last executing test programs: 5.264096765s ago: executing program 3 (id=4): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x10, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x6}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000003640)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x44, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r2, {0x14, 0x7}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x40) 5.196684931s ago: executing program 2 (id=3): socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x10000, @empty}, 0x1c) 4.430685465s ago: executing program 0 (id=1): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x400}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x64, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x30, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xfffa, 0x7, 0x8001}, {{0x2, 0x0, 0x1}, {0x3, 0x0, 0x1, 0x1}}}}, @TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x8, 0x0, 0xe}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x0) 4.411264721s ago: executing program 3 (id=6): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000000303"], 0x20}}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c00000010000100"/20, @ANYRES32=r4, @ANYBLOB="00bf4300"], 0x3c}}, 0x0) 3.989258291s ago: executing program 1 (id=7): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth1_to_bridge\x00', 0x0}) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6gre0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000240)={@rand_addr=' \x01\x00', @empty, @private1, 0x6, 0x6, 0x7, 0x500, 0x8, 0x400000, r1}) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000540)={@private2, @rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x400, 0x0, 0x6, r3}) 3.709468107s ago: executing program 2 (id=8): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000200)={0x0, 0x4, 0x0, 0x9}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={r1, 0x9, 0x10}, 0xc) 3.641125137s ago: executing program 0 (id=9): mkdir(0x0, 0x10) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x3000005, 0x0) chroot(&(0x7f0000000200)='./file0\x00') umount2(&(0x7f0000000000)='./file0\x00', 0x0) 3.246524372s ago: executing program 1 (id=10): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001a"], 0x24}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0b00000000010000000100000900000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0x8, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r0}, 0x38) 3.211075812s ago: executing program 3 (id=11): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000"], 0x0}, 0x94) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) close(r5) setsockopt$sock_attach_bpf(r6, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) close(r3) 2.825180395s ago: executing program 2 (id=12): r0 = socket$inet(0x2, 0x801, 0x0) sendto$inet(r0, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) listen(r0, 0x9) 2.793781026s ago: executing program 0 (id=13): recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448cb, 0x0) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x800000, 0x10008, 0x8}) write$bt_hci(r0, &(0x7f0000000080)=ANY=[], 0x6) 2.520057731s ago: executing program 1 (id=14): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x1) 2.400630543s ago: executing program 3 (id=15): syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x2008002, &(0x7f0000000080), 0x4, 0x54c, &(0x7f0000000fc0)="$eJzs3UFvI1cdAPD/TJJNut02u9ADVMAuUFjQau2Nt11VvbR7AaGqEqLigDhsQ+JEIXYcYqc0IRLpZwAJJE7wETggcUDqiQMXxIEDEgeEVA5IC0SgDRJIRjN2EjdxuiZ27Db+/aTJvJnnmf97ssfv+dmZF8DYujFxlH4jImbb6aS95F6JuBERj/Z2Fvb3dhaSaDZf/3uS52f7ouOYzJMRsRsRMxHxtS9HfCs5Gbe+tb06X6mUN9rbxUZ1vVjf2r69Up1fLi+X10qle3P37rx494XSwOp6vfrzh19aefXrv/rlJ9/93e4Xv5cV60o7r7Meg9Sq+tRhnMxkRLx6HsFG4ODlc2nE5eBs0oj4SER8Jr/+Z2Mif3UCABdZszkbzdnObQDgokvzMbAkLUREmrY7AYXWGN4zcTmt1OqNW0u1zbXF1ljZ1ZhKl1Yq5TvXpv/4nfzBU0m2PZfn5fn5dunY9t2IuBYRP5x+It8uLNQqi6Pp8gDA2Huys/2PiH9Np2mh0NOhXb7VAwA+NGZGXQAAYOi0/wAwfrT/ADB+emj/21/27557WQCA4fD5HwDGj/YfAMaP9h8AxspXX3stW5r77ftfL765tblae/P2Yrm+WqhuLhQWahvrheVabTm/Z0/1ceer1Grrc8/H5lvFRrneKNa3th9Ua5trjQf5fb0flKeGUisA4P1cu/7OH5KI2H3piXyJjrkctNVwsaWjLgAwMhP9HKyDAB9qZvuC8dVTE553En5z7mUBRqPrzbxnuibf68f/RxC/M4IPlJsf73383xzPcLEcH/93gw8YH2cb/3954OUAhs/4P4yvZjM5Puf/pcMsAOBC6uMnfM3vD6oTAozU4ybzHsj3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHDBXImIb0eSFvK5wNPsb1ooRDwVEVdjKllaqZTvRMTTcT0ipqaXViq//f2oCw0A9Cn9a9Ke/+vm7HNXjudeSv49na8j4rs/ef1Hb803Ghtz2f5/HO6fPpg+rHR0XB/zCgIAA5a336X2eu5o/6O9nYWDZZjleXg//tueinhhf28nX1o5k5HtjJjJ+xKX/5nEZPuYmYh4NiImBhB/9+2I+Fi3+if52MjV9synnfGjHfupocZP3xM/zfNa66zz9dEBlAXGzTv3I+KVbtdfGjfydffrfyZ/h+rfw/utkx289+13xJ9sR5roEj+75m/0GuP5X3/lxM7mbCvv7YhnJ7vFTw7jJ6fEf67H+H/6xKd+8PIpec2fRtyM7vE7YxUb1fVifWv79kp1frm8XF4rle7N3bvz4t0XSsV8jLp4MFJ90t9euvX0aWXL6n/5lPgzXet/6fDYz/VY/5/9541vfvpoc/p4/C98tvvz/0zX+C1Zm/j5HuPPX/7FqdN3Z/EXT6n/457/Wz3Gf/cv24s9PhQAGIL61vbqfKVS3ugrkX0KHcR5TiSyIvb24IPuYn9B/xznUYszJqbyruLIi3GGxORhX3GwZ/5GdsaBFjUfRHnfl0068Fr0lXg0rFgjekMChubooh91SQAAAAAAAAAAAAAAgNMM41+XRl1HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALq7/BQAA//8NTcl+") fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x40000000, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0xfffffffd, 0x0, 0x6, 0x1, "e315bc1cc24ff7b7cdb242e1ff0aa6905446b3"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) read$usbmon(r2, &(0x7f0000000340)=""/126, 0x7e) 2.084579252s ago: executing program 4 (id=5): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet(0x2, 0x3, 0x1) epoll_create1(0x0) socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) 1.991968956s ago: executing program 2 (id=16): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x4c, r1, 0x8007023327f40d31, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@key_params=[@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_MAC={0xa}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000005}, 0x20000010) 1.386657961s ago: executing program 4 (id=17): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)="711f664eb50cd5279c17da770c", 0x4c}, 0x1, 0x0, 0x0, 0x805}, 0x4044004) recvmmsg(r0, &(0x7f0000002e40)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x30062, 0x0) 1.351235803s ago: executing program 1 (id=18): writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000080)="3900000013", 0x5}], 0x1) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x0, {{0xa, 0x4e20, 0x6, @mcast2, 0x4d}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000b00)={0xb, {{0xa, 0x0, 0x76171c1, @mcast2}}, 0x1, 0x1, [{{0xa, 0x4e24, 0x8000008, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7}}]}, 0x110) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x800, @empty}, 0x1c) syz_emit_ethernet(0x46, &(0x7f0000000580)={@link_local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "04c2ad", 0x10, 0x11, 0x0, @private1, @mcast2, {[], {0x4e21, 0xe22, 0x10, 0x0, @gue={{0x2}}}}}}}}, 0x0) 1.299975272s ago: executing program 2 (id=19): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000010101010000000000000000020000000400018018000a8014000180080001007f00000108000200ac1414aa14001980080001"], 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000000906010800000001000000000200ffff0900020073797a310000000008000940000000390600010007000000100008"], 0x40}, 0x1, 0x0, 0x0, 0x10000082}, 0x0) 1.268255306s ago: executing program 0 (id=20): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f0000014780)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000001c0)="cee210b397759b5ea26d", 0xa}], 0x1}}], 0x1, 0x20000000) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000d0400"/20, @ANYRES32=r2, @ANYBLOB="002000000000000024001280110001006272696467655f736c617665000000000c000580080022"], 0x44}}, 0x0) 949.028729ms ago: executing program 3 (id=21): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r1) 671.501833ms ago: executing program 1 (id=22): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0xfffffffc, 0xb, 0x0, 0xfffffffc, 0x7f, "db8f2d2b3b7596160c6981acf8805944823a7f"}) write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x40000000, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0xfffffffd, 0x0, 0x6, 0x1, "e315bc1cc24ff7b7cdb242e1ff0aa6905446b3"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) 443.440604ms ago: executing program 4 (id=23): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [], {0x14}}, 0x28}}, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000006c000000160a01020000000000000000010000000900010073797a30000000000900020073797a3000000000400003802c00038004000100766c616e31000000000000000000000014000100776c616e3100000000000000000000000800014000000000080002"], 0xfc}}, 0x0) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="12008864"], 0xfce) 394.542802ms ago: executing program 2 (id=24): mkdir(0x0, 0x10) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x3000005, 0x0) chroot(&(0x7f0000000200)='./file0\x00') umount2(&(0x7f0000000000)='./file0\x00', 0x0) 219.55572ms ago: executing program 0 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x8101}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0xfffffffffffffe90, &(0x7f00000007c0)=[{&(0x7f0000000600)=""/178, 0xb2}, {&(0x7f0000000800)=""/257, 0x101}, {&(0x7f0000001b40)=""/4109, 0x100d}, {&(0x7f0000000a40)=""/231, 0xe7}], 0x4}, 0x4}, {{0x0, 0x1c, 0x0}, 0x7243}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000000500)=""/118, 0x76}, {&(0x7f00000006c0)=""/228, 0xe4}, {&(0x7f0000005080)=""/4093, 0xffd}, {&(0x7f0000003e40)=""/4111, 0x100f}, {&(0x7f00000003c0)=""/101, 0x65}], 0x5}, 0x1452}, {{0x0, 0x0, 0x0}, 0x6}], 0x8, 0x22, 0x0) 0s ago: executing program 1 (id=26): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newtfilter={0x50, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r1, {0xb, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x1c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0xfffffff8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}]}}]}, 0x50}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.67' (ED25519) to the list of known hosts. [ 163.175429][ T5791] cgroup: Unknown subsys name 'net' [ 163.339385][ T5791] cgroup: Unknown subsys name 'cpuset' [ 163.353797][ T5791] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 205.379611][ T5791] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 209.063761][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 209.116583][ T5816] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 209.125859][ T5816] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 209.138201][ T5816] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 209.148078][ T5816] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 209.154383][ T5822] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 209.163797][ T5822] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 209.182746][ T5816] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 209.202639][ T5105] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 209.219602][ T5105] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 209.227883][ T5105] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 209.236974][ T5105] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 209.241485][ T5826] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 209.246328][ T5105] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 209.259321][ T5105] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 209.272788][ T5826] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 209.285330][ T5826] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 209.296173][ T5826] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 209.349506][ T5826] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 209.361238][ T5826] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 209.395287][ T5826] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 209.492136][ T5826] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 209.538747][ T5826] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 209.552887][ T5826] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 209.622318][ T5826] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 210.503899][ T5814] chnl_net:caif_netlink_parms(): no params data found [ 210.870272][ T5818] chnl_net:caif_netlink_parms(): no params data found [ 210.903959][ T5821] chnl_net:caif_netlink_parms(): no params data found [ 211.211665][ T5823] chnl_net:caif_netlink_parms(): no params data found [ 211.261724][ T5826] Bluetooth: hci0: command tx timeout [ 211.345341][ T5826] Bluetooth: hci2: command tx timeout [ 211.351101][ T5822] Bluetooth: hci1: command tx timeout [ 211.404277][ T5828] chnl_net:caif_netlink_parms(): no params data found [ 211.435349][ T5826] Bluetooth: hci3: command tx timeout [ 211.666429][ T5826] Bluetooth: hci4: command tx timeout [ 211.720609][ T5814] bridge0: port 1(bridge_slave_0) entered blocking state [ 211.728172][ T5814] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.736097][ T5814] bridge_slave_0: entered allmulticast mode [ 211.745504][ T5814] bridge_slave_0: entered promiscuous mode [ 211.822864][ T5814] bridge0: port 2(bridge_slave_1) entered blocking state [ 211.831586][ T5814] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.839730][ T5814] bridge_slave_1: entered allmulticast mode [ 211.848947][ T5814] bridge_slave_1: entered promiscuous mode [ 212.033837][ T5814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 212.102372][ T5818] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.109873][ T5818] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.117940][ T5818] bridge_slave_0: entered allmulticast mode [ 212.126963][ T5818] bridge_slave_0: entered promiscuous mode [ 212.146966][ T5814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 212.156867][ T5818] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.167161][ T5818] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.174948][ T5818] bridge_slave_1: entered allmulticast mode [ 212.183966][ T5818] bridge_slave_1: entered promiscuous mode [ 212.374592][ T5823] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.385282][ T5823] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.394799][ T5823] bridge_slave_0: entered allmulticast mode [ 212.406194][ T5823] bridge_slave_0: entered promiscuous mode [ 212.417642][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.425522][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.434308][ T5821] bridge_slave_0: entered allmulticast mode [ 212.443299][ T5821] bridge_slave_0: entered promiscuous mode [ 212.515718][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.524365][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.532243][ T5823] bridge_slave_1: entered allmulticast mode [ 212.541644][ T5823] bridge_slave_1: entered promiscuous mode [ 212.554481][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.562139][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.569816][ T5821] bridge_slave_1: entered allmulticast mode [ 212.579032][ T5821] bridge_slave_1: entered promiscuous mode [ 212.596612][ T5814] team0: Port device team_slave_0 added [ 212.643956][ T5818] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 212.748677][ T5814] team0: Port device team_slave_1 added [ 212.764348][ T5818] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 212.782630][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 212.926703][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.001137][ T5823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 213.011279][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state [ 213.018894][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state [ 213.028215][ T5828] bridge_slave_0: entered allmulticast mode [ 213.036307][ T5828] bridge_slave_0: entered promiscuous mode [ 213.148014][ T5818] team0: Port device team_slave_0 added [ 213.162098][ T5821] team0: Port device team_slave_0 added [ 213.177687][ T5823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.194764][ T5818] team0: Port device team_slave_1 added [ 213.236393][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.244037][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state [ 213.251735][ T5828] bridge_slave_1: entered allmulticast mode [ 213.259765][ T5828] bridge_slave_1: entered promiscuous mode [ 213.270379][ T5814] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 213.277676][ T5814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 213.304823][ T5814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 213.324190][ T5821] team0: Port device team_slave_1 added [ 213.341183][ T5826] Bluetooth: hci0: command tx timeout [ 213.420948][ T5826] Bluetooth: hci2: command tx timeout [ 213.426462][ T5814] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 213.426531][ T5814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 213.433775][ T5822] Bluetooth: hci1: command tx timeout [ 213.465776][ T5814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 213.510694][ T5826] Bluetooth: hci3: command tx timeout [ 213.544004][ T5823] team0: Port device team_slave_0 added [ 213.553354][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 213.560724][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 213.587281][ T5818] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 213.653712][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 213.698904][ T5823] team0: Port device team_slave_1 added [ 213.708543][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 213.715822][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 213.742390][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 213.751938][ T5826] Bluetooth: hci4: command tx timeout [ 213.777975][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 213.785367][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 213.812783][ T5818] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 213.837303][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.882631][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 213.889730][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 213.916269][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 214.015798][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 214.023156][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.049670][ T5823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 214.111181][ T5828] team0: Port device team_slave_0 added [ 214.160703][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.167860][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.194274][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 214.232666][ T5828] team0: Port device team_slave_1 added [ 214.292532][ T5814] hsr_slave_0: entered promiscuous mode [ 214.302343][ T5814] hsr_slave_1: entered promiscuous mode [ 214.546157][ T5823] hsr_slave_0: entered promiscuous mode [ 214.555857][ T5823] hsr_slave_1: entered promiscuous mode [ 214.564348][ T5823] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 214.572212][ T5823] Cannot create hsr debugfs directory [ 214.621287][ T5818] hsr_slave_0: entered promiscuous mode [ 214.630902][ T5818] hsr_slave_1: entered promiscuous mode [ 214.639234][ T5818] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 214.647060][ T5818] Cannot create hsr debugfs directory [ 214.672640][ T5821] hsr_slave_0: entered promiscuous mode [ 214.681616][ T5821] hsr_slave_1: entered promiscuous mode [ 214.689209][ T5821] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 214.697088][ T5821] Cannot create hsr debugfs directory [ 214.706144][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 214.713718][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.740185][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 214.756131][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.763513][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 214.789988][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 215.423309][ T5826] Bluetooth: hci0: command tx timeout [ 215.442122][ T5828] hsr_slave_0: entered promiscuous mode [ 215.451738][ T5828] hsr_slave_1: entered promiscuous mode [ 215.459450][ T5828] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 215.467492][ T5828] Cannot create hsr debugfs directory [ 215.522858][ T5826] Bluetooth: hci2: command tx timeout [ 215.522902][ T5822] Bluetooth: hci1: command tx timeout [ 215.595038][ T5826] Bluetooth: hci3: command tx timeout [ 215.829054][ T5826] Bluetooth: hci4: command tx timeout [ 216.182112][ T5814] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 216.256228][ T5814] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 216.325574][ T5814] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 216.373738][ T5814] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 216.538974][ T5823] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 216.577616][ T5823] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 216.601460][ T5823] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 216.628825][ T5823] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 216.648170][ T5818] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 216.726258][ T5818] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 216.836821][ T5818] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 216.884605][ T5818] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 216.986903][ T5821] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 217.045834][ T5821] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 217.069977][ T5821] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 217.093434][ T5821] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 217.247464][ T5828] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 217.333113][ T5828] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 217.367260][ T5828] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 217.396113][ T5828] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 217.507773][ T5826] Bluetooth: hci0: command tx timeout [ 217.581236][ T5826] Bluetooth: hci1: command tx timeout [ 217.588372][ T5822] Bluetooth: hci2: command tx timeout [ 217.661368][ T5826] Bluetooth: hci3: command tx timeout [ 217.746302][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 217.834265][ T5823] 8021q: adding VLAN 0 to HW filter on device team0 [ 217.867120][ T5818] 8021q: adding VLAN 0 to HW filter on device bond0 [ 217.911071][ T5826] Bluetooth: hci4: command tx timeout [ 217.929528][ T4002] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.937300][ T4002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 217.961534][ T5814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 218.056259][ T4002] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.063881][ T4002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 218.154043][ T5818] 8021q: adding VLAN 0 to HW filter on device team0 [ 218.203124][ T5814] 8021q: adding VLAN 0 to HW filter on device team0 [ 218.256865][ T4002] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.264463][ T4002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 218.314314][ T4002] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.321912][ T4002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 218.374072][ T4002] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.381711][ T4002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 218.487053][ T4002] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.494796][ T4002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 218.565936][ T5823] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 218.665055][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 218.939352][ T5821] 8021q: adding VLAN 0 to HW filter on device team0 [ 218.972120][ T5814] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 218.983479][ T5814] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 219.069738][ T4002] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.077389][ T4002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.219565][ T4002] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.228812][ T4002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.316360][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.361001][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 219.367692][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 219.544865][ T5828] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.655570][ T3572] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.663202][ T3572] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.757067][ T3572] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.764715][ T3572] bridge0: port 2(bridge_slave_1) entered forwarding state [ 220.605506][ T5818] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.636975][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.850234][ T5814] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 221.195276][ T5823] veth0_vlan: entered promiscuous mode [ 221.213194][ T5818] veth0_vlan: entered promiscuous mode [ 221.256968][ T5818] veth1_vlan: entered promiscuous mode [ 221.347825][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 221.368645][ T5823] veth1_vlan: entered promiscuous mode [ 221.486842][ T5814] veth0_vlan: entered promiscuous mode [ 221.586032][ T5814] veth1_vlan: entered promiscuous mode [ 221.636371][ T5818] veth0_macvtap: entered promiscuous mode [ 221.682075][ T5818] veth1_macvtap: entered promiscuous mode [ 221.785775][ T5823] veth0_macvtap: entered promiscuous mode [ 221.878150][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 221.897998][ T5823] veth1_macvtap: entered promiscuous mode [ 221.961467][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 222.020778][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 222.039611][ T5821] veth0_vlan: entered promiscuous mode [ 222.066065][ T5814] veth0_macvtap: entered promiscuous mode [ 222.111016][ T5818] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.120031][ T5818] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.129206][ T5818] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.138437][ T5818] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.176762][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 222.224340][ T5814] veth1_macvtap: entered promiscuous mode [ 222.249902][ T5821] veth1_vlan: entered promiscuous mode [ 222.293637][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 222.376688][ T5823] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.386449][ T5823] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.395677][ T5823] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.404857][ T5823] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.476258][ T5814] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 222.524291][ T5814] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 222.617829][ T5821] veth0_macvtap: entered promiscuous mode [ 222.656247][ T5814] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.666141][ T5814] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.675965][ T5814] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.685057][ T5814] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.721613][ T5821] veth1_macvtap: entered promiscuous mode [ 222.789970][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 222.886415][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 222.968580][ T5821] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.979297][ T5821] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.989544][ T5821] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 222.999858][ T5821] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 224.349483][ T5828] veth0_vlan: entered promiscuous mode [ 224.458330][ T5828] veth1_vlan: entered promiscuous mode [ 224.711409][ T5828] veth0_macvtap: entered promiscuous mode [ 224.777621][ T5828] veth1_macvtap: entered promiscuous mode [ 224.978846][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 225.082498][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 225.163473][ T5828] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.175064][ T5828] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.185563][ T5828] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 225.195533][ T5828] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.162085][ T3959] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.170160][ T3959] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.264105][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.272876][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.453407][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.462234][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.607696][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.615875][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.750296][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.759273][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.773716][ T5818] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 228.857834][ T14] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.868703][ T14] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 229.165333][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 229.173823][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 229.501045][ T3959] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 229.509206][ T3959] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 230.633665][ T6006] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6'. [ 230.643698][ T6006] sit0: entered promiscuous mode [ 230.648853][ T6006] sit0: entered allmulticast mode [ 231.760851][ T3572] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 231.769023][ T3572] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 231.974763][ T3016] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 231.983286][ T3016] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 232.306669][ T6025] Bluetooth: MGMT ver 1.23 [ 232.579439][ T6028] loop3: detected capacity change from 0 to 512 [ 232.981269][ T6022] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 233.671625][ T6042] netlink: 8 bytes leftover after parsing attributes in process `syz.2.19'. [ 233.698164][ T6044] netlink: 'syz.2.19': attribute type 1 has an invalid length. [ 234.512551][ T6053] syz.4.23 uses obsolete (PF_INET,SOCK_PACKET) [ 234.642041][ T6058] ===================================================== [ 234.649382][ T6058] BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 [ 234.657765][ T6058] nf_flow_offload_inet_hook+0x7e4/0x940 [ 234.663699][ T6058] nf_hook_slow+0xde/0x3d0 [ 234.668302][ T6058] __netif_receive_skb_core+0x4aff/0x70c0 [ 234.674375][ T6058] __netif_receive_skb+0xcc/0xac0 [ 234.679645][ T6058] netif_receive_skb+0x57/0x630 [ 234.684885][ T6058] tun_rx_batched+0x1df/0x980 [ 234.689749][ T6058] tun_get_user+0x4ee0/0x6b40 [ 234.694872][ T6058] tun_chr_write_iter+0x3e9/0x5c0 [ 234.700082][ T6058] vfs_write+0xb48/0x1580 [ 234.704808][ T6058] __ia32_sys_write+0x1f9/0x4d0 [ 234.709869][ T6058] ia32_sys_call+0x30f2/0x42c0 [ 234.714914][ T6058] __do_fast_syscall_32+0xb0/0x150 [ 234.720237][ T6058] do_fast_syscall_32+0x38/0x80 [ 234.725442][ T6058] do_SYSENTER_32+0x1f/0x30 [ 234.730168][ T6058] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 234.736927][ T6058] [ 234.739356][ T6058] Uninit was created at: [ 234.743994][ T6058] kmem_cache_alloc_node_noprof+0x818/0xf00 [ 234.750074][ T6058] kmalloc_reserve+0x13c/0x4b0 [ 234.755248][ T6058] __alloc_skb+0x347/0x7d0 [ 234.759861][ T6058] alloc_skb_with_frags+0xc5/0xa60 [ 234.765378][ T6058] sock_alloc_send_pskb+0xad8/0xc70 [ 234.770939][ T6058] tun_get_user+0x1019/0x6b40 [ 234.775802][ T6058] tun_chr_write_iter+0x3e9/0x5c0 [ 234.781214][ T6058] vfs_write+0xb48/0x1580 [ 234.785748][ T6058] __ia32_sys_write+0x1f9/0x4d0 [ 234.790996][ T6058] ia32_sys_call+0x30f2/0x42c0 [ 234.795937][ T6058] __do_fast_syscall_32+0xb0/0x150 [ 234.801456][ T6058] do_fast_syscall_32+0x38/0x80 [ 234.806525][ T6058] do_SYSENTER_32+0x1f/0x30 [ 234.811439][ T6058] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 234.817988][ T6058] [ 234.820594][ T6058] CPU: 1 UID: 0 PID: 6058 Comm: syz.4.23 Not tainted 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(none) [ 234.832842][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 234.843259][ T6058] ===================================================== [ 234.850317][ T6058] Disabling lock debugging due to kernel taint [ 234.856787][ T6058] Kernel panic - not syncing: kmsan.panic set ... [ 234.863374][ T6058] CPU: 1 UID: 0 PID: 6058 Comm: syz.4.23 Tainted: G B 6.16.0-rc5-syzkaller-00025-gd006330be3f7 #0 PREEMPT(none) [ 234.877228][ T6058] Tainted: [B]=BAD_PAGE [ 234.881496][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 234.891734][ T6058] Call Trace: [ 234.895135][ T6058] [ 234.898179][ T6058] __dump_stack+0x26/0x30 [ 234.902714][ T6058] dump_stack_lvl+0x53/0x270 [ 234.907511][ T6058] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 234.913533][ T6058] dump_stack+0x1e/0x25 [ 234.917874][ T6058] panic+0x4bd/0xd50 [ 234.921994][ T6058] kmsan_report+0x31c/0x320 [ 234.926682][ T6058] ? __msan_warning+0x1b/0x30 [ 234.931530][ T6058] ? nf_flow_offload_inet_hook+0x7e4/0x940 [ 234.937533][ T6058] ? nf_hook_slow+0xde/0x3d0 [ 234.942293][ T6058] ? __netif_receive_skb_core+0x4aff/0x70c0 [ 234.948385][ T6058] ? __netif_receive_skb+0xcc/0xac0 [ 234.953771][ T6058] ? netif_receive_skb+0x57/0x630 [ 234.958985][ T6058] ? tun_rx_batched+0x1df/0x980 [ 234.963998][ T6058] ? tun_get_user+0x4ee0/0x6b40 [ 234.969012][ T6058] ? tun_chr_write_iter+0x3e9/0x5c0 [ 234.974360][ T6058] ? vfs_write+0xb48/0x1580 [ 234.979062][ T6058] ? __ia32_sys_write+0x1f9/0x4d0 [ 234.984267][ T6058] ? ia32_sys_call+0x30f2/0x42c0 [ 234.989348][ T6058] ? __do_fast_syscall_32+0xb0/0x150 [ 234.994834][ T6058] ? do_fast_syscall_32+0x38/0x80 [ 235.000046][ T6058] ? do_SYSENTER_32+0x1f/0x30 [ 235.004906][ T6058] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 235.011598][ T6058] ? kmsan_get_metadata+0xfb/0x160 [ 235.016908][ T6058] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 235.023011][ T6058] ? __pskb_pull_tail+0x1779/0x2660 [ 235.028419][ T6058] ? kmsan_get_metadata+0xfb/0x160 [ 235.033726][ T6058] __msan_warning+0x1b/0x30 [ 235.038401][ T6058] nf_flow_offload_inet_hook+0x7e4/0x940 [ 235.044297][ T6058] ? kmsan_get_metadata+0xfb/0x160 [ 235.049592][ T6058] ? __pfx_nf_flow_offload_inet_hook+0x10/0x10 [ 235.055931][ T6058] ? __pfx_nf_flow_offload_inet_hook+0x10/0x10 [ 235.062259][ T6058] nf_hook_slow+0xde/0x3d0 [ 235.066879][ T6058] __netif_receive_skb_core+0x4aff/0x70c0 [ 235.073159][ T6058] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 235.079164][ T6058] ? filter_irq_stacks+0x49/0x190 [ 235.084419][ T6058] __netif_receive_skb+0xcc/0xac0 [ 235.089699][ T6058] netif_receive_skb+0x57/0x630 [ 235.094764][ T6058] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 235.100781][ T6058] ? tun_rx_batched+0x16c/0x980 [ 235.105804][ T6058] tun_rx_batched+0x1df/0x980 [ 235.110656][ T6058] ? kmsan_get_metadata+0xfb/0x160 [ 235.115987][ T6058] tun_get_user+0x4ee0/0x6b40 [ 235.120834][ T6058] ? stack_depot_save_flags+0x35/0x7b0 [ 235.126488][ T6058] ? __rcu_read_unlock+0x6d/0xd0 [ 235.131649][ T6058] ? kmsan_get_metadata+0xfb/0x160 [ 235.136974][ T6058] ? kmsan_get_metadata+0xfb/0x160 [ 235.142311][ T6058] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 235.148833][ T6058] ? kmsan_internal_unpoison_memory+0x14/0x20 [ 235.155134][ T6058] tun_chr_write_iter+0x3e9/0x5c0 [ 235.160347][ T6058] vfs_write+0xb48/0x1580 [ 235.164889][ T6058] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 235.170610][ T6058] __ia32_sys_write+0x1f9/0x4d0 [ 235.175676][ T6058] ia32_sys_call+0x30f2/0x42c0 [ 235.180594][ T6058] __do_fast_syscall_32+0xb0/0x150 [ 235.185923][ T6058] do_fast_syscall_32+0x38/0x80 [ 235.190979][ T6058] do_SYSENTER_32+0x1f/0x30 [ 235.195676][ T6058] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 235.202186][ T6058] RIP: 0023:0xf711e539 [ 235.206407][ T6058] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 235.226220][ T6058] RSP: 002b:00000000f50ed55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 235.234858][ T6058] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 235.242976][ T6058] RDX: 0000000000000fce RSI: 0000000000000000 RDI: 0000000000000000 [ 235.251094][ T6058] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 235.259229][ T6058] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 235.267344][ T6058] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 235.275478][ T6058] [ 235.278890][ T6058] Kernel Offset: disabled [ 235.283290][ T6058] Rebooting in 86400 seconds..