last executing test programs: 7.330102088s ago: executing program 1 (id=6779): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00', 0x0}) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001580)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd700006dcdf250100000008000100", @ANYRES32, @ANYBLOB="44000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000080000008000600", @ANYRES32=r1], 0x60}, 0x1, 0x400000000000000}, 0x0) 5.183700381s ago: executing program 1 (id=6786): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x0) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect$unix(r3, &(0x7f0000000100)=@abs={0x27, 0x0, 0x4e23}, 0x6e) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_opts(r4, 0x29, 0x4d, 0x0, 0x8) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) close(r1) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001340)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4870000000000000200000000000e0ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f55ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf3ed410f6accd3641110bec4e90a634199e07f8f6eb9604000e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e468eea13c9a77e1c89c5082a703fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea7042ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850bf895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fabc0c4dd418c005479ecab19bdfb15a32a4fd67ce446adb431d7e74853b7978639be2463308af07db79240acaf0910300000077d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061622718551c20ec23812770d72c700a44e113d17088fdd00600000f7889b8d7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f740586903500090000000000000000be34b10f9d640dd782ac0cbc0abcf72846903243d0d0f4bc7fb0a0d7c5000032daaf281c450e64c33aac8ff7e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4bfaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e0c81efb5e392a13cdd2ce219e6733b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e863fef0ad9d1ac32276cffe5f1fc21390797d0244cf1ce269d10525745caaa3f77d1b80116cb385a0242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2424ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f55136628090702f70000d0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c685492a1689ad4218cea744b332ab232a09cf1ec375627074ce2d3d7619936768a84a1465fff4610cf8838b28319e0f79533d87eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507818231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f278ea00cee8a2088359946e726aef83d9ff9281ab79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df0000000010c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481c55e86dcd7816ad8940bd19953603000000adeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016be64dc097982e23462392a0cd05afb2e060fd6424a942ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1af45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5d81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b1495213060000000000000049584655c4fce8c5bb7c54664aef6d780100358aa54bcb49926c4be9ee4659153d9fa95d07cc4efdab2c355efe8e8d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6122f572047ccf3c8edd82660e5d74c52be71d780c30000000000fd00000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f99f1b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f2def52394db3e9d8318bbb9baff3db95bfd69e08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d05b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0a832f5194ddfce51e5aff28f621bb2fd2a5ab719df823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c3348329b0ee77d93596e3f1287552e0c8cdb326c5118d2e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e26aa90c571fa3c07238697b13c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170e42f28cea4105541e11c8605628b9ca935bc252fee8b596a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babb8fa16f3182c5b98493a5aa943aa3a777a751f56e0c7a74f7f63d83ff119561acd5fe560563b051dc29ac586b21148ad5a5498369ac347d19660c132b1df58d65418bc824d8b88b699462c2ce6524eaf0905445413033f041a26b189f2553ef218eba22152a4dc979a0e37396ae1a2883b1e4d44c8af7973d5c1f286c26459209db5a9a51dc69d0ba3fb6c884e50be3598ac53295137c97dabe52d98fed0b352c0b68b7e75ed59931ef57bb5fc28d5b1f914fc8abbb444637a5dfbac5035eb0713efb823360a8da80e4265e599f76952a8082b8c5f7890275a922cd2ccaaf75dcca6849e89e1bab32fe9b598c61d7565dc6ab0a6d43b60f8d08ddf27a286807692d18973edaa6d5401c79b3cafaab4a8d6c946cbe5de350000000022e16a5f72c6d41dc9de8517fdcfa0c0efca880257443cfc3057c353569ffb1588b4bb261a6e99c5936e1b4339d87ec84db99e797f44451fc6b5da1950d24b3d4118f2288804740e605500c1f493c7dc42164cc6c1b01a329ce95272a07a355d4ba705b5e71ce5e1042a0c638e565881e5eedbc62f79407b73ae787c9cdb752eda44aeef962c93ab245f61e8ca5c0d41cc56124840f1b2b30be599fea0afaf905f90dd3e55fef0b94afbfd7144b7"], &(0x7f0000000140)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r5, 0x18000000000002a0, 0x34, 0x62, &(0x7f0000000380)="b9e403c6630d698cb8a00b04339c", 0x0, 0x172, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0xffff, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffdba, 0x1, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x2, 'syz1\x00', @null, 0x40005, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default]}) 5.044997616s ago: executing program 1 (id=6789): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f0000000080)={'filter\x00', 0x0, 0x0, 0x0, [0x7266da2e, 0xd4, 0x1, 0x9, 0x99, 0x7e26], 0x1, 0x0, 0x0, [{}]}, 0x88) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x9) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007040)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x19}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x3}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x94}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0xd9, 0x6, 0x0, @private=0xa210104, @local, {[@generic={0x7, 0x7, "04030e5c61"}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x80}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) gettid() r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e21, 0x100059, @private0, 0x6}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r6, 0x84, 0x7d, &(0x7f00000000c0)=@assoc_value={r7}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@ipv4_getnetconf={0x0, 0x52, 0x2, 0x70bd2c, 0x25dfdbfb, {}, [@NETCONFA_PROXY_NEIGH={0x0, 0x5, 0x80}, @NETCONFA_PROXY_NEIGH={0x0, 0x5, 0xff}, @NETCONFA_PROXY_NEIGH={0x0, 0x5, 0x5}, @NETCONFA_PROXY_NEIGH={0x0, 0x5, 0x81}, @NETCONFA_RP_FILTER={0x0, 0x3, 0x6}, @NETCONFA_IFINDEX={0x0, 0x1, r5}, @NETCONFA_RP_FILTER={0x0, 0x3, 0xbb}, @NETCONFA_FORWARDING={0x0, 0x2, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x81}, 0x80) r8 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=@can_newroute={0x44, 0x18, 0x1, 0x0, 0x0, {}, [@CGW_DST_IF={0x8}, @CGW_SRC_IF={0x8}, @CGW_MOD_UID={0x8, 0xe, r9}, @CGW_MOD_SET={0x15, 0x4, {{{0x3, 0x1, 0x1, 0x1}, 0xa, 0x1, 0x0, 0x0, "0325175362eb4cf2"}, 0x4}}]}, 0x44}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@loopback, @in=@multicast2}}, {{@in6=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000000300)=0xe8) getgid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) ioctl$int_in(r10, 0x5452, &(0x7f00000000c0)=0x400) r11 = getpid() ioctl$sock_SIOCSPGRP(r10, 0x8902, &(0x7f0000000140)=r11) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000380), &(0x7f00000003c0)=0xc) r12 = socket(0x10, 0x3, 0x0) r13 = gettid() sendmsg$nl_route(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c00000010000537cf2cd55b6806c1160b71279a", @ANYRES32=0x0, @ANYBLOB="c042000000000000140012800900010076657468000000000400028008001300", @ANYRES32=r13, @ANYBLOB], 0x3c}}, 0x0) 4.640950076s ago: executing program 1 (id=6795): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60487}}, 0x20}}, 0x10) 4.576809495s ago: executing program 0 (id=6798): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'md5\x00'}, 0x58) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x27}, 0x62) bind$bt_hci(r1, &(0x7f0000000180)={0x27}, 0x6) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x1}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x12}]}}}]}, 0x38}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x800) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000000) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)={0x28, r7, 0x1, 0x70bd25, 0x25dfdbf7, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x4000}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000850}, 0x20044004) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xb8dd}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r10, 0x1, 0xd7, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x14) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x48000}, 0x4) 4.483381069s ago: executing program 1 (id=6800): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0xffff, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffdba, 0x1, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x84, 0x84, 0x5, [@struct={0xe, 0x9, 0x0, 0x4, 0x1, 0x2, [{0xa, 0x3, 0x80000001}, {0x1, 0x1}, {0x0, 0x4, 0x5}, {0x10, 0x4, 0xf9}, {0xa, 0x5, 0x7}, {0xa, 0x5, 0x67}, {0x6, 0x0, 0x2}, {0xe, 0x2, 0x9}, {0xc, 0x0, 0x4b0f66d8}]}, @func={0xe, 0x0, 0x0, 0xc, 0x3}]}, {0x0, [0x30, 0x1e, 0x61]}}, &(0x7f00000000c0)=""/150, 0xa1, 0x96, 0x1, 0x3}, 0x28) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r1, 0x40047211, &(0x7f0000000240)=0x1afa6f8a92db3193) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x2, 'syz1\x00', @null, 0x40005, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default]}) 4.31827968s ago: executing program 1 (id=6802): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000037400062c00070073797352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a7330000800020000000000080007002609090914000600626f6e64300000000000000000000000080003"], 0x78}, 0x1, 0xffffffff00000003}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r2, 0x800, 0x70bd29, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x8012}, 0x200044c5) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @remote}}}, 0x108) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000240)={0x0, 0x300, &(0x7f0000000200)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2c, 0x25dfdbfc, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vxcan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x810) ioctl$sock_bt_hci(r4, 0x400448cc, 0x0) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0x0, 0x1}, 0x6) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000c40), r0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x34, r6, 0x1, 0x34000000, 0x0, {0x6, 0x0, 0x900}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @empty}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0xb}}, @NLBL_UNLABEL_A_SECCTX={0xf, 0x7, 'unconfined\x00'}]}, 0x34}, 0x2, 0x34005, 0x0, 0x24080040}, 0x24000880) 2.086591674s ago: executing program 0 (id=6808): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x5, 0x14, 0x0, &(0x7f0000000000)="259a53f271a76d2608004c6588a80a3888ca2f15", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x40}, 0x50) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000020603000000000000000000000000001400078008001240000000000500150002000000050001000600000005000500020000000500040000000000090002"], 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 1.985031339s ago: executing program 3 (id=6810): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60487}}, 0x20}}, 0x10) 1.918523916s ago: executing program 0 (id=6812): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee9, 0x8031, r0, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) ioctl$sock_TIOCINQ(r1, 0x61d8, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="14010000360001000000000000000000010145800c0004000700000000"], 0x114}], 0x1, 0x0, 0x0, 0x4000080}, 0x0) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03000000040000ee0300e4e10900000000000000245624b06e277b76f78283d1416e839072078dcd060eb17e5e65ca0cd996a7948480516501ea6ec0f37d8fba12ba05525c2f94bc0904c60ed0a921f6d448b94ae3faa67371683f2aa512b017ce19aca8e94894117bbd151dbd3ff1f2d926", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB="1809000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70300000000000085000000c4000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.831427424s ago: executing program 3 (id=6814): r0 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000480)=@ethtool_ringparam={0x4, 0x106f, 0x6, 0x0, 0xbb63, 0x200, 0xc45, 0x6, 0x4}}) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00'}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040)={0x95, 0xfffe, 0x205, 0x5, 0x9, 0x6, 0x2, 0x5, 0x0}, &(0x7f0000000080)=0x20) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000000c0)={r3, 0x4}, 0x8) 1.608035219s ago: executing program 3 (id=6817): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x7, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000ffffffffffffffe400000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000000000a50a000000000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.429620707s ago: executing program 3 (id=6818): bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) r0 = socket$netlink(0x10, 0x3, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000c00)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\b', 0x30, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_redir={0x87, 0x0, 0x0, '\x00', @local, @mcast2={0xe}, [{0x1, 0x1, "2025b07f3c58"}]}}}}}}, 0x0) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)=ANY=[@ANYBLOB="b80000002d000100000008000000000000000000", @ANYRES32, @ANYBLOB="0b000080976b640868603000910001"], 0xb8}], 0x1}, 0x0) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000280)=0x1c, 0x80800) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x1f, 0x6, 0x588, 0x2d8, 0x0, 0x1e8, 0x0, 0x2d8, 0x4b8, 0x4b8, 0x4b8, 0x4b8, 0x4b8, 0x6, &(0x7f00000002c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0xd}, [0xffffffff, 0xffffff00, 0xff], [0xff000000, 0xffffff00, 0xffffffff, 0xa543183afcf2f3ae], 'veth0_to_team\x00', 'bond_slave_1\x00', {}, {0xff}, 0x2b, 0x1, 0x5, 0x5c}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@eui64={{0x28}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@dev={0xfe, 0x80, '\x00', 0x15}, 0x2b, 0x15, 0x3}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@multicast2, @ipv6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x25, 0x2, 0x40}}}, {{@uncond, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x3}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x3, 0x9, @ipv4=@remote, 0x4e22}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0x0, 0x0, 0xff000000, 0xffffffff], [0x0, 0xffffffff, 0x0, 0xff], 'veth1\x00', 'veth0_vlan\x00', {0xff}, {}, 0x2c, 0x6, 0x2, 0x40}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x3, 0xf7}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5e8) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) connect$bt_l2cap(r2, &(0x7f0000002480)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0xe) (async) connect$bt_l2cap(r2, &(0x7f0000002480)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0xe) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000000c0)=@bpf_lsm={0x3, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="450a00000000000061116300000000009500000000ddffffb45f337cada102283111327531fe3f34dd6fa115e7b55c139a4b12d9340aabec6c9a00fd81740d8c04e9c422f4480ac0765e430000000000fe08cc8e62ed21a09056d3fe019404210e80"], &(0x7f0000000080)='syzkaller\x00', 0xfffffffd}, 0x94) (async) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000000c0)=@bpf_lsm={0x3, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="450a00000000000061116300000000009500000000ddffffb45f337cada102283111327531fe3f34dd6fa115e7b55c139a4b12d9340aabec6c9a00fd81740d8c04e9c422f4480ac0765e430000000000fe08cc8e62ed21a09056d3fe019404210e80"], &(0x7f0000000080)='syzkaller\x00', 0xfffffffd}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={r3}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000180)={r3, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={r4}, 0x4) r5 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_inet_sctp_SIOCINQ(r5, 0x541b, &(0x7f0000000340)) 1.323555253s ago: executing program 3 (id=6820): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0010000000ba8000001201", 0x2e}], 0x1}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000300)=0x0) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendmsg$netlink(r1, &(0x7f00000009c0)={&(0x7f00000002c0)=@proc={0x10, 0x0, 0x25dfdbfe, 0x800}, 0xc, &(0x7f0000000980)=[{&(0x7f0000000680)={0x1d4, 0x41, 0x200, 0x70bd29, 0x25dfdbfc, "", [@generic="26e2853cbf4a338ae3e36f19f57d88975c9d2288120712844f184ffb28a98e234d912d2072644a6f101c37baae21ef80903f01c2f0377e191e0011cf03825ec206a209e964e87a2c22b722f96f11b9c998885273939e528c16a6441e3033585ed70f894e82fc12766b94d2b3690b71a67594788e7dd660bbfca4fbcf19dd80bb28fe88be0f055beb08e0fdabcf9e39ac4f4f53a186ed7a834bbc6288ee5afe7f679062eb28d4e1cad3ff84935e00804b22611a369b0c671a3960d561496bfec1", @nested={0xc, 0x19, 0x0, 0x1, [@typed={0x8, 0x138, 0x0, 0x0, @pid=r2}]}, @nested={0xf5, 0x28, 0x0, 0x1, [@typed={0x8, 0x34, 0x0, 0x0, @u32=0xcd40}, @nested={0x4, 0x117}, @generic="42efce6e9fada32303237c7af41697dcdaa84b8d8ed7429aa19c10b739c7cd", @nested={0x4, 0xbd}, @generic="9a26c55a4fbc7cc100ac78d7e71398769de4053290ea2ad1bf8ef1de7d00ff5ead6a623de7d484eec8678346477d9735", @generic="47e7871466e1b05449a412b985addd9636ddd578e9936371a66b3e4ccf14b4f496643be442648534ed85a08d4be7b107fd2be29182680fcb1a8816ed12f432010a71626a48a94c89c6a8e532fa65d3706e60a68402cb352edfc73a7c6000cb7e8456bd793c3a8e73bf24aff8010f5316f0ad9f9be376e3be89dccf6ce735a6539ee662c907692af190be", @typed={0x8, 0xe2, 0x0, 0x0, @pid=0xffffffffffffffff}]}]}, 0x1d4}, {&(0x7f0000000880)={0xdc, 0x28, 0x2, 0x70bd2b, 0x25dfdbfe, "", [@nested={0x22, 0xa5, 0x0, 0x1, [@generic="0d37a202d5a605076ac57cd9c62c2e1f4da83bb97e54b68973d2", @nested={0x4, 0xdf}]}, @generic="d0e06aaa51b445cbb029b18be3411c8457bb6f6ce08ceaef964d5a01e64eb595b2f075aa62f70ed0c6aeee82c9a2e5974457cd560928952561dee9576bcf2684f819c3feeae56d6e99d6ffccb0030aab760ee5ab2a0bbb825fb8dba203b83951313dcac14257339b0cc2bb5c9d8e3787da79d24cfa9643c3acb528f67804fc9b9862", @nested={0x20, 0x124, 0x0, 0x1, [@typed={0xc, 0x11a, 0x0, 0x0, @u64=0x4}, @nested={0x4, 0x149}, @nested={0x4, 0xb7}, @typed={0x8, 0xce, 0x0, 0x0, @fd=r3}]}, @typed={0x4, 0x43}]}, 0xdc}], 0x2, 0x0, 0x0, 0x4}, 0x20000080) ioctl$XFS_IOC_GETBMAPA(r1, 0xc020582c, &(0x7f0000000140)={0x5, 0xfff, 0x5, 0x7, 0xb}) r4 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd600000000014064100000000000000000000000000000000fe8000000000000000000000000000aa04004e2200a6"], 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r5, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64"], 0x3c}, 0x1, 0x0, 0x0, 0x11}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x70bd28, 0x25dfdbfc, {0x2, 0x20, 0x1, 0xc8, r5}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x40000c0) socket$inet(0x2, 0x3, 0x2) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000180), &(0x7f0000000200)=0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xf, &(0x7f0000000240)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r8}}}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$inet_mreq(r7, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @sit={{0x8}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x440b0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r9, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r9, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r9, 0x1, 0x8, 0x0, 0x0) connect$inet6(r9, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) 1.198143342s ago: executing program 4 (id=6821): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)={0x118, 0x35, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x107, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac0b}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @loopback}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x8, 0x145, 0x0, 0x0, @ipv4=@remote}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, &(0x7f0000000000), 0x4) 1.197920799s ago: executing program 2 (id=6822): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c, 0x0}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r2) ioctl$sock_rose_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x9, @default, @rose={'rose', 0x0}, 0x8, [@default, @bcast, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) (async) ioctl$sock_rose_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x9, @default, @rose={'rose', 0x0}, 0x8, [@default, @bcast, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) socket$tipc(0x1e, 0x2, 0x0) setsockopt$inet_mreq(r2, 0x0, 0x24, &(0x7f0000000000)={@rand_addr=0x64010100, @empty}, 0x8) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newtaction={0x88, 0x30, 0xb, 0x0, 0x0, {}, [{0x74, 0x1, [@m_ct={0x70, 0x1, 0x0, 0x0, {{0x7}, {0x48, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @private1}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newtaction={0x88, 0x30, 0xb, 0x0, 0x0, {}, [{0x74, 0x1, [@m_ct={0x70, 0x1, 0x0, 0x0, {{0x7}, {0x48, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_NAT_IPV6_MIN={0x14, 0xb, @private1}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000080)={'bond0\x00', &(0x7f00000000c0)=@ethtool_channels={0x1, 0x7c4d2537, 0x0, 0xfffffffd}}) (async) ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000080)={'bond0\x00', &(0x7f00000000c0)=@ethtool_channels={0x1, 0x7c4d2537, 0x0, 0xfffffffd}}) 1.128733989s ago: executing program 2 (id=6823): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00'}) syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x0) 1.021912902s ago: executing program 4 (id=6824): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60487}}, 0x20}}, 0x10) 946.580754ms ago: executing program 2 (id=6825): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@nat={'nat\x00', 0x19, 0x2, 0x146, [0x2000000025c0, 0x0, 0x0, 0x2000000025f0, 0x200000002620], 0x0, 0x0, &(0x7f00000025c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000900000a08000000000c626174616476300000000000000000006e657405657673696d300000000000006970766c616e3100000000000000000076657468315f746f5f626f6e64000200aaaaaaaaaabb00ff0000ffffd685fc5d01147f00010000ff6e0000006e000000b60000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a310000000000000000000000005a060000000000000600000000000000f9b3"]}, 0x1b9) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@ipv4_delroute={0x40, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x14, 0x0, 0x0, 0x0, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_HOPLIMIT={0x5, 0x4, 0x81}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newtfilter={0x2c, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r2, {0xb, 0x9}, {}, {0x1c, 0xfff1}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x7}}]}, 0x2c}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 882.817391ms ago: executing program 4 (id=6826): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000300)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000100)=ANY=[@ANYBLOB='b *:75'], 0x9) 707.481167ms ago: executing program 2 (id=6827): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[], 0x0}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 707.014249ms ago: executing program 4 (id=6828): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x2c}}, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x62) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, &(0x7f0000000080)=0xffffffff, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="600000000c0605000000000000000000020000030900020073797a30000000000500010007000000050001"], 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) 630.574901ms ago: executing program 0 (id=6829): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x44, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x24048058) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000dc0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000200)={'wpan1\x00', 0x0}) r3 = socket$inet(0x2, 0x3, 0x800000) sendmmsg(r3, &(0x7f0000000e40)=[{{&(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000000300)=[{&(0x7f00000000c0)="ae", 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[{0x10, 0x84, 0x5}], 0x10}}], 0x2, 0x0) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000fedbdf25030000005800018044000400200001000a00000000000000fe8000000000000000000000000000aabf090000200002004a00000000000005fe8000000000000000000000000000bb000000000d0001007564703a73"], 0x6c}}, 0x0) (async) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fedbdf250f00000208000300", @ANYRES32=r2, @ANYBLOB="05000f00ff00"], 0x24}, 0x1, 0x0, 0x0, 0x2004000}, 0x20004010) (async, rerun: 32) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@deltclass={0x24, 0x29, 0x1, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x15, 0x9}, {0xf, 0x2}, {0xffe0, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) (rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x24048840) (async, rerun: 64) r6 = socket(0x2, 0x80805, 0x0) (rerun: 64) sendmmsg$inet(r6, &(0x7f0000000440)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000300)="99", 0x1}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000400)={0x93de, 0x1, 0x0, 0x3, 0x1ff, 0x7, 0xdff8, 0xb, r7}, 0x20) (async, rerun: 32) r8 = socket$netlink(0x10, 0x3, 0x0) (rerun: 32) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) r9 = socket(0x11, 0x3, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r9, &(0x7f0000000180)={0x11, 0x0, r11}, 0x14) (async) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000000)=0x2000e8, 0x4) (async) sendmmsg$inet(r9, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000004c0)="8fdd6b301db0d311eddfd305205d7d4a2b2a92516a002d95f9397ee55b926f6ed6236b", 0x23}], 0x1}}], 0x1, 0x4000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000240)={'dummy0\x00', 0x0}) (async) r14 = gettid() r15 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r15, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c00000010000304f9fffffffedbdf2500007400", @ANYRES32=r13, @ANYBLOB="5b1300ab39", @ANYRES32=r14, @ANYBLOB="1400030076657468315f6d616376746170000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4802}, 0x4000010) 497.169144ms ago: executing program 4 (id=6830): r0 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$EXT4_IOC_SETFSUUID(r0, 0x4008662c, &(0x7f0000000000)={0x0, 0x0, "3223d1a33917e18f7e9fe1e899f188b4"}) ioctl$XFS_IOC_SWAPEXT(r0, 0xc0c0586d, &(0x7f0000000040)={0x0, r0, r0, 0x3, 0x400, '\x00', {0x6000000, 0x4, 0xf419, 0x6, 0x4, 0xe, 0x3, 0x8, {0x7, 0x6}, {0x8, 0x4}, {0x6, 0x1}, 0x0, 0x10001, 0x4, 0x7, 0xb416, 0x9, 0x7ff, 0x1000, 0x1, 0x8, '\x00', 0x7, 0x10, 0x4, 0x81}}) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$INCFS_IOC_PERMIT_FILL(r1, 0x40046721, &(0x7f0000000100)={r0}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000180)={0x6, &(0x7f0000000140)=[{0x5, 0x2, 0x8, 0x80}, {0x8, 0x2, 0x0, 0x7}, {0x2, 0x4, 0x18, 0x5}, {0x9, 0x5, 0xc, 0xc}, {0x0, 0x27, 0x7, 0x8}, {0xfffc, 0x7, 0x5, 0x4}]}, 0x10) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000001c0)={0x0, 0x6}, 0x4) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f0000000200), &(0x7f0000000240)=0xc) listen(r1, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SCAN(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r3, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xcf, 0x80}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8010) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000400), r2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'dvmrp1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000500)={'erspan0\x00', &(0x7f0000000480)={'sit0\x00', 0x0, 0x700, 0x8, 0x8, 0x2, {{0xf, 0x4, 0x1, 0x19, 0x3c, 0x66, 0x0, 0x5, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, {[@lsrr={0x83, 0x27, 0x2b, [@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @local, @loopback, @rand_addr=0x64010102, @broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote]}]}}}}}) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, r4, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@GTPA_FAMILY={0x5, 0xd, 0x15}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_LINK={0x8, 0x1, r5}, @GTPA_LINK={0x8}, @GTPA_LINK={0x8, 0x1, r6}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000000700)={r2, &(0x7f0000000600)='nl80211\x00', 0x40a000, &(0x7f0000000640)={@align=0x2, {0x8001, 0x8000, 0xcdd, 0x3}}, 0x8, &(0x7f0000000680)={@_ha_fsid}, &(0x7f00000006c0)=0x855}) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f0000000740)=@gcm_128={{0x303}, "0d378542f50e7ab2", "97fbb8217b47f1659480b4955118ee7e", "ea0cdb76", "6dc73cf08172f8af"}, 0x28) writev(0xffffffffffffffff, &(0x7f0000000800)=[{&(0x7f0000000780)="1b995b7bba82740624ca30525b8c72fab0706a9e7d4bf631d0e42f876725cbcc7c3b0d6ceb4968407ceb5ef6b3c0d8b28f3c75e9ccac213b48645f25bfcfafc179bc248f446033276f68f0b81145458810f8a0c8eed21571dd608b36d5620267dd9fd3f407ae6df62b4c9d", 0x6b}], 0x1) ioctl$OCFS2_IOC_GROUP_ADD64(r0, 0x40186f03, &(0x7f0000000840)={0x4146, 0x0, 0x4, 0x5}) socket$l2tp(0x2, 0x2, 0x73) r8 = openat$cgroup_ro(r7, &(0x7f0000000880)='blkio.bfq.time\x00', 0x0, 0x0) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f00000008c0)=@gcm_128={{0x303}, "ce1d9f406a78426e", "703c21530f06f1f2b86e2f67580ea8e3", "9a3490a6", "0f91aa438aa40bf5"}, 0x28) setsockopt$inet6_opts(r8, 0x29, 0x36, &(0x7f0000000900)=@hopopts={0x67, 0x12, '\x00', [@generic={0x95, 0x91, "7357f435f748e39623388b13d5f2283d81e657d72bbb36bdb0c4b3182ea046c0661ffbcc2e81006812fa18b42ff2b04ab1621d0023a7b48873bf7c1af91b7af2c54a7fdc6a79025358bb1ce29ca221f281e9dce37e41e05ec52ea69bcf3ad4c08d580dfe26cf88bb09e9b4d1d61ffb246298b7ce06ed68ea339ac9259968b6933a3ae973512a7932f7f9e685b6f3d2e722"}]}, 0xa0) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000009c0)={0x0, 0x9}, 0x8) r9 = accept4$phonet_pipe(r7, &(0x7f0000000a00), &(0x7f0000000a40)=0x10, 0x80c00) readv(r9, &(0x7f0000001c40)=[{&(0x7f0000000a80)=""/178, 0xb2}, {&(0x7f0000000b40)=""/4096, 0x1000}, {&(0x7f0000001b40)=""/154, 0x9a}, {&(0x7f0000001c00)=""/28, 0x1c}], 0x4) syz_emit_ethernet(0x56, &(0x7f0000001c80)={@empty, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xd}, @void, {@canfd={0xd, {{0x2, 0x1}, 0x1d, 0x1, 0x0, 0x0, "c3d410184dd2ea9e7095543a190efc6dc57db98a8d42091ac37265e0037a0b7f0cbb22727f9bf3be1bade7b9013a014f63295ff63d5a4296b59500ee0955f87d"}}}}, &(0x7f0000001d00)={0x1, 0x4, [0x8c8, 0x3ab, 0xddd, 0xd5b]}) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r10, &(0x7f0000001f00)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e40)={0x60, 0x0, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x4}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xff}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x14}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x2004c811) 447.275803ms ago: executing program 0 (id=6831): r0 = socket$caif_stream(0x25, 0x1, 0x0) connect$caif(r0, &(0x7f0000001780)=@dbg={0x2}, 0x18) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_buf(r1, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f00000001c0)="0613af", 0x0, 0xffffff76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xb}, 0x50) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'geneve0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x88a8ffff, &(0x7f0000000140)={0x11, 0x88a8, r4}, 0x14) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@empty, @in=@multicast1, 0x200, 0x0, 0x0, 0xffff, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xfffffffffffffffe, 0xc, 0x0, 0x0, 0x4, 0xffffffffffffffff}, {0x0, 0x8000, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0xb8}}, 0xc004004) sendmmsg$inet6(r1, &(0x7f0000006e80)=[{{&(0x7f0000002080)={0xa, 0x4e1f, 0x2, @rand_addr=' \x01\x00', 0xd1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000100)="d5", 0x1}], 0x1}}], 0x1, 0x20002845) 386.323044ms ago: executing program 2 (id=6832): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x8, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bf080000000000007b8af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x609, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x2}]}}}]}, 0x3c}}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000000200), 0xe) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001a80)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a68000000060a010400000000000000000a0000010900010073797a31000000003c000480380001800b00010064796e73657400002800028008000440000000090900010073797a3200000000080003400000000208000940000000030900020073797a32"], 0x90}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) 355.873308ms ago: executing program 3 (id=6833): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, &(0x7f0000000040)) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x14, 0x32, 0x1, 0xfffffffd, 0x25dfdbfb, {0x0, 0x0, 0x11}}, 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f0000000180)=0x4, 0x4) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) accept4$bt_l2cap(r4, 0x0, 0x0, 0x800) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r5, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001000000000000ffffff0500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000001300c000b400000000000000006140000001100010000000000000000000100"], 0x78}}, 0x40) r7 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'ip6gre0\x00', 0x0}) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(r9, 0x107, 0x18, &(0x7f0000000800)={r8, 0x1, 0x6, @local}, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010058c6000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x4000894) 292.821322ms ago: executing program 0 (id=6834): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x4e22, 0x3, 'rr\x00', 0x28, 0x5, 0x72}, 0x2c) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa0100fe, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e20, 0x10000, 0x2, 0x2}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0}, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4f23, 0x6, @loopback, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x20000000) 147.997609ms ago: executing program 4 (id=6835): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@empty, @in=@multicast1, 0x200, 0x0, 0x0, 0xffff, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xfffffffffffffffe, 0xc, 0x0, 0x0, 0x4, 0xffffffffffffffff}, {0x0, 0x8000, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0xb8}}, 0xc004004) sendmmsg$inet6(r0, &(0x7f0000006e80)=[{{&(0x7f0000002080)={0xa, 0x4e1f, 0x2, @rand_addr=' \x01\x00', 0xd1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000100)="d5", 0x1}], 0x1}}], 0x1, 0x20002845) (fail_nth: 4) 0s ago: executing program 2 (id=6836): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60487}, [@IFLA_LINK_NETNSID={0x8}]}, 0x28}}, 0x10) kernel console output (not intermixed with test programs): nk: 72 bytes leftover after parsing attributes in process `syz.4.5448'. [ 525.789918][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 525.817564][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 525.843137][T23778] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5450'. [ 525.886567][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 525.927751][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 525.977999][T23781] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5452'. [ 525.979044][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 525.999439][T23781] netlink: 'syz.4.5452': attribute type 25 has an invalid length. [ 526.003105][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 526.003360][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 526.045701][T23783] netlink: 'syz.2.5451': attribute type 3 has an invalid length. [ 526.093643][T23781] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5452'. [ 526.104824][ T132] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.117415][ T132] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.136694][ T132] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.159477][T23787] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5454'. [ 526.168808][T23781] netlink: 'syz.4.5452': attribute type 25 has an invalid length. [ 526.183499][ T132] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.204136][T23005] IPVS: stop unused estimator thread 0... [ 526.247417][T23791] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5456'. [ 526.370627][T23798] netlink: 'syz.4.5459': attribute type 32 has an invalid length. [ 526.449045][T23798] bond23: Setting coupled_control to off (0) [ 526.493088][T23807] netlink: 'syz.3.5462': attribute type 1 has an invalid length. [ 526.516890][T23807] netlink: 'syz.3.5462': attribute type 2 has an invalid length. [ 526.571319][T23806] netlink: 'syz.3.5462': attribute type 83 has an invalid length. [ 526.758613][T23828] netlink: 'syz.2.5467': attribute type 1 has an invalid length. [ 526.889346][T23828] 8021q: adding VLAN 0 to HW filter on device bond17 [ 526.921966][T23840] bond17: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 527.009182][T23849] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 527.021634][T23847] bond17: entered promiscuous mode [ 527.029354][T23849] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 527.038209][T23847] bond17: entered allmulticast mode [ 527.118812][T23863] pim6reg1: entered promiscuous mode [ 527.139782][T23863] pim6reg1: entered allmulticast mode [ 527.538203][T23891] netlink: 'syz.4.5488': attribute type 3 has an invalid length. [ 527.781990][T23908] netlink: 'syz.0.5493': attribute type 10 has an invalid length. [ 528.099215][T23928] syzkaller1: entered promiscuous mode [ 528.113288][T23928] syzkaller1: entered allmulticast mode [ 548.054678][T23956] __nla_validate_parse: 9 callbacks suppressed [ 548.054697][T23956] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5497'. [ 548.271136][T23969] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5502'. [ 548.284644][T23979] validate_nla: 1 callbacks suppressed [ 548.284662][T23979] netlink: 'syz.3.5504': attribute type 3 has an invalid length. [ 548.563180][T23005] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 548.599037][T23005] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 548.750265][T24002] netlink: 596 bytes leftover after parsing attributes in process `syz.1.5512'. [ 548.773282][T24002] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5512'. [ 549.100971][T24029] bridge0: port 3(gretap0) entered blocking state [ 549.115881][T24029] bridge0: port 3(gretap0) entered disabled state [ 549.130163][T24029] gretap0: entered allmulticast mode [ 549.208648][T24032] s5: renamed from vlan1 (while UP) [ 549.228529][T24032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5522'. [ 568.582375][T24064] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5528'. [ 568.785047][T24082] batadv1: entered allmulticast mode [ 568.860342][T24091] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5538'. [ 569.014038][T24105] netlink: 'syz.2.5543': attribute type 1 has an invalid length. [ 569.096149][T24110] mac80211_hwsim hwsim28 syzkaller0: entered promiscuous mode [ 569.122780][T24110] mac80211_hwsim hwsim28 syzkaller0: entered allmulticast mode [ 569.291111][T24133] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5548'. [ 569.444977][T24147] caif0: entered promiscuous mode [ 569.658724][T24154] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5555'. [ 569.680107][ T29] audit: type=1107 audit(1776483356.269:7): pid=24160 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='7-[S/TDh݆˧<]3^Fw.N-uT_ב)D{fX[!I,onSrsxH;Cy| [ 569.680107][ T29] 4dLM>!2C2wb!K|2JI#Tz#K' [ 570.003171][T24173] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5559'. [ 570.029052][T24173] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5559'. [ 570.049326][T24173] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5559'. [ 570.084252][T24173] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5559'. [ 570.378556][T24199] wg1: entered promiscuous mode [ 570.389801][T24199] wg1: entered allmulticast mode [ 570.484076][T24200] veth0_to_bond: Caught tx_queue_len zero misconfig [ 570.563499][T24210] netlink: 'syz.3.5570': attribute type 21 has an invalid length. [ 570.587646][T24212] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5571'. [ 570.598205][T24210] netlink: 128 bytes leftover after parsing attributes in process `syz.3.5570'. [ 570.628621][T24217] netlink: 'syz.3.5570': attribute type 21 has an invalid length. [ 570.652313][T24210] netlink: 'syz.3.5570': attribute type 4 has an invalid length. [ 570.689303][T24210] netlink: 'syz.3.5570': attribute type 5 has an invalid length. [ 570.731893][T24221] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 570.797363][T24217] netlink: 'syz.3.5570': attribute type 4 has an invalid length. [ 570.812395][T24217] netlink: 'syz.3.5570': attribute type 5 has an invalid length. [ 570.988400][T24225] netlink: 'syz.0.5574': attribute type 83 has an invalid length. [ 571.613027][T24287] netlink: 'syz.4.5588': attribute type 72 has an invalid length. [ 572.353512][T24333] syzkaller0: entered promiscuous mode [ 572.388857][T24333] syzkaller0: entered allmulticast mode [ 572.609971][T24355] bond19: entered allmulticast mode [ 572.650618][T24355] veth23: entered allmulticast mode [ 572.672183][T24355] bond19: (slave veth23): Enslaving as an active interface with an up link [ 572.708404][T24355] bond19 (unregistering): (slave veth23): Releasing backup interface [ 572.739603][T24355] bond19 (unregistering): Released all slaves [ 572.995460][T24386] xt_policy: output policy not valid in PREROUTING and INPUT [ 573.380253][T24406] syzkaller1: entered promiscuous mode [ 573.406380][T24406] syzkaller1: entered allmulticast mode [ 573.895880][T24434] netlink: 'syz.1.5621': attribute type 1 has an invalid length. [ 573.926137][T24434] __nla_validate_parse: 18 callbacks suppressed [ 573.926154][T24434] netlink: 348 bytes leftover after parsing attributes in process `syz.1.5621'. [ 574.029085][T24440] netlink: 116 bytes leftover after parsing attributes in process `syz.0.5622'. [ 574.447609][T24469] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5629'. [ 574.481625][T24473] ip6gre1: entered allmulticast mode [ 574.497419][T24469] macsec0: entered promiscuous mode [ 574.525003][T24477] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5629'. [ 574.686014][T24485] bond24: entered allmulticast mode [ 574.732972][T24489] bond19: option min_links: invalid value (18446744073709551614) [ 574.741040][T24489] bond19: option min_links: allowed values 0 - 2147483647 [ 574.754432][T24489] bond19 (unregistering): Released all slaves [ 574.871887][T24485] veth1: entered allmulticast mode [ 574.900901][T24485] bond24: (slave veth1): Enslaving as an active interface with an up link [ 574.953296][T24496] bond24 (unregistering): (slave veth1): Releasing backup interface [ 574.989871][T24496] bond24 (unregistering): Released all slaves [ 575.197267][T24515] tipc: Enabled bearer , priority 10 [ 575.308894][T24522] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5639'. [ 575.362032][T24527] net_ratelimit: 23 callbacks suppressed [ 575.362050][T24527] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 575.448034][T24530] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5639'. [ 575.520069][T24537] x_tables: ip_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 575.549232][T24536] x_tables: ip_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 575.587143][T24536] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5644'. [ 575.726384][T24548] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5645'. [ 576.482097][T24597] netlink: 656 bytes leftover after parsing attributes in process `syz.0.5660'. [ 576.523146][T24597] openvswitch: netlink: Flow key attr not present in new flow. [ 576.913072][T24615] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5665'. [ 577.064965][T24624] validate_nla: 1 callbacks suppressed [ 577.064982][T24624] netlink: 'syz.0.5668': attribute type 1 has an invalid length. [ 577.224643][T24624] 8021q: adding VLAN 0 to HW filter on device bond18 [ 577.239121][T24628] bridge0: entered promiscuous mode [ 577.246032][T24636] netlink: 'syz.3.5670': attribute type 3 has an invalid length. [ 577.275262][T24628] bridge0: entered allmulticast mode [ 577.688633][T24655] netlink: 'syz.2.5674': attribute type 1 has an invalid length. [ 578.339650][T24692] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 578.473647][T24702] syzkaller0: entered promiscuous mode [ 578.510364][T24702] syzkaller0: entered allmulticast mode [ 578.760342][T24722] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 578.917442][T24732] bond19: entered promiscuous mode [ 578.969339][T24732] bond19: entered allmulticast mode [ 578.982078][T24732] 8021q: adding VLAN 0 to HW filter on device bond19 [ 579.068690][T24735] bond6: entered promiscuous mode [ 579.100360][T24735] bond6: entered allmulticast mode [ 579.117532][T24735] 8021q: adding VLAN 0 to HW filter on device bond6 [ 579.296332][T24755] __nla_validate_parse: 10 callbacks suppressed [ 579.296353][T24755] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5707'. [ 579.332234][T24758] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5709'. [ 579.399755][T24761] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 579.424190][T24759] C: renamed from lo (while UP) [ 579.438913][T24759] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 579.612817][T24767] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5712'. [ 579.623252][T24772] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5715'. [ 579.755000][T24780] netlink: 'syz.0.5718': attribute type 1 has an invalid length. [ 579.936665][T24788] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5720'. [ 579.965844][T24793] tipc: Can't bind to reserved service type 1 [ 580.173949][T24806] netlink: 'syz.2.5725': attribute type 3 has an invalid length. [ 580.985948][T24840] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5734'. [ 581.027943][T24842] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5735'. [ 581.213237][T24848] team0: Device gtp0 is up. Set it down before adding it as a team port [ 581.254916][T24855] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5739'. [ 581.310839][T24857] netlink: 'syz.1.5738': attribute type 1 has an invalid length. [ 581.345110][T24857] netlink: 'syz.1.5738': attribute type 3 has an invalid length. [ 581.389913][T24857] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5738'. [ 581.664806][T24879] netlink: 'syz.3.5744': attribute type 9 has an invalid length. [ 581.708893][T24879] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.5744'. [ 581.861590][T24888] sctp: [Deprecated]: syz.1.5746 (pid 24888) Use of struct sctp_assoc_value in delayed_ack socket option. [ 581.861590][T24888] Use struct sctp_sack_info instead [ 581.922435][T24888] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 582.080034][T24893] netlink: 'syz.3.5748': attribute type 1 has an invalid length. [ 582.474131][T24914] vcan1: entered promiscuous mode [ 582.490393][T24914] vcan1: entered allmulticast mode [ 582.755062][T24930] netlink: 'syz.4.5759': attribute type 64 has an invalid length. [ 582.833869][T24933] bond20: option fail_over_mac: invalid value (16) [ 582.870671][T24933] bond20 (unregistering): Released all slaves [ 582.894270][T24946] netlink: 'syz.0.5764': attribute type 26 has an invalid length. [ 582.962861][T24944] syzkaller0: entered promiscuous mode [ 582.990008][T24944] syzkaller0: entered allmulticast mode [ 583.088560][T24953] syzkaller1: entered promiscuous mode [ 583.101341][T24953] syzkaller1: entered allmulticast mode [ 583.137106][T24953] netlink: 'syz.2.5767': attribute type 11 has an invalid length. [ 583.196294][T24966] netlink: 'syz.2.5767': attribute type 1 has an invalid length. [ 583.268130][T24953] netlink: 'syz.2.5767': attribute type 72 has an invalid length. [ 583.831945][T25000] netlink: 'syz.1.5783': attribute type 1 has an invalid length. [ 583.850787][T24999] syzkaller1: entered promiscuous mode [ 583.871694][T24999] syzkaller1: entered allmulticast mode [ 584.055372][T25011] netlink: 'syz.0.5787': attribute type 2 has an invalid length. [ 584.322392][T25028] __nla_validate_parse: 25 callbacks suppressed [ 584.322410][T25028] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5793'. [ 585.034434][T25055] netlink: 'syz.1.5802': attribute type 1 has an invalid length. [ 585.084876][T25055] bond20: entered promiscuous mode [ 585.090458][T25055] 8021q: adding VLAN 0 to HW filter on device bond20 [ 585.106706][T25060] lo: left promiscuous mode [ 585.112007][T25060] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 585.128448][T25060] netlink: 'syz.2.5801': attribute type 1 has an invalid length. [ 585.137124][T25060] netlink: 'syz.2.5801': attribute type 1 has an invalid length. [ 585.145204][T25060] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5801'. [ 585.176291][T25054] syzkaller1: entered promiscuous mode [ 585.181908][T25054] syzkaller1: entered allmulticast mode [ 585.508997][T25081] tipc: Enabling of bearer rejected, failed to enable media [ 585.788248][T25100] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5813'. [ 585.799698][T25098] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.5815'. [ 585.949400][ T5830] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 585.970969][ T5830] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 585.973251][T25103] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5816'. [ 585.987723][ T5830] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 586.000912][T25103] netlink: 658 bytes leftover after parsing attributes in process `syz.3.5816'. [ 586.014249][ T5830] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 586.024021][ T5830] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 586.070595][T25108] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5818'. [ 586.110762][T25106] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 586.193085][T25113] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5821'. [ 586.207358][T25106] syzkaller0: entered promiscuous mode [ 586.229603][T25106] syzkaller0: entered allmulticast mode [ 586.681256][T25134] xt_l2tp: missing protocol rule (udp|l2tpip) [ 586.702121][T25136] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5828'. [ 586.734573][ T140] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 586.771619][ T140] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.786166][ T140] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 586.811142][T25144] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5829'. [ 587.052228][ T140] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.089476][ T140] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.129547][ T140] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 587.340136][T25180] validate_nla: 5 callbacks suppressed [ 587.340155][T25180] netlink: 'syz.4.5837': attribute type 5 has an invalid length. [ 587.372902][ T140] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.384474][ T140] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.397115][ T140] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 587.600120][ T140] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.629693][ T140] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.666902][ T140] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 587.956711][T25101] chnl_net:caif_netlink_parms(): no params data found [ 588.127855][ T50] Bluetooth: hci3: command tx timeout [ 588.129665][T25215] syzkaller0: entered promiscuous mode [ 588.139759][T25215] syzkaller0: entered allmulticast mode [ 588.226620][T25237] bond20: entered allmulticast mode [ 588.365864][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 590.098028][T25237] bridge7: entered promiscuous mode [ 590.103725][T25237] bridge7: entered allmulticast mode [ 590.116081][T25237] bond20: (slave bridge7): Enslaving as an active interface with an up link [ 590.171908][T25246] __nla_validate_parse: 7 callbacks suppressed [ 590.171926][T25246] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5854'. [ 590.205008][ T50] Bluetooth: hci3: command tx timeout [ 590.256278][T25101] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.263536][T25101] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.271381][T25101] bridge_slave_0: entered allmulticast mode [ 590.279459][T25101] bridge_slave_0: entered promiscuous mode [ 590.311225][ T140] bond9: left allmulticast mode [ 590.323708][ T140] bond9: left promiscuous mode [ 590.337939][ T140] bridge0: port 1(bond9) entered disabled state [ 590.371906][T25256] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5858'. [ 590.409360][ T140] dvmrp0: left allmulticast mode [ 590.563219][T25267] netlink: 'syz.2.5862': attribute type 1 has an invalid length. [ 590.572446][T25267] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5862'. [ 590.582971][T25267] netlink: 1 bytes leftover after parsing attributes in process `syz.2.5862'. [ 590.594026][T25267] netlink: 'syz.2.5862': attribute type 1 has an invalid length. [ 590.602638][T25267] netlink: 'syz.2.5862': attribute type 8 has an invalid length. [ 590.611185][T25267] netlink: 606 bytes leftover after parsing attributes in process `syz.2.5862'. [ 590.638154][ T140] bond14 (unregistering): (slave ip6gre1): Releasing backup interface [ 590.750483][ T140] bond16 (unregistering): (slave geneve3): Releasing active interface [ 590.774370][ T140] bridge0 (unregistering): left allmulticast mode [ 590.828550][ T140] bond6 (unregistering): (slave bridge1): Releasing active interface [ 590.870179][ T140] bond8 (unregistering): (slave bridge2): Releasing active interface [ 591.009169][ T140] bond0 (unregistering): Released all slaves [ 591.022220][ T140] bond1 (unregistering): Released all slaves [ 591.036783][ T140] bond2 (unregistering): Released all slaves [ 591.051959][ T140] bond3 (unregistering): Released all slaves [ 591.073003][ T140] bond4 (unregistering): Released all slaves [ 591.087156][ T140] bond5 (unregistering): Released all slaves [ 591.103622][ T140] bond6 (unregistering): Released all slaves [ 591.118573][ T140] bond7 (unregistering): Released all slaves [ 591.131766][ T140] bond8 (unregistering): Released all slaves [ 591.152123][ T140] bond9 (unregistering): Released all slaves [ 591.166854][ T140] bond10 (unregistering): (slave bond11): Releasing active interface [ 591.175807][ T140] bond10 (unregistering): Released all slaves [ 591.189642][ T140] bond11 (unregistering): Released all slaves [ 591.202825][ T140] bond12 (unregistering): Released all slaves [ 591.217405][ T140] bond13 (unregistering): (slave veth7): Releasing backup interface [ 591.226685][ T140] bond13 (unregistering): Released all slaves [ 591.248013][ T140] bond14 (unregistering): Released all slaves [ 591.262597][ T140] bond15 (unregistering): (slave veth0_to_bond): Releasing active interface [ 591.273388][ T140] bond15 (unregistering): Released all slaves [ 591.286527][ T140] bond16 (unregistering): Released all slaves [ 591.308038][ T140] bond17 (unregistering): (slave veth9): Releasing backup interface [ 591.317371][ T140] bond17 (unregistering): Released all slaves [ 591.331150][ T140] bond18 (unregistering): (slave bond19): Releasing backup interface [ 591.340084][ T140] bond18 (unregistering): Released all slaves [ 591.353772][ T140] bond19 (unregistering): Released all slaves [ 591.372290][ T140] bond20 (unregistering): Released all slaves [ 591.386008][T25101] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.393319][T25101] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.403713][T25101] bridge_slave_1: entered allmulticast mode [ 591.411723][T25101] bridge_slave_1: entered promiscuous mode [ 591.515231][T25101] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 591.576276][ T140] tipc: Disabling bearer [ 591.592714][ T140] tipc: Left network mode [ 591.603687][T25101] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 591.718440][T25101] team0: Port device team_slave_0 added [ 591.779017][T25101] team0: Port device team_slave_1 added [ 591.826805][T25288] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5867'. [ 591.846037][T25286] 8021q: VLANs not supported on ip6_vti0 [ 592.138582][T25101] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 592.149473][T25101] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 592.179795][T25101] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 592.283378][T25317] netlink: 'syz.4.5872': attribute type 1 has an invalid length. [ 592.292841][ T50] Bluetooth: hci3: command tx timeout [ 592.341757][T25317] workqueue: Failed to create a rescuer kthread for wq "bond24": -EINTR [ 592.351328][T25101] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 592.426684][T25101] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 592.486498][T25101] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 592.722797][T25101] hsr_slave_0: entered promiscuous mode [ 592.753544][T25101] hsr_slave_1: entered promiscuous mode [ 592.808719][ T140] hsr_slave_1: left promiscuous mode [ 592.869086][ T140] veth1_macvtap: left promiscuous mode [ 592.887572][ T140] veth0_macvtap: left promiscuous mode [ 592.908011][ T140] veth1_vlan: left promiscuous mode [ 592.945409][T25351] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5878'. [ 593.053627][T25355] xt_connbytes: Forcing CT accounting to be enabled [ 593.139785][T25355] xt_CT: No such helper "netbios-ns" [ 593.401373][ T5488] 8021q: adding VLAN 0 to HW filter on device eth1 [ 593.415272][T25364] netlink: 'syz.4.5882': attribute type 3 has an invalid length. [ 593.424606][T25360] syzkaller1: entered promiscuous mode [ 593.454124][T25360] syzkaller1: entered allmulticast mode [ 593.599879][T25378] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5886'. [ 593.706975][T25378] sctp: [Deprecated]: syz.3.5886 (pid 25378) Use of int in maxseg socket option. [ 593.706975][T25378] Use struct sctp_assoc_value instead [ 593.916012][ T140] IPVS: stop unused estimator thread 0... [ 594.020981][T25396] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5889'. [ 594.375995][ T50] Bluetooth: hci3: command tx timeout [ 594.774133][T25444] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5902'. [ 594.832802][T25448] netlink: 'syz.4.5904': attribute type 1 has an invalid length. [ 594.884003][T25442] bond21: option arp_all_targets: invalid value (18446744073709551613) [ 594.884977][T25453] openvswitch: netlink: IP tunnel dst address not specified [ 594.911677][T25442] bond21 (unregistering): Released all slaves [ 595.024888][T25448] 8021q: adding VLAN 0 to HW filter on device bond24 [ 595.046411][T25454] bond24: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 595.060676][T25454] bond24: entered allmulticast mode [ 595.075042][T25457] tipc: Enabling of bearer rejected, already enabled [ 595.251449][T25472] FAULT_INJECTION: forcing a failure. [ 595.251449][T25472] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 595.295516][T25472] CPU: 0 UID: 0 PID: 25472 Comm: syz.0.5909 Not tainted syzkaller #0 PREEMPT(full) [ 595.295541][T25472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 595.295553][T25472] Call Trace: [ 595.295560][T25472] [ 595.295568][T25472] dump_stack_lvl+0xe8/0x150 [ 595.295600][T25472] should_fail_ex+0x412/0x560 [ 595.295628][T25472] _copy_to_user+0x31/0xb0 [ 595.295648][T25472] simple_read_from_buffer+0xe1/0x170 [ 595.295675][T25472] proc_fail_nth_read+0x1bb/0x230 [ 595.295702][T25472] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 595.295729][T25472] ? rw_verify_area+0x2a6/0x4d0 [ 595.295753][T25472] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 595.295777][T25472] vfs_read+0x20c/0xa70 [ 595.295805][T25472] ? __pfx___mutex_lock+0x10/0x10 [ 595.295829][T25472] ? __pfx_vfs_read+0x10/0x10 [ 595.295854][T25472] ? __fget_files+0x2a/0x420 [ 595.295880][T25472] ? __fget_files+0x3a0/0x420 [ 595.295900][T25472] ? __fget_files+0x2a/0x420 [ 595.295929][T25472] ksys_read+0x150/0x270 [ 595.295954][T25472] ? __pfx_ksys_read+0x10/0x10 [ 595.295985][T25472] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.296012][T25472] do_syscall_64+0x15f/0xf80 [ 595.296031][T25472] ? trace_irq_disable+0x3b/0x140 [ 595.296050][T25472] ? clear_bhb_loop+0x40/0x90 [ 595.296070][T25472] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.296088][T25472] RIP: 0033:0x7fac2b55d04e [ 595.296105][T25472] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 595.296120][T25472] RSP: 002b:00007fac2c39afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 595.296139][T25472] RAX: ffffffffffffffda RBX: 00007fac2c39b6c0 RCX: 00007fac2b55d04e [ 595.296153][T25472] RDX: 000000000000000f RSI: 00007fac2c39b0a0 RDI: 0000000000000005 [ 595.296164][T25472] RBP: 00007fac2c39b090 R08: 0000000000000000 R09: 0000000000000000 [ 595.296175][T25472] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 595.296186][T25472] R13: 00007fac2b816038 R14: 00007fac2b815fa0 R15: 00007ffe9dac4758 [ 595.296215][T25472] [ 595.634661][T25101] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 595.653105][T25493] __nla_validate_parse: 4 callbacks suppressed [ 595.653124][T25493] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5914'. [ 595.693409][T25101] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 595.703765][T25101] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 595.719728][T25101] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 595.738291][T25499] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5915'. [ 595.765659][T25101] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 595.785911][T25101] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 595.793725][T25101] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 595.811264][T25101] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 595.882444][T25508] netlink: 'syz.3.5917': attribute type 1 has an invalid length. [ 595.929480][T25508] netlink: 'syz.3.5917': attribute type 3 has an invalid length. [ 595.970096][T25512] h: entered promiscuous mode [ 595.994917][T25508] netlink: 172 bytes leftover after parsing attributes in process `syz.3.5917'. [ 596.019747][T25517] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5919'. [ 596.029509][T25508] NCSI netlink: No device for ifindex 813332851 [ 596.035681][T25101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 596.100448][T25101] 8021q: adding VLAN 0 to HW filter on device team0 [ 596.135279][ T140] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.142459][ T140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 596.182604][ T140] bridge0: port 2(bridge_slave_1) entered blocking state [ 596.189786][ T140] bridge0: port 2(bridge_slave_1) entered forwarding state [ 596.447961][T25542] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5926'. [ 596.470316][T25540] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5925'. [ 596.535259][ T981] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 596.593305][T25550] netlink: 'syz.0.5925': attribute type 1 has an invalid length. [ 596.595035][ T981] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 596.748871][T25540] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5925'. [ 596.789630][T25540] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5925'. [ 596.904587][T25101] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 597.029152][T25571] vlan1: entered allmulticast mode [ 597.049186][T25571] bond0: entered allmulticast mode [ 597.074568][T25573] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 597.119338][T25101] veth0_vlan: entered promiscuous mode [ 597.125496][T25573] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 597.160801][T25101] veth1_vlan: entered promiscuous mode [ 597.232713][T25586] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5940'. [ 597.268519][T25101] veth0_macvtap: entered promiscuous mode [ 597.299654][T25101] veth1_macvtap: entered promiscuous mode [ 597.342118][T25591] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5942'. [ 597.381282][T25101] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 597.434130][T25596] bond11: (slave lo): Releasing backup interface [ 597.443391][T25596] bond11: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 597.460390][T25596] bridge_slave_0: left allmulticast mode [ 597.468504][T25596] bridge_slave_0: left promiscuous mode [ 597.481969][T25596] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.500272][T25596] bridge_slave_1: left promiscuous mode [ 597.511490][T25596] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.544111][T25596] bond17: (slave veth0_to_bond): Releasing active interface [ 597.576280][T25596] team0: Port device team_slave_0 removed [ 597.591783][T25596] team0: Port device team_slave_1 removed [ 597.603721][T25596] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 597.624666][T25101] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 597.661947][T25591] bond8: (slave vxcan5): The slave device specified does not support setting the MAC address [ 597.674177][T25591] bond8: (slave vxcan5): Error -95 calling set_mac_address [ 597.723775][ T35] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.741181][ T35] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.761139][ T35] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.791350][ T35] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.865719][T25612] netlink: 'syz.2.5945': attribute type 6 has an invalid length. [ 598.042268][T25623] FAULT_INJECTION: forcing a failure. [ 598.042268][T25623] name failslab, interval 1, probability 0, space 0, times 0 [ 598.046785][T23016] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 598.073038][T25620] netlink: 'syz.3.5947': attribute type 3 has an invalid length. [ 598.079781][T23016] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 598.112232][T25623] CPU: 1 UID: 0 PID: 25623 Comm: syz.0.5948 Not tainted syzkaller #0 PREEMPT(full) [ 598.112254][T25623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 598.112265][T25623] Call Trace: [ 598.112273][T25623] [ 598.112279][T25623] dump_stack_lvl+0xe8/0x150 [ 598.112309][T25623] should_fail_ex+0x412/0x560 [ 598.112338][T25623] should_failslab+0xa8/0x100 [ 598.112359][T25623] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 598.112384][T25623] ? __alloc_skb+0x186/0x7d0 [ 598.112406][T25623] ? __alloc_skb+0x1d0/0x7d0 [ 598.112426][T25623] ? __local_bh_enable_ip+0xd0/0x130 [ 598.112452][T25623] __alloc_skb+0x1d0/0x7d0 [ 598.112478][T25623] netlink_sendmsg+0x5d4/0xb40 [ 598.112511][T25623] ? __pfx_netlink_sendmsg+0x10/0x10 [ 598.112538][T25623] ? aa_sock_msg_perm+0xf1/0x1b0 [ 598.112562][T25623] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 598.112595][T25623] ____sys_sendmsg+0x972/0x9f0 [ 598.112627][T25623] ? __pfx_____sys_sendmsg+0x10/0x10 [ 598.112660][T25623] ? import_iovec+0x73/0xa0 [ 598.112682][T25623] ___sys_sendmsg+0x2a5/0x360 [ 598.112705][T25623] ? __lock_acquire+0x6b5/0x2cf0 [ 598.112732][T25623] ? __pfx____sys_sendmsg+0x10/0x10 [ 598.112785][T25623] ? __fget_files+0x2a/0x420 [ 598.112812][T25623] ? __fget_files+0x3a0/0x420 [ 598.112840][T25623] __x64_sys_sendmsg+0x1bd/0x2a0 [ 598.112867][T25623] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 598.112900][T25623] ? __pfx_ksys_write+0x10/0x10 [ 598.112931][T25623] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.112950][T25623] do_syscall_64+0x15f/0xf80 [ 598.112970][T25623] ? trace_irq_disable+0x3b/0x140 [ 598.112989][T25623] ? clear_bhb_loop+0x40/0x90 [ 598.113008][T25623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.113022][T25623] RIP: 0033:0x7fac2b59c819 [ 598.113036][T25623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 598.113051][T25623] RSP: 002b:00007fac2c39b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 598.113069][T25623] RAX: ffffffffffffffda RBX: 00007fac2b815fa0 RCX: 00007fac2b59c819 [ 598.113082][T25623] RDX: 0000000004040040 RSI: 0000200000000180 RDI: 0000000000000003 [ 598.113093][T25623] RBP: 00007fac2c39b090 R08: 0000000000000000 R09: 0000000000000000 [ 598.113104][T25623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 598.113114][T25623] R13: 00007fac2b816038 R14: 00007fac2b815fa0 R15: 00007ffe9dac4758 [ 598.113143][T25623] [ 598.182763][T23003] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 598.212533][T25628] netlink: 'syz.2.5949': attribute type 1 has an invalid length. [ 598.226030][T23003] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 598.367391][T25628] 8021q: adding VLAN 0 to HW filter on device bond20 [ 598.394340][T25630] bond17: (slave veth0_to_bond): Releasing active interface [ 598.410933][T25630] bond20: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 598.521593][T25639] netlink: 'syz.2.5952': attribute type 1 has an invalid length. [ 598.585739][T25639] bond21: entered promiscuous mode [ 598.591262][T25639] 8021q: adding VLAN 0 to HW filter on device bond21 [ 598.657771][T25639] 8021q: adding VLAN 0 to HW filter on device bond21 [ 598.683201][T25639] bond21: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 598.737999][T25639] bond21: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 598.740854][ T5830] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 598.762912][ T5830] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 598.771244][ T5830] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 598.779359][ T5830] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 598.787794][ T5830] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 598.807587][T25639] bond21: (slave ip6gre1): making interface the new active one [ 598.830902][T25639] ip6gre1: entered promiscuous mode [ 598.851607][T25639] bond21: (slave ip6gre1): Enslaving as an active interface with an up link [ 599.014483][T25659] nftables ruleset with unbound set [ 599.214598][T25669] netlink: 'syz.2.5961': attribute type 1 has an invalid length. [ 599.267966][T25671] geneve2: entered promiscuous mode [ 599.273204][T25671] geneve2: entered allmulticast mode [ 599.301047][T25669] 8021q: adding VLAN 0 to HW filter on device bond22 [ 599.320801][T25674] bond20: (slave veth0_to_bond): Releasing active interface [ 599.338219][T25674] bond22: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 599.498449][T25648] chnl_net:caif_netlink_parms(): no params data found [ 599.615267][T25687] Cannot find add_set index 2 as target [ 599.668127][T25648] bridge0: port 1(bridge_slave_0) entered blocking state [ 599.676932][T25648] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.684386][T25648] bridge_slave_0: entered allmulticast mode [ 599.692752][T25648] bridge_slave_0: entered promiscuous mode [ 599.701561][T25648] bridge0: port 2(bridge_slave_1) entered blocking state [ 599.709214][T25648] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.716984][T25648] bridge_slave_1: entered allmulticast mode [ 599.727273][T25648] bridge_slave_1: entered promiscuous mode [ 599.892683][T25648] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 599.930325][T25648] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 600.035422][T25648] team0: Port device team_slave_0 added [ 600.091599][T25648] team0: Port device team_slave_1 added [ 600.162750][T25648] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 600.178080][T25648] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.217046][T25648] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 600.232594][T25648] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 600.236959][T25715] netlink: 'syz.3.5973': attribute type 1 has an invalid length. [ 600.240321][T25648] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.300283][T25648] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 600.456233][T25648] hsr_slave_0: entered promiscuous mode [ 600.463051][T25648] hsr_slave_1: entered promiscuous mode [ 600.469795][T25648] debugfs: 'hsr0' already exists in 'hsr' [ 600.476996][T25648] Cannot create hsr debugfs directory [ 600.663797][T25746] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 600.683325][T25748] __nla_validate_parse: 15 callbacks suppressed [ 600.683342][T25748] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5984'. [ 600.701762][T25704] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 600.701830][T25748] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 600.708183][T25704] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 600.773213][T25750] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5985'. [ 600.793925][T25648] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.805291][T25648] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.823770][T25752] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5985'. [ 600.838832][T25704] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 600.843677][T25752] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5985'. [ 600.844972][ T50] Bluetooth: hci5: command tx timeout [ 600.854380][T25752] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5985'. [ 600.865209][T25704] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 600.885089][T25748] syzkaller0: entered promiscuous mode [ 600.891472][T25752] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5985'. [ 600.893311][T25748] syzkaller0: entered allmulticast mode [ 600.902291][T25752] netlink: 'syz.0.5985': attribute type 12 has an invalid length. [ 600.912130][T25704] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 600.918037][T25748] delete_channel: no stack [ 600.921562][T25704] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 600.926723][T25752] netlink: 'syz.0.5985': attribute type 11 has an invalid length. [ 600.953319][T25648] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.964094][T25648] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.020361][T25704] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 601.041155][T25704] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 601.076262][T25648] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.088121][T25648] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.172627][T25704] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 601.182532][T25704] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 601.206251][T25648] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 601.217520][T25648] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.287902][T25758] bond1: entered promiscuous mode [ 601.293077][T25758] bond1: entered allmulticast mode [ 601.299813][T25758] 8021q: adding VLAN 0 to HW filter on device bond1 [ 601.307641][T25759] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5987'. [ 601.341980][T25759] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5987'. [ 601.388393][T25759] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5987'. [ 601.422466][T25771] bond5: (slave veth0_to_bond): Releasing active interface [ 601.445793][T25759] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5987'. [ 601.616977][T25783] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 601.804233][T25648] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 601.821341][T25648] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 601.832821][T25792] xt_NFQUEUE: number of total queues is 0 [ 601.840147][T25648] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 601.864068][T25648] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 601.872160][T25797] netlink: 'syz.3.5999': attribute type 29 has an invalid length. [ 601.885962][T25648] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 601.910614][T25648] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 601.924164][T25648] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 601.937603][T25648] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 601.978073][T25801] bond0: entered promiscuous mode [ 601.993484][T25801] bond15: entered promiscuous mode [ 602.012129][T25801] batadv0: entered promiscuous mode [ 602.029879][T25801] debugfs: 'hsr1' already exists in 'hsr' [ 602.037404][T25801] Cannot create hsr debugfs directory [ 602.043651][T25801] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 602.054567][T25801] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 602.062512][T25801] bond0: left promiscuous mode [ 602.067757][T25801] bond15: left promiscuous mode [ 602.073612][T25801] batadv0: left promiscuous mode [ 602.254346][T25648] 8021q: adding VLAN 0 to HW filter on device bond0 [ 602.278907][T25648] 8021q: adding VLAN 0 to HW filter on device team0 [ 602.305638][T23003] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.312850][T23003] bridge0: port 1(bridge_slave_0) entered forwarding state [ 602.338537][T23016] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.345745][T23016] bridge0: port 2(bridge_slave_1) entered forwarding state [ 602.800778][T25648] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 603.150934][T25648] veth0_vlan: entered promiscuous mode [ 603.223225][T25648] veth1_vlan: entered promiscuous mode [ 603.265791][T25648] veth0_macvtap: entered promiscuous mode [ 603.290834][T25648] veth1_macvtap: entered promiscuous mode [ 603.325443][T25648] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 603.358404][T25648] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 603.372870][ T132] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.391035][ T132] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.423240][ T132] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.445958][ T132] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.501325][T25879] bond21: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 603.525856][T25885] netlink: 'syz.2.6019': attribute type 4 has an invalid length. [ 603.534904][T25879] bond21 (unregistering): Released all slaves [ 603.831058][T23003] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 603.855224][T23003] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 603.924707][T25896] netlink: 'syz.0.6022': attribute type 1 has an invalid length. [ 603.948882][T23003] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 603.969102][T25896] netlink: 'syz.0.6022': attribute type 1 has an invalid length. [ 603.977320][T23003] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 604.016244][T25901] bond23: entered allmulticast mode [ 604.074617][T25901] veth25: entered allmulticast mode [ 604.103367][T25901] bond23: (slave veth25): Enslaving as an active interface with an up link [ 604.716350][T25945] xt_CT: You must specify a L4 protocol and not use inversions on it [ 604.745694][T25947] openvswitch: netlink: Missing key (keys=40, expected=80) [ 604.820511][T25953] syzkaller1: entered promiscuous mode [ 604.829589][T25953] syzkaller1: entered allmulticast mode [ 604.923651][T25958] netlink: 'syz.3.6040': attribute type 5 has an invalid length. [ 604.999394][T25962] bond24: entered allmulticast mode [ 605.052990][T25962] veth27: entered allmulticast mode [ 605.069486][T25962] bond24: (slave veth27): Enslaving as an active interface with an up link [ 605.231794][T25977] netlink: 'syz.2.6044': attribute type 1 has an invalid length. [ 605.280782][T25977] 8021q: adding VLAN 0 to HW filter on device bond25 [ 605.469028][T25999] netlink: 'syz.0.6052': attribute type 1 has an invalid length. [ 605.512981][T25999] 8021q: adding VLAN 0 to HW filter on device bond21 [ 605.549656][T25999] bond21: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 605.647736][ T5830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 605.663092][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 605.672758][ T5830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 605.689397][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 605.697253][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 605.777666][T26007] veth3: entered allmulticast mode [ 605.795584][T26007] team0: Port device veth3 added [ 605.946209][T26020] tipc: Enabling of bearer rejected, already enabled [ 606.181328][T26035] __nla_validate_parse: 19 callbacks suppressed [ 606.181347][T26035] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6062'. [ 606.217042][T26036] netlink: 640 bytes leftover after parsing attributes in process `syz.4.6060'. [ 606.229446][T26036] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 606.323623][T26044] netlink: 'syz.0.6064': attribute type 3 has an invalid length. [ 606.351130][T26004] chnl_net:caif_netlink_parms(): no params data found [ 606.395045][T26049] bond0: Caught tx_queue_len zero misconfig [ 606.409650][T26049] "syz.0.6065" (26049) uses obsolete ecb(arc4) skcipher [ 606.632310][T26004] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.649755][T26004] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.665001][T26004] bridge_slave_0: entered allmulticast mode [ 606.680003][T26004] bridge_slave_0: entered promiscuous mode [ 606.697640][T26004] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.716123][T26004] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.737718][T26004] bridge_slave_1: entered allmulticast mode [ 606.749990][T26004] bridge_slave_1: entered promiscuous mode [ 606.905543][T26004] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 606.953874][T26004] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 607.062430][T26004] team0: Port device team_slave_0 added [ 607.089814][T26004] team0: Port device team_slave_1 added [ 607.176996][T26093] ipt_REJECT: TCP_RESET invalid for non-tcp [ 607.179728][T26004] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 607.193251][T26004] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 607.226547][T26004] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 607.241802][T26097] delete_channel: no stack [ 607.260365][T26004] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 607.280884][T26004] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 607.334588][ T797] IPVS: starting estimator thread 0... [ 607.341643][T26004] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 607.370869][T26098] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 607.389457][T26098] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 607.429509][T26106] netlink: set zone limit has 4 unknown bytes [ 607.435924][T26112] IPVS: using max 33 ests per chain, 79200 per kthread [ 607.442123][T26114] bond22: entered allmulticast mode [ 607.557408][T26114] veth19: entered allmulticast mode [ 607.572769][T26114] bond22: (slave veth19): Enslaving as an active interface with an up link [ 607.612058][T26004] hsr_slave_0: entered promiscuous mode [ 607.618224][T26120] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6084'. [ 607.628387][T26004] hsr_slave_1: entered promiscuous mode [ 607.628478][T26124] ipt_ECN: cannot use operation on non-tcp rule [ 607.636994][T26004] debugfs: 'hsr0' already exists in 'hsr' [ 607.648210][T26004] Cannot create hsr debugfs directory [ 607.732046][ T5830] Bluetooth: hci0: command tx timeout [ 607.967543][T26129] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6087'. [ 608.018222][T26127] syzkaller0: entered promiscuous mode [ 608.023971][T26127] syzkaller0: entered allmulticast mode [ 608.079666][T26138] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6089'. [ 608.294995][T26159] netlink: 'syz.1.6092': attribute type 20 has an invalid length. [ 608.314658][T26159] IPv6: NLM_F_CREATE should be specified when creating new route [ 609.807224][ T5830] Bluetooth: hci0: command tx timeout [ 609.998199][T26148] netlink: 112 bytes leftover after parsing attributes in process `syz.4.6091'. [ 610.204462][T23016] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 610.222674][T23016] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 610.238353][T23016] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.238629][T26177] netlink: 'syz.0.6095': attribute type 1 has an invalid length. [ 610.313120][T26169] veth0: entered promiscuous mode [ 610.383728][T26177] syz.0.6095: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 610.403244][T26177] CPU: 0 UID: 0 PID: 26177 Comm: syz.0.6095 Not tainted syzkaller #0 PREEMPT(full) [ 610.403275][T26177] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 610.403288][T26177] Call Trace: [ 610.403296][T26177] [ 610.403305][T26177] dump_stack_lvl+0xe8/0x150 [ 610.403340][T26177] warn_alloc+0x249/0x340 [ 610.403372][T26177] ? stack_trace_save+0xa9/0x100 [ 610.403398][T26177] ? __pfx_warn_alloc+0x10/0x10 [ 610.403433][T26177] ? kasan_save_track+0x4f/0x80 [ 610.403461][T26177] ? kasan_save_track+0x3e/0x80 [ 610.403486][T26177] ? __kasan_kmalloc+0x93/0xb0 [ 610.403503][T26177] ? __kmalloc_cache_noprof+0x31c/0x660 [ 610.403528][T26177] ? xskq_create+0x56/0x170 [ 610.403549][T26177] ? xsk_setsockopt+0x54c/0x990 [ 610.403566][T26177] ? do_sock_setsockopt+0x17c/0x1b0 [ 610.403593][T26177] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 610.403621][T26177] ? do_syscall_64+0x15f/0xf80 [ 610.403649][T26177] __vmalloc_node_range_noprof+0x132/0x1730 [ 610.403706][T26177] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 610.403743][T26177] ? __kasan_kmalloc+0x93/0xb0 [ 610.403768][T26177] vmalloc_user_noprof+0xad/0xe0 [ 610.403797][T26177] ? xskq_create+0xbf/0x170 [ 610.403819][T26177] xskq_create+0xbf/0x170 [ 610.403843][T26177] xsk_init_queue+0x8a/0xe0 [ 610.403866][T26177] xsk_setsockopt+0x54c/0x990 [ 610.403887][T26177] ? __pfx_xsk_setsockopt+0x10/0x10 [ 610.403905][T26177] ? __pfx_aa_sk_perm+0x10/0x10 [ 610.403930][T26177] ? aa_sock_opt_perm+0xff/0x1a0 [ 610.403958][T26177] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 610.403995][T26177] ? __pfx_xsk_setsockopt+0x10/0x10 [ 610.404017][T26177] do_sock_setsockopt+0x17c/0x1b0 [ 610.404049][T26177] __x64_sys_setsockopt+0x13d/0x1b0 [ 610.404080][T26177] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.404102][T26177] do_syscall_64+0x15f/0xf80 [ 610.404124][T26177] ? trace_irq_disable+0x3b/0x140 [ 610.404142][T26177] ? clear_bhb_loop+0x40/0x90 [ 610.404165][T26177] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.404184][T26177] RIP: 0033:0x7fac2b59c819 [ 610.404204][T26177] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 610.404220][T26177] RSP: 002b:00007fac2c37a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 610.404241][T26177] RAX: ffffffffffffffda RBX: 00007fac2b816090 RCX: 00007fac2b59c819 [ 610.404256][T26177] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009 [ 610.404267][T26177] RBP: 00007fac2b632c91 R08: 0000000000000004 R09: 0000000000000000 [ 610.404279][T26177] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 610.404291][T26177] R13: 00007fac2b816128 R14: 00007fac2b816090 R15: 00007ffe9dac4758 [ 610.404321][T26177] [ 610.404508][T26177] Mem-Info: [ 610.532694][T26187] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6095'. [ 610.554566][T26177] active_anon:6458 inactive_anon:0 isolated_anon:0 [ 610.554566][T26177] active_file:3538 inactive_file:40154 isolated_file:0 [ 610.554566][T26177] unevictable:768 dirty:54 writeback:0 [ 610.554566][T26177] slab_reclaimable:12379 slab_unreclaimable:121170 [ 610.554566][T26177] mapped:30929 shmem:1534 pagetables:1384 [ 610.554566][T26177] sec_pagetables:0 bounce:0 [ 610.554566][T26177] kernel_misc_reclaimable:0 [ 610.554566][T26177] free:1253888 free_pcp:21258 free_cma:0 [ 610.807609][T26177] Node 0 active_anon:32676kB inactive_anon:0kB active_file:14152kB inactive_file:160416kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:118276kB dirty:272kB writeback:0kB shmem:11428kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17444kB pagetables:5464kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 610.856814][T26177] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:20480kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 610.887759][T26177] Node 0 DMA free:11256kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 610.918333][T26177] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 610.924207][T26177] Node 0 DMA32 free:1251704kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:36476kB inactive_anon:0kB active_file:14152kB inactive_file:160416kB unevictable:1536kB writepending:272kB zspages:0kB present:3129332kB managed:2551532kB mlocked:0kB bounce:0kB free_pcp:24204kB local_pcp:4872kB free_cma:0kB [ 610.958931][T26177] lowmem_reserve[]: 0 0 0 0 0 [ 610.963733][T26177] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:612kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 610.993541][T26177] lowmem_reserve[]: 0 0 0 0 0 [ 610.998385][T26177] Node 1 Normal free:3583940kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:51256kB local_pcp:23484kB free_cma:0kB [ 610.998911][T23016] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 611.042991][T26177] lowmem_reserve[]: 0 0 0 0 0 [ 611.043042][T26177] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 1*4096kB (M) = 11256kB [ 611.056215][T23016] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 611.064324][T26177] Node 0 DMA32: 3593*4kB (UME) 5819*8kB (UME) 3179*16kB (UME) 497*32kB (UME) 287*64kB (UME) 893*128kB (UME) 904*256kB (UME) 458*512kB (UME) 297*1024kB (UME) 108*2048kB (U) 0*4096kB = 1251596kB [ 611.074689][T23016] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.093803][T26177] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 611.118073][T26177] Node 1 Normal: 2*4kB (U) 6*8kB (UM) 10*16kB (UM) 13*32kB (UM) [ 611.118328][T26169] veth0: left promiscuous mode [ 611.131094][T26177] 10*64kB (UM) 8*128kB (UM) 7*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 2*2048kB (U) 872*4096kB (M) = 3583992kB [ 611.145930][T26177] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 611.186573][T26177] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 611.204811][T26177] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 611.228954][T26177] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 611.235140][T23016] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 611.248583][T26177] 46881 total pagecache pages [ 611.248610][T26177] 0 pages in swap cache [ 611.248619][T26177] Free swap = 124996kB [ 611.248628][T26177] Total swap = 124996kB [ 611.248638][T26177] 2097051 pages RAM [ 611.248646][T26177] 0 pages HighMem/MovableOnly [ 611.248655][T26177] 427400 pages reserved [ 611.248664][T26177] 0 pages cma reserved [ 611.326791][T23016] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 611.368875][T23016] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.525221][T23016] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 611.562863][T23016] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 611.589975][T26201] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6101'. [ 611.606433][T23016] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.885550][ T5830] Bluetooth: hci0: command tx timeout [ 612.289150][T26225] veth1_macvtap: left promiscuous mode [ 612.305953][T26225] macsec0: entered promiscuous mode [ 612.316070][T26224] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6107'. [ 612.319684][T26225] macsec0: entered allmulticast mode [ 612.493582][T26231] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6107'. [ 612.919957][T23016] bond0 (unregistering): Released all slaves [ 612.931554][T23016] bond1 (unregistering): Released all slaves [ 612.945883][T23016] bond2 (unregistering): Released all slaves [ 612.960279][T23016] bond3 (unregistering): Released all slaves [ 612.978834][T23016] bond4 (unregistering): (slave veth7): Releasing backup interface [ 612.991889][T23016] bond4 (unregistering): Released all slaves [ 613.008998][T23016] bond5 (unregistering): Released all slaves [ 613.023107][T23016] bond6 (unregistering): Released all slaves [ 613.039172][T23016] bond7 (unregistering): Released all slaves [ 613.052249][T23016] bond8 (unregistering): Released all slaves [ 613.080855][T26228] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 613.098376][T26228] bridge0: port 2(bridge_slave_1) entered disabled state [ 613.106223][T26228] bridge0: port 1(bridge_slave_0) entered disabled state [ 613.125799][T26233] veth1_macvtap: entered promiscuous mode [ 613.150772][T26233] veth1_macvtap: entered allmulticast mode [ 613.157306][T26233] macsec0: left promiscuous mode [ 613.162722][T26233] macsec0: left allmulticast mode [ 613.187731][T26233] veth1_macvtap: left allmulticast mode [ 613.218343][T23016] 9: left promiscuous mode [ 613.454980][T23016] tipc: Disabling bearer [ 613.462764][T23016] tipc: Left network mode [ 613.515692][T23016] IPVS: stopping backup sync thread 24761 ... [ 613.689956][T26250] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6116'. [ 613.708857][T26254] ip6tnl0: Caught tx_queue_len zero misconfig [ 613.728508][T26250] netlink: 'syz.4.6116': attribute type 5 has an invalid length. [ 613.787114][T26250] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6116'. [ 613.965777][ T5830] Bluetooth: hci0: command tx timeout [ 613.990029][T26273] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6121'. [ 614.219982][T26288] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6125'. [ 614.481956][T23016] veth1_vlan: left promiscuous mode [ 614.486952][T26305] netlink: 'syz.0.6126': attribute type 1 has an invalid length. [ 614.518021][T23016] veth0_vlan: left promiscuous mode [ 614.573627][T26308] ipt_REJECT: TCP_RESET invalid for non-tcp [ 614.909575][T26305] workqueue: Failed to create a rescuer kthread for wq "bond23": -EINTR [ 615.209148][T26328] netlink: 'syz.2.6131': attribute type 1 has an invalid length. [ 615.269900][T26004] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 615.282795][T26341] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6134'. [ 615.314503][T26004] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 615.368137][T26346] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6136'. [ 615.370693][T26328] bond26: entered promiscuous mode [ 615.383104][T26328] 8021q: adding VLAN 0 to HW filter on device bond26 [ 615.422499][T26004] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 615.478954][T26004] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 615.505634][T26004] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 615.520625][T26004] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 615.540491][T26004] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 615.565993][T26358] netlink: 'syz.4.6137': attribute type 3 has an invalid length. [ 615.592674][T26004] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 615.600767][T26357] team0: entered promiscuous mode [ 615.608551][T26357] vxcan1: entered promiscuous mode [ 615.732368][T23016] IPVS: stop unused estimator thread 0... [ 615.797900][T26372] sit0: Caught tx_queue_len zero misconfig [ 615.816605][T26376] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6141'. [ 616.024076][T26387] netlink: 'syz.1.6140': attribute type 1 has an invalid length. [ 616.046324][T26004] 8021q: adding VLAN 0 to HW filter on device bond0 [ 616.249433][T26387] 8021q: adding VLAN 0 to HW filter on device bond3 [ 616.352194][T26390] bond23: option xmit_hash_policy: invalid value (64) [ 616.378542][T26390] bond23 (unregistering): Released all slaves [ 616.601983][T26004] 8021q: adding VLAN 0 to HW filter on device team0 [ 616.628008][ T132] bridge0: port 1(bridge_slave_0) entered blocking state [ 616.635195][ T132] bridge0: port 1(bridge_slave_0) entered forwarding state [ 616.675598][ T132] bridge0: port 2(bridge_slave_1) entered blocking state [ 616.682774][ T132] bridge0: port 2(bridge_slave_1) entered forwarding state [ 616.857666][T26434] __nla_validate_parse: 2 callbacks suppressed [ 616.857686][T26434] netlink: 244 bytes leftover after parsing attributes in process `syz.0.6153'. [ 617.029595][T26439] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6155'. [ 617.140408][T26439] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 617.160292][T26439] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 617.217631][T26004] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 617.342231][T26004] veth0_vlan: entered promiscuous mode [ 617.380338][T26463] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6163'. [ 617.400006][T26463] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6163'. [ 617.417624][T26004] veth1_vlan: entered promiscuous mode [ 617.591907][T26471] gtp0: entered promiscuous mode [ 617.597447][T26471] gtp0: entered allmulticast mode [ 617.603747][T26473] netem: change failed [ 617.622282][T26004] veth0_macvtap: entered promiscuous mode [ 617.639267][T26004] veth1_macvtap: entered promiscuous mode [ 617.646889][T26471] Bluetooth: MGMT ver 1.23 [ 617.683572][T26004] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 617.708475][T26004] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 617.744391][T23005] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.756467][T23005] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.768788][T23005] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.785972][T23005] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.862111][T26484] x_tables: duplicate underflow at hook 2 [ 617.999737][T26493] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6172'. [ 618.150269][T26495] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 618.174502][T26500] Bluetooth: hci2: Opcode 0x0401 failed: -22 [ 618.181979][T26495] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 618.226739][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 618.249875][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 618.353453][T26504] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 618.382061][T23003] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 618.396182][T23003] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 618.988430][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 619.003126][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 619.018083][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 619.029566][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 619.040570][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 619.058164][T26540] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6187'. [ 619.113882][T26540] bond27: (slave vxcan5): The slave device specified does not support setting the MAC address [ 619.126473][T26540] bond27: (slave vxcan5): Error -95 calling set_mac_address [ 619.160309][T26541] syzkaller0: entered promiscuous mode [ 619.168268][T26541] syzkaller0: entered allmulticast mode [ 619.232675][T26545] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6188'. [ 619.496963][T26555] netlink: 'syz.3.6193': attribute type 2 has an invalid length. [ 619.804950][T26572] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6199'. [ 619.956121][T26580] netlink: 'syz.2.6200': attribute type 3 has an invalid length. [ 620.018875][T26574] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 620.031226][T26574] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 620.266775][T26602] netlink: 'syz.2.6203': attribute type 10 has an invalid length. [ 620.280854][T26602] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6203'. [ 620.293510][T26583] syzkaller0: entered promiscuous mode [ 620.300739][T26583] syzkaller0: entered allmulticast mode [ 620.504137][T26612] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 620.509102][T26533] chnl_net:caif_netlink_parms(): no params data found [ 620.554175][T26616] netlink: 'syz.2.6207': attribute type 1 has an invalid length. [ 620.590296][T26620] netlink: 'syz.4.6210': attribute type 1 has an invalid length. [ 620.618497][T26624] netlink: 'syz.3.6211': attribute type 3 has an invalid length. [ 620.652621][T26616] 8021q: adding VLAN 0 to HW filter on device bond28 [ 620.678560][T26610] bond22: (slave veth0_to_bond): Releasing active interface [ 620.700743][T26610] bond28: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 620.759797][T26620] 8021q: adding VLAN 0 to HW filter on device bond3 [ 620.771880][T26627] bond28: entered promiscuous mode [ 620.780326][T26627] bond28: entered allmulticast mode [ 620.803832][T26622] bridge0: entered allmulticast mode [ 620.886762][T26641] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6213'. [ 620.961739][T26648] netlink: 'syz.4.6215': attribute type 39 has an invalid length. [ 621.087238][ T50] Bluetooth: hci4: command tx timeout [ 621.303789][T26646] ieee80211 .: Failed to add default virtual iface [ 621.317140][T26533] bridge0: port 1(bridge_slave_0) entered blocking state [ 621.327148][T26533] bridge0: port 1(bridge_slave_0) entered disabled state [ 621.336525][T26533] bridge_slave_0: entered allmulticast mode [ 621.357641][T26533] bridge_slave_0: entered promiscuous mode [ 621.373727][T26533] bridge0: port 2(bridge_slave_1) entered blocking state [ 621.383177][T26533] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.390753][T26533] bridge_slave_1: entered allmulticast mode [ 621.401761][T26533] bridge_slave_1: entered promiscuous mode [ 621.438190][T23005] veth0_to_team: left allmulticast mode [ 621.778728][T23005] bond13 (unregistering): (slave bridge4): Releasing backup interface [ 621.919701][T23005] bond20 (unregistering): (slave bridge7): Releasing backup interface [ 621.958785][T23005] bond1 (unregistering): Released all slaves [ 621.972355][T23005] bond2 (unregistering): Released all slaves [ 621.987110][T23005] bond3 (unregistering): Released all slaves [ 622.001867][T23005] bond4 (unregistering): Released all slaves [ 622.023209][T23005] bond5 (unregistering): Released all slaves [ 622.037116][T23005] bond6 (unregistering): Released all slaves [ 622.054088][T23005] bond7 (unregistering): Released all slaves [ 622.088121][T23005] bond8 (unregistering): Released all slaves [ 622.123622][T23005] bond9 (unregistering): Released all slaves [ 622.129182][T26681] __nla_validate_parse: 3 callbacks suppressed [ 622.129198][T26681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6222'. [ 622.154448][T23005] bond10 (unregistering): (slave veth11): Releasing backup interface [ 622.169429][T23005] bond10 (unregistering): Released all slaves [ 622.183717][T23005] bond11 (unregistering): Released all slaves [ 622.197969][T23005] bond12 (unregistering): Released all slaves [ 622.215259][T23005] bond13 (unregistering): Released all slaves [ 622.239643][T23005] bond14 (unregistering): (slave veth13): Releasing backup interface [ 622.251131][T23005] bond14 (unregistering): Released all slaves [ 622.265560][T23005] bond0 (unregistering): (slave bond15): Releasing backup interface [ 622.274339][T23005] bond0 (unregistering): Released all slaves [ 622.294478][T23005] bond15 (unregistering): Released all slaves [ 622.309637][T23005] bond16 (unregistering): (slave veth15): Releasing backup interface [ 622.338170][T23005] bond16 (unregistering): Released all slaves [ 622.361665][T23005] bond17 (unregistering): Released all slaves [ 622.375011][T23005] bond18 (unregistering): Released all slaves [ 622.388386][T23005] bond19 (unregistering): Released all slaves [ 622.404701][T23005] bond20 (unregistering): Released all slaves [ 622.425300][T23005] bond21 (unregistering): (slave veth0_to_bond): Releasing active interface [ 622.436462][T23005] bond21 (unregistering): Released all slaves [ 622.450871][T23005] bond22 (unregistering): (slave veth19): Releasing backup interface [ 622.469019][T23005] bond22 (unregistering): Released all slaves [ 622.482624][T26646] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 622.637680][T26533] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 622.648611][T26686] netlink: 'syz.4.6223': attribute type 10 has an invalid length. [ 622.672584][T26687] netlink: 'syz.1.6225': attribute type 1 has an invalid length. [ 622.692886][T26686] team0: Device ipvlan1 failed to register rx_handler [ 622.701452][T26688] netlink: 'syz.3.6224': attribute type 1 has an invalid length. [ 622.735693][T26533] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 622.749548][T26686] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6223'. [ 622.762641][T26691] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6226'. [ 622.771867][T23005] : left promiscuous mode [ 622.828153][T26533] team0: Port device team_slave_0 added [ 622.840209][T26533] team0: Port device team_slave_1 added [ 622.960250][T26694] bond29: (slave vxcan5): The slave device specified does not support setting the MAC address [ 622.983200][T26694] bond29: (slave vxcan5): Error -95 calling set_mac_address [ 623.008950][T26688] veth1_to_bond: entered promiscuous mode [ 623.016071][T26688] veth1_to_bond: entered allmulticast mode [ 623.036438][T23005] tipc: Disabling bearer [ 623.043301][T23005] tipc: Left network mode [ 623.047252][T26533] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 623.094622][T26533] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 623.175075][ T50] Bluetooth: hci4: command tx timeout [ 623.191077][T26533] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 623.282981][T26533] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 623.293857][T26533] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 623.377907][T26533] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 623.610348][T26727] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6232'. [ 623.673171][T26533] hsr_slave_0: entered promiscuous mode [ 623.698549][T26533] hsr_slave_1: entered promiscuous mode [ 623.723096][T26533] debugfs: 'hsr0' already exists in 'hsr' [ 623.742599][T26533] Cannot create hsr debugfs directory [ 623.886186][T26738] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6235'. [ 623.886385][T26732] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6235'. [ 623.897097][T26741] netlink: 'syz.2.6237': attribute type 1 has an invalid length. [ 623.935704][T26738] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6235'. [ 623.977655][T26732] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6235'. [ 625.246952][ T50] Bluetooth: hci4: command tx timeout [ 626.913265][T23005] hsr_slave_0: left promiscuous mode [ 626.996866][T23005] hsr_slave_1: left promiscuous mode [ 627.021891][T23005] vlan0: left allmulticast mode [ 627.030633][T23005] veth0_vlan: left allmulticast mode [ 627.044852][T23005] vlan0: left promiscuous mode [ 627.046155][T26771] netlink: 'syz.3.6243': attribute type 10 has an invalid length. [ 627.061382][T26772] netlink: 'syz.1.6242': attribute type 1 has an invalid length. [ 627.097960][T23005] pim6reg (unregistering): left allmulticast mode [ 627.325592][ T50] Bluetooth: hci4: command tx timeout [ 627.799491][T26748] bond28: (slave veth0_to_bond): Releasing active interface [ 627.809418][T26741] workqueue: Failed to create a rescuer kthread for wq "bond30": -EINTR [ 627.820295][ T5488] 8021q: adding VLAN 0 to HW filter on device eth1 [ 627.860245][T26766] h: entered promiscuous mode [ 627.921613][T26771] team0 (unregistering): Port device team_slave_0 removed [ 627.952838][T26771] team0 (unregistering): Port device team_slave_1 removed [ 627.980665][T26772] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 628.074446][T26778] sit0: Caught tx_queue_len zero misconfig [ 628.217552][T26790] Unsupported ieee802154 address type: 0 [ 628.582073][T26811] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6254'. [ 628.593251][T26799] block nbd2: server does not support multiple connections per device. [ 628.612297][T26799] block nbd2: shutting down sockets [ 628.874644][T26826] xt_NFQUEUE: number of total queues is 0 [ 629.107134][ T10] IPVS: starting estimator thread 0... [ 629.159976][T26836] bond0: entered promiscuous mode [ 629.194821][T26836] bond_slave_0: entered promiscuous mode [ 629.206115][T26841] IPVS: using max 35 ests per chain, 84000 per kthread [ 629.210937][T26836] bond_slave_1: entered promiscuous mode [ 629.250927][T26836] batadv0: entered promiscuous mode [ 629.277198][T26836] debugfs: 'hsr1' already exists in 'hsr' [ 629.305029][T26836] Cannot create hsr debugfs directory [ 629.322007][T26836] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 629.368229][T26836] bond0: left promiscuous mode [ 629.393759][T26836] bond_slave_0: left promiscuous mode [ 629.415401][T26836] bond_slave_1: left promiscuous mode [ 629.430908][T26836] batadv0: left promiscuous mode [ 629.437734][T26827] netlink: 'syz.2.6256': attribute type 13 has an invalid length. [ 629.494788][T26851] bridge0: port 2(bridge_slave_1) entered blocking state [ 629.502137][T26851] bridge0: port 2(bridge_slave_1) entered forwarding state [ 629.509632][T26851] bridge0: port 1(bridge_slave_0) entered blocking state [ 629.516801][T26851] bridge0: port 1(bridge_slave_0) entered forwarding state [ 629.593448][T26851] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 630.149646][T26872] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6267'. [ 630.172901][T26533] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 630.204542][T26533] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 630.231318][T26533] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 630.283082][T26533] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 630.318280][T26533] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 630.377952][T26533] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 630.394668][T26533] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 630.450839][T26533] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 630.576108][T26899] netlink: zone id is out of range [ 630.598849][T26899] netlink: zone id is out of range [ 630.616826][T26533] 8021q: adding VLAN 0 to HW filter on device bond0 [ 630.625734][T26899] netlink: set zone limit has 8 unknown bytes [ 630.690403][T26533] 8021q: adding VLAN 0 to HW filter on device team0 [ 630.721886][T23003] bridge0: port 1(bridge_slave_0) entered blocking state [ 630.729068][T23003] bridge0: port 1(bridge_slave_0) entered forwarding state [ 630.780790][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 630.787957][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 631.098546][T26913] netlink: 'syz.4.6277': attribute type 1 has an invalid length. [ 631.134878][T26913] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6277'. [ 631.638148][T26533] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 631.812465][T26533] veth0_vlan: entered promiscuous mode [ 631.871024][T26533] veth1_vlan: entered promiscuous mode [ 631.954576][T26943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6282'. [ 631.971787][T26533] veth0_macvtap: entered promiscuous mode [ 631.994515][T26533] veth1_macvtap: entered promiscuous mode [ 632.041916][T26533] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 632.065539][T26533] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 632.088600][ T57] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.118319][ T57] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.153449][ T57] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.182430][ T57] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.332666][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 632.348014][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 632.402986][T23005] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 632.421815][T23005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 632.662939][T26972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6291'. [ 632.825526][T26981] netlink: 'syz.1.6293': attribute type 34 has an invalid length. [ 633.034682][T26989] bond_slave_0: entered promiscuous mode [ 633.042473][T26989] bond_slave_1: entered promiscuous mode [ 633.085169][T26989] vlan2: entered promiscuous mode [ 633.105107][T26989] bond0: entered promiscuous mode [ 633.249205][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 633.266149][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 633.274980][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 633.286572][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 633.307691][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 633.837376][T27028] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma? [ 633.974527][T26998] chnl_net:caif_netlink_parms(): no params data found [ 634.164020][T26998] bridge0: port 1(bridge_slave_0) entered blocking state [ 634.171544][T26998] bridge0: port 1(bridge_slave_0) entered disabled state [ 634.179699][T26998] bridge_slave_0: entered allmulticast mode [ 634.187789][T26998] bridge_slave_0: entered promiscuous mode [ 634.196933][T26998] bridge0: port 2(bridge_slave_1) entered blocking state [ 634.204275][T26998] bridge0: port 2(bridge_slave_1) entered disabled state [ 634.212232][T26998] bridge_slave_1: entered allmulticast mode [ 634.220282][T26998] bridge_slave_1: entered promiscuous mode [ 634.267918][T26998] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 634.812843][T27043] bridge0: port 2(bridge_slave_1) entered disabled state [ 634.820139][T27043] bridge0: port 1(bridge_slave_0) entered disabled state [ 634.959186][T27043] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 634.978384][T27043] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 635.253837][T26998] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 635.300773][T26998] team0: Port device team_slave_0 added [ 635.404852][ T50] Bluetooth: hci2: command tx timeout [ 635.468093][T23005] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.498431][T23005] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.510333][T26998] team0: Port device team_slave_1 added [ 635.519509][T23005] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.589514][T23005] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 635.665649][T26998] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 635.677505][T26998] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 635.744796][T26998] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 635.768342][T27062] tipc: Started in network mode [ 635.774424][T27062] tipc: Node identity 92b1fbd7e38, cluster identity 4711 [ 635.788346][T27062] tipc: Enabled bearer , priority 0 [ 635.954143][T27066] syzkaller0: entered promiscuous mode [ 635.962177][T27066] syzkaller0: entered allmulticast mode [ 635.969601][T27066] tipc: Resetting bearer [ 635.990602][T26998] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 636.011216][T26998] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 636.044044][T26998] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 636.117640][T27061] tipc: Resetting bearer [ 637.483678][T27051] Set syz1 is full, maxelem 65536 reached [ 637.496005][ T50] Bluetooth: hci2: command tx timeout [ 638.630069][T27061] tipc: Disabling bearer [ 638.656111][T25619] tipc: Node number set to 1899101143 [ 638.769473][T26998] hsr_slave_0: entered promiscuous mode [ 638.800954][T26998] hsr_slave_1: entered promiscuous mode [ 638.827528][T26998] debugfs: 'hsr0' already exists in 'hsr' [ 638.847038][T26998] Cannot create hsr debugfs directory [ 639.027603][T27098] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6331'. [ 639.039815][T27100] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6333'. [ 639.088800][T27098] team1: entered promiscuous mode [ 639.105188][T27098] team1: entered allmulticast mode [ 639.112272][T27098] 8021q: adding VLAN 0 to HW filter on device team1 [ 639.271916][T26998] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.284849][T26998] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.294744][T27113] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6337'. [ 639.520403][T26998] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.533033][T26998] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.565305][ T50] Bluetooth: hci2: command tx timeout [ 639.679842][T26998] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.698258][T26998] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.781559][T27138] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6346'. [ 640.152298][T27151] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6351'. [ 640.200189][T27140] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.207644][T27140] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.405739][T27140] veth1_to_bond: left promiscuous mode [ 640.414589][T27140] veth1_to_bond: left allmulticast mode [ 640.453368][T27140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 640.484666][T27140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 640.653829][T27161] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6354'. [ 640.968758][T23016] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.980103][T23016] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.025883][T23016] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.068408][T23016] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.393738][T26998] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 641.417479][T26998] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 641.434059][T26998] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 641.451861][T26998] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 641.460578][T26998] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 641.481346][T26998] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 641.497275][T26998] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 641.506957][T26998] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 641.578910][T26998] 8021q: adding VLAN 0 to HW filter on device bond0 [ 641.605995][T26998] 8021q: adding VLAN 0 to HW filter on device team0 [ 641.628628][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.635831][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 641.645427][ T5830] Bluetooth: hci2: command tx timeout [ 641.663663][T23016] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.670855][T23016] bridge0: port 2(bridge_slave_1) entered forwarding state [ 641.963793][T26998] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 642.019905][T26998] veth0_vlan: entered promiscuous mode [ 642.033809][T26998] veth1_vlan: entered promiscuous mode [ 642.078055][T26998] veth0_macvtap: entered promiscuous mode [ 642.094262][T26998] veth1_macvtap: entered promiscuous mode [ 642.111317][T26998] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 642.125546][T26998] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 642.141713][T23016] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 642.158495][T23016] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 642.170679][T23016] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 642.186848][ T35] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 642.329272][T23016] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 642.360096][T23016] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 642.433006][T23015] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 642.460780][T23015] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 642.549002][T27223] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6376'. [ 642.950569][T27245] xt_hashlimit: size too large, truncated to 1048576 [ 643.515999][T27262] IPVS: Scheduler module ip_vs_sip not found [ 643.632764][T27274] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6396'. [ 643.857338][T27281] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 644.116937][T27291] netlink: 'syz.2.6403': attribute type 10 has an invalid length. [ 644.170524][T27292] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6403'. [ 644.320162][T27291] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 644.474025][T27302] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6408'. [ 644.505674][T27302] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6408'. [ 644.670727][T27310] netlink: 'syz.2.6411': attribute type 3 has an invalid length. [ 644.677630][T27306] netlink: 'syz.1.6410': attribute type 10 has an invalid length. [ 644.704015][T27310] netlink: 'syz.2.6411': attribute type 3 has an invalid length. [ 644.735265][T27310] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6411'. [ 644.745903][T27306] mac80211_hwsim hwsim47 wlan1: entered promiscuous mode [ 644.759874][T27306] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 644.796008][ T140] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.809106][T27306] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6410'. [ 644.822097][ T140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.138353][T27328] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6421'. [ 645.168304][ T5830] Bluetooth: hci2: command tx timeout [ 645.211234][T27334] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6421'. [ 645.439826][T27340] syzkaller0: entered promiscuous mode [ 645.456876][T27340] syzkaller0: entered allmulticast mode [ 645.492489][T27337] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6423'. [ 645.730709][T27350] netlink: 'syz.2.6427': attribute type 1 has an invalid length. [ 645.773636][T27350] erspan1: entered allmulticast mode [ 645.815227][T27350] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6427'. [ 646.511015][T27374] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6436'. [ 647.392143][ T29] audit: type=1800 audit(1776483433.979:8): pid=27396 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.6443" name="memory.events" dev="tmpfs" ino=183 res=0 errno=0 [ 647.456194][T27396] ip6tnl1: entered allmulticast mode [ 647.747919][T27414] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 647.949535][T27425] openvswitch: netlink: Duplicate or invalid key (type 0). [ 647.965264][T27424] openvswitch: netlink: Duplicate or invalid key (type 0). [ 647.981694][T27424] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 648.013790][T27425] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 648.757478][T27467] netlink: 'syz.0.6466': attribute type 1 has an invalid length. [ 648.909856][T27476] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 648.924017][T27476] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 649.011366][T27486] vlan2: entered promiscuous mode [ 649.019098][T27486] bridge0: entered promiscuous mode [ 649.184152][T25619] IPVS: starting estimator thread 0... [ 649.199233][T27498] IPVS: nq: FWM 3 0x00000003 - no destination available [ 649.228885][T27500] __nla_validate_parse: 9 callbacks suppressed [ 649.228902][T27500] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6476'. [ 649.253126][ C0] IPVS: nq: FWM 3 0x00000003 - no destination available [ 649.315132][T27499] IPVS: using max 43 ests per chain, 103200 per kthread [ 649.507287][T27518] pim6reg1: entered promiscuous mode [ 649.516996][T27518] pim6reg1: entered allmulticast mode [ 649.564870][ T5830] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 649.849379][T27535] FAULT_INJECTION: forcing a failure. [ 649.849379][T27535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 649.898147][T27535] CPU: 1 UID: 0 PID: 27535 Comm: syz.0.6486 Not tainted syzkaller #0 PREEMPT(full) [ 649.898173][T27535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 649.898183][T27535] Call Trace: [ 649.898190][T27535] [ 649.898198][T27535] dump_stack_lvl+0xe8/0x150 [ 649.898228][T27535] should_fail_ex+0x412/0x560 [ 649.898256][T27535] _copy_from_user+0x2d/0xb0 [ 649.898284][T27535] nr_rt_ioctl+0x966/0xf90 [ 649.898316][T27535] ? kasan_quarantine_put+0xbb/0x1f0 [ 649.898340][T27535] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 649.898371][T27535] ? apparmor_capable+0x126/0x170 [ 649.898400][T27535] ? capable+0x88/0xe0 [ 649.898422][T27535] ? nr_ioctl+0x1b1/0x3b0 [ 649.898444][T27535] sock_do_ioctl+0x101/0x320 [ 649.898467][T27535] ? __pfx_sock_do_ioctl+0x10/0x10 [ 649.898485][T27535] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 649.898529][T27535] sock_ioctl+0x5c6/0x7f0 [ 649.898550][T27535] ? __pfx_sock_ioctl+0x10/0x10 [ 649.898569][T27535] ? __fget_files+0x2a/0x420 [ 649.898591][T27535] ? __fget_files+0x3a0/0x420 [ 649.898611][T27535] ? __fget_files+0x2a/0x420 [ 649.898635][T27535] ? bpf_lsm_file_ioctl+0x9/0x20 [ 649.898654][T27535] ? __pfx_sock_ioctl+0x10/0x10 [ 649.898673][T27535] __se_sys_ioctl+0xfc/0x170 [ 649.898690][T27535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.898710][T27535] do_syscall_64+0x15f/0xf80 [ 649.898731][T27535] ? trace_irq_disable+0x3b/0x140 [ 649.898755][T27535] ? clear_bhb_loop+0x40/0x90 [ 649.898777][T27535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.898793][T27535] RIP: 0033:0x7f22e6d9c819 [ 649.898809][T27535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 649.898824][T27535] RSP: 002b:00007f22e7bd2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 649.898843][T27535] RAX: ffffffffffffffda RBX: 00007f22e7015fa0 RCX: 00007f22e6d9c819 [ 649.898856][T27535] RDX: 00002000000001c0 RSI: 000000000000890b RDI: 0000000000000004 [ 649.898868][T27535] RBP: 00007f22e7bd2090 R08: 0000000000000000 R09: 0000000000000000 [ 649.898880][T27535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 649.898891][T27535] R13: 00007f22e7016038 R14: 00007f22e7015fa0 R15: 00007fff68d9a2d8 [ 649.898918][T27535] [ 650.216415][T27546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6491'. [ 650.567957][T27575] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6502'. [ 650.648172][T27577] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6500'. [ 650.657581][T27577] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6500'. [ 651.466314][T27631] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6518'. [ 651.485936][T27631] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6518'. [ 651.506513][T27631] netlink: 'syz.3.6518': attribute type 3 has an invalid length. [ 651.545995][T27637] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6522'. [ 651.566098][T27637] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6522'. [ 651.817837][T27649] IPVS: sh: FWM 3 0x00000003 - no destination available [ 652.305788][T27673] IPVS: Scheduler module ip_vs_sip not found [ 652.326563][T27675] SET target dimension over the limit! [ 652.595299][T27688] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6536'. [ 652.726435][T27693] ipt_REJECT: TCP_RESET invalid for non-tcp [ 653.129462][T27713] IPVS: Scheduler module ip_vs_sip not found [ 653.173340][T27711] xt_hashlimit: invalid rate [ 653.554310][T27730] netlink: 'syz.0.6550': attribute type 9 has an invalid length. [ 654.005689][T27741] IPVS: Scheduler module ip_vs_sip not found [ 654.588120][T27760] FAULT_INJECTION: forcing a failure. [ 654.588120][T27760] name failslab, interval 1, probability 0, space 0, times 0 [ 654.625018][T27760] CPU: 1 UID: 0 PID: 27760 Comm: syz.2.6560 Not tainted syzkaller #0 PREEMPT(full) [ 654.625044][T27760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 654.625055][T27760] Call Trace: [ 654.625063][T27760] [ 654.625071][T27760] dump_stack_lvl+0xe8/0x150 [ 654.625102][T27760] should_fail_ex+0x412/0x560 [ 654.625132][T27760] should_failslab+0xa8/0x100 [ 654.625153][T27760] __kmalloc_noprof+0xe8/0x760 [ 654.625179][T27760] ? ioctl_standard_iw_point+0x516/0xd90 [ 654.625205][T27760] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 654.625231][T27760] ioctl_standard_iw_point+0x516/0xd90 [ 654.625264][T27760] ? __pfx_cfg80211_wext_siwencodeext+0x10/0x10 [ 654.625291][T27760] ? __pfx_ioctl_standard_iw_point+0x10/0x10 [ 654.625311][T27760] ? __pfx___mutex_lock+0x10/0x10 [ 654.625339][T27760] ? __pfx_cfg80211_wext_siwencodeext+0x10/0x10 [ 654.625364][T27760] ioctl_standard_call+0xaf/0x1b0 [ 654.625384][T27760] ? __pfx_cfg80211_wext_siwencodeext+0x10/0x10 [ 654.625408][T27760] wext_ioctl_dispatch+0xee/0x410 [ 654.625424][T27760] ? __pfx_ioctl_standard_call+0x10/0x10 [ 654.625450][T27760] wext_handle_ioctl+0x10f/0x1d0 [ 654.625471][T27760] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 654.625488][T27760] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 654.625525][T27760] sock_ioctl+0x159/0x7f0 [ 654.625548][T27760] ? __pfx_sock_ioctl+0x10/0x10 [ 654.625567][T27760] ? __fget_files+0x2a/0x420 [ 654.625588][T27760] ? __fget_files+0x3a0/0x420 [ 654.625608][T27760] ? __fget_files+0x2a/0x420 [ 654.625632][T27760] ? bpf_lsm_file_ioctl+0x9/0x20 [ 654.625652][T27760] ? __pfx_sock_ioctl+0x10/0x10 [ 654.625670][T27760] __se_sys_ioctl+0xfc/0x170 [ 654.625688][T27760] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.625708][T27760] do_syscall_64+0x15f/0xf80 [ 654.625728][T27760] ? trace_irq_disable+0x3b/0x140 [ 654.625747][T27760] ? clear_bhb_loop+0x40/0x90 [ 654.625769][T27760] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.625787][T27760] RIP: 0033:0x7f197e99c819 [ 654.625805][T27760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 654.625819][T27760] RSP: 002b:00007f197f90a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 654.625839][T27760] RAX: ffffffffffffffda RBX: 00007f197ec15fa0 RCX: 00007f197e99c819 [ 654.625853][T27760] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 654.625864][T27760] RBP: 00007f197f90a090 R08: 0000000000000000 R09: 0000000000000000 [ 654.625876][T27760] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 654.625886][T27760] R13: 00007f197ec16038 R14: 00007f197ec15fa0 R15: 00007ffe04e236a8 [ 654.625916][T27760] [ 655.061184][T27767] netlink: 'syz.3.6561': attribute type 2 has an invalid length. [ 655.440326][T27780] __nla_validate_parse: 2 callbacks suppressed [ 655.440344][T27780] netlink: 264 bytes leftover after parsing attributes in process `syz.0.6566'. [ 655.523932][T27781] netlink: 264 bytes leftover after parsing attributes in process `syz.0.6566'. [ 656.022700][T27809] bond0: entered promiscuous mode [ 656.042204][T27809] bond_slave_0: entered promiscuous mode [ 656.066654][T27809] bond_slave_1: entered promiscuous mode [ 656.076321][T27809] batadv0: entered promiscuous mode [ 656.082435][T27809] debugfs: 'hsr1' already exists in 'hsr' [ 656.089241][T27809] Cannot create hsr debugfs directory [ 656.096246][T27809] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 656.106536][T27809] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 656.118151][T27809] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 656.127935][T27809] bond0: left promiscuous mode [ 656.132873][T27809] bond_slave_0: left promiscuous mode [ 656.143358][T27809] bond_slave_1: left promiscuous mode [ 656.156527][T27809] batadv0: left promiscuous mode [ 656.873619][T27840] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6582'. [ 656.899981][T27642] Set syz1 is full, maxelem 65536 reached [ 656.996886][T27846] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6582'. [ 657.125233][T27854] bond0: entered promiscuous mode [ 657.136440][T27854] bond_slave_0: entered promiscuous mode [ 657.157320][T27854] bond_slave_1: entered promiscuous mode [ 657.179419][T27854] batadv0: entered promiscuous mode [ 657.211650][T27854] debugfs: 'hsr1' already exists in 'hsr' [ 657.219183][T27854] Cannot create hsr debugfs directory [ 657.238714][T27854] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 657.264857][T27854] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 657.287165][T27854] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 657.303925][T27854] bond0: left promiscuous mode [ 657.309601][T27854] bond_slave_0: left promiscuous mode [ 657.316196][T27854] bond_slave_1: left promiscuous mode [ 657.323033][T27854] batadv0: left promiscuous mode [ 657.402465][T27868] veth0_to_bridge: Caught tx_queue_len zero misconfig [ 657.475196][T27877] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6593'. [ 657.810227][T27887] FAULT_INJECTION: forcing a failure. [ 657.810227][T27887] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 657.885121][T27887] CPU: 1 UID: 0 PID: 27887 Comm: syz.1.6597 Not tainted syzkaller #0 PREEMPT(full) [ 657.885147][T27887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 657.885158][T27887] Call Trace: [ 657.885166][T27887] [ 657.885174][T27887] dump_stack_lvl+0xe8/0x150 [ 657.885205][T27887] should_fail_ex+0x412/0x560 [ 657.885234][T27887] _copy_from_user+0x2d/0xb0 [ 657.885254][T27887] copy_from_sockptr_offset+0x66/0xa0 [ 657.885280][T27887] do_ip6t_set_ctl+0x93d/0xe10 [ 657.885304][T27887] ? rcu_is_watching+0x15/0xb0 [ 657.885328][T27887] ? trace_contention_end+0x3d/0x140 [ 657.885346][T27887] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 657.885384][T27887] ? __pfx___mutex_lock+0x10/0x10 [ 657.885407][T27887] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 657.885434][T27887] ? __pfx_aa_sk_perm+0x10/0x10 [ 657.885460][T27887] nf_setsockopt+0x26f/0x290 [ 657.885480][T27887] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 657.885505][T27887] do_sock_setsockopt+0x17c/0x1b0 [ 657.885532][T27887] __x64_sys_setsockopt+0x13d/0x1b0 [ 657.885556][T27887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 657.885575][T27887] do_syscall_64+0x15f/0xf80 [ 657.885594][T27887] ? trace_irq_disable+0x3b/0x140 [ 657.885612][T27887] ? clear_bhb_loop+0x40/0x90 [ 657.885633][T27887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 657.885650][T27887] RIP: 0033:0x7fe955f9c819 [ 657.885667][T27887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 657.885682][T27887] RSP: 002b:00007fe9541ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 657.885700][T27887] RAX: ffffffffffffffda RBX: 00007fe956215fa0 RCX: 00007fe955f9c819 [ 657.885713][T27887] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 657.885723][T27887] RBP: 00007fe9541ee090 R08: 0000000000000418 R09: 0000000000000000 [ 657.885735][T27887] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 657.885746][T27887] R13: 00007fe956216038 R14: 00007fe956215fa0 R15: 00007ffcd4a4dd58 [ 657.885773][T27887] [ 658.327234][T27899] netlink: 'syz.3.6601': attribute type 4 has an invalid length. [ 658.340097][T27902] FAULT_INJECTION: forcing a failure. [ 658.340097][T27902] name failslab, interval 1, probability 0, space 0, times 0 [ 658.384914][T27902] CPU: 1 UID: 0 PID: 27902 Comm: syz.1.6600 Not tainted syzkaller #0 PREEMPT(full) [ 658.384940][T27902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 658.384951][T27902] Call Trace: [ 658.384959][T27902] [ 658.384967][T27902] dump_stack_lvl+0xe8/0x150 [ 658.384998][T27902] should_fail_ex+0x412/0x560 [ 658.385028][T27902] should_failslab+0xa8/0x100 [ 658.385047][T27902] __kmalloc_cache_noprof+0x88/0x660 [ 658.385075][T27902] ? cfg80211_set_encryption+0x141/0x1540 [ 658.385101][T27902] ? cfg80211_wext_siwencodeext+0x5dc/0x870 [ 658.385130][T27902] cfg80211_set_encryption+0x141/0x1540 [ 658.385171][T27902] cfg80211_wext_siwencodeext+0x63c/0x870 [ 658.385205][T27902] ? __pfx_cfg80211_wext_siwencodeext+0x10/0x10 [ 658.385245][T27902] ioctl_standard_iw_point+0x6cd/0xd90 [ 658.385278][T27902] ? __pfx_cfg80211_wext_siwencodeext+0x10/0x10 [ 658.385304][T27902] ? __pfx_ioctl_standard_iw_point+0x10/0x10 [ 658.385324][T27902] ? __pfx___mutex_lock+0x10/0x10 [ 658.385354][T27902] ? __pfx_cfg80211_wext_siwencodeext+0x10/0x10 [ 658.385380][T27902] ioctl_standard_call+0xaf/0x1b0 [ 658.385401][T27902] ? __pfx_cfg80211_wext_siwencodeext+0x10/0x10 [ 658.385425][T27902] wext_ioctl_dispatch+0xee/0x410 [ 658.385442][T27902] ? __pfx_ioctl_standard_call+0x10/0x10 [ 658.385463][T27902] wext_handle_ioctl+0x10f/0x1d0 [ 658.385484][T27902] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 658.385500][T27902] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 658.385544][T27902] sock_ioctl+0x159/0x7f0 [ 658.385566][T27902] ? __pfx_sock_ioctl+0x10/0x10 [ 658.385586][T27902] ? __fget_files+0x2a/0x420 [ 658.385607][T27902] ? __fget_files+0x3a0/0x420 [ 658.385627][T27902] ? __fget_files+0x2a/0x420 [ 658.385658][T27902] ? bpf_lsm_file_ioctl+0x9/0x20 [ 658.385676][T27902] ? __pfx_sock_ioctl+0x10/0x10 [ 658.385695][T27902] __se_sys_ioctl+0xfc/0x170 [ 658.385712][T27902] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.385733][T27902] do_syscall_64+0x15f/0xf80 [ 658.385753][T27902] ? trace_irq_disable+0x3b/0x140 [ 658.385772][T27902] ? clear_bhb_loop+0x40/0x90 [ 658.385794][T27902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.385812][T27902] RIP: 0033:0x7fe955f9c819 [ 658.385829][T27902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 658.385845][T27902] RSP: 002b:00007fe9541ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 658.385865][T27902] RAX: ffffffffffffffda RBX: 00007fe956215fa0 RCX: 00007fe955f9c819 [ 658.385879][T27902] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 658.385891][T27902] RBP: 00007fe9541ee090 R08: 0000000000000000 R09: 0000000000000000 [ 658.385903][T27902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 658.385913][T27902] R13: 00007fe956216038 R14: 00007fe956215fa0 R15: 00007ffcd4a4dd58 [ 658.385946][T27902] [ 658.392387][T27899] netlink: 'syz.3.6601': attribute type 4 has an invalid length. [ 658.690002][T27917] ipt_REJECT: TCP_RESET invalid for non-tcp [ 658.698341][T27893] pim6reg1: entered allmulticast mode [ 658.986576][T27928] IPVS: sh: FWM 3 0x00000003 - no destination available [ 658.987066][T27927] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6607'. [ 659.872816][T27959] netlink: 'syz.1.6614': attribute type 1 has an invalid length. [ 659.880341][T27957] netlink: 232 bytes leftover after parsing attributes in process `syz.3.6613'. [ 660.089814][T27969] ipt_REJECT: TCP_RESET invalid for non-tcp [ 660.310398][T27974] netlink: 'syz.4.6621': attribute type 1 has an invalid length. [ 660.336669][T27974] netlink: 'syz.4.6621': attribute type 2 has an invalid length. [ 660.428572][ T24] IPVS: starting estimator thread 0... [ 660.439658][T27983] IPVS: nq: FWM 3 0x00000003 - no destination available [ 660.544988][T27984] IPVS: using max 31 ests per chain, 74400 per kthread [ 660.670166][T27993] Bluetooth: MGMT ver 1.23 [ 660.817946][T28001] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6629'. [ 660.968335][T28004] ipt_REJECT: TCP_RESET invalid for non-tcp [ 661.099535][T28014] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 661.190095][T28018] IPVS: Scheduler module ip_vs_sip not found [ 661.377656][T28033] netlink: 'syz.0.6641': attribute type 1 has an invalid length. [ 661.398221][T25619] IPVS: starting estimator thread 0... [ 661.404012][T28035] IPVS: nq: FWM 3 0x00000003 - no destination available [ 661.416322][ C0] IPVS: nq: FWM 3 0x00000003 - no destination available [ 661.421265][T28039] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6643'. [ 661.498362][T28036] IPVS: using max 44 ests per chain, 105600 per kthread [ 661.533517][T28033] bond1: entered promiscuous mode [ 661.540770][T28033] 8021q: adding VLAN 0 to HW filter on device bond1 [ 661.673513][T28041] macvtap0: entered allmulticast mode [ 661.716042][T28033] bond1: (slave bridge1): making interface the new active one [ 661.737303][T28033] bridge1: entered promiscuous mode [ 661.747018][T28033] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 661.792787][T28055] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6646'. [ 662.236480][T28078] netdevsim netdevsim0 : renamed from netdevsim0 (while UP) [ 662.765228][ T50] Bluetooth: hci2: command 0x0401 tx timeout [ 662.766034][ T5830] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 664.698703][T28049] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 665.023351][T28138] netlink: 1 bytes leftover after parsing attributes in process `syz.4.6666'. [ 665.085410][T28143] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6667'. [ 665.471078][T28159] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6675'. [ 665.509691][T28159] xt_limit: Overflow, try lower: 271964/0 [ 665.609865][T28161] IPVS: Scheduler module ip_vs_sip not found [ 665.614443][T28164] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6677'. [ 665.754569][T28171] lo: Caught tx_queue_len zero misconfig [ 666.377521][T28209] netlink: 7 bytes leftover after parsing attributes in process `syz.2.6691'. [ 666.600802][T28220] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6694'. [ 666.678480][T28200] bridge0: port 2(bridge_slave_1) entered disabled state [ 666.686150][T28200] bridge0: port 1(bridge_slave_0) entered disabled state [ 666.704662][T28234] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6695'. [ 667.064159][T28200] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 667.101613][T28200] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 667.470374][T28209] erspan0: entered promiscuous mode [ 667.527832][T28245] netlink: 'syz.1.6699': attribute type 10 has an invalid length. [ 667.563305][T28249] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6700'. [ 667.609670][ T57] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.639889][ T57] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.658102][T28245] veth0_vlan: left promiscuous mode [ 667.665206][T28245] veth0_vlan: entered promiscuous mode [ 667.672892][T28245] team0: Device veth0_vlan failed to register rx_handler [ 667.721221][T28250] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6699'. [ 667.733580][T28250] team0: Caught tx_queue_len zero misconfig [ 667.747318][ T132] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.780066][ T132] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 668.019675][T28273] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6706'. [ 668.308646][T28279] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 668.924598][T28283] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.6709'. [ 669.584283][T28219] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 669.817173][T28296] syzkaller1: entered promiscuous mode [ 669.846986][T28296] syzkaller1: entered allmulticast mode [ 670.233461][T28315] bond0: entered promiscuous mode [ 670.250741][T28316] netlink: 'syz.3.6717': attribute type 21 has an invalid length. [ 670.260964][T28315] bond_slave_0: entered promiscuous mode [ 670.274322][T28315] bond_slave_1: entered promiscuous mode [ 670.308748][T28315] batadv0: entered promiscuous mode [ 670.332415][T28315] debugfs: 'hsr1' already exists in 'hsr' [ 670.345509][T28315] Cannot create hsr debugfs directory [ 670.358450][T28315] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 670.379300][T28315] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 670.391439][T28315] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 670.402526][T28315] bond0: left promiscuous mode [ 670.416453][T28315] bond_slave_0: left promiscuous mode [ 670.429544][T28315] bond_slave_1: left promiscuous mode [ 670.438518][T28315] batadv0: left promiscuous mode [ 670.458456][T28316] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6717'. [ 670.493435][T28324] ipt_REJECT: TCP_RESET invalid for non-tcp [ 670.625935][T28328] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6723'. [ 670.672254][T28337] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.6725'. [ 671.253435][T28358] gretap1: entered promiscuous mode [ 671.264495][T28358] batman_adv: batadv0: Adding interface: gretap1 [ 671.271121][T28358] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.301056][T28358] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 673.578634][T28329] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 673.593809][T28357] netlink: 'syz.2.6731': attribute type 1 has an invalid length. [ 673.799434][T28370] __nla_validate_parse: 2 callbacks suppressed [ 673.799453][T28370] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6735'. [ 673.817175][T28370] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6735'. [ 673.827050][T28370] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6735'. [ 673.827147][T28372] netlink: 'syz.2.6737': attribute type 10 has an invalid length. [ 673.853591][T28371] batadv0: entered promiscuous mode [ 673.875145][T28372] netlink: 228 bytes leftover after parsing attributes in process `syz.2.6737'. [ 673.884664][T28371] debugfs: 'hsr1' already exists in 'hsr' [ 673.903851][T28371] Cannot create hsr debugfs directory [ 673.910551][T28371] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 673.922943][T28371] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 673.936306][T28371] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 673.959264][T28371] batadv0: left promiscuous mode [ 674.018081][T28380] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6741'. [ 674.200018][T28384] syzkaller0: entered promiscuous mode [ 674.221865][T28384] syzkaller0: entered allmulticast mode [ 674.258123][T28395] team0 (unregistering): Port device team_slave_0 removed [ 674.296691][T28395] team0 (unregistering): Port device team_slave_1 removed [ 674.751980][T28422] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6757'. [ 676.420910][T28411] tipc: Enabling of bearer rejected, failed to enable media [ 676.757886][T28453] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.6769'. [ 676.771226][T28453] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.6769'. [ 676.789493][T28451] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6768'. [ 677.530398][T28474] syzkaller0: entered promiscuous mode [ 677.549714][T28474] syzkaller0: entered allmulticast mode [ 677.558459][T28479] batadv_slave_1: entered promiscuous mode [ 677.564914][T28480] batadv_slave_1: left promiscuous mode [ 677.573361][T28479] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6778'. [ 679.736233][T28497] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 679.910273][T28518] netlink: 'syz.2.6788': attribute type 2 has an invalid length. [ 679.959868][T28514] netlink: 'syz.3.6787': attribute type 1 has an invalid length. [ 679.989490][T28514] netlink: 'syz.3.6787': attribute type 4 has an invalid length. [ 680.028879][T28528] __nla_validate_parse: 2 callbacks suppressed [ 680.028899][T28528] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6791'. [ 680.052425][T28514] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.6787'. [ 680.192601][T28530] veth7: entered allmulticast mode [ 680.235318][T28534] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6792'. [ 680.461702][T28547] IPVS: sh: FWM 3 0x00000003 - no destination available [ 680.566494][T28548] syzkaller0: entered promiscuous mode [ 680.572504][T28548] syzkaller0: entered allmulticast mode [ 680.581156][T28555] syzkaller0: entered promiscuous mode [ 680.590702][T28555] syzkaller0: entered allmulticast mode [ 680.625276][T28556] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6801'. [ 680.642774][T28556] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6801'. [ 680.653214][T28559] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6802'. [ 680.742353][T28565] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6804'. [ 680.751871][T28565] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6804'. [ 680.842537][T28570] netlink: 'syz.3.6805': attribute type 1 has an invalid length. [ 682.643552][T28568] vxcan1 speed is unknown, defaulting to 1000 [ 682.644400][T28570] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 682.690947][T28568] vxcan1 speed is unknown, defaulting to 1000 [ 682.710092][T28568] vxcan1 speed is unknown, defaulting to 1000 [ 682.804363][T28578] delete_channel: no stack [ 682.828950][T28579] xt_socket: unknown flags 0x50 [ 683.217411][T28603] netlink: 'syz.3.6814': attribute type 10 has an invalid length. [ 683.249847][T28568] infiniband syz2: set down [ 683.262383][T27157] vxcan1 speed is unknown, defaulting to 1000 [ 683.273265][T28568] infiniband syz2: added vxcan1 [ 683.440736][T28568] RDS/IB: syz2: added [ 683.457800][T28609] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 683.486109][T28568] smc: adding ib device syz2 with port count 1 [ 683.537578][T28568] smc: ib device syz2 port 1 has pnetid SYZ1 (user defined) [ 683.549374][T27157] vxcan1 speed is unknown, defaulting to 1000 [ 683.569922][T28568] vxcan1 speed is unknown, defaulting to 1000 [ 683.671053][T28627] netlink: 'syz.3.6820': attribute type 10 has an invalid length. [ 683.681978][T28627] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6820'. [ 683.789199][T28634] netlink: 'syz.4.6821': attribute type 1 has an invalid length. [ 683.816850][T28634] netlink: 228 bytes leftover after parsing attributes in process `syz.4.6821'. [ 683.907867][T28596] mpoa:mpoad_close: () going down [ 684.333525][T28568] vxcan1 speed is unknown, defaulting to 1000 [ 684.748477][T28675] bond1: entered promiscuous mode [ 684.769987][T28675] bond1: entered allmulticast mode [ 684.788320][T28675] 8021q: adding VLAN 0 to HW filter on device bond1 [ 684.915709][T28690] FAULT_INJECTION: forcing a failure. [ 684.915709][T28690] name failslab, interval 1, probability 0, space 0, times 0 [ 684.995721][T28230] ================================================================== [ 685.003830][T28230] BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x550 [ 685.011742][T28230] Read of size 8 at addr ffff888059eb24c0 by task kworker/0:13/28230 [ 685.019809][T28230] [ 685.022140][T28230] CPU: 0 UID: 0 PID: 28230 Comm: kworker/0:13 Not tainted syzkaller #0 PREEMPT(full) [ 685.022161][T28230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 685.022174][T28230] Workqueue: mld mld_ifc_work [ 685.022200][T28230] Call Trace: [ 685.022208][T28230] [ 685.022215][T28230] dump_stack_lvl+0xe8/0x150 [ 685.022241][T28230] print_report+0xba/0x230 [ 685.022261][T28230] ? sock_def_readable+0x1cb/0x550 [ 685.022281][T28230] kasan_report+0x117/0x150 [ 685.022300][T28230] ? sock_def_readable+0x1cb/0x550 [ 685.022323][T28230] sock_def_readable+0x1cb/0x550 [ 685.022341][T28230] ? sock_def_readable+0xae/0x550 [ 685.022360][T28230] ? send_to_lecd+0x26d/0x830 [ 685.022380][T28230] send_to_lecd+0x3e7/0x830 [ 685.022403][T28230] lec_start_xmit+0xe52/0x2890 [ 685.022430][T28230] dev_hard_start_xmit+0x2cd/0x830 [ 685.022454][T28230] sch_direct_xmit+0x251/0x4c0 [ 685.022479][T28230] ? __pfx_sch_direct_xmit+0x10/0x10 [ 685.022504][T28230] __dev_queue_xmit+0x180f/0x3950 [ 685.022525][T28230] ? __dev_queue_xmit+0x2b6/0x3950 [ 685.022549][T28230] ? __pfx___dev_queue_xmit+0x10/0x10 [ 685.022567][T28230] ? neigh_resolve_output+0x438/0x750 [ 685.022589][T28230] ? eth_header+0x11b/0x200 [ 685.022605][T28230] ? __asan_memcpy+0x40/0x70 [ 685.022637][T28230] ? ip6_output+0x126/0x550 [ 685.022658][T28230] ip6_output+0x340/0x550 [ 685.022679][T28230] ? __pfx_ip6_output+0x10/0x10 [ 685.022700][T28230] NF_HOOK+0x177/0x4f0 [ 685.022722][T28230] ? __pfx_NF_HOOK+0x10/0x10 [ 685.022743][T28230] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 685.022761][T28230] ? __local_bh_enable_ip+0xd0/0x130 [ 685.022784][T28230] ? lockdep_hardirqs_on+0x7a/0x110 [ 685.022805][T28230] ? __local_bh_enable_ip+0xd0/0x130 [ 685.022845][T28230] ? icmp6_dst_alloc+0x3a6/0x440 [ 685.022869][T28230] mld_sendpack+0x8b4/0xe40 [ 685.022897][T28230] ? mld_sendpack+0x213/0xe40 [ 685.022917][T28230] ? __pfx_mld_sendpack+0x10/0x10 [ 685.022947][T28230] mld_ifc_work+0x835/0xe70 [ 685.022970][T28230] ? process_scheduled_works+0xa70/0x1860 [ 685.022993][T28230] process_scheduled_works+0xb5d/0x1860 [ 685.023029][T28230] ? __pfx_process_scheduled_works+0x10/0x10 [ 685.023054][T28230] ? assign_work+0x3d5/0x5e0 [ 685.023077][T28230] worker_thread+0xa53/0xfc0 [ 685.023110][T28230] kthread+0x388/0x470 [ 685.023126][T28230] ? __pfx_worker_thread+0x10/0x10 [ 685.023147][T28230] ? __pfx_kthread+0x10/0x10 [ 685.023163][T28230] ret_from_fork+0x514/0xb70 [ 685.023187][T28230] ? __pfx_ret_from_fork+0x10/0x10 [ 685.023209][T28230] ? __switch_to+0xc79/0x1410 [ 685.023229][T28230] ? __pfx_kthread+0x10/0x10 [ 685.023247][T28230] ret_from_fork_asm+0x1a/0x30 [ 685.023278][T28230] [ 685.023285][T28230] [ 685.058180][T28690] CPU: 1 UID: 0 PID: 28690 Comm: syz.4.6835 Not tainted syzkaller #0 PREEMPT(full) [ 685.058204][T28690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 685.058215][T28690] Call Trace: [ 685.058222][T28690] [ 685.058230][T28690] dump_stack_lvl+0xe8/0x150 [ 685.058259][T28690] should_fail_ex+0x412/0x560 [ 685.058287][T28690] should_failslab+0xa8/0x100 [ 685.058308][T28690] __kmalloc_cache_noprof+0x88/0x660 [ 685.058333][T28690] ? sctp_add_bind_addr+0x8c/0x370 [ 685.058351][T28690] ? __pfx_sctp_get_port_local+0x10/0x10 [ 685.058378][T28690] sctp_add_bind_addr+0x8c/0x370 [ 685.058396][T28690] ? sctp_auto_asconf_init+0x15c/0x1e0 [ 685.058421][T28690] sctp_do_bind+0x5b2/0x9d0 [ 685.058454][T28690] sctp_connect_new_asoc+0x270/0x6b0 [ 685.058479][T28690] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 685.058508][T28690] ? __local_bh_enable_ip+0xd0/0x130 [ 685.058529][T28690] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 685.058546][T28690] ? security_sctp_bind_connect+0x7e/0x2c0 [ 685.058568][T28690] sctp_sendmsg+0x1528/0x2c10 [ 685.058604][T28690] ? __pfx_sctp_sendmsg+0x10/0x10 [ 685.058628][T28690] ? aa_sk_perm+0x6d5/0x900 [ 685.058656][T28690] ? __pfx_aa_sk_perm+0x10/0x10 [ 685.058680][T28690] ? sock_rps_record_flow+0x19/0x350 [ 685.058700][T28690] ? inet_sendmsg+0x2f4/0x370 [ 685.058721][T28690] ____sys_sendmsg+0x80a/0x9f0 [ 685.058753][T28690] ? __pfx_____sys_sendmsg+0x10/0x10 [ 685.058785][T28690] ? import_iovec+0x73/0xa0 [ 685.058806][T28690] ___sys_sendmsg+0x2a5/0x360 [ 685.058828][T28690] ? __lock_acquire+0x6b5/0x2cf0 [ 685.058853][T28690] ? __pfx____sys_sendmsg+0x10/0x10 [ 685.058882][T28690] ? kstrtouint+0x6e/0xe0 [ 685.058928][T28690] ? __fget_files+0x2a/0x420 [ 685.058948][T28690] ? __fget_files+0x3a0/0x420 [ 685.058978][T28690] __sys_sendmmsg+0x27c/0x4e0 [ 685.059008][T28690] ? __pfx___sys_sendmmsg+0x10/0x10 [ 685.059030][T28690] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 685.059075][T28690] ? ksys_write+0x242/0x270 [ 685.059107][T28690] ? __pfx_ksys_write+0x10/0x10 [ 685.059137][T28690] __x64_sys_sendmmsg+0xa0/0xc0 [ 685.059161][T28690] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.059179][T28690] do_syscall_64+0x15f/0xf80 [ 685.059198][T28690] ? trace_irq_disable+0x3b/0x140 [ 685.059217][T28690] ? clear_bhb_loop+0x40/0x90 [ 685.059238][T28690] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.059255][T28690] RIP: 0033:0x7f148259c819 [ 685.059273][T28690] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 685.059288][T28690] RSP: 002b:00007f1483375028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 685.059310][T28690] RAX: ffffffffffffffda RBX: 00007f1482815fa0 RCX: 00007f148259c819 [ 685.059322][T28690] RDX: 0000000000000001 RSI: 0000200000006e80 RDI: 0000000000000003 [ 685.059333][T28690] RBP: 00007f1483375090 R08: 0000000000000000 R09: 0000000000000000 [ 685.059344][T28690] R10: 0000000020002845 R11: 0000000000000246 R12: 0000000000000001 [ 685.059355][T28690] R13: 00007f1482816038 R14: 00007f1482815fa0 R15: 00007ffe630907d8 [ 685.059409][T28690] [ 685.582237][T28230] Allocated by task 28597: [ 685.586637][T28230] kasan_save_track+0x3e/0x80 [ 685.591316][T28230] __kasan_slab_alloc+0x6c/0x80 [ 685.596155][T28230] kmem_cache_alloc_lru_noprof+0x2b8/0x640 [ 685.601957][T28230] sock_alloc_inode+0x2c/0x190 [ 685.606717][T28230] alloc_inode+0x6a/0x1b0 [ 685.611047][T28230] __sock_create+0x12d/0x9d0 [ 685.615632][T28230] __sys_socket+0xd6/0x1b0 [ 685.620046][T28230] __x64_sys_socket+0x7a/0x90 [ 685.624719][T28230] do_syscall_64+0x15f/0xf80 [ 685.629311][T28230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.635199][T28230] [ 685.637511][T28230] Freed by task 28638: [ 685.641563][T28230] kasan_save_track+0x3e/0x80 [ 685.646232][T28230] kasan_save_free_info+0x46/0x50 [ 685.651249][T28230] __kasan_slab_free+0x5c/0x80 [ 685.656011][T28230] kmem_cache_free+0x180/0x630 [ 685.660774][T28230] rcu_core+0x7cd/0x1070 [ 685.665016][T28230] handle_softirqs+0x22a/0x840 [ 685.669771][T28230] __irq_exit_rcu+0xca/0x220 [ 685.674353][T28230] irq_exit_rcu+0x9/0x30 [ 685.678586][T28230] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 685.684210][T28230] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 685.690185][T28230] [ 685.692495][T28230] Last potentially related work creation: [ 685.698202][T28230] kasan_save_stack+0x3e/0x60 [ 685.702882][T28230] kasan_record_aux_stack+0xbd/0xd0 [ 685.708072][T28230] call_rcu+0xee/0x890 [ 685.712133][T28230] evict+0x95b/0xb10 [ 685.716016][T28230] __dentry_kill+0x1a2/0x5e0 [ 685.720598][T28230] finish_dput+0xc9/0x480 [ 685.724919][T28230] __fput+0x691/0xa60 [ 685.728897][T28230] task_work_run+0x1d9/0x270 [ 685.733480][T28230] exit_to_user_mode_loop+0xed/0x480 [ 685.738754][T28230] do_syscall_64+0x33e/0xf80 [ 685.743340][T28230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.749219][T28230] [ 685.751529][T28230] The buggy address belongs to the object at ffff888059eb2400 [ 685.751529][T28230] which belongs to the cache sock_inode_cache of size 1408 [ 685.766093][T28230] The buggy address is located 192 bytes inside of [ 685.766093][T28230] freed 1408-byte region [ffff888059eb2400, ffff888059eb2980) [ 685.779969][T28230] [ 685.782289][T28230] The buggy address belongs to the physical page: [ 685.788692][T28230] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x59eb0 [ 685.797463][T28230] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 685.805962][T28230] memcg:ffff8880325b9001 [ 685.810188][T28230] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 685.817717][T28230] page_type: f5(slab) [ 685.821701][T28230] raw: 00fff00000000040 ffff88801dee2c80 dead000000000100 dead000000000122 [ 685.830277][T28230] raw: 0000000000000000 0000000800150015 00000000f5000000 ffff8880325b9001 [ 685.838856][T28230] head: 00fff00000000040 ffff88801dee2c80 dead000000000100 dead000000000122 [ 685.847521][T28230] head: 0000000000000000 0000000800150015 00000000f5000000 ffff8880325b9001 [ 685.856183][T28230] head: 00fff00000000003 ffffea000167ac01 00000000ffffffff 00000000ffffffff [ 685.864860][T28230] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 685.873516][T28230] page dumped because: kasan: bad access detected [ 685.879923][T28230] page_owner tracks the page as allocated [ 685.885622][T28230] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5826, tgid 5826 (syz-executor), ts 74362053821, free_ts 19300909988 [ 685.908705][T28230] post_alloc_hook+0x231/0x280 [ 685.913469][T28230] get_page_from_freelist+0x24dc/0x2580 [ 685.919002][T28230] __alloc_frozen_pages_noprof+0x18d/0x380 [ 685.924802][T28230] allocate_slab+0x77/0x660 [ 685.929296][T28230] refill_objects+0x331/0x3c0 [ 685.933964][T28230] __pcs_replace_empty_main+0x2e6/0x730 [ 685.939503][T28230] kmem_cache_alloc_lru_noprof+0x37c/0x640 [ 685.945301][T28230] sock_alloc_inode+0x2c/0x190 [ 685.950057][T28230] alloc_inode+0x6a/0x1b0 [ 685.954379][T28230] __sock_create+0x12d/0x9d0 [ 685.958967][T28230] __sys_socket+0xd6/0x1b0 [ 685.963376][T28230] __x64_sys_socket+0x7a/0x90 [ 685.968060][T28230] do_syscall_64+0x15f/0xf80 [ 685.972648][T28230] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.978542][T28230] page last free pid 1 tgid 1 stack trace: [ 685.984337][T28230] __free_frozen_pages+0xc2b/0xdb0 [ 685.989449][T28230] free_contig_range+0xbb/0x170 [ 685.994295][T28230] destroy_args+0x4e5/0x570 [ 685.998797][T28230] debug_vm_pgtable+0x3f8/0x410 [ 686.003648][T28230] do_one_initcall+0x250/0x870 [ 686.008412][T28230] do_initcall_level+0x104/0x190 [ 686.013346][T28230] do_initcalls+0x59/0xa0 [ 686.017667][T28230] kernel_init_freeable+0x2a6/0x3e0 [ 686.022859][T28230] kernel_init+0x1d/0x1d0 [ 686.027185][T28230] ret_from_fork+0x514/0xb70 [ 686.031768][T28230] ret_from_fork_asm+0x1a/0x30 [ 686.036539][T28230] [ 686.038850][T28230] Memory state around the buggy address: [ 686.044467][T28230] ffff888059eb2380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 686.052518][T28230] ffff888059eb2400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 686.060573][T28230] >ffff888059eb2480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 686.068625][T28230] ^ [ 686.074766][T28230] ffff888059eb2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 686.082821][T28230] ffff888059eb2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 686.090869][T28230] ================================================================== [ 686.098957][T28230] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 686.106156][T28230] CPU: 0 UID: 0 PID: 28230 Comm: kworker/0:13 Not tainted syzkaller #0 PREEMPT(full) [ 686.115688][T28230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 686.125743][T28230] Workqueue: mld mld_ifc_work [ 686.130429][T28230] Call Trace: [ 686.133705][T28230] [ 686.136630][T28230] vpanic+0x56c/0xa60 [ 686.140612][T28230] ? __pfx_vpanic+0x10/0x10 [ 686.145113][T28230] panic+0xc5/0xd0 [ 686.148837][T28230] ? __pfx_panic+0x10/0x10 [ 686.153251][T28230] ? sock_def_readable+0x1cb/0x550 [ 686.158362][T28230] ? rcu_is_watching+0x15/0xb0 [ 686.163122][T28230] ? sock_def_readable+0x1cb/0x550 [ 686.168227][T28230] ? sock_def_readable+0x1cb/0x550 [ 686.173331][T28230] check_panic_on_warn+0x89/0xb0 [ 686.178266][T28230] ? sock_def_readable+0x1cb/0x550 [ 686.183375][T28230] end_report+0x73/0x170 [ 686.187616][T28230] ? sock_def_readable+0x1cb/0x550 [ 686.192723][T28230] kasan_report+0x128/0x150 [ 686.197226][T28230] ? sock_def_readable+0x1cb/0x550 [ 686.202338][T28230] sock_def_readable+0x1cb/0x550 [ 686.207273][T28230] ? sock_def_readable+0xae/0x550 [ 686.212295][T28230] ? send_to_lecd+0x26d/0x830 [ 686.216969][T28230] send_to_lecd+0x3e7/0x830 [ 686.221475][T28230] lec_start_xmit+0xe52/0x2890 [ 686.226242][T28230] dev_hard_start_xmit+0x2cd/0x830 [ 686.231357][T28230] sch_direct_xmit+0x251/0x4c0 [ 686.236120][T28230] ? __pfx_sch_direct_xmit+0x10/0x10 [ 686.241405][T28230] __dev_queue_xmit+0x180f/0x3950 [ 686.246434][T28230] ? __dev_queue_xmit+0x2b6/0x3950 [ 686.251542][T28230] ? __pfx___dev_queue_xmit+0x10/0x10 [ 686.256906][T28230] ? neigh_resolve_output+0x438/0x750 [ 686.262275][T28230] ? eth_header+0x11b/0x200 [ 686.266771][T28230] ? __asan_memcpy+0x40/0x70 [ 686.271368][T28230] ? ip6_output+0x126/0x550 [ 686.275869][T28230] ip6_output+0x340/0x550 [ 686.280195][T28230] ? __pfx_ip6_output+0x10/0x10 [ 686.285043][T28230] NF_HOOK+0x177/0x4f0 [ 686.289111][T28230] ? __pfx_NF_HOOK+0x10/0x10 [ 686.293698][T28230] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 686.299503][T28230] ? __local_bh_enable_ip+0xd0/0x130 [ 686.304793][T28230] ? lockdep_hardirqs_on+0x7a/0x110 [ 686.309999][T28230] ? __local_bh_enable_ip+0xd0/0x130 [ 686.315283][T28230] ? icmp6_dst_alloc+0x3a6/0x440 [ 686.320220][T28230] mld_sendpack+0x8b4/0xe40 [ 686.324731][T28230] ? mld_sendpack+0x213/0xe40 [ 686.329414][T28230] ? __pfx_mld_sendpack+0x10/0x10 [ 686.334442][T28230] mld_ifc_work+0x835/0xe70 [ 686.338943][T28230] ? process_scheduled_works+0xa70/0x1860 [ 686.344662][T28230] process_scheduled_works+0xb5d/0x1860 [ 686.350220][T28230] ? __pfx_process_scheduled_works+0x10/0x10 [ 686.356202][T28230] ? assign_work+0x3d5/0x5e0 [ 686.360793][T28230] worker_thread+0xa53/0xfc0 [ 686.365393][T28230] kthread+0x388/0x470 [ 686.369457][T28230] ? __pfx_worker_thread+0x10/0x10 [ 686.374562][T28230] ? __pfx_kthread+0x10/0x10 [ 686.379144][T28230] ret_from_fork+0x514/0xb70 [ 686.383730][T28230] ? __pfx_ret_from_fork+0x10/0x10 [ 686.388847][T28230] ? __switch_to+0xc79/0x1410 [ 686.393521][T28230] ? __pfx_kthread+0x10/0x10 [ 686.398105][T28230] ret_from_fork_asm+0x1a/0x30 [ 686.402874][T28230] [ 686.406194][T28230] Kernel Offset: disabled [ 686.410535][T28230] Rebooting in 86400 seconds..