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14187}, [@IFLA_ADDRESS={0xa, 0x1, @remote}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x24000042) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000003c0)) socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0x8, 0x7f}, 0x48) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1712f11576ba85ae}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, 0x1, 0x1, 0x5, 0x0, 0x0, {0x1, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r6}, @alu={0x7, 0x1, 0x0, 0x0, 0x8}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x90) socket(0x1, 0x803, 0x0) 0s ago: executing program 4 (id=2168): r0 = socket$igmp(0x2, 0x3, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="450a000000000000611174000000dcd10bd100000000008000000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x4e}, 0x94) setsockopt$MRT_FLUSH(r0, 0x0, 0xd1, &(0x7f0000000000)=0x3, 0x4) (async) syz_emit_ethernet(0x36, &(0x7f0000000240)={@local, @random="b0c942034375", @void, {@ipv4={0x8864, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x22, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) kernel console output (not intermixed with test programs): ode [ 377.920747][ T6677] syz_tun: entered allmulticast mode [ 377.931980][ T6681] ipvlan0: Caught tx_queue_len zero misconfig [ 377.988064][ T5696] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.006774][ T5696] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.033311][ T5696] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.131232][ T5696] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.365237][ T6701] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 378.376672][ T6705] netlink: 'syz.3.225': attribute type 1 has an invalid length. [ 378.406091][ T6701] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 378.518133][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.544711][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.573533][ T6705] 8021q: adding VLAN 0 to HW filter on device bond1 [ 378.589469][ T6706] erspan0: entered promiscuous mode [ 378.678280][ T6712] sit2: entered promiscuous mode [ 378.704824][ T6712] sit2: entered allmulticast mode [ 378.731820][ T6712] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 378.748953][ T6712] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 378.879001][ T6710] tipc: Started in network mode [ 378.907190][ T6710] tipc: Node identity 080211, cluster identity 4711 [ 378.945650][ T6710] tipc: Enabled bearer , priority 0 [ 378.987743][ T6718] __nla_validate_parse: 12 callbacks suppressed [ 378.987784][ T6718] netlink: 16 bytes leftover after parsing attributes in process `syz.3.231'. [ 379.410828][ T6742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.235'. [ 379.548463][ T6748] netlink: 'syz.0.238': attribute type 6 has an invalid length. [ 379.625339][ T6750] netlink: 16 bytes leftover after parsing attributes in process `syz.0.238'. [ 379.778531][ T6750] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 379.838529][ T6750] gretap2: entered promiscuous mode [ 379.845079][ T6750] gretap2: entered allmulticast mode [ 379.887185][ T6750] netlink: 24 bytes leftover after parsing attributes in process `syz.0.238'. [ 379.893809][ T6764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 380.055161][ T9] tipc: Node number set to 134353152 [ 380.284476][ T6775] netlink: 'syz.4.245': attribute type 1 has an invalid length. [ 380.388069][ T6775] bond1: entered promiscuous mode [ 380.438292][ T6775] 8021q: adding VLAN 0 to HW filter on device bond1 [ 380.565912][ T6769] syzkaller1: entered promiscuous mode [ 380.587689][ T6769] syzkaller1: entered allmulticast mode [ 380.879755][ T6793] vlan2: entered allmulticast mode [ 381.811691][ T6826] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 381.916705][ T6830] netlink: 12 bytes leftover after parsing attributes in process `syz.3.258'. [ 382.544310][ T5803] IPVS: starting estimator thread 0... [ 382.618801][ T6849] bridge_slave_0: left allmulticast mode [ 382.660723][ T6849] bridge_slave_0: left promiscuous mode [ 382.670684][ T6851] IPVS: using max 25 ests per chain, 60000 per kthread [ 382.689855][ T6827] Can't find ip_set type [ 382.703724][ T6849] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.788722][ T6849] bridge_slave_1: left allmulticast mode [ 382.814638][ T6849] bridge_slave_1: left promiscuous mode [ 382.830159][ T6849] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.870308][ T6849] bond0: (slave bond_slave_0): Releasing backup interface [ 382.945576][ T6849] bond0: (slave bond_slave_1): Releasing backup interface [ 382.999785][ T6849] team0: Port device team_slave_0 removed [ 383.051239][ T6849] team0: Port device team_slave_1 removed [ 383.077748][ T6849] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 383.100297][ T6849] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 383.144162][ T6849] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 383.154642][ T6867] netlink: 20 bytes leftover after parsing attributes in process `syz.3.268'. [ 383.192794][ T6849] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 383.228021][ T6849] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 383.263182][ T6852] team0: Port device xfrm0 added [ 383.286552][ T6859] tipc: Started in network mode [ 383.301217][ T6859] tipc: Node identity 4ec471f91531, cluster identity 4711 [ 383.315540][ T6859] tipc: Enabled bearer , priority 0 [ 383.694227][ T6879] netlink: 260 bytes leftover after parsing attributes in process `syz.3.272'. [ 383.714866][ T6879] raw_sendmsg: syz.3.272 forgot to set AF_INET. Fix it! [ 384.016864][ T6885] block nbd0: Unsupported socket: should be TCP or UNIX. [ 384.083118][ T6893] netlink: 20 bytes leftover after parsing attributes in process `syz.1.274'. [ 384.116155][ T6889] netlink: 80 bytes leftover after parsing attributes in process `syz.0.275'. [ 384.308174][ T6898] openvswitch: netlink: Message has 1 unknown bytes. [ 384.340196][ T6898] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 384.416117][ T6901] netlink: 'syz.1.279': attribute type 3 has an invalid length. [ 384.426046][ T6902] ip6tnl0: Caught tx_queue_len zero misconfig [ 384.453810][ T24] tipc: Node number set to 1542812153 [ 384.757772][ T6912] netlink: 'syz.1.284': attribute type 16 has an invalid length. [ 384.800075][ T6912] netlink: 'syz.1.284': attribute type 17 has an invalid length. [ 384.829788][ T6912] lo: left allmulticast mode [ 384.866363][ T6920] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 384.882426][ T6916] ksmbd: Unknown IPC event: 3, ignore. [ 384.904515][ T6912] tunl0: left allmulticast mode [ 384.946383][ T6912] gre0: left allmulticast mode [ 384.985331][ T6912] gretap0: left allmulticast mode [ 385.016747][ T6912] erspan0: left allmulticast mode [ 385.048419][ T6912] ip_vti0: left allmulticast mode [ 385.074547][ T6912] ip6_vti0: left allmulticast mode [ 385.092372][ T6912] sit0: left allmulticast mode [ 385.105034][ T6931] netlink: 24 bytes leftover after parsing attributes in process `syz.2.290'. [ 385.125536][ T6932] netlink: 12 bytes leftover after parsing attributes in process `syz.3.289'. [ 385.135001][ T6912] ip6tnl0: left allmulticast mode [ 385.154410][ T6912] ip6gre0: left allmulticast mode [ 385.165099][ T6912] syz_tun: left allmulticast mode [ 385.180683][ T6912] 8021q: adding VLAN 0 to HW filter on device team0 [ 385.197148][ T6912] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 385.256727][ T6912] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 385.267767][ T6912] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 385.281941][ T6912] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 385.293946][ T6912] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 385.311865][ T6912] veth1_vlan: left promiscuous mode [ 385.321132][ T6912] veth0_vlan: left promiscuous mode [ 385.327739][ T6912] veth0_vlan: entered promiscuous mode [ 385.337074][ T6912] veth1_vlan: entered promiscuous mode [ 385.346360][ T6912] veth1_macvtap: left promiscuous mode [ 385.353157][ T6912] veth0_macvtap: left promiscuous mode [ 385.359851][ T6912] veth0_macvtap: entered promiscuous mode [ 385.367573][ T6912] veth1_macvtap: entered promiscuous mode [ 385.379912][ T6912] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 385.391528][ T6912] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 385.399915][ T6912] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 385.408446][ T6912] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 385.423228][ T6912] 8021q: adding VLAN 0 to HW filter on device bond1 [ 385.430981][ T6912] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 385.438301][ T6912] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 385.446149][ T6912] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 385.546252][ T5696] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.553551][ T5696] bridge0: port 1(bridge_slave_0) entered forwarding state [ 385.609771][ T5696] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.617054][ T5696] bridge0: port 2(bridge_slave_1) entered forwarding state [ 385.712616][ T6934] netlink: 40 bytes leftover after parsing attributes in process `syz.2.290'. [ 385.731094][ T3262] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.742487][ T3262] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.830062][ T3262] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.862222][ T3262] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 385.883412][ T5681] dummy0: entered promiscuous mode [ 386.185977][ T6957] TCP: TCP_TX_DELAY enabled [ 386.558134][ T5855] dummy0: left promiscuous mode [ 386.619637][ T6971] netlink: 'syz.0.298': attribute type 11 has an invalid length. [ 386.774989][ T6971] netdevsim netdevsim0: Direct firmware load for .. failed with error -2 [ 386.803148][ T6971] netdevsim netdevsim0: Falling back to sysfs fallback for: .. [ 386.813222][ T6978] netlink: 20 bytes leftover after parsing attributes in process `syz.0.298'. [ 386.958362][ T6981] netlink: 12 bytes leftover after parsing attributes in process `syz.3.302'. [ 387.195117][ T6975] 8021q: adding VLAN 0 to HW filter on device bond2 [ 387.535497][ T6981] bond2: entered promiscuous mode [ 387.541785][ T6981] 8021q: adding VLAN 0 to HW filter on device bond2 [ 387.549337][ T6996] netlink: 36 bytes leftover after parsing attributes in process `syz.1.304'. [ 387.576750][ T6991] 8021q: adding VLAN 0 to HW filter on device bond2 [ 387.595063][ T6991] bond2: (slave sit1): The slave device specified does not support setting the MAC address [ 387.626050][ T6991] bond2: (slave sit1): Error -95 calling set_mac_address [ 387.730081][ T6996] bridge0: port 2(bridge_slave_1) entered disabled state [ 387.739840][ T6996] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.928803][ T7004] netlink: 52 bytes leftover after parsing attributes in process `syz.4.306'. [ 387.939217][ T6976] netlink: 'syz.2.301': attribute type 19 has an invalid length. [ 387.979027][ T7004] tc_dump_action: action bad kind [ 388.227629][ T7011] netlink: 16 bytes leftover after parsing attributes in process `syz.3.310'. [ 388.634834][ T7019] team0: Port device team_slave_0 removed [ 388.776000][ T7024] vcan0: entered allmulticast mode [ 389.108062][ T7039] __nla_validate_parse: 4 callbacks suppressed [ 389.108112][ T7039] netlink: 112 bytes leftover after parsing attributes in process `syz.3.316'. [ 389.141007][ T7044] netlink: 40 bytes leftover after parsing attributes in process `syz.2.315'. [ 389.186059][ T7044] block nbd0: not configured, cannot reconfigure [ 389.208463][ T7040] vlan2: entered promiscuous mode [ 389.245822][ T7040] hsr0: entered promiscuous mode [ 389.290682][ T7050] netlink: 'syz.1.319': attribute type 1 has an invalid length. [ 389.306627][ T7040] vlan2: entered allmulticast mode [ 389.329739][ T7040] hsr0: entered allmulticast mode [ 389.339346][ T7050] netlink: 228 bytes leftover after parsing attributes in process `syz.1.319'. [ 389.380819][ T7040] hsr_slave_0: entered allmulticast mode [ 389.391727][ T7050] netlink: 8 bytes leftover after parsing attributes in process `syz.1.319'. [ 389.421989][ T7040] hsr_slave_1: entered allmulticast mode [ 389.590734][ T7059] netlink: 'syz.2.320': attribute type 1 has an invalid length. [ 389.639952][ T7062] netlink: 68 bytes leftover after parsing attributes in process `syz.4.321'. [ 389.804749][ T7070] netlink: 4 bytes leftover after parsing attributes in process `syz.0.323'. [ 389.877635][ T7064] bond1: (slave bridge1): making interface the new active one [ 389.891227][ T7064] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 390.035049][ T7070] bridge_slave_1: left allmulticast mode [ 390.047965][ T7070] bridge_slave_1: left promiscuous mode [ 390.074629][ T7070] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.156996][ T7070] bridge_slave_0: left promiscuous mode [ 390.199019][ T7070] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.843039][ T7093] bond3: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 390.957499][ T7093] bond3 (unregistering): Released all slaves [ 391.104068][ T7115] x_tables: duplicate underflow at hook 1 [ 391.691465][ T7124] netlink: 20 bytes leftover after parsing attributes in process `syz.0.334'. [ 392.228844][ T7146] netlink: 8 bytes leftover after parsing attributes in process `syz.0.341'. [ 392.501349][ T7151] netdevsim netdevsim1: Firmware load for './file0/file0/../file0' refused, path contains '..' component [ 392.774625][ T7163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.345'. [ 392.859323][ T7166] netlink: 124 bytes leftover after parsing attributes in process `syz.1.347'. [ 394.198638][ T7201] __nla_validate_parse: 4 callbacks suppressed [ 394.198658][ T7201] netlink: 4 bytes leftover after parsing attributes in process `syz.1.353'. [ 394.366421][ T7209] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.598668][ T7204] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 394.984934][ T7219] syzkaller1: entered promiscuous mode [ 395.013190][ T7219] syzkaller1: entered allmulticast mode [ 395.042160][ T7226] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 395.091743][ T7219] tipc: Started in network mode [ 395.122583][ T7219] tipc: Node identity , cluster identity 4711 [ 395.152384][ T7219] tipc: Failed to set node id, please configure manually [ 395.195338][ T7219] tipc: Enabling of bearer rejected, failed to enable media [ 395.904704][ T7249] netlink: 256 bytes leftover after parsing attributes in process `syz.3.364'. [ 396.010839][ T7256] netlink: 20 bytes leftover after parsing attributes in process `syz.2.367'. [ 396.313976][ T7265] netlink: 8 bytes leftover after parsing attributes in process `syz.1.370'. [ 396.390891][ T7265] macvlan0: entered promiscuous mode [ 396.643381][ T7279] netlink: 24 bytes leftover after parsing attributes in process `syz.4.373'. [ 396.863713][ T7290] netlink: 28 bytes leftover after parsing attributes in process `syz.2.374'. [ 397.198410][ T7292] erspan0: left promiscuous mode [ 397.510033][ T7292] geneve2: left promiscuous mode [ 397.557221][ T7292] gretap2: left promiscuous mode [ 397.599895][ T7292] vlan2: left promiscuous mode [ 397.622360][ T7292] hsr0: left promiscuous mode [ 398.397538][ T7331] macsec0: entered promiscuous mode [ 398.423914][ T7331] netlink: 4 bytes leftover after parsing attributes in process `syz.4.385'. [ 398.445991][ T7331] veth1_macvtap: left promiscuous mode [ 398.560267][ T7331] macsec0 (unregistering): left promiscuous mode [ 398.643076][ T7340] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 399.998158][ T7392] netlink: 'syz.2.403': attribute type 5 has an invalid length. [ 400.027879][ T7392] netlink: 56 bytes leftover after parsing attributes in process `syz.2.403'. [ 400.905282][ T7431] netlink: 28 bytes leftover after parsing attributes in process `syz.0.413'. [ 401.073557][ T7436] team_slave_1: mtu less than device minimum [ 401.287666][ T7440] Bluetooth: MGMT ver 1.23 [ 401.325176][ T7440] ieee802154 phy0 wpan0: encryption failed: -22 [ 401.840242][ T7452] netlink: 14544 bytes leftover after parsing attributes in process `syz.2.420'. [ 402.316837][ T7470] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 402.419858][ T7470] bond2: (slave lo): Enslaving as an active interface with an up link [ 402.459735][ T7470] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 402.699187][ T7481] netlink: 'syz.3.428': attribute type 2 has an invalid length. [ 403.061114][ T7490] netlink: 28 bytes leftover after parsing attributes in process `syz.3.433'. [ 403.129800][ T7490] netlink: 28 bytes leftover after parsing attributes in process `syz.3.433'. [ 403.141533][ T7494] netlink: 28 bytes leftover after parsing attributes in process `syz.3.433'. [ 403.157583][ T7494] netlink: 28 bytes leftover after parsing attributes in process `syz.3.433'. [ 403.180135][ T7494] gretap0: entered promiscuous mode [ 403.203046][ T7494] gretap0: left promiscuous mode [ 403.279219][ T7490] gretap0: entered promiscuous mode [ 403.338298][ T7490] gretap0: left promiscuous mode [ 403.470198][ T7505] netlink: 404 bytes leftover after parsing attributes in process `syz.2.437'. [ 403.497401][ T7505] netlink: 28 bytes leftover after parsing attributes in process `syz.2.437'. [ 403.524372][ T7505] netlink: 28 bytes leftover after parsing attributes in process `syz.2.437'. [ 403.597709][ T7508] netlink: 'syz.4.436': attribute type 1 has an invalid length. [ 403.983234][ T7515] Can't find ip_set type [ 404.371619][ T7535] netlink: 'syz.1.443': attribute type 1 has an invalid length. [ 404.548116][ T7543] nbd: couldn't find device at index 16777216 [ 404.611652][ T7548] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 404.691348][ T7553] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 404.805602][ T7562] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 405.373787][ T7586] __nla_validate_parse: 7 callbacks suppressed [ 405.373827][ T7586] netlink: 60 bytes leftover after parsing attributes in process `syz.2.452'. [ 405.391504][ T7586] netlink: 60 bytes leftover after parsing attributes in process `syz.2.452'. [ 407.303685][ T7538] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 407.316070][ T7574] netlink: 4 bytes leftover after parsing attributes in process `syz.0.451'. [ 407.501227][ T7612] netlink: 'syz.1.454': attribute type 39 has an invalid length. [ 408.415140][ T7630] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 408.534973][ T7636] netlink: 28 bytes leftover after parsing attributes in process `syz.4.461'. [ 408.554156][ T7639] rB: renamed from lo (while UP) [ 408.597658][ T7640] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 408.846357][ T7652] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 408.938015][ T7652] bridge_slave_0: left allmulticast mode [ 408.966202][ T7652] bridge_slave_0: left promiscuous mode [ 408.990126][ T7652] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.034598][ T7652] bridge_slave_1: left allmulticast mode [ 409.057937][ T7652] bridge_slave_1: left promiscuous mode [ 409.066179][ T7652] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.137993][ T7658] netlink: 44 bytes leftover after parsing attributes in process `syz.0.466'. [ 409.158765][ T7658] netlink: 43 bytes leftover after parsing attributes in process `syz.0.466'. [ 409.176074][ T7652] bond0: (slave bond_slave_0): Releasing backup interface [ 409.184834][ T7658] netlink: 'syz.0.466': attribute type 5 has an invalid length. [ 409.260489][ T7658] netlink: 43 bytes leftover after parsing attributes in process `syz.0.466'. [ 409.347516][ T7652] bond0: (slave bond_slave_1): Releasing backup interface [ 409.464273][ T7652] team0: Port device team_slave_0 removed [ 409.575585][ T7652] team0: Port device team_slave_1 removed [ 409.631391][ T7652] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 409.688575][ T7652] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 409.767294][ T7652] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 409.791898][ T7670] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.469'. [ 409.812256][ T7652] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 409.859431][ T7652] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 410.558960][ T7674] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 410.573379][ T50] Bluetooth: hci0: command tx timeout [ 410.908024][ T7690] netlink: 'syz.1.477': attribute type 1 has an invalid length. [ 411.016635][ T7693] netlink: 8 bytes leftover after parsing attributes in process `syz.1.477'. [ 411.027873][ T5802] IPVS: starting estimator thread 0... [ 411.068870][ T7697] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.479'. [ 411.086470][ T7693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.477'. [ 411.122909][ T7695] IPVS: using max 26 ests per chain, 62400 per kthread [ 411.399683][ T7699] macvlan2: entered promiscuous mode [ 411.428781][ T7699] macvlan2: entered allmulticast mode [ 411.460916][ T7703] netlink: 40 bytes leftover after parsing attributes in process `syz.3.481'. [ 411.477721][ T7699] bond3: entered promiscuous mode [ 411.510590][ T7699] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 411.576091][ T7699] bond3: left promiscuous mode [ 411.841560][ T7704] : renamed from bond0 (while UP) [ 413.269972][ T7743] netlink: 12 bytes leftover after parsing attributes in process `syz.3.492'. [ 413.951558][ T7752] netlink: 12 bytes leftover after parsing attributes in process `syz.0.494'. [ 414.219061][ T7765] netlink: 56 bytes leftover after parsing attributes in process `syz.1.498'. [ 414.816110][ T7772] netlink: 24 bytes leftover after parsing attributes in process `syz.2.500'. [ 414.867588][ T7774] xt_CONNSECMARK: invalid mode: 0 [ 415.378359][ T7786] netlink: 16 bytes leftover after parsing attributes in process `syz.1.504'. [ 416.767305][ T7811] netlink: 'syz.2.513': attribute type 7 has an invalid length. [ 417.429111][ T7829] sctp: [Deprecated]: syz.0.516 (pid 7829) Use of int in max_burst socket option deprecated. [ 417.429111][ T7829] Use struct sctp_assoc_value instead [ 417.930608][ T7837] netlink: 8 bytes leftover after parsing attributes in process `syz.1.519'. [ 417.991992][ T7837] netlink: 8 bytes leftover after parsing attributes in process `syz.1.519'. [ 418.018290][ T7839] netlink: 8 bytes leftover after parsing attributes in process `syz.1.519'. [ 418.040243][ T7839] netlink: 'syz.1.519': attribute type 1 has an invalid length. [ 418.071821][ T7839] netlink: 'syz.1.519': attribute type 2 has an invalid length. [ 418.122403][ T7837] netlink: 'syz.1.519': attribute type 1 has an invalid length. [ 418.162563][ T7837] netlink: 'syz.1.519': attribute type 2 has an invalid length. [ 418.203595][ T7833] sit0: Caught tx_queue_len zero misconfig [ 418.219687][ T7845] netlink: zone id is out of range [ 418.238363][ T7845] netlink: zone id is out of range [ 418.262938][ T7845] netlink: zone id is out of range [ 418.335432][ T7845] netlink: zone id is out of range [ 418.383184][ T7845] netlink: zone id is out of range [ 418.406164][ T7845] netlink: zone id is out of range [ 418.432556][ T7845] netlink: zone id is out of range [ 418.471140][ T7848] netlink: 12 bytes leftover after parsing attributes in process `syz.0.523'. [ 418.480870][ T7845] netlink: zone id is out of range [ 418.533055][ T7845] netlink: zone id is out of range [ 418.573069][ T7845] netlink: zone id is out of range [ 418.917114][ T7866] trusted_key: syz.0.528 sent an empty control message without MSG_MORE. [ 419.461880][ T7884] netlink: 32 bytes leftover after parsing attributes in process `syz.0.534'. [ 419.580846][ T7886] --map-set only usable from mangle table [ 419.627616][ T7887] --map-set only usable from mangle table [ 420.148106][ T7902] netlink: 'syz.3.538': attribute type 1 has an invalid length. [ 420.186850][ T7902] netlink: 28 bytes leftover after parsing attributes in process `syz.3.538'. [ 420.313794][ T7907] netlink: 8 bytes leftover after parsing attributes in process `syz.1.540'. [ 420.818015][ T7922] xt_hashlimit: size too large, truncated to 1048576 [ 420.846193][ T7923] netlink: 412 bytes leftover after parsing attributes in process `syz.1.544'. [ 421.765917][ T7942] netlink: 12 bytes leftover after parsing attributes in process `syz.0.552'. [ 422.023861][ T7946] veth0: entered promiscuous mode [ 422.052311][ T7946] veth0: left promiscuous mode [ 422.197469][ T7948] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 422.269438][ T7948] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 422.381813][ T7952] netlink: 8 bytes leftover after parsing attributes in process `syz.2.555'. [ 423.436497][ T7984] netlink: 15 bytes leftover after parsing attributes in process `syz.1.567'. [ 423.482126][ T7985] Bluetooth: MGMT ver 1.23 [ 423.529209][ T7985] IPVS: length: 8 != 1152 [ 423.819438][ T7998] netlink: 216 bytes leftover after parsing attributes in process `syz.1.570'. [ 423.839154][ T7991] netlink: 4 bytes leftover after parsing attributes in process `syz.0.566'. [ 423.886613][ T7998] netlink: 8 bytes leftover after parsing attributes in process `syz.1.570'. [ 423.904214][ T7985] syzkaller0: entered allmulticast mode [ 424.319935][ T8009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.572'. [ 424.369922][ T8005] bond3: entered promiscuous mode [ 424.400256][ T8014] netlink: 8 bytes leftover after parsing attributes in process `syz.4.574'. [ 424.431719][ T8009] netlink: 12 bytes leftover after parsing attributes in process `syz.3.572'. [ 424.459867][ T8014] netlink: 8 bytes leftover after parsing attributes in process `syz.4.574'. [ 424.790019][ T8021] netlink: 36 bytes leftover after parsing attributes in process `syz.2.576'. [ 424.884247][ T8025] netlink: 'syz.1.578': attribute type 1 has an invalid length. [ 424.946792][ T8025] netlink: 12 bytes leftover after parsing attributes in process `syz.1.578'. [ 425.917975][ T8047] netlink: 'syz.1.586': attribute type 1 has an invalid length. [ 426.257767][ T8056] xt_TPROXY: Can be used only with -p tcp or -p udp [ 426.783479][ T8069] netlink: 'syz.4.593': attribute type 1 has an invalid length. [ 426.904337][ T8069] 8021q: adding VLAN 0 to HW filter on device bond3 [ 427.295813][ T8072] bond3: (slave geneve2): making interface the new active one [ 427.426524][ T8072] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 427.715419][ T8092] xt_policy: too many policy elements [ 428.137345][ T8092] can: request_module (can-proto-0) failed. [ 428.859811][ T8116] net_ratelimit: 51 callbacks suppressed [ 428.859915][ T8116] netlink: zone id is out of range [ 428.977849][ T8116] netlink: zone id is out of range [ 429.003495][ T8116] netlink: zone id is out of range [ 429.027916][ T8116] netlink: zone id is out of range [ 429.067845][ T8116] netlink: zone id is out of range [ 429.108168][ T8116] netlink: zone id is out of range [ 429.122201][ T8116] netlink: zone id is out of range [ 429.128481][ T8116] netlink: zone id is out of range [ 429.133942][ T8116] netlink: zone id is out of range [ 429.139121][ T8116] netlink: zone id is out of range [ 429.325640][ T8127] bond0 (unregistering): Released all slaves [ 429.594361][ T8142] __nla_validate_parse: 55 callbacks suppressed [ 429.594422][ T8142] netlink: 4 bytes leftover after parsing attributes in process `syz.1.613'. [ 430.127911][ T8153] netlink: 28 bytes leftover after parsing attributes in process `syz.2.617'. [ 430.146521][ T8156] netlink: 8 bytes leftover after parsing attributes in process `syz.3.618'. [ 430.170343][ T8156] netlink: 'syz.3.618': attribute type 6 has an invalid length. [ 430.194829][ T8156] netlink: 4 bytes leftover after parsing attributes in process `syz.3.618'. [ 430.454431][ T8165] netlink: 220 bytes leftover after parsing attributes in process `syz.0.620'. [ 430.605216][ T7596] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.650229][ T7596] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.698621][ T7596] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.757725][ T7596] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 430.968525][ T8168] netlink: 16 bytes leftover after parsing attributes in process `syz.0.623'. [ 430.978487][ T8172] netlink: 'syz.3.624': attribute type 1 has an invalid length. [ 431.116826][ T8173] can: request_module (can-proto-0) failed. [ 431.217928][ T8172] bond4: entered promiscuous mode [ 431.248677][ T8172] 8021q: adding VLAN 0 to HW filter on device bond4 [ 431.299492][ T8176] netlink: 4 bytes leftover after parsing attributes in process `syz.0.623'. [ 431.558308][ T8187] gtp0: entered promiscuous mode [ 431.576067][ T8187] gtp0: entered allmulticast mode [ 435.582915][ T8227] netlink: 356 bytes leftover after parsing attributes in process `syz.2.633'. [ 435.936663][ T8244] netlink: 'syz.3.637': attribute type 1 has an invalid length. [ 435.990034][ T8244] netlink: 224 bytes leftover after parsing attributes in process `syz.3.637'. [ 436.439435][ T8260] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 436.580341][ T8274] netlink: 16 bytes leftover after parsing attributes in process `syz.2.642'. [ 436.655596][ T8275] team0: Caught tx_queue_len zero misconfig [ 436.711627][ T8276] net_ratelimit: 3 callbacks suppressed [ 436.711683][ T8276] openvswitch: netlink: Unexpected mask (mask=201040, allowed=10048) [ 436.792073][ T8276] tipc: Started in network mode [ 436.862834][ T8276] tipc: Node identity ac1414aa, cluster identity 4711 [ 436.928870][ T8280] netlink: 212344 bytes leftover after parsing attributes in process `syz.1.645'. [ 436.939593][ T8276] tipc: Enabled bearer , priority 10 [ 437.608688][ T8298] netlink: 4 bytes leftover after parsing attributes in process `syz.1.649'. [ 438.073798][ T5364] tipc: Node number set to 2886997162 [ 438.257356][ T8316] netlink: 24 bytes leftover after parsing attributes in process `syz.1.654'. [ 439.941468][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.860466][ T8361] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 442.980629][ T8365] x_tables: duplicate underflow at hook 1 [ 443.049507][ T8369] openvswitch: netlink: Key type 30 is not supported [ 443.535493][ T8381] netlink: 76 bytes leftover after parsing attributes in process `syz.3.667'. [ 444.319517][ T8405] netlink: 27 bytes leftover after parsing attributes in process `syz.2.672'. [ 444.379912][ T8411] netlink: 'syz.0.673': attribute type 2 has an invalid length. [ 444.431775][ T8411] netlink: 'syz.0.673': attribute type 11 has an invalid length. [ 444.483181][ T8411] netlink: 132 bytes leftover after parsing attributes in process `syz.0.673'. [ 444.988441][ T8423] netlink: 'syz.3.676': attribute type 1 has an invalid length. [ 445.240111][ T8429] netlink: 'syz.4.681': attribute type 1 has an invalid length. [ 445.420181][ T8430] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 445.672567][ T8429] bond4: entered promiscuous mode [ 445.688960][ T8429] 8021q: adding VLAN 0 to HW filter on device bond4 [ 445.742211][ T8433] bond4: (slave bridge3): making interface the new active one [ 445.750462][ T8433] bridge3: entered promiscuous mode [ 445.759260][ T8433] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 445.783112][ T8439] vcan0: entered allmulticast mode [ 446.146325][ T8456] netlink: 'syz.2.684': attribute type 1 has an invalid length. [ 446.452482][ T8447] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 446.867054][ T8447] geneve2: left allmulticast mode [ 446.899621][ T8447] gretap2: left allmulticast mode [ 446.916768][ T8447] vlan2: left allmulticast mode [ 446.921768][ T8447] hsr0: left allmulticast mode [ 446.928479][ T8447] hsr_slave_0: left allmulticast mode [ 446.935736][ T8447] hsr_slave_1: left allmulticast mode [ 446.946371][ T5819] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.957401][ T5819] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 446.967115][ T5819] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.982483][ T5819] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 447.010487][ T5819] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.028415][ T5819] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 447.041770][ T5696] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.089985][ T5696] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 447.561348][ T8487] sit1: entered promiscuous mode [ 447.609503][ T8487] sit1: entered allmulticast mode [ 447.662604][ T8492] bond0: entered allmulticast mode [ 447.896217][ T8501] netlink: 8 bytes leftover after parsing attributes in process `syz.2.697'. [ 447.917005][ T8501] netlink: 24 bytes leftover after parsing attributes in process `syz.2.697'. [ 447.951765][ T8501] netlink: 8 bytes leftover after parsing attributes in process `syz.2.697'. [ 447.981787][ T8501] netlink: 24 bytes leftover after parsing attributes in process `syz.2.697'. [ 448.451567][ T8516] veth0: entered promiscuous mode [ 448.475060][ T8516] veth0: left promiscuous mode [ 449.747519][ T8535] netlink: 4 bytes leftover after parsing attributes in process `syz.1.706'. [ 451.826981][ T8560] netlink: 24 bytes leftover after parsing attributes in process `syz.3.716'. [ 451.904248][ T8560] openvswitch: netlink: Flow key attr not present in new flow. [ 451.999989][ T8562] netlink: 4 bytes leftover after parsing attributes in process `syz.1.717'. [ 452.453685][ T8573] netlink: 4 bytes leftover after parsing attributes in process `syz.2.721'. [ 452.926077][ T8586] netlink: 20 bytes leftover after parsing attributes in process `syz.3.724'. [ 453.117506][ T8595] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ku crK:̥B| [ 453.689155][ T8612] netlink: 216 bytes leftover after parsing attributes in process `syz.3.729'. [ 453.771533][ T8612] netlink: 'syz.3.729': attribute type 2 has an invalid length. [ 453.856721][ T8613] netlink: 12 bytes leftover after parsing attributes in process `syz.3.729'. [ 453.902448][ T8612] netlink: 'syz.3.729': attribute type 1 has an invalid length. [ 454.194027][ T8613] 8021q: adding VLAN 0 to HW filter on device bond5 [ 454.646130][ T8643] netlink: 16 bytes leftover after parsing attributes in process `syz.3.735'. [ 454.717786][ T8644] netlink: 'syz.3.735': attribute type 2 has an invalid length. [ 454.904362][ T8648] netlink: 4 bytes leftover after parsing attributes in process `syz.0.737'. [ 455.492449][ T30] audit: type=1107 audit(1781375923.558:4): pid=8662 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 455.608969][ T8670] netlink: 96 bytes leftover after parsing attributes in process `syz.2.744'. [ 455.728913][ T8670] vlan3: entered allmulticast mode [ 456.116493][ T8683] netlink: 'syz.1.748': attribute type 1 has an invalid length. [ 456.410360][ T8691] netlink: 8 bytes leftover after parsing attributes in process `syz.2.750'. [ 456.439073][ T8683] bond4: entered promiscuous mode [ 456.460068][ T8683] 8021q: adding VLAN 0 to HW filter on device bond4 [ 456.510384][ T8686] netlink: 72 bytes leftover after parsing attributes in process `syz.0.749'. [ 456.638303][ T8692] 8021q: adding VLAN 0 to HW filter on device bond4 [ 456.680121][ T8692] bond4: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 456.729578][ T8692] bond4: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 456.769497][ T8692] bond4: (slave ip6gre1): making interface the new active one [ 456.822876][ T8692] ip6gre1: entered promiscuous mode [ 456.879431][ T8692] bond4: (slave ip6gre1): Enslaving as an active interface with an up link [ 457.069619][ T8696] netlink: 'syz.3.751': attribute type 27 has an invalid length. [ 457.093964][ T8696] netlink: 'syz.3.751': attribute type 4 has an invalid length. [ 457.154989][ T8696] netlink: 152 bytes leftover after parsing attributes in process `syz.3.751'. [ 457.991050][ T8731] netlink: 16 bytes leftover after parsing attributes in process `syz.1.759'. [ 458.035262][ T8731] netlink: 8 bytes leftover after parsing attributes in process `syz.1.759'. [ 458.075026][ T8734] netlink: 24 bytes leftover after parsing attributes in process `syz.0.760'. [ 458.094020][ T8733] netlink: 4 bytes leftover after parsing attributes in process `syz.3.761'. [ 458.286469][ T8742] netlink: 16 bytes leftover after parsing attributes in process `syz.4.763'. [ 458.295681][ T8738] netlink: 'syz.2.762': attribute type 11 has an invalid length. [ 458.792322][ T8765] netlink: 'syz.2.769': attribute type 2 has an invalid length. [ 459.045772][ T8742] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 459.408202][ T8781] netlink: 'syz.1.772': attribute type 1 has an invalid length. [ 459.935234][ T8800] IPVS: lc: FWM 3 0x00000003 - no destination available [ 460.016577][ T8805] __nla_validate_parse: 4 callbacks suppressed [ 460.016597][ T8805] netlink: 12 bytes leftover after parsing attributes in process `syz.4.780'. [ 461.161605][ T8845] syzkaller0: entered promiscuous mode [ 461.168544][ T8845] syzkaller0: entered allmulticast mode [ 462.337144][ T8780] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 463.412280][ T8879] netlink: 12 bytes leftover after parsing attributes in process `syz.3.799'. [ 463.789952][ T8893] netlink: 'syz.1.803': attribute type 1 has an invalid length. [ 463.981277][ T8898] netlink: 'syz.3.804': attribute type 1 has an invalid length. [ 464.001917][ T8897] netlink: 256 bytes leftover after parsing attributes in process `syz.3.804'. [ 464.059366][ T8893] 8021q: adding VLAN 0 to HW filter on device bond5 [ 464.357894][ T8898] 8021q: adding VLAN 0 to HW filter on device bond6 [ 464.426951][ T8917] netlink: 8 bytes leftover after parsing attributes in process `syz.2.808'. [ 464.578107][ T8897] bond6: (slave gretap1): making interface the new active one [ 464.600614][ T8897] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 465.132538][ T8936] netlink: 16 bytes leftover after parsing attributes in process `syz.3.812'. [ 465.191986][ T8936] netlink: 16 bytes leftover after parsing attributes in process `syz.3.812'. [ 465.516947][ T8949] netlink: 'syz.3.817': attribute type 1 has an invalid length. [ 465.540648][ T8949] netlink: 224 bytes leftover after parsing attributes in process `syz.3.817'. [ 465.554199][ T8945] netlink: 56 bytes leftover after parsing attributes in process `syz.1.815'. [ 466.141321][ T8964] netem: change failed [ 466.270944][ T8972] netlink: 32 bytes leftover after parsing attributes in process `syz.3.823'. [ 466.542377][ T8966] netlink: 48 bytes leftover after parsing attributes in process `syz.1.820'. [ 466.575736][ T8978] erspan0: left promiscuous mode [ 466.991281][ T8982] batadv0: Caught tx_queue_len zero misconfig [ 467.098563][ T8996] netlink: 20 bytes leftover after parsing attributes in process `syz.4.831'. [ 468.226568][ T9019] netlink: 60 bytes leftover after parsing attributes in process `syz.1.835'. [ 468.267960][ T9017] syzkaller0: entered promiscuous mode [ 468.319672][ T9017] syzkaller0: entered allmulticast mode [ 468.374820][ T9023] netlink: 4 bytes leftover after parsing attributes in process `syz.4.836'. [ 468.423711][ T9017] netlink: 16 bytes leftover after parsing attributes in process `syz.3.834'. [ 469.381157][ T5819] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 469.464587][ T5819] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 469.484991][ T5780] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 469.629881][ T9052] vlan3: entered allmulticast mode [ 469.664274][ T5780] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 469.756161][ T5780] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 471.191042][ T9097] xt_hashlimit: size too large, truncated to 1048576 [ 471.716978][ T9116] __nla_validate_parse: 2 callbacks suppressed [ 471.716998][ T9116] netlink: 12 bytes leftover after parsing attributes in process `syz.0.865'. [ 471.790758][ T9119] geneve2: entered promiscuous mode [ 471.828835][ T9116] 8021q: adding VLAN 0 to HW filter on device bond0 [ 471.844346][ T5829] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 51247 - 0 [ 471.976991][ T9119] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.161790][ T5829] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 51247 - 0 [ 472.212437][ T5829] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 51247 - 0 [ 472.246632][ T9133] netlink: 'syz.0.869': attribute type 10 has an invalid length. [ 472.270269][ T5829] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 472.480675][ T9133] team0: Port device dummy0 added [ 472.741239][ T9089] Bluetooth: hci3: command 0x0406 tx timeout [ 472.748000][ T4948] Bluetooth: hci2: command 0x0406 tx timeout [ 472.755493][ T4948] Bluetooth: hci1: command 0x0406 tx timeout [ 472.757798][ T9089] Bluetooth: hci0: command 0x0406 tx timeout [ 473.151282][ T9156] netlink: 12 bytes leftover after parsing attributes in process `syz.3.871'. [ 473.453384][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 473.601447][ T9170] Illegal XDP return value 4294967274 on prog (id 170) dev N/A, expect packet loss! [ 473.659428][ T9173] netlink: 40 bytes leftover after parsing attributes in process `syz.0.876'. [ 474.201011][ T9168] can: request_module (can-proto-5) failed. [ 477.315883][ T9213] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 477.332517][ T5293] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 477.588923][ T9221] x_tables: duplicate underflow at hook 1 [ 477.749267][ T9225] netlink: 20 bytes leftover after parsing attributes in process `syz.0.889'. [ 477.764511][ T9226] netlink: 12 bytes leftover after parsing attributes in process `syz.2.891'. [ 478.032143][ T9233] netlink: 'syz.2.894': attribute type 11 has an invalid length. [ 478.061829][ T9233] netlink: 'syz.2.894': attribute type 11 has an invalid length. [ 478.093937][ T9233] netlink: 204 bytes leftover after parsing attributes in process `syz.2.894'. [ 478.130569][ T9233] netlink: 176 bytes leftover after parsing attributes in process `syz.2.894'. [ 478.168495][ T9233] netlink: 32 bytes leftover after parsing attributes in process `syz.2.894'. [ 478.584517][ T9250] netlink: 'syz.4.897': attribute type 11 has an invalid length. [ 478.889595][ T9255] netlink: 24 bytes leftover after parsing attributes in process `syz.3.899'. [ 479.068742][ T9259] netlink: 32 bytes leftover after parsing attributes in process `syz.3.899'. [ 479.106603][ T9261] netlink: 24 bytes leftover after parsing attributes in process `syz.4.900'. [ 479.510937][ T9273] netlink: 'syz.3.904': attribute type 3 has an invalid length. [ 479.741591][ T9288] netlink: 8 bytes leftover after parsing attributes in process `syz.4.907'. [ 479.812063][ T9288] netlink: 12 bytes leftover after parsing attributes in process `syz.4.907'. [ 479.881931][ T9289] netlink: 'syz.4.907': attribute type 1 has an invalid length. [ 479.981072][ T9288] bond5: (slave geneve3): making interface the new active one [ 480.003731][ T9288] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 480.019152][ T3262] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 480.106732][ T3262] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 480.154510][ T3262] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 480.185568][ T8464] IPVS: starting estimator thread 0... [ 480.201705][ T3262] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 480.290161][ T9302] IPVS: using max 29 ests per chain, 69600 per kthread [ 480.524245][ T9305] netlink: 'syz.1.911': attribute type 27 has an invalid length. [ 480.984748][ T9318] netlink: 'syz.0.915': attribute type 61 has an invalid length. [ 480.996764][ T9315] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 481.073090][ T9315] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 481.149121][ T9315] gretap1: entered promiscuous mode [ 481.185825][ T9315] gretap1: entered allmulticast mode [ 481.511549][ T9327] 8021q: adding VLAN 0 to HW filter on device bond7 [ 481.533179][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 481.573520][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880583cec00: rx timeout, send abort [ 481.819569][ T9347] netlink: 'syz.0.923': attribute type 3 has an invalid length. [ 482.962150][ T9381] __nla_validate_parse: 6 callbacks suppressed [ 482.962171][ T9381] netlink: 64 bytes leftover after parsing attributes in process `syz.0.936'. [ 483.065138][ T9383] netlink: 4 bytes leftover after parsing attributes in process `syz.4.937'. [ 483.901585][ T9408] tipc: Failed to remove unknown binding: 66,0,0/0:2953057776/2953057777 [ 483.948396][ T9408] tipc: Failed to remove unknown binding: 66,0,0/0:2953057776/2953057777 [ 484.058861][ T9409] netlink: 'syz.1.943': attribute type 10 has an invalid length. [ 484.150466][ T9413] netlink: 'syz.3.944': attribute type 1 has an invalid length. [ 484.177204][ T9409] 8021q: adding VLAN 0 to HW filter on device team0 [ 484.214327][ T9409] bond0: (slave team0): Enslaving as an active interface with an up link [ 484.301073][ T9418] netlink: 40 bytes leftover after parsing attributes in process `syz.2.946'. [ 484.390779][ T9413] 8021q: adding VLAN 0 to HW filter on device bond8 [ 484.444542][ T9429] netlink: 'syz.4.947': attribute type 32 has an invalid length. [ 484.485897][ T9429] netlink: 8 bytes leftover after parsing attributes in process `syz.4.947'. [ 484.553809][ T9431] netlink: 28 bytes leftover after parsing attributes in process `syz.4.947'. [ 484.592194][ T9433] netlink: 20 bytes leftover after parsing attributes in process `syz.1.948'. [ 484.602544][ T9431] netlink: 28 bytes leftover after parsing attributes in process `syz.4.947'. [ 484.728057][ T9429] bond6: option coupled_control: invalid value (192) [ 484.785236][ T9429] bond6 (unregistering): Released all slaves [ 484.858703][ T9440] netlink: 16 bytes leftover after parsing attributes in process `syz.3.951'. [ 484.908578][ T9442] netlink: 'syz.1.952': attribute type 10 has an invalid length. [ 484.959803][ T9443] ipt_rpfilter: unknown options [ 484.969141][ T9437] veth0_macvtap: entered allmulticast mode [ 485.026351][ T9437] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 485.101178][ T9442] veth1_macvtap: left promiscuous mode [ 485.173865][ T9442] bond0: (slave macsec0): Error -34 calling dev_set_mtu [ 485.221942][ T9443] netlink: 'syz.1.952': attribute type 12 has an invalid length. [ 485.285708][ T9443] netlink: 132 bytes leftover after parsing attributes in process `syz.1.952'. [ 486.800764][ T9487] syzkaller1: entered promiscuous mode [ 486.828413][ T9487] syzkaller1: entered allmulticast mode [ 486.879329][ T9489] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 487.092455][ T9497] netlink: 64 bytes leftover after parsing attributes in process `syz.3.969'. [ 487.314369][ T9503] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 487.711107][ T9524] tipc: Started in network mode [ 487.721015][ T9524] tipc: Node identity 0200000000000000010001, cluster identity 4711 [ 487.733977][ T9524] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 487.745152][ T9525] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 488.801917][ T9546] syzkaller0: entered promiscuous mode [ 488.851570][ T9546] syzkaller0: entered allmulticast mode [ 488.983162][ T9550] netdevsim netdevsim3 : renamed from netdevsim0 (while UP) [ 489.125152][ T9562] __nla_validate_parse: 5 callbacks suppressed [ 489.125313][ T9562] netlink: 4 bytes leftover after parsing attributes in process `syz.2.986'. [ 489.409676][ T9568] openvswitch: netlink: Multiple metadata blocks provided [ 489.550724][ T9558] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 489.937823][ T5829] bond0: (slave team0): interface is now down [ 489.970213][ T5829] bond0: now running without any active interface! [ 490.125802][ T9577] bridge5: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 490.430227][ T9585] netlink: 12 bytes leftover after parsing attributes in process `syz.0.996'. [ 490.630430][ T9591] netlink: 16 bytes leftover after parsing attributes in process `syz.3.997'. [ 490.780444][ T9594] netlink: 20 bytes leftover after parsing attributes in process `syz.4.998'. [ 490.799366][ T9596] netlink: 4 bytes leftover after parsing attributes in process `syz.0.999'. [ 491.118622][ T9601] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1003'. [ 491.214017][ T9601] xfrm1: entered promiscuous mode [ 491.265086][ T9601] xfrm1: entered allmulticast mode [ 491.677725][ T9614] bond3: Removing last ns target with arp_interval on [ 491.697067][ T9625] netlink: 284 bytes leftover after parsing attributes in process `syz.4.1006'. [ 491.716297][ T9625] openvswitch: netlink: EtherType 0 is less than min 600 [ 492.271199][ T9642] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1014'. [ 492.635204][ T9647] bridge0: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 492.689635][ T9647] netlink: 'syz.0.1015': attribute type 1 has an invalid length. [ 492.786299][ T9660] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1015'. [ 493.237384][ T9647] 8021q: adding VLAN 0 to HW filter on device bond4 [ 493.759657][ T9682] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1022'. [ 493.796910][ T9682] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 494.249829][ T9699] __nla_validate_parse: 3 callbacks suppressed [ 494.249863][ T9699] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1028'. [ 494.400485][ T9709] netlink: 'syz.1.1029': attribute type 32 has an invalid length. [ 494.424595][ T9707] syzkaller0: entered promiscuous mode [ 494.462409][ T9707] syzkaller0: entered allmulticast mode [ 494.556142][ T9699] af_packet: tpacket_rcv: packet too big, clamped from 48 to 4294967272. macoff=96 [ 495.747994][ T9735] IPVS: Unknown mcast interface: ip6erspan0 [ 495.763587][ T9737] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1037'. [ 495.818205][ T9737] netlink: 'syz.4.1037': attribute type 5 has an invalid length. [ 495.855045][ T9737] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1037'. [ 496.224163][ T9746] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1040'. [ 496.252077][ T9746] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1040'. [ 496.470586][ T9752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1042'. [ 496.760937][ T9763] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 496.865119][ T9755] bond6: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 496.947272][ T9755] bond6 (unregistering): Released all slaves [ 497.127047][ T9774] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1046'. [ 497.148970][ T9774] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1046'. [ 497.235088][ T9775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 497.301506][ T9778] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 497.532990][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 498.991507][ T9816] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1059'. [ 499.408124][ T9821] sctp: [Deprecated]: syz.0.1060 (pid 9821) Use of int in maxseg socket option. [ 499.408124][ T9821] Use struct sctp_assoc_value instead [ 499.484568][ T9808] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1057'. [ 499.602162][ T9819] sctp: [Deprecated]: syz.0.1060 (pid 9819) Use of struct sctp_assoc_value in delayed_ack socket option. [ 499.602162][ T9819] Use struct sctp_sack_info instead [ 500.016395][ T9833] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1062'. [ 500.388856][ T9842] syzkaller0: entered promiscuous mode [ 500.457642][ T9842] syzkaller0: entered allmulticast mode [ 501.084945][ T9857] IPVS: ip_vs_edit_dest(): server weight less than zero [ 501.383113][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.717198][ T9873] netlink: 9 bytes leftover after parsing attributes in process `syz.3.1072'. [ 501.728177][ T9873] netlink: 9 bytes leftover after parsing attributes in process `syz.3.1072'. [ 501.921485][ T9878] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 503.480134][ T9896] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1076'. [ 503.502404][ T9851] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 503.530157][ T9896] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1076'. [ 504.279351][ T9914] xt_hashlimit: size too large, truncated to 1048576 [ 504.456429][ T9918] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1084'. [ 505.008084][ T9932] mac80211_hwsim hwsim7 wlan1: Caught tx_queue_len zero misconfig [ 505.064936][ T9937] netlink: 'syz.0.1092': attribute type 1 has an invalid length. [ 505.477827][ T9937] 8021q: adding VLAN 0 to HW filter on device bond5 [ 505.510410][ T9940] netdevsim netdevsim4: Direct firmware load for . failed with error -2 [ 505.523757][ T9940] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 505.861611][ T9961] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 505.905291][ T9962] IPVS: set_ctl: invalid protocol: 137 10.1.1.2:20001 [ 505.970844][ T9962] IPVS: set_ctl: invalid protocol: 103 172.20.20.170:20004 [ 506.107788][ T9970] hsr0: entered allmulticast mode [ 506.171117][ T9970] hsr_slave_0: entered allmulticast mode [ 506.241058][ T9970] hsr_slave_1: entered allmulticast mode [ 506.273073][ T9973] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 506.283434][ T9973] IPv6: NLM_F_CREATE should be set when creating new route [ 506.291751][ T9973] IPv6: NLM_F_CREATE should be set when creating new route [ 506.299962][ T9973] IPv6: NLM_F_CREATE should be set when creating new route [ 506.402024][ T9975] bridge_slave_0 (unregistering): left allmulticast mode [ 506.419364][ T9961] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 506.448758][ T9975] bridge_slave_0 (unregistering): left promiscuous mode [ 506.488021][ T9975] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.915764][ T9980] tipc: Started in network mode [ 506.955313][ T9980] tipc: Node identity de62f7867698, cluster identity 4711 [ 506.983433][ T9980] tipc: Enabled bearer , priority 0 [ 507.270148][ T9983] syzkaller0: entered promiscuous mode [ 507.317545][ T9983] syzkaller0: entered allmulticast mode [ 507.352152][ T9983] tipc: Resetting bearer [ 507.390843][T10004] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1108'. [ 507.467436][ T9978] tipc: Resetting bearer [ 507.940368][T10022] netlink: 'syz.1.1110': attribute type 11 has an invalid length. [ 510.162094][ T9978] tipc: Disabling bearer [ 510.191090][T10012] bond0: (slave bond_slave_1): Releasing backup interface [ 510.330805][ T8463] tipc: Node number set to 2835019654 [ 510.498567][T10027] netlink: 'syz.0.1113': attribute type 1 has an invalid length. [ 510.811056][T10036] netlink: 'syz.4.1114': attribute type 13 has an invalid length. [ 510.858205][T10036] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1114'. [ 510.976690][ T3262] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 510.986343][T10036] netlink: 'syz.4.1114': attribute type 13 has an invalid length. [ 511.040487][ T3262] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 511.051295][T10036] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1114'. [ 511.100642][ T3262] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 511.134648][T10040] ipt_ECN: cannot use operation on non-tcp rule [ 511.178368][ T3262] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 511.396766][T10046] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1117'. [ 511.448862][T10046] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1117'. [ 511.626474][T10054] netlink: 'syz.1.1122': attribute type 1 has an invalid length. [ 511.666939][T10054] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1122'. [ 512.066590][T10060] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1123'. [ 512.267794][T10068] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1125'. [ 512.540249][T10084] team0: Device xfrm0 is of different type [ 512.926432][T10094] blkio.reset_stats is deprecated [ 513.042806][T10095] netlink: 'syz.3.1132': attribute type 2 has an invalid length. [ 513.115507][T10095] netlink: 'syz.3.1132': attribute type 2 has an invalid length. [ 513.186413][T10097] netlink: 'syz.3.1132': attribute type 2 has an invalid length. [ 513.222122][T10097] netlink: 'syz.3.1132': attribute type 2 has an invalid length. [ 513.649641][T10115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1140'. [ 513.678698][T10119] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1140'. [ 513.727350][T10112] netem: change failed [ 513.751758][T10120] netlink: 'syz.2.1139': attribute type 1 has an invalid length. [ 514.076471][T10120] bond2: entered promiscuous mode [ 514.116424][T10135] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1141'. [ 514.125874][T10120] 8021q: adding VLAN 0 to HW filter on device bond2 [ 514.779166][T10145] netlink: 'syz.1.1145': attribute type 2 has an invalid length. [ 514.887255][T10146] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1144'. [ 514.944968][T10146] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 514.996963][T10146] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1144'. [ 515.007375][T10153] sctp: [Deprecated]: syz.3.1146 (pid 10153) Use of int in max_burst socket option. [ 515.007375][T10153] Use struct sctp_assoc_value instead [ 516.025901][T10181] xt_socket: unknown flags 0x50 [ 516.299118][T10189] openvswitch: netlink: IP tunnel dst address not specified [ 516.404192][T10189] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1156'. [ 516.722286][T10211] Cannot find add_set index 2 as target [ 517.909887][T10237] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1167'. [ 518.109165][T10246] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1169'. [ 518.148960][T10243] validate_nla: 1 callbacks suppressed [ 518.149061][T10243] netlink: 'syz.2.1168': attribute type 268 has an invalid length. [ 518.664426][T10260] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1174'. [ 518.755960][T10260] unsupported nla_type 7424 [ 519.052305][ T8462] IPVS: starting estimator thread 0... [ 519.163367][T10276] IPVS: using max 26 ests per chain, 62400 per kthread [ 520.230446][T10316] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1190'. [ 520.256744][T10315] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1190'. [ 520.834263][T10330] tap0: tun_chr_ioctl cmd 1074025672 [ 520.848566][T10330] tap0: ignored: set checksum disabled [ 520.873747][T10335] netlink: 'syz.0.1196': attribute type 11 has an invalid length. [ 521.201009][T10343] netlink: 'syz.1.1199': attribute type 1 has an invalid length. [ 521.231730][T10341] syzkaller0: entered promiscuous mode [ 521.261847][T10341] syzkaller0: entered allmulticast mode [ 521.334743][T10343] bond6: entered promiscuous mode [ 521.354225][T10343] 8021q: adding VLAN 0 to HW filter on device bond6 [ 521.679606][T10343] bond6: (slave bridge1): making interface the new active one [ 521.710924][T10343] bridge1: entered promiscuous mode [ 521.737343][T10343] bond6: (slave bridge1): Enslaving as an active interface with an up link [ 521.991135][T10367] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 522.020544][T10371] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 522.037991][T10371] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 522.459317][T10387] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1210'. [ 522.498521][T10387] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1210'. [ 522.567583][T10390] netlink: 'syz.1.1211': attribute type 10 has an invalid length. [ 522.918584][T10401] ipt_ECN: cannot use operation on non-tcp rule [ 523.226982][T10415] netlink: 'syz.2.1217': attribute type 1 has an invalid length. [ 523.268008][T10415] netlink: 'syz.2.1217': attribute type 3 has an invalid length. [ 523.290104][T10415] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1217'. [ 523.972553][T10438] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1220'. [ 524.080944][T10443] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1220'. [ 524.115958][T10445] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1223'. [ 524.569051][T10456] syzkaller0: entered promiscuous mode [ 524.598325][T10456] syzkaller0: entered allmulticast mode [ 524.676414][T10458] ipvlan2: entered promiscuous mode [ 525.016465][T10466] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1228'. [ 525.091410][T10466] netlink: 'syz.0.1228': attribute type 1 has an invalid length. [ 525.106975][T10470] netlink: 'syz.1.1227': attribute type 1 has an invalid length. [ 525.131101][T10470] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1227'. [ 525.143317][T10466] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 525.232093][T10474] x_tables: duplicate underflow at hook 1 [ 525.755066][T10492] netlink: 'syz.3.1235': attribute type 2 has an invalid length. [ 525.804738][T10492] netlink: 'syz.3.1235': attribute type 2 has an invalid length. [ 526.039882][ T9517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.057999][ T6568] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.080665][ T8464] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.097452][ T5856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.314512][T10512] netlink: 108 bytes leftover after parsing attributes in process `syz.3.1240'. [ 527.136130][ T9517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.339946][T10528] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1244'. [ 527.434794][T10531] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 527.442137][T10531] IPv6: NLM_F_CREATE should be set when creating new route [ 527.449427][T10531] IPv6: NLM_F_CREATE should be set when creating new route [ 527.459742][ T8464] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.469498][T10531] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 527.616043][ T5691] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.627129][ T8464] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.640343][ T8462] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 528.173236][ T5856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 528.736567][T10493] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 528.998414][T10536] syzkaller0: entered promiscuous mode [ 529.006083][T10536] syzkaller0: entered allmulticast mode [ 529.029906][T10537] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1246'. [ 529.224662][ T9517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 529.614329][T10553] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1254'. [ 529.825230][T10562] bridge3: entered allmulticast mode [ 530.175510][ T5696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.204101][ T8462] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.217413][ T8464] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.234074][T10591] netlink: 'syz.3.1256': attribute type 21 has an invalid length. [ 530.411555][T10595] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.1261'. [ 530.437860][T10595] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1261'. [ 530.703952][T10598] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1262'. [ 530.813099][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 531.066079][T10606] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1264'. [ 531.119040][T10607] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1264'. [ 531.594055][T10612] netlink: 'syz.2.1266': attribute type 39 has an invalid length. [ 532.496209][ T5856] net_ratelimit: 5 callbacks suppressed [ 532.496226][ T5856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.305625][ T8464] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.535380][ T5856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.565032][T10591] bond9: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 533.582028][T10591] bond9 (unregistering): Released all slaves [ 533.867744][T10612] hsr_slave_0: left promiscuous mode [ 533.878613][T10612] hsr_slave_1: left promiscuous mode [ 533.925794][T10622] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1269'. [ 534.131825][T10624] netlink: 'syz.0.1270': attribute type 10 has an invalid length. [ 534.221092][T10624] team0: Port device dummy0 removed [ 534.271746][T10624] : (slave dummy0): Enslaving as an active interface with an up link [ 534.418810][T10636] veth1_macvtap: entered promiscuous mode [ 534.471823][T10636] macsec0: entered promiscuous mode [ 534.549225][T10636] veth1_macvtap: left promiscuous mode [ 534.576428][ T5856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.085795][T10660] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1281'. [ 535.095054][T10660] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1281'. [ 535.335799][T10665] : (slave dummy0): Releasing backup interface [ 535.406418][T10665] : (slave bond_slave_0): Releasing backup interface [ 535.465641][T10665] : (slave bond_slave_1): Releasing backup interface [ 535.540463][T10665] team0: Port device team_slave_0 removed [ 535.657875][T10665] team0: Port device team_slave_1 removed [ 535.660658][T10680] netlink: 'syz.4.1287': attribute type 1 has an invalid length. [ 535.682639][ T9517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.765191][T10665] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 535.821720][T10665] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 535.901274][T10668] team0: Port device xfrm0 added [ 535.943953][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.954652][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.966460][ T6568] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 535.978971][ T9517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.026875][T10689] netlink: 'syz.4.1290': attribute type 1 has an invalid length. [ 536.062829][T10689] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1290'. [ 536.113593][T10689] netlink: 'syz.4.1290': attribute type 1 has an invalid length. [ 536.363874][T10696] syzkaller0: entered promiscuous mode [ 536.383716][T10696] syzkaller0: entered allmulticast mode [ 536.721153][T10707] syzkaller0: entered promiscuous mode [ 536.748326][T10707] syzkaller0: entered allmulticast mode [ 536.873631][T10708] netlink: 512 bytes leftover after parsing attributes in process `syz.2.1296'. [ 537.047437][T10713] netlink: 240 bytes leftover after parsing attributes in process `syz.3.1297'. [ 537.138390][T10719] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1298'. [ 537.551812][T10726] netlink: 14560 bytes leftover after parsing attributes in process `syz.3.1300'. [ 537.804341][T10731] bridge0: port 2(bridge_slave_1) entered blocking state [ 537.811612][T10731] bridge0: port 2(bridge_slave_1) entered listening state [ 537.822460][ T5856] net_ratelimit: 3 callbacks suppressed [ 537.822479][ T5856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.019870][T10740] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1304'. [ 538.079968][T10731] macvlan0: left promiscuous mode [ 538.126636][T10731] veth1_macvtap: entered promiscuous mode [ 538.157295][T10731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 538.175386][T10746] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1306'. [ 538.260466][T10731] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 538.861633][T10761] xt_TPROXY: Can be used only with -p tcp or -p udp [ 538.944212][ T9517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.054301][ T8462] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.134366][T10768] openvswitch: netlink: Multiple metadata blocks provided [ 539.307859][T10770] ipvlan2: entered allmulticast mode [ 539.358200][T10770] batadv_slave_1: entered allmulticast mode [ 539.436991][T10770] batman_adv: batadv0: Adding interface: ipvlan2 [ 539.458520][T10770] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 539.533854][T10770] batman_adv: batadv0: Interface activated: ipvlan2 [ 539.776380][T10777] vlan2: entered promiscuous mode [ 539.789968][T10777] geneve1: entered promiscuous mode [ 539.815794][T10777] vlan2: entered allmulticast mode [ 539.833890][T10777] geneve1: entered allmulticast mode [ 539.962450][T10796] netlink: 'syz.3.1319': attribute type 5 has an invalid length. [ 540.059038][ T5856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 540.109537][T10804] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1320'. [ 540.364966][T10810] syzkaller0: entered promiscuous mode [ 540.395463][T10810] syzkaller0: entered allmulticast mode [ 540.529532][T10818] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1321'. [ 540.585151][T10810] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1322'. [ 540.609781][T10825] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1325'. [ 540.641976][T10822] netlink: 'syz.0.1324': attribute type 10 has an invalid length. [ 541.079754][T10831] netlink: 'syz.4.1327': attribute type 1 has an invalid length. [ 541.123083][T10831] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1327'. [ 541.156701][ T5855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 541.180760][T10835] netlink: 'syz.4.1327': attribute type 1 has an invalid length. [ 541.199109][T10835] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1327'. [ 541.234005][T10838] netlink: 'syz.0.1328': attribute type 5 has an invalid length. [ 541.262533][T10838] netlink: 140 bytes leftover after parsing attributes in process `syz.0.1328'. [ 541.388080][T10841] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1329'. [ 541.505321][T10847] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1331'. [ 542.027545][T10860] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1334'. [ 542.357854][T10869] block nbd4: not configured, cannot reconfigure [ 542.388463][T10868] block nbd4: not configured, cannot reconfigure [ 543.301236][T10903] netlink: 'syz.4.1346': attribute type 10 has an invalid length. [ 543.410236][T10905] netlink: 'syz.1.1347': attribute type 1 has an invalid length. [ 543.521170][T10905] 8021q: adding VLAN 0 to HW filter on device bond7 [ 545.081845][T10933] netlink: 'syz.3.1352': attribute type 2 has an invalid length. [ 545.118801][T10934] bridge: RTM_NEWNEIGH with invalid ether address [ 545.159659][T10934] __nla_validate_parse: 6 callbacks suppressed [ 545.159679][T10934] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1353'. [ 545.255979][T10934] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1353'. [ 545.448003][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 545.617655][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 545.702568][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 545.761737][T10954] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1357'. [ 545.798617][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 545.855689][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 545.915759][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 545.961098][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1356'. [ 546.357938][T10958] veth0: mtu less than device minimum [ 546.680679][T10966] bond7: option all_slaves_active: invalid value (222) [ 546.759385][T10966] bond7 (unregistering): Released all slaves [ 547.009111][T10978] bridge7: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 549.220707][T11039] netlink: 'syz.1.1372': attribute type 29 has an invalid length. [ 549.549623][T11050] syz.0.1376: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 549.632570][T11050] CPU: 1 UID: 0 PID: 11050 Comm: syz.0.1376 Not tainted syzkaller #0 PREEMPT(full) [ 549.632601][T11050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 549.632614][T11050] Call Trace: [ 549.632623][T11050] [ 549.632634][T11050] dump_stack_lvl+0xe8/0x150 [ 549.632669][T11050] warn_alloc+0x249/0x340 [ 549.632705][T11050] ? __pfx_stack_trace_save+0x10/0x10 [ 549.632783][T11050] ? __pfx_warn_alloc+0x10/0x10 [ 549.632823][T11050] ? __kasan_kmalloc+0x93/0xb0 [ 549.632856][T11050] ? __kmalloc_cache_noprof+0x318/0x660 [ 549.632887][T11050] ? xskq_create+0x56/0x170 [ 549.632920][T11050] ? xsk_init_queue+0x8a/0xe0 [ 549.632947][T11050] ? xsk_setsockopt+0x52a/0x960 [ 549.632974][T11050] ? do_sock_setsockopt+0x17c/0x1b0 [ 549.633007][T11050] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 549.633040][T11050] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.633073][T11050] __vmalloc_node_range_noprof+0x12c/0x1730 [ 549.633139][T11050] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 549.633179][T11050] ? __kasan_kmalloc+0x93/0xb0 [ 549.633219][T11050] vmalloc_user_noprof+0xad/0xe0 [ 549.633251][T11050] ? xskq_create+0xbf/0x170 [ 549.633284][T11050] xskq_create+0xbf/0x170 [ 549.633319][T11050] xsk_init_queue+0x8a/0xe0 [ 549.633352][T11050] xsk_setsockopt+0x52a/0x960 [ 549.633384][T11050] ? __pfx_xsk_setsockopt+0x10/0x10 [ 549.633415][T11050] ? __pfx_aa_sk_perm+0x10/0x10 [ 549.633454][T11050] ? aa_sock_opt_perm+0xff/0x1a0 [ 549.633491][T11050] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 549.633523][T11050] ? __pfx_xsk_setsockopt+0x10/0x10 [ 549.633554][T11050] do_sock_setsockopt+0x17c/0x1b0 [ 549.633594][T11050] __x64_sys_setsockopt+0x13d/0x1b0 [ 549.633629][T11050] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.633654][T11050] do_syscall_64+0x174/0x580 [ 549.633679][T11050] ? clear_bhb_loop+0x40/0x90 [ 549.633708][T11050] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.633739][T11050] RIP: 0033:0x7f987139ce59 [ 549.633761][T11050] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 549.633789][T11050] RSP: 002b:00007f987233b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 549.633813][T11050] RAX: ffffffffffffffda RBX: 00007f9871615fa0 RCX: 00007f987139ce59 [ 549.633830][T11050] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 549.633843][T11050] RBP: 00007f9871432d6f R08: 0000000000000004 R09: 0000000000000000 [ 549.633857][T11050] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 549.633871][T11050] R13: 00007f9871616038 R14: 00007f9871615fa0 R15: 00007ffe97b65b48 [ 549.633907][T11050] [ 549.968223][T11050] Mem-Info: [ 549.972394][T11050] active_anon:8523 inactive_anon:0 isolated_anon:0 [ 549.972394][T11050] active_file:2826 inactive_file:40030 isolated_file:0 [ 549.972394][T11050] unevictable:768 dirty:53 writeback:0 [ 549.972394][T11050] slab_reclaimable:10596 slab_unreclaimable:98884 [ 549.972394][T11050] mapped:32217 shmem:4152 pagetables:3530 [ 549.972394][T11050] sec_pagetables:0 bounce:0 [ 549.972394][T11050] kernel_misc_reclaimable:0 [ 549.972394][T11050] free:1324015 free_pcp:8108 free_cma:0 [ 550.043704][T11059] netlink: 'syz.2.1378': attribute type 12 has an invalid length. [ 550.091606][T11050] Node 0 active_anon:34092kB inactive_anon:0kB active_file:11304kB inactive_file:159920kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:128868kB dirty:212kB writeback:0kB shmem:15072kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13648kB pagetables:14048kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 550.126336][T11050] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 550.178211][T11050] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 550.208119][T11050] lowmem_reserve[]: 0 2493 2494 2494 2494 [ 550.213951][T11050] Node 0 DMA32 free:1342640kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:34092kB inactive_anon:0kB active_file:11304kB inactive_file:159920kB unevictable:1536kB writepending:212kB zspages:0kB present:3129332kB managed:2553212kB mlocked:0kB bounce:0kB free_pcp:32604kB local_pcp:21184kB free_cma:0kB [ 550.247380][T11050] lowmem_reserve[]: 0 0 0 0 0 [ 550.252150][T11050] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:692kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 550.353778][T11050] lowmem_reserve[]: 0 0 0 0 0 [ 550.375876][T11050] Node 1 Normal free:3938360kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 550.497066][T11050] lowmem_reserve[]: 0 0 0 0 0 [ 550.512075][T11050] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 550.605161][T11050] Node 0 DMA32: 4422*4kB (UM) 3193*8kB (UME) 1373*16kB (UM) 256*32kB (UME) 667*64kB (UME) 600*128kB (UE) 451*256kB (UME) 348*512kB (UME) 192*1024kB (UM) 36*2048kB (UM) 143*4096kB (UM) = 1342576kB [ 550.682430][T11050] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 550.730998][T11050] Node 1 Normal: 0*4kB 3*8kB (UM) 12*16kB (UM) 5*32kB (UM) 9*64kB (UM) 7*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 960*4096kB (M) = 3938360kB [ 550.824300][T11050] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 550.833931][T11050] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 550.843315][T11050] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 550.852906][T11050] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 551.013833][T11085] netlink: 'syz.2.1383': attribute type 142 has an invalid length. [ 551.048881][T11050] 44207 total pagecache pages [ 551.053636][T11050] 0 pages in swap cache [ 551.064996][T11050] Free swap = 124996kB [ 551.069208][T11050] Total swap = 124996kB [ 551.073405][T11050] 2097051 pages RAM [ 551.112537][T11091] __nla_validate_parse: 41 callbacks suppressed [ 551.112560][T11091] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1384'. [ 551.152978][T11050] 0 pages HighMem/MovableOnly [ 551.157722][T11050] 426960 pages reserved [ 551.161908][T11050] 0 pages cma reserved [ 551.292936][T11102] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 551.674623][T11116] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1388'. [ 551.693871][T11116] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1388'. [ 552.075762][T11136] netlink: 'syz.2.1395': attribute type 4 has an invalid length. [ 552.538083][T11151] netlink: 208240 bytes leftover after parsing attributes in process `syz.4.1400'. [ 553.064523][T11172] syzkaller1: entered promiscuous mode [ 553.077319][T11172] syzkaller1: entered allmulticast mode [ 553.105119][T11172] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1403'. [ 553.609361][T11179] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 553.639339][T11179] xt_CT: You must specify a L4 protocol and not use inversions on it [ 554.042174][T11201] netlink: 'syz.2.1407': attribute type 1 has an invalid length. [ 554.156263][T11201] 8021q: adding VLAN 0 to HW filter on device bond3 [ 554.178760][T11204] netlink: 3648 bytes leftover after parsing attributes in process `syz.4.1412'. [ 554.187970][T11204] netlink: 3648 bytes leftover after parsing attributes in process `syz.4.1412'. [ 554.205481][T11210] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1414'. [ 554.372514][T11201] bond3: (slave geneve3): making interface the new active one [ 554.381693][T11201] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 554.656479][T11231] netlink: 'syz.0.1418': attribute type 39 has an invalid length. [ 554.774809][T11238] netlink: 'syz.2.1419': attribute type 4 has an invalid length. [ 555.118132][T11248] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1422'. [ 555.294266][T11248] netlink: 'syz.2.1422': attribute type 1 has an invalid length. [ 555.571359][T11273] ipip1: entered allmulticast mode [ 555.589836][T11279] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1432'. [ 556.357224][T11317] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1441'. [ 556.808196][T11334] workqueue: Failed to create a rescuer kthread for wq "nfc5_nci_cmd_wq": -EINTR [ 556.934729][T11354] sctp: [Deprecated]: syz.1.1448 (pid 11354) Use of struct sctp_assoc_value in delayed_ack socket option. [ 556.934729][T11354] Use struct sctp_sack_info instead [ 557.465495][T11376] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.1457'. [ 557.639639][T11385] netlink: 'syz.2.1459': attribute type 1 has an invalid length. [ 557.958004][T11385] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1459'. [ 557.983864][T11394] bond4: (slave geneve4): making interface the new active one [ 557.992550][T11394] bond4: (slave geneve4): Enslaving as an active interface with an up link [ 558.003975][ T5819] netdevsim netdevsim2 netdevsim0: set [1, 2] type 2 family 0 port 20000 - 0 [ 558.013173][ T5819] netdevsim netdevsim2 netdevsim1: set [1, 2] type 2 family 0 port 20000 - 0 [ 558.030130][T11385] 8021q: adding VLAN 0 to HW filter on device bond4 [ 558.121706][ T5819] netdevsim netdevsim2 netdevsim2: set [1, 2] type 2 family 0 port 20000 - 0 [ 558.212627][T11385] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1459'. [ 558.322534][T11406] tipc: Failed to remove unknown binding: 66,0,0/2886997162:157899976/157899977 [ 558.345310][T11406] tipc: Failed to remove unknown binding: 66,0,0/2886997162:157899976/157899977 [ 558.628063][T11418] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1467'. [ 558.663714][ T5682] Bluetooth: hci4: command 0x0405 tx timeout [ 558.803709][T11424] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1470'. [ 558.812738][T11424] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 558.900067][T11429] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1473'. [ 558.995639][T11435] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1474'. [ 559.473372][T11450] netlink: 'syz.3.1479': attribute type 1 has an invalid length. [ 559.588957][T11450] bond9: entered promiscuous mode [ 559.601688][T11450] 8021q: adding VLAN 0 to HW filter on device bond9 [ 559.667777][T11450] netlink: 108 bytes leftover after parsing attributes in process `syz.3.1479'. [ 559.802228][T11460] bond9: (slave bridge8): making interface the new active one [ 559.809790][T11460] bridge8: entered promiscuous mode [ 559.816574][T11460] bond9: (slave bridge8): Enslaving as an active interface with an up link [ 560.439780][T11466] syzkaller0: entered promiscuous mode [ 560.445319][T11466] syzkaller0: entered allmulticast mode [ 560.790141][T11483] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1488'. [ 560.856360][T11483] 8021q: adding VLAN 0 to HW filter on device bond5 [ 560.984878][T11483] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 561.368400][T11516] netlink: 'syz.3.1495': attribute type 2 has an invalid length. [ 561.376663][T11516] netlink: 'syz.3.1495': attribute type 2 has an invalid length. [ 561.442442][T11521] netlink: 'syz.1.1497': attribute type 11 has an invalid length. [ 561.565525][T11520] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 561.722471][T11525] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 562.247182][T11563] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1508'. [ 562.821787][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.841245][T11591] netlink: 'syz.1.1516': attribute type 5 has an invalid length. [ 562.873108][T11591] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1516'. [ 563.153965][T11593] C: renamed from lo (while UP) [ 563.221061][T11601] netlink: 'syz.1.1517': attribute type 89 has an invalid length. [ 563.231994][T11593] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 563.281768][T11606] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1521'. [ 563.297460][T11593] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 563.303573][T11606] 8021q: VLANs not supported on ip6_vti0 [ 563.324626][T11608] lo: entered promiscuous mode [ 563.331843][T11608] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 563.692832][T11625] netlink: 'syz.4.1528': attribute type 16 has an invalid length. [ 563.700756][T11625] netlink: 'syz.4.1528': attribute type 17 has an invalid length. [ 563.740740][T11625] erspan0: left allmulticast mode [ 563.821275][T11625] veth0_to_team: entered promiscuous mode [ 563.827990][T11625] bond1: left promiscuous mode [ 563.834942][T11625] 8021q: adding VLAN 0 to HW filter on device bond2 [ 563.857418][T11625] bond4: left promiscuous mode [ 563.862370][T11625] bridge3: left promiscuous mode [ 563.908167][T11625] vlan3: left allmulticast mode [ 563.913107][T11625] bond0: left allmulticast mode [ 563.925299][T11625] 8021q: adding VLAN 0 to HW filter on device bond5 [ 563.944204][T11625] ipip1: left allmulticast mode [ 564.114374][T11633] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.1529'. [ 564.300662][T11643] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1531'. [ 564.308716][T11641] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1531'. [ 564.558797][T11655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1535'. [ 565.818443][ T6568] wlan1: Trigger new scan to find an IBSS to join [ 566.428497][T11656] syzkaller0: entered promiscuous mode [ 566.434727][T11656] syzkaller0: entered allmulticast mode [ 566.463054][T11655] macvlan2: entered allmulticast mode [ 566.478847][T11655] dummy0: entered allmulticast mode [ 567.024958][T11688] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1542'. [ 567.145723][T11688] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1542'. [ 567.162863][T11688] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1542'. [ 567.184906][T11682] C: entered promiscuous mode [ 567.205052][T11682] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 567.458984][T11708] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 567.466447][T11708] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 567.768529][T11719] netlink: 14560 bytes leftover after parsing attributes in process `syz.0.1552'. [ 567.956038][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 567.981327][T11728] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1555'. [ 568.040876][T11728] netlink: 'syz.1.1555': attribute type 11 has an invalid length. [ 568.994221][T11764] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1567'. [ 569.179852][T11773] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 569.242025][T11775] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 569.255423][T11775] netlink: 'syz.0.1570': attribute type 6 has an invalid length. [ 569.426098][T11783] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1573'. [ 569.793822][ T6568] wlan1: Trigger new scan to find an IBSS to join [ 571.215337][ T5696] wlan1: Creating new IBSS network, BSSID 7a:21:86:7c:b3:3a [ 571.818743][T11756] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 572.188326][T11813] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1581'. [ 572.220012][T11813] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1581'. [ 572.816595][T11839] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1587'. [ 572.884128][T11802] bond6: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 572.908376][T11802] bond6 (unregistering): Released all slaves [ 573.035411][T11844] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 573.115498][T11844] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 573.140956][T11844] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 573.155679][T11844] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 573.235480][T11844] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 573.285709][T11850] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1591'. [ 573.308889][T11851] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1591'. [ 573.325122][T11852] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1590'. [ 573.334150][T11852] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1590'. [ 573.749043][T11883] xt_hashlimit: overflow, try lower: 3/0 [ 573.766289][T11882] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1595'. [ 573.833961][T11883] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1594'. [ 574.017537][T11895] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1601'. [ 574.167227][T11896] ipvlan2: entered allmulticast mode [ 574.172600][T11896] batadv_slave_1: entered allmulticast mode [ 574.270901][T11896] batman_adv: batadv0: Adding interface: ipvlan2 [ 574.277333][T11896] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.326734][T11896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 574.337216][T11896] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 574.347062][T11896] batman_adv: batadv0: Interface activated: ipvlan2 [ 574.475927][T11909] syzkaller1: entered promiscuous mode [ 574.506630][T11909] syzkaller1: entered allmulticast mode [ 574.581280][T11911] netlink: 'syz.2.1606': attribute type 7 has an invalid length. [ 574.683665][T11912] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1606'. [ 574.701231][T11914] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1608'. [ 574.732454][T11914] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 574.760854][T11914] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 574.777857][ T5704] smbdirect: ib_dev[syz1] removed [ 574.786842][T11914] bond0 (unregistering): Released all slaves [ 574.809525][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 574.818953][ T5788] infiniband syz1: ib_query_port failed (-19) [ 574.826671][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 574.839748][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 574.850409][T11916] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 574.866709][T11916] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 574.885671][T11916] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 574.911680][T11916] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 575.122490][T11923] IPv6: sit2: Disabled Multicast RS [ 575.228189][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 575.266612][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 575.309130][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 575.423301][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 575.506982][T11916] xfrm0 speed is unknown, defaulting to 1000 [ 575.947195][T11946] netlink: Unknown conntrack attr (type=2304, max=9) [ 576.391177][T11968] netlink: 'syz.2.1622': attribute type 17 has an invalid length. [ 576.435065][T11963] 8021q: adding VLAN 0 to HW filter on device bond6 [ 576.711898][T11963] 8021q: adding VLAN 0 to HW filter on device bond7 [ 576.725834][T11963] bond6: (slave bond7): Enslaving as an active interface with an up link [ 576.736448][T11974] xfrm0 speed is unknown, defaulting to 1000 [ 576.834823][T11990] bond6 (unregistering): (slave bond7): Releasing backup interface [ 576.862951][T11990] bond6 (unregistering): Released all slaves [ 576.985571][T12000] netlink: 'syz.3.1631': attribute type 3 has an invalid length. [ 577.389969][T12018] netlink: 'syz.1.1633': attribute type 4 has an invalid length. [ 577.596361][T12018] .`: renamed from bond0 (while UP) [ 577.768812][T12033] batadv0: entered promiscuous mode [ 577.778290][T12033] batadv0: left promiscuous mode [ 577.797611][T12038] netlink: 'syz.2.1640': attribute type 1 has an invalid length. [ 577.817806][T12038] __nla_validate_parse: 16 callbacks suppressed [ 577.817826][T12038] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1640'. [ 577.867253][T12038] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1640'. [ 577.880295][T12038] netlink: 'syz.2.1640': attribute type 1 has an invalid length. [ 577.898469][T12038] netlink: 'syz.2.1640': attribute type 8 has an invalid length. [ 577.919485][T12038] netlink: 606 bytes leftover after parsing attributes in process `syz.2.1640'. [ 578.089376][T12048] syzkaller0: entered promiscuous mode [ 578.095335][T12048] syzkaller0: entered allmulticast mode [ 579.221111][T12071] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1651'. [ 579.508007][T12079] netlink: 144 bytes leftover after parsing attributes in process `syz.0.1655'. [ 580.726586][T12130] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1671'. [ 580.801620][T12137] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1672'. [ 580.802770][T12130] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1671'. [ 580.810628][T12137] openvswitch: netlink: Flow key attr not present in new flow. [ 580.872606][T12139] ip6tnl2: entered promiscuous mode [ 580.887307][T12130] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1671'. [ 580.897661][T12145] netlink: 'syz.0.1671': attribute type 1 has an invalid length. [ 581.400458][T12170] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1681'. [ 582.263029][T12216] bond0 (unregistering): Released all slaves [ 582.708326][T12226] bond6: option fail_over_mac: invalid value (16) [ 582.740511][T12226] bond6 (unregistering): Released all slaves [ 582.873064][T12238] __nla_validate_parse: 2 callbacks suppressed [ 582.873086][T12238] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.1703'. [ 583.030722][T12245] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1705'. [ 583.054421][T12239] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1702'. [ 583.193758][T12253] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 583.200459][T12253] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 583.432115][T12267] netlink: 'syz.1.1710': attribute type 10 has an invalid length. [ 583.455096][T12259] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1709'. [ 583.634779][T12273] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1280 [ 583.663151][T12273] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1711'. [ 583.929622][T12282] bond6: option min_links: invalid value (18446744073709551614) [ 583.942875][T12282] bond6: option min_links: allowed values 0 - 2147483647 [ 583.973717][T12287] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 584.002335][T12282] bond6 (unregistering): Released all slaves [ 584.452180][T12306] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1720'. [ 584.566784][T12308] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 584.578047][T12306] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1720'. [ 584.772493][T12309] veth0_macvtap: Caught tx_queue_len zero misconfig [ 584.841132][T12325] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 585.203306][ T5685] Bluetooth: hci4: command 0x0405 tx timeout [ 585.242395][T12343] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1731'. [ 585.262307][T12343] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1731'. [ 585.452119][T12351] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1734'. [ 585.499425][T12354] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 585.922018][T12377] netlink: 'syz.3.1739': attribute type 10 has an invalid length. [ 585.969614][T12377] ipvlan0: entered allmulticast mode [ 586.034185][T12377] veth0_vlan: entered allmulticast mode [ 586.043688][T12377] team0: Device ipvlan0 failed to register rx_handler [ 586.114647][T12383] netlink: 'syz.2.1741': attribute type 1 has an invalid length. [ 586.378225][T12398] netlink: 'syz.0.1746': attribute type 10 has an invalid length. [ 586.410213][T12401] netlink: 'syz.4.1747': attribute type 8 has an invalid length. [ 586.412715][T12398] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 586.471675][T12398] batman_adv: batadv0: Removing interface: ipvlan2 [ 586.953660][T12420] veth0_to_bond: Caught tx_queue_len zero misconfig [ 587.123500][T12427] syzkaller0: entered promiscuous mode [ 587.151846][T12427] syzkaller0: entered allmulticast mode [ 587.214242][ T5685] Bluetooth: hci4: command 0x0405 tx timeout [ 587.392034][T12433] netlink: 'syz.0.1758': attribute type 4 has an invalid length. [ 587.856652][T12455] IPVS: set_ctl: invalid protocol: 145 127.0.0.1:20004 [ 587.948439][T12455] netdevsim netdevsim1: Direct firmware load for  failed with error -2 [ 587.977042][T12458] __nla_validate_parse: 5 callbacks suppressed [ 587.977074][T12458] netlink: 288 bytes leftover after parsing attributes in process `syz.4.1766'. [ 587.983052][T12455] netdevsim netdevsim1: Falling back to sysfs fallback for:  [ 588.288306][T12477] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1772'. [ 588.308410][T12477] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1772'. [ 588.326873][T12472] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1770'. [ 588.343708][T12477] netlink: 6 bytes leftover after parsing attributes in process `syz.0.1772'. [ 588.358005][T12472] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1770'. [ 588.384831][T12473] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1770'. [ 588.396498][T12477] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1772'. [ 588.405827][ T6568] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 588.429683][T12477] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1772'. [ 588.440670][ T6568] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 588.458020][T12477] netlink: 6 bytes leftover after parsing attributes in process `syz.0.1772'. [ 588.503853][ T6568] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 588.516577][ T6568] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 588.628619][T12484] xt_hashlimit: size too large, truncated to 1048576 [ 588.784376][T12490] openvswitch: netlink: IP tunnel dst address not specified [ 588.804078][T12487] team_slave_1: entered promiscuous mode [ 589.083384][T12498] syzkaller0: entered promiscuous mode [ 589.100770][T12498] syzkaller0: entered allmulticast mode [ 590.120243][T12548] netlink: 'syz.4.1791': attribute type 2 has an invalid length. [ 590.178738][T12550] netlink: 'syz.0.1793': attribute type 5 has an invalid length. [ 590.388803][T12553] bond7: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 590.403303][T12553] bond7 (unregistering): Released all slaves [ 590.617048][T12559] vxcan4: entered promiscuous mode [ 590.630325][T12559] vxcan4: entered allmulticast mode [ 590.789298][T12553] bond7: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 590.818767][T12553] bond7 (unregistering): Released all slaves [ 590.843898][T12578] ieee802154 phy1 wpan1: encryption failed: -22 [ 590.867521][T12561] syzkaller1: entered promiscuous mode [ 590.887337][T12561] syzkaller1: entered allmulticast mode [ 590.908548][T12558] syzkaller1: left promiscuous mode [ 590.914689][T12558] syzkaller1: left allmulticast mode [ 590.985513][T12553] bond7: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 591.000629][T12553] bond7 (unregistering): Released all slaves [ 591.156718][T12585] netlink: 'syz.3.1800': attribute type 21 has an invalid length. [ 591.385899][T12593] netem: incorrect ge model size [ 591.395516][T12593] netem: change failed [ 591.437389][T12592] netem: incorrect ge model size [ 591.454172][T12592] netem: change failed [ 591.516845][T12598] veth0: entered promiscuous mode [ 591.717181][T12607] openvswitch: netlink: IPv4 tun info is not correct [ 591.784516][T12607] bridge4: entered promiscuous mode [ 591.801107][T12607] bridge4: entered allmulticast mode [ 591.817314][T12618] block nbd0: not configured, cannot reconfigure [ 591.859075][T12594] veth0: left promiscuous mode [ 592.105160][T12625] netlink: 'syz.3.1807': attribute type 1 has an invalid length. [ 592.479498][T12636] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 592.542191][T12636] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 593.017405][T12653] gre2: entered promiscuous mode [ 593.059249][T12654] __nla_validate_parse: 6 callbacks suppressed [ 593.059271][T12654] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1816'. [ 593.403077][T12667] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1819'. [ 593.468246][T12668] x_tables: duplicate underflow at hook 3 [ 593.497174][T12667] openvswitch: netlink: Flow actions attr not present in new flow. [ 593.709767][T12676] ip6t_srh: unknown srh invflags 4000 [ 593.736958][T12678] netlink: 'syz.1.1822': attribute type 1 has an invalid length. [ 593.750704][T12678] netlink: 244 bytes leftover after parsing attributes in process `syz.1.1822'. [ 593.866463][T12682] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1822'. [ 594.477358][T12710] netlink: 'syz.4.1830': attribute type 3 has an invalid length. [ 594.514540][T12710] netlink: 3 bytes leftover after parsing attributes in process `syz.4.1830'. [ 594.941277][T12725] syzkaller0: entered promiscuous mode [ 594.969109][T12725] syzkaller0: entered allmulticast mode [ 595.036299][T12728] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 595.096743][T12733] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1837'. [ 595.239601][T12733] bond8: Invalid ad_actor_system MAC address. [ 595.246327][T12733] bond8: option ad_actor_system: invalid value (1) [ 595.260019][T12733] bond8 (unregistering): Released all slaves [ 595.277486][T12728] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1834'. [ 595.293995][T12728] openvswitch: netlink: Unknown nsh attribute 0 [ 595.467889][T12750] netlink: 'syz.4.1840': attribute type 3 has an invalid length. [ 595.697754][T12756] openvswitch: netlink: VXLAN extension 1 has unexpected len 16 expected 4 [ 595.900103][T12769] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1847'. [ 596.017846][T12771] netem: change failed [ 596.605970][T12789] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 596.853258][T12796] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1854'. [ 597.120661][T12800] netlink: 'syz.0.1855': attribute type 1 has an invalid length. [ 597.131424][T12800] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1855'. [ 597.140526][T12800] netlink: 'syz.0.1855': attribute type 10 has an invalid length. [ 598.013994][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 598.021329][ C0] bridge0: topology change detected, propagating [ 598.067906][T12739] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 598.391998][T12808] bridge5: entered promiscuous mode [ 598.403146][T12808] bridge5: entered allmulticast mode [ 598.652860][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 599.507124][T12877] __nla_validate_parse: 1 callbacks suppressed [ 599.507147][T12877] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1867'. [ 600.223963][T12905] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1878'. [ 600.249080][T12905] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1878'. [ 600.278740][T12905] syzkaller0: entered promiscuous mode [ 600.293454][T12905] syzkaller0: entered allmulticast mode [ 600.771884][T12914] tunl0: entered promiscuous mode [ 600.796304][T12914] netlink: 'syz.0.1880': attribute type 4 has an invalid length. [ 600.836957][T12914] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1880'. [ 601.764174][T12953] netlink: 'syz.1.1890': attribute type 9 has an invalid length. [ 601.945134][T12964] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1893'. [ 601.977385][T12964] netlink: 'syz.0.1893': attribute type 7 has an invalid length. [ 602.011675][T12964] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1893'. [ 602.167861][T12975] syz_tun: entered allmulticast mode [ 602.195287][T12973] syz_tun: left allmulticast mode [ 602.331533][T12983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1898'. [ 602.404212][T12985] tipc: Enabled bearer , priority 0 [ 602.425827][T12994] netlink: 'syz.4.1901': attribute type 1 has an invalid length. [ 602.441569][T12984] tipc: Enabling of bearer rejected, already enabled [ 602.455262][T12996] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.1900'. [ 602.487443][T12996] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 602.570655][T12994] 8021q: adding VLAN 0 to HW filter on device bond6 [ 602.642415][T12992] syzkaller0: entered promiscuous mode [ 602.648206][T12992] syzkaller0: entered allmulticast mode [ 602.655177][T12992] tipc: Resetting bearer [ 602.745701][T13007] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1903'. [ 602.772102][ T6567] tipc: Resetting bearer [ 602.793069][T13001] bond6: (slave geneve4): making interface the new active one [ 602.805945][T13001] bond6: (slave geneve4): Enslaving as an active interface with an up link [ 602.827520][T12980] tipc: Resetting bearer [ 604.923910][T12980] tipc: Disabling bearer [ 605.222427][T13022] IPv6: Can't replace route, no match found [ 605.239556][T13022] IPv6: Can't replace route, no match found [ 605.273937][T13022] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 605.290131][T13022] netlink: 'syz.3.1907': attribute type 1 has an invalid length. [ 605.343318][T13032] openvswitch: netlink: IP tunnel dst address not specified [ 605.361966][T13029] netlink: 1204 bytes leftover after parsing attributes in process `syz.0.1909'. [ 605.728461][T13047] netlink: 780 bytes leftover after parsing attributes in process `syz.1.1915'. [ 605.746696][T13050] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1916'. [ 605.769953][T13047] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 605.828930][T13052] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1917'. [ 605.973589][T13062] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1917'. [ 606.018011][T13064] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1921'. [ 606.055061][T13070] IPv6: NLM_F_CREATE should be specified when creating new route [ 606.225102][T13064] syzkaller1: entered promiscuous mode [ 606.265138][T13064] syzkaller1: entered allmulticast mode [ 606.464219][T13085] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1926'. [ 606.721533][T13093] tipc: MTU too low for tipc bearer [ 606.907214][T13107] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 607.201225][T13120] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1936'. [ 607.336149][T13128] openvswitch: netlink: IPv4 tunnel dst address is zero [ 607.359344][T13125] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 607.380567][T13125] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1938'. [ 607.398139][T13130] syzkaller1: entered promiscuous mode [ 607.411408][T13130] syzkaller1: entered allmulticast mode [ 607.539879][T13136] nft_compat: unsupported protocol 0 [ 607.539879][T13135] sctp: [Deprecated]: syz.2.1940 (pid 13135) Use of int in maxseg socket option. [ 607.539879][T13135] Use struct sctp_assoc_value instead [ 607.945818][T13158] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1946'. [ 610.218184][T13175] IPv6: sit3: Disabled Multicast RS [ 610.438623][T13187] __nla_validate_parse: 1 callbacks suppressed [ 610.438644][T13187] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1954'. [ 610.596964][T13195] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 610.795553][T13204] netlink: 108 bytes leftover after parsing attributes in process `syz.4.1957'. [ 610.946887][T13211] netlink: 'syz.2.1959': attribute type 11 has an invalid length. [ 610.989742][T13211] netlink: 180760 bytes leftover after parsing attributes in process `syz.2.1959'. [ 611.331229][T13243] netlink: 'syz.1.1964': attribute type 21 has an invalid length. [ 611.389057][T13243] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1964'. [ 611.558014][T13248] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1967'. [ 611.569820][T13247] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1968'. [ 611.755459][T13255] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1970'. [ 611.766750][T13255] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1970'. [ 611.844406][T13257] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1971'. [ 612.344730][T13273] netlink: 1580 bytes leftover after parsing attributes in process `syz.0.1975'. [ 614.222907][T13226] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 615.567656][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 615.578388][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 615.680323][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 615.746610][T13352] __nla_validate_parse: 2 callbacks suppressed [ 615.746631][T13352] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1998'. [ 615.901719][T13359] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2001'. [ 615.984877][T13360] syzkaller1: entered promiscuous mode [ 615.999943][T13360] syzkaller1: entered allmulticast mode [ 616.399741][T13386] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2009'. [ 616.410810][T13383] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2008'. [ 616.457307][ T8462] xfrm0 speed is unknown, defaulting to 1000 [ 616.465992][T13348] infiniband syz1: set down [ 616.483844][T13348] infiniband syz1: added xfrm0 [ 616.530189][T13348] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 616.537222][T13348] infiniband syz1: Couldn't open port 1 [ 616.552465][T13348] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 616.567825][T13348] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 616.588018][T13348] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 616.632748][T13348] RDS/IB: syz1: added [ 616.640929][T13348] smc: adding ib device syz1 with port count 1 [ 616.661786][T13386] 8021q: adding VLAN 0 to HW filter on device bond7 [ 616.672110][T13348] smc: ib device syz1 port 1 has no pnetid [ 616.688766][T13383] netlink: 'syz.0.2008': attribute type 1 has an invalid length. [ 616.702133][T13383] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2008'. [ 616.729303][ T8463] xfrm0 speed is unknown, defaulting to 1000 [ 616.740523][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 616.783656][T13396] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 616.811575][T13396] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 616.987194][T13403] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2013'. [ 617.174830][T13411] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 617.272381][T13417] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 617.338980][T13419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2016'. [ 617.416023][T13419] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 617.473478][T13419] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 617.499002][T13419] gretap1: entered promiscuous mode [ 617.525846][T13419] gretap1: entered allmulticast mode [ 617.558526][T13431] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2016'. [ 617.586310][T13431] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2016'. [ 617.622220][T13431] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2016'. [ 617.660061][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 617.825199][T13422] nbd0: detected capacity change from 0 to 63 [ 617.923803][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 617.948903][ T5682] block nbd0: Receive control failed (result -104) [ 617.955917][ T5674] block nbd0: Receive control failed (result -32) [ 618.093522][T13440] netlink: 'syz.1.2023': attribute type 3 has an invalid length. [ 618.307788][T13455] netlink: 'syz.4.2026': attribute type 1 has an invalid length. [ 618.341567][T13455] netlink: 'syz.4.2026': attribute type 2 has an invalid length. [ 618.843320][T13476] bond7 (unregistering): Released all slaves [ 618.875330][T13480] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 618.908979][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 619.143867][T12870] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 619.338382][T13499] xt_hashlimit: invalid rate [ 619.437887][ T5685] block nbd1: Receive control failed (result -1) [ 619.549303][T13348] xfrm0 speed is unknown, defaulting to 1000 [ 619.552385][T13517] netlink: 'syz.0.2042': attribute type 1 has an invalid length. [ 619.719337][T13523] netlink: 'syz.1.2044': attribute type 1 has an invalid length. [ 619.976821][T13527] bond8: (slave geneve3): making interface the new active one [ 620.024440][T13527] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 620.060029][T13531] bond8: entered promiscuous mode [ 620.093566][T13531] geneve3: entered promiscuous mode [ 620.109766][T13531] bond8: entered allmulticast mode [ 620.129765][T13531] geneve3: entered allmulticast mode [ 620.147561][T13531] 8021q: adding VLAN 0 to HW filter on device bond8 [ 620.166750][T12870] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 620.196742][T12870] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 620.241033][T13533] veth1_to_team: entered promiscuous mode [ 620.262183][T13533] gretap0: entered promiscuous mode [ 620.286003][T13533] hsr1: entered promiscuous mode [ 620.301204][T12870] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 620.332148][T12870] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 620.553690][T13543] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 620.692184][T13552] macsec0: entered promiscuous mode [ 620.720911][T13552] veth1_macvtap: left promiscuous mode [ 620.881750][T13552] macsec0 (unregistering): left promiscuous mode [ 620.966438][T13565] __nla_validate_parse: 11 callbacks suppressed [ 620.966461][T13565] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2049'. [ 621.413634][T13574] ip6erspan0: entered promiscuous mode [ 621.584190][T13581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2056'. [ 621.624667][T13581] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2056'. [ 621.883636][T13593] openvswitch: netlink: Missing key (keys=40, expected=100) [ 621.984901][T13602] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2061'. [ 622.115389][T12870] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.161373][T12870] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.185551][T13613] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2066'. [ 622.219715][T12870] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.266168][T13614] vlan5: entered allmulticast mode [ 622.271447][T13614] bond0: entered allmulticast mode [ 622.299034][T12870] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 622.340507][T13613] syzkaller0: entered promiscuous mode [ 622.367879][T13613] syzkaller0: entered allmulticast mode [ 622.718290][T13637] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2072'. [ 622.840443][T13644] netlink: 'syz.2.2075': attribute type 21 has an invalid length. [ 622.861791][T13637] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2072'. [ 622.869576][T13644] IPv6: NLM_F_CREATE should be specified when creating new route [ 622.884574][T13644] netlink: 'syz.2.2075': attribute type 1 has an invalid length. [ 623.071482][T13652] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2077'. [ 623.128395][T13652] 8021q: VLANs not supported on ip6tnl0 [ 623.157350][T13652] macvlan0: entered promiscuous mode [ 623.162286][T13659] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2078'. [ 623.279386][T13665] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2081'. [ 623.956895][T13704] IPVS: length: 239 != 24 [ 623.987695][T13704] sch_tbf: peakrate 8 is lower than or equals to rate 7508080445633888606 ! [ 624.261331][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.329046][T13721] netlink: 'syz.1.2097': attribute type 11 has an invalid length. [ 624.750864][T13736] xt_recent: Unsupported userspace flags (000000b1) [ 624.877216][ T30] audit: type=1107 audit(1781376092.948:5): pid=13737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='3l֍us k%.. !+$3R?дUmP+ '^ )qѺ"8HI_*3` %-0@' [ 625.020397][T13751] netlink: 'syz.1.2106': attribute type 5 has an invalid length. [ 625.200148][T13743] syzkaller0: entered promiscuous mode [ 625.225322][T13743] syzkaller0: entered allmulticast mode [ 629.532331][T13821] __nla_validate_parse: 8 callbacks suppressed [ 629.532351][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.577224][T13822] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2119'. [ 629.586920][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.609131][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.648031][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.691371][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.745498][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.782219][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.851770][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 629.909112][T13821] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2118'. [ 630.038875][T13834] nbd: illegal input index -8454144 [ 630.521631][T13856] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 631.788578][T13916] erspan0: entered promiscuous mode [ 631.848502][T13916] erspan0: entered allmulticast mode [ 632.217828][T13918] syzkaller0: entered promiscuous mode [ 632.226606][T13918] syzkaller0: entered allmulticast mode [ 632.244498][T13924] bridge0: port 1(ipvlan3) entered blocking state [ 632.251395][T13924] bridge0: port 1(ipvlan3) entered disabled state [ 632.263638][T13924] ipvlan3: entered allmulticast mode [ 632.269138][T13924] bridge0: entered allmulticast mode [ 632.280190][T13924] ipvlan3: left allmulticast mode [ 632.287896][T13924] bridge0: left allmulticast mode [ 632.850392][T13932] netlink: 'syz.3.2150': attribute type 21 has an invalid length. [ 633.065113][T13936] sctp: [Deprecated]: syz.2.2152 (pid 13936) Use of int in max_burst socket option. [ 633.065113][T13936] Use struct sctp_assoc_value instead [ 635.177656][T13950] netlink: 'syz.3.2154': attribute type 13 has an invalid length. [ 635.237695][T13950] veth1_macvtap: left promiscuous mode [ 635.260338][T13950] macsec0: entered allmulticast mode [ 635.289832][T13963] openvswitch: netlink: IP tunnel dst address not specified [ 635.334967][T13953] Cannot find add_set index 46338 as target [ 635.500056][T13971] openvswitch: netlink: Multiple metadata blocks provided [ 635.607698][T13973] __nla_validate_parse: 27 callbacks suppressed [ 635.607720][T13973] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2160'. [ 635.763865][T13981] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2163'. [ 635.798939][T13981] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2163'. [ 635.805396][T13978] netlink: 'syz.4.2161': attribute type 9 has an invalid length. [ 636.079294][T13993] [ 636.081694][T13993] ====================================================== [ 636.088778][T13993] WARNING: possible circular locking dependency detected [ 636.095953][T13993] syzkaller #0 Not tainted [ 636.100426][T13993] ------------------------------------------------------ [ 636.107529][T13993] syz.2.2167/13993 is trying to acquire lock: [ 636.113619][T13993] ffffffff8ea84d40 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x15b/0x650 [ 636.119023][T13995] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2166'. [ 636.122924][T13993] [ 636.122924][T13993] but task is already holding lock: [ 636.122936][T13993] ffff88803c4cf178 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 636.123002][T13993] [ 636.123002][T13993] which lock already depends on the new lock. [ 636.123002][T13993] [ 636.123011][T13993] [ 636.123011][T13993] the existing dependency chain (in reverse order) is: [ 636.123020][T13993] [ 636.123020][T13993] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 636.123150][T13993] __might_fault+0xcb/0x130 [ 636.181004][T13993] _copy_from_user+0x28/0xb0 [ 636.186224][T13993] csum_and_copy_from_iter_full+0x210/0x1fb0 [ 636.192816][T13993] ip_generic_getfrag+0x149/0x2d0 [ 636.198477][T13993] __ip6_append_data+0x3aef/0x4080 [ 636.204262][T13993] ip6_append_data+0x108/0x270 [ 636.209593][T13993] rawv6_sendmsg+0x1298/0x18c0 [ 636.214983][T13993] ____sys_sendmsg+0x853/0xa20 [ 636.220323][T13993] ___sys_sendmsg+0x2a5/0x360 [ 636.225584][T13993] __x64_sys_sendmsg+0x1bd/0x2a0 [ 636.231099][T13993] do_syscall_64+0x174/0x580 [ 636.236255][T13993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.239833][T13995] veth1_to_team: entered promiscuous mode [ 636.242698][T13993] [ 636.242698][T13993] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 636.242744][T13993] lock_sock_nested+0x41/0x100 [ 636.242846][T13993] inet_shutdown+0x6a/0x390 [ 636.266678][T13993] nbd_mark_nsock_dead+0x2cb/0x550 [ 636.272496][T13993] recv_work+0x1cef/0x1e10 [ 636.277464][T13993] process_scheduled_works+0xa8e/0x14e0 [ 636.283578][T13993] worker_thread+0xa47/0xfb0 [ 636.288710][T13993] kthread+0x389/0x470 [ 636.293320][T13993] ret_from_fork+0x514/0xb70 [ 636.298479][T13993] ret_from_fork_asm+0x1a/0x30 [ 636.303793][T13993] [ 636.303793][T13993] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 636.311464][T13993] __mutex_lock+0x19d/0x1590 [ 636.316599][T13993] nbd_queue_rq+0x373/0x1150 [ 636.321737][T13993] blk_mq_dispatch_rq_list+0x499/0x1990 [ 636.327915][T13993] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 636.334826][T13993] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 636.341352][T13993] blk_mq_run_hw_queue+0x348/0x4f0 [ 636.347007][T13993] blk_mq_dispatch_list+0xd11/0xe10 [ 636.352749][T13993] blk_mq_flush_plug_list+0x45f/0x540 [ 636.358669][T13993] __blk_flush_plug+0x3ed/0x4d0 [ 636.364145][T13993] __submit_bio+0x465/0x560 [ 636.369190][T13993] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 636.375360][T13993] block_read_full_folio+0x599/0x830 [ 636.381188][T13993] filemap_read_folio+0x12c/0x3a0 [ 636.386782][T13993] do_read_cache_folio+0x354/0x590 [ 636.392437][T13993] read_part_sector+0xb6/0x2b0 [ 636.397801][T13993] adfspart_check_ICS+0xb1/0x960 [ 636.403284][T13993] bdev_disk_changed+0x82b/0x1780 [ 636.408847][T13993] blkdev_get_whole+0x372/0x510 [ 636.414286][T13993] bdev_open+0x324/0xd70 [ 636.419073][T13993] blkdev_open+0x461/0x600 [ 636.424032][T13993] do_dentry_open+0x816/0x1380 [ 636.429334][T13993] vfs_open+0x3b/0x340 [ 636.433980][T13993] path_openat+0x2e3b/0x3890 [ 636.439121][T13993] do_file_open+0x23e/0x4a0 [ 636.444168][T13993] do_sys_openat2+0x113/0x200 [ 636.449405][T13993] __x64_sys_openat+0x138/0x170 [ 636.454799][T13993] do_syscall_64+0x174/0x580 [ 636.459930][T13993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.466369][T13993] [ 636.466369][T13993] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 636.473612][T13993] __mutex_lock+0x19d/0x1590 [ 636.478757][T13993] nbd_queue_rq+0xc1/0x1150 [ 636.483823][T13993] blk_mq_dispatch_rq_list+0x499/0x1990 [ 636.489935][T13993] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 636.496838][T13993] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 636.503382][T13993] blk_mq_run_hw_queue+0x348/0x4f0 [ 636.509058][T13993] blk_mq_dispatch_list+0xd11/0xe10 [ 636.514816][T13993] blk_mq_flush_plug_list+0x45f/0x540 [ 636.520744][T13993] __blk_flush_plug+0x3ed/0x4d0 [ 636.526150][T13993] __submit_bio+0x465/0x560 [ 636.531205][T13993] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 636.537396][T13993] block_read_full_folio+0x599/0x830 [ 636.543233][T13993] filemap_read_folio+0x12c/0x3a0 [ 636.548816][T13993] do_read_cache_folio+0x354/0x590 [ 636.554478][T13993] read_part_sector+0xb6/0x2b0 [ 636.559787][T13993] adfspart_check_ICS+0xb1/0x960 [ 636.565277][T13993] bdev_disk_changed+0x82b/0x1780 [ 636.570852][T13993] blkdev_get_whole+0x372/0x510 [ 636.576261][T13993] bdev_open+0x324/0xd70 [ 636.581063][T13993] blkdev_open+0x461/0x600 [ 636.586042][T13993] do_dentry_open+0x816/0x1380 [ 636.591354][T13993] vfs_open+0x3b/0x340 [ 636.595968][T13993] path_openat+0x2e3b/0x3890 [ 636.601110][T13993] do_file_open+0x23e/0x4a0 [ 636.606169][T13993] do_sys_openat2+0x113/0x200 [ 636.611407][T13993] __x64_sys_openat+0x138/0x170 [ 636.616810][T13993] do_syscall_64+0x174/0x580 [ 636.621947][T13993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.628385][T13993] [ 636.628385][T13993] -> #3 (set->srcu){.+.+}-{0:0}: [ 636.635555][T13993] __synchronize_srcu+0xc9/0x2f0 [ 636.641073][T13993] elevator_switch+0x1e8/0x7b0 [ 636.646386][T13993] elevator_change+0x2fa/0x480 [ 636.651699][T13993] elevator_set_default+0x375/0x440 [ 636.657457][T13993] blk_register_queue+0x3f3/0x4e0 [ 636.663051][T13993] __add_disk+0x6cb/0xe30 [ 636.667937][T13993] add_disk_fwnode+0xfb/0x4b0 [ 636.673180][T13993] nbd_dev_add+0x733/0xb60 [ 636.678172][T13993] nbd_init+0x15f/0x1e0 [ 636.683022][T13993] do_one_initcall+0x250/0x870 [ 636.688348][T13993] do_initcall_level+0x10a/0x1a0 [ 636.693930][T13993] do_initcalls+0x59/0xa0 [ 636.698799][T13993] kernel_init_freeable+0x29d/0x3e0 [ 636.704541][T13993] kernel_init+0x1d/0x1d0 [ 636.709422][T13993] ret_from_fork+0x514/0xb70 [ 636.714553][T13993] ret_from_fork_asm+0x1a/0x30 [ 636.719862][T13993] [ 636.719862][T13993] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 636.727709][T13993] __mutex_lock+0x19d/0x1590 [ 636.732859][T13993] elevator_change+0x1af/0x480 [ 636.738167][T13993] elevator_set_none+0xb5/0x140 [ 636.743562][T13993] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 636.749922][T13993] nbd_start_device+0x189/0xb30 [ 636.755326][T13993] nbd_genl_connect+0x1597/0x1c10 [ 636.760903][T13993] genl_family_rcv_msg_doit+0x233/0x340 [ 636.767090][T13993] genl_rcv_msg+0x614/0x7a0 [ 636.772145][T13993] netlink_rcv_skb+0x226/0x4a0 [ 636.777472][T13993] genl_rcv+0x28/0x40 [ 636.781992][T13993] netlink_unicast+0x7bb/0x940 [ 636.787300][T13993] netlink_sendmsg+0x813/0xb40 [ 636.792610][T13993] ____sys_sendmsg+0x9b9/0xa20 [ 636.797930][T13993] ___sys_sendmsg+0x2a5/0x360 [ 636.803156][T13993] __x64_sys_sendmsg+0x1bd/0x2a0 [ 636.808653][T13993] do_syscall_64+0x174/0x580 [ 636.813780][T13993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.820215][T13993] [ 636.820215][T13993] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 636.828915][T13993] blk_alloc_queue+0x544/0x690 [ 636.834221][T13993] __blk_mq_alloc_disk+0x194/0x390 [ 636.839879][T13993] nbd_dev_add+0x494/0xb60 [ 636.844861][T13993] nbd_init+0x15f/0x1e0 [ 636.849822][T13993] do_one_initcall+0x250/0x870 [ 636.855131][T13993] do_initcall_level+0x10a/0x1a0 [ 636.860611][T13993] do_initcalls+0x59/0xa0 [ 636.865482][T13993] kernel_init_freeable+0x29d/0x3e0 [ 636.871222][T13993] kernel_init+0x1d/0x1d0 [ 636.876100][T13993] ret_from_fork+0x514/0xb70 [ 636.881233][T13993] ret_from_fork_asm+0x1a/0x30 [ 636.886540][T13993] [ 636.886540][T13993] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 636.893776][T13993] __lock_acquire+0x1520/0x2cd0 [ 636.899174][T13993] lock_acquire+0x106/0x350 [ 636.904214][T13993] fs_reclaim_acquire+0x71/0x100 [ 636.909702][T13993] prepare_alloc_pages+0x15b/0x650 [ 636.915372][T13993] __alloc_frozen_pages_noprof+0x12f/0x380 [ 636.921730][T13993] alloc_pages_mpol+0x212/0x380 [ 636.927140][T13993] folio_alloc_mpol_noprof+0x39/0x160 [ 636.933085][T13993] vma_alloc_folio_noprof+0xe1/0x1e0 [ 636.938913][T13993] do_pte_missing+0x1750/0x3540 [ 636.944314][T13993] handle_mm_fault+0x1b38/0x3080 [ 636.949827][T13993] do_user_addr_fault+0x744/0x1340 [ 636.955504][T13993] exc_page_fault+0x6a/0xc0 [ 636.960558][T13993] asm_exc_page_fault+0x26/0x30 [ 636.965950][T13993] rep_movs_alternative+0x11/0x90 [ 636.971582][T13993] _copy_to_user+0x8a/0xb0 [ 636.976539][T13993] llc_ui_getsockopt+0x3cf/0x4c0 [ 636.982103][T13993] do_sock_getsockopt+0x51d/0x7e0 [ 636.987677][T13993] __x64_sys_getsockopt+0x1a4/0x240 [ 636.993462][T13993] do_syscall_64+0x174/0x580 [ 636.998591][T13993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.005023][T13993] [ 637.005023][T13993] other info that might help us debug this: [ 637.005023][T13993] [ 637.015263][T13993] Chain exists of: [ 637.015263][T13993] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 637.015263][T13993] [ 637.027954][T13993] Possible unsafe locking scenario: [ 637.027954][T13993] [ 637.035477][T13993] CPU0 CPU1 [ 637.040903][T13993] ---- ---- [ 637.046320][T13993] rlock(&mm->mmap_lock); [ 637.050758][T13993] lock(sk_lock-AF_INET6); [ 637.057816][T13993] lock(&mm->mmap_lock); [ 637.064689][T13993] lock(fs_reclaim); [ 637.068701][T13993] [ 637.068701][T13993] *** DEADLOCK *** [ 637.068701][T13993] [ 637.076860][T13993] 2 locks held by syz.2.2167/13993: [ 637.082066][T13993] #0: ffff88808ce5a260 (sk_lock-AF_LLC){+.+.}-{0:0}, at: llc_ui_getsockopt+0xb1/0x4c0 [ 637.091837][T13993] #1: ffff88803c4cf178 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 637.101792][T13993] [ 637.101792][T13993] stack backtrace: [ 637.107699][T13993] CPU: 0 UID: 0 PID: 13993 Comm: syz.2.2167 Not tainted syzkaller #0 PREEMPT(full) [ 637.107730][T13993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 637.107743][T13993] Call Trace: [ 637.107751][T13993] [ 637.107759][T13993] dump_stack_lvl+0xe8/0x150 [ 637.107784][T13993] print_circular_bug+0x2e1/0x300 [ 637.107810][T13993] check_noncircular+0x12e/0x150 [ 637.107836][T13993] __lock_acquire+0x1520/0x2cd0 [ 637.107858][T13993] ? rcu_is_watching+0x15/0xb0 [ 637.107878][T13993] ? trace_hrtimer_start+0x82/0x200 [ 637.107908][T13993] ? prepare_alloc_pages+0x15b/0x650 [ 637.107935][T13993] lock_acquire+0x106/0x350 [ 637.107952][T13993] ? prepare_alloc_pages+0x15b/0x650 [ 637.107985][T13993] fs_reclaim_acquire+0x71/0x100 [ 637.108010][T13993] ? prepare_alloc_pages+0x15b/0x650 [ 637.108037][T13993] prepare_alloc_pages+0x15b/0x650 [ 637.108067][T13993] __alloc_frozen_pages_noprof+0x12f/0x380 [ 637.108128][T13993] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 637.108159][T13993] ? __pfx_policy_nodemask+0x10/0x10 [ 637.108190][T13993] ? __lock_acquire+0x683/0x2cd0 [ 637.108208][T13993] alloc_pages_mpol+0x212/0x380 [ 637.108241][T13993] folio_alloc_mpol_noprof+0x39/0x160 [ 637.108271][T13993] vma_alloc_folio_noprof+0xe1/0x1e0 [ 637.108288][T13993] ? timerqueue_linked_add+0x287/0x2e0 [ 637.108375][T13993] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 637.108404][T13993] ? __pte_offset_map+0x29/0x240 [ 637.108426][T13993] ? __pte_offset_map+0x29/0x240 [ 637.108449][T13993] do_pte_missing+0x1750/0x3540 [ 637.108484][T13993] handle_mm_fault+0x1b38/0x3080 [ 637.108511][T13993] ? handle_mm_fault+0xec/0x3080 [ 637.108536][T13993] ? __pfx_handle_mm_fault+0x10/0x10 [ 637.108566][T13993] ? lock_mm_and_find_vma+0xa7/0x340 [ 637.108592][T13993] do_user_addr_fault+0x744/0x1340 [ 637.108617][T13993] exc_page_fault+0x6a/0xc0 [ 637.108647][T13993] asm_exc_page_fault+0x26/0x30 [ 637.108664][T13993] RIP: 0010:rep_movs_alternative+0x11/0x90 [ 637.108688][T13993] Code: e9 54 5b 04 00 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f 8a 06 <88> 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f [ 637.108704][T13993] RSP: 0018:ffffc9000395fbe8 EFLAGS: 00050202 [ 637.108727][T13993] RAX: ffffffff84b02803 RBX: 0000000000000004 RCX: 0000000000000004 [ 637.108739][T13993] RDX: 0000000000000000 RSI: ffffc9000395fc60 RDI: 00002000000018c0 [ 637.108752][T13993] RBP: ffffc9000395fcd0 R08: 0000000000000003 R09: 0000000000000004 [ 637.108764][T13993] R10: dffffc0000000000 R11: fffff5200072bf8c R12: 00002000000018c4 [ 637.108777][T13993] R13: 00007ffffffff000 R14: ffffc9000395fc60 R15: 00002000000018c0 [ 637.108794][T13993] ? _copy_from_user+0x93/0xb0 [ 637.108820][T13993] _copy_to_user+0x8a/0xb0 [ 637.108842][T13993] llc_ui_getsockopt+0x3cf/0x4c0 [ 637.108873][T13993] ? __pfx_llc_ui_getsockopt+0x10/0x10 [ 637.108904][T13993] ? __pfx_llc_ui_getsockopt+0x10/0x10 [ 637.108932][T13993] do_sock_getsockopt+0x51d/0x7e0 [ 637.108963][T13993] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 637.108996][T13993] ? __fget_files+0x3a2/0x420 [ 637.109018][T13993] ? __fget_files+0x2a/0x420 [ 637.109043][T13993] __x64_sys_getsockopt+0x1a4/0x240 [ 637.109073][T13993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.109091][T13993] do_syscall_64+0x174/0x580 [ 637.109108][T13993] ? trace_irq_disable+0x3b/0x140 [ 637.109136][T13993] ? clear_bhb_loop+0x40/0x90 [ 637.109156][T13993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.109174][T13993] RIP: 0033:0x7f2e9619ce59 [ 637.109191][T13993] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 637.109206][T13993] RSP: 002b:00007f2e970ff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 637.109224][T13993] RAX: ffffffffffffffda RBX: 00007f2e96415fa0 RCX: 00007f2e9619ce59 [ 637.109238][T13993] RDX: 0000000000000006 RSI: 000000000000010c RDI: 0000000000000004 [ 637.109250][T13993] RBP: 00007f2e96232d6f R08: 00002000000079c0 R09: 0000000000000000 [ 637.109262][T13993] R10: 00002000000018c0 R11: 0000000000000246 R12: 0000000000000000 [ 637.109273][T13993] R13: 00007f2e96416038 R14: 00007f2e96415fa0 R15: 00007ffed4b62d18 [ 637.109294][T13993] [ 637.518002][T13995] gretap0: entered promiscuous mode [ 637.532087][T13995] debugfs: 'hsr1' already exists in 'hsr' [ 637.537939][T13995] Cannot create hsr debugfs directory [ 637.543460][T13995] hsr1: entered promiscuous mode [ 637.608069][T13993] netlink: 'syz.2.2167': attribute type 1 has an invalid length. [ 637.667385][T13993] 8021q: adding VLAN 0 to HW filter on device bond6 [ 637.688591][T14000] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link