last executing test programs: 8.423218966s ago: executing program 0 (id=3092): r0 = socket(0x22, 0x800, 0x2) close(0xffffffffffffffff) r1 = gettid() r2 = socket(0x10, 0x803, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010000304f9fffffffedbdf2500007400", @ANYRES32=0x0, @ANYBLOB="049c0100075005c908001300", @ANYRES32=r1, @ANYBLOB="140003006d616373656330000000000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4802}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000000d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r8) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r9, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@void, @void}}}, 0x14}}, 0x4000054) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TESTMODE(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="48020000", @ANYRES16=r9, @ANYBLOB="000025bd7000fcdbdf252d00000008000300", @ANYRES32=r10, @ANYBLOB="210045007b75de80f353dc55d2ead55efe11f3069502b2c3dfa576a72a92d01faa0000008c004500f6b0c722da66ebbf7af09392855b3ef625292a782c8c8432298912f8e05d8ced4391bf2227579725fe466cfa1ce28940af0d939ec28c5a4a68ce34ec79a5b8f8469656138e4936b5f6cdec4463434ddb03ed7857c38d10827e4a55396af11e76b111e409058f7a42f46fbe4f81f02ddba2d30d493728727ae3412c87095bf8e3b41a688bbf13dae0f4004500180e0b6b66c8c45c3217619c54d75509ec9e62a7e41ab0976d7b3bb0f383932161d41b2a735134094abbbb4a3722909183754c1abea64fe43963caee68c66531d9d862436fec3321a244afb241336008271e6102f1fec47bd16cd42effb6495d6f7f2a6b220a93b7a2829a626302da6ede2a6e28b399186a71bdf932b0091d2c69befa261141c6d9147237f212ba1edf65e24fa0eb55f60f5f0f9a7df274f17a58dc7262ab99762aee98228fed7efe5d7870eaa9739699520e36cc6d4b6f75277f5e4cb25e4313ce14e5452a2cf2f5244353a76a83de3605000a4fbe6cc161816cc2bda427020bc97155da769929aee0610045006d68089af327eda4fa24fe5c459a8e29e604096e067fac3bfe04bf6bbe8dd6e97f3c90f12a80b1a4e599b5855794af9227ff1d92bb46332457d231ca08bb0b8a5b367f3b05b24afb80eb22959606db3bb4c7881d2deb6d02f6efc5727b0000000900450090a2b29f54000000170045002acbbee299dd829537da0c30bdf23303ef87b800"], 0x248}, 0x1, 0x0, 0x0, 0x8004}, 0xc0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r12 = syz_open_procfs$namespace(r1, &(0x7f0000000180)='ns/pid\x00') sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000940)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00032dbd7000fbdbdf253100000008000300", @ANYRES32=r10, @ANYBLOB='\b\x00R\x00', @ANYRES32=r1, @ANYBLOB="08000300", @ANYRES32=r11, @ANYBLOB="0800db00", @ANYRES32=r12, @ANYBLOB='\b\x00R\x00', @ANYRES32=r1, @ANYBLOB='\b\x00R\x00', @ANYRES32=r1, @ANYBLOB="295c63a6b9b0cf1d7a99650b50399295918195eae1eba6888b747e71f98468e8ccd89c81cb39f82124b7acb3ba9ed8080000003a239c581d", @ANYRES32=r1, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x8000) bind$bt_l2cap(0xffffffffffffffff, &(0x7f00000005c0)={0x1f, 0x0, @none, 0x4, 0x2}, 0xe) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r13 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r13, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x4}, {&(0x7f0000000300)='l3', 0x7fffef80}, {&(0x7f0000000780)="5b06c70461fab92b3d952a0a0b5eca7d6b21f62c4f56ea9109a00b742eab4a7fdac90ab7c51a813cc4d693127d10c4e7234944e9410ad19c43ca9751c1b97aca344e5bf77fde23184af0b7e160e7a9a681f6391270dedc2978f7d1b9a913801beaa52e1eedf0ae71021e0d40864fc63603f1d6d94f55d23fb15eebc780292ee4be48a9036dcb83345a4285e043439e95b3f23b6edf199cea092725d6f7fab0f975cc42bd279f5de21d08a38091edbb34b32c6cd53373651fd3343aa6b228a996d957c556694dc3a26b68b38093a92eb192aa973bda1b51c61b6cc2b49a54550085e8d8270d889cefe65f62c975815b1b1208ed"}], 0x3f}], 0x1, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r13, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="200027bd7000fcdbdf254f0000000c0099000000000072000000"], 0x20}, 0x1, 0x0, 0x0, 0x20040080}, 0x8004) accept4$llc(r13, 0x0, 0x0, 0x0) sendmsg$nl_netfilter(r13, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="e8000000030301022dbd7000fcdbdf250300000808002d0000040000ca00e8805fb1755c807e0c3b07963c75796b3bc21418171b3651104bc66a3bbe3c787db88a11f891f77656bd9531000068a3b4833ab2856a08fc84b845d39b5e86879103ae6a5139ea41a6f85a86354e8f438aac37bae4a999dd0b239608eb765a55dc2adf92399bfb122301af845610992e6a8418fc938bf9a675b5f783aac716c5ea10f7641485d96f87cc7c221ca4bbd13dc2001811413f9dc5d92808d314e98df3a6074179bd0d5f5194b50f1be34fc7fa19541aea9e8b0115a09c4553ae420000"], 0xe8}, 0x1, 0x0, 0x0, 0x41}, 0x4000020) r14 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="20000000680001000000b84acaeed82a46e1000000000000080005"], 0x20}, 0x1, 0x0, 0x0, 0x20008845}, 0x8004) 8.109118676s ago: executing program 0 (id=3095): bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000f00)={@cgroup, 0xffffffffffffffff, 0x4}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0f00000004"], 0x50) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6800000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000480012800b000100697036746e6c00003800028014000200fe8000000000000000000000000000aa08000100", @ANYBLOB="04001300140003004f"], 0x68}}, 0x20008804) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e21, 0xd, @loopback, 0x4}]}, &(0x7f0000000280)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x1000, @empty}}, 0x7fff, 0x0, 0xd78e, 0x40, 0x5a1, 0x0, 0x7}, 0x9c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021100011800c000100636f756e746572009c0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000700003806c000080080003400000000260000b80440001800c000100636f756e746572"], 0x130}, 0x1, 0x0, 0x0, 0x8000}, 0x8880) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=@bridge_delneigh={0x24, 0x1d, 0xf07, 0x0, 0x0, {0x7, 0x0, 0x0, r5, 0x0, 0xd2, 0xb}, [@NDA_VLAN={0x6, 0x5, 0x2}]}, 0x24}}, 0x0) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SET_TUNSRC(r4, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="e50328bd7000fedbdf2503000000050006000c00000014c20200fc010000000000000000000000000001080002006c840000b9aacd425e9eada30411d035e300f8383dd6531c11cd0a06ad8f55085f04a11188b7043a787166fa6e4c9ca0308da81c576055022c4004b0ef9f862c2b6adb09411df72caddbf912300b813e711031857dece69f41fd20fc358074ff9fb6247451dafc79245f871c22799359225d1641f2b1935af0f1aee1176dbd76cfb21098500e3514ea43a4758cf1063d4381bae3532bfecfbb22df241a4f04315d0ba31bc9bec59b68ace5ab3f5ee6e9adafd56fcf60bffaa685edae4b721a9a1cf8fd3d4cb116b9788f43715d3a6b01b6045a82955b83c8325f876ca218e5ec0248249ad33583477951d3c2e4d8aa44603f00c5f681b51aba95a49f8bd5de992ffb68b5a223b008947777fe523ccaf0305f262335de974a7f398b46bf257630d5d32a1b1f0142ee1c815acb501e606b76ca54a8c76995371410f1803be8012cce53db48a15382b3774805e64259d90715446151961b72aebf9c2c597a47965c72b1b9c590511381d62430b726"], 0x38}}, 0x40010) 7.701930307s ago: executing program 0 (id=3098): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@ipv4_newrule={0x24, 0x1e, 0x1, 0x0, 0x2, {0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xe}, [@FRA_DST={0x8, 0x1, @rand_addr=0x64010102}]}, 0x24}, 0x1, 0x0, 0x0, 0x42}, 0x2810) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000091}, 0x40010) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003ec0)={0x28, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x7, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xdd}]}, @nested={0xc, 0x3, 0x0, 0x1, [@nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x7a}]}]}]}, 0x28}}, 0x2000c004) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000000)=0x7, 0x4) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000080)=@newtaction={0x60, 0x30, 0x9, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_skbedit={0x48, 0x1, 0x0, 0x0, {{0xc}, {0x38, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x0, 0x0, 0x20020000}}]}, {0x4}, {0xc}, {0xc, 0x9}}}]}]}, 0x60}}, 0x0) 7.513491725s ago: executing program 0 (id=3101): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="0026bd7000fbdbdf250a108008dd00000300"/28], 0x1c}, 0x1, 0x0, 0x0, 0x20048001}, 0x8000) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040), 0x10, &(0x7f00000001c0)={&(0x7f0000000140)={0x2, 0x12, 0x0, {0x77359400}, {r1, r2/1000+60000}, {0x1, 0x0, 0x1}, 0x1, @canfd={{0x4, 0x1, 0x0, 0x1}, 0x36, 0x0, 0x0, 0x0, "24a80b9810f4df3932936dd983724b710a584d1e0d5edf6c8c84f2da470558e1cf77c028d7acd6f611652c6dd40d42ce808a53a2fe922a5f49ab306d1c9fc67a"}}, 0x80}, 0x1, 0x0, 0x0, 0x10}, 0x801) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) 7.41138562s ago: executing program 0 (id=3102): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'veth0_to_hsr\x00', 0x10}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002, 0x2000}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000000080)='D', 0x1, 0x0, 0x0, 0x0) shutdown(r3, 0x1) splice(r3, 0x0, r2, 0x0, 0x406f413, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)=@can_delroute={0x44, 0x19, 0x308, 0x70bd28, 0x25dfdbfc, {0x1d, 0x1, 0x1}, [@CGW_MOD_OR={0x15, 0x2, {{{0x4, 0x1, 0x1}, 0x6, 0x3, 0x0, 0x0, "a105a735f710af83"}, 0x6}}, @CGW_MOD_SET={0x15, 0x4, {{{0x1, 0x1, 0x1, 0x1}, 0x1, 0x1, 0x0, 0x0, "fd097e3fa42bb02e"}, 0x2}}]}, 0x44}, 0x1, 0x0, 0x0, 0x48000}, 0x0) close(r1) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000140)={'sit0\x00', &(0x7f0000000840)={'ip_vti0\x00', 0x0, 0x7, 0x1, 0x1, 0x7, {{0x5, 0x4, 0x0, 0x5, 0x14, 0x68, 0x0, 0x3d, 0x29, 0x0, @multicast1, @remote}}}}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r7) sendmsg$NL802154_CMD_GET_WPAN_PHY(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="6d932bbd70000000000001"], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r7) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001300)={0x13, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="000000000000711100"], &(0x7f00000000c0)='syzkaller\x00', 0x2, 0xde, &(0x7f00000013c0)=""/222, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) syz_genetlink_get_family_id$nbd(&(0x7f0000000000), r7) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000001a00010000000000fbdbdf25020010170000000008001a00080002007f000001"], 0x2c}}, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x41071, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x5, 0x20000000ec071, 0xffffffffffffffff, 0x0) getsockname$inet6(r4, &(0x7f0000000340)={0xa, 0x0, 0x0, @local}, &(0x7f0000000380)=0x1c) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 5.697178072s ago: executing program 1 (id=3123): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r4, &(0x7f00000000c0)={&(0x7f0000000180)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2004c09d) (async) shutdown(r4, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c0000081004030468bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="a42804000000000014003500766c616e30000000000000000000000008000a00", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x8000) (async) sendmsg$nl_route(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x20, 0x11, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x408}}, 0x20}, 0x1, 0x200000000000000, 0x0, 0x4}, 0x40cc040) 5.564133773s ago: executing program 4 (id=3125): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x403, 0x0, 0x25dfdc01, {0x0, 0x0, 0x3, 0x0, 0xd410, 0xf69aa1672a50ebb1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TOS={0x5, 0x4, 0x4}, @IFLA_GENEVE_UDP_ZERO_CSUM6_RX={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40881}, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x403, 0x0, 0x25dfdc01, {0x0, 0x0, 0x3, 0x0, 0xd410, 0xf69aa1672a50ebb1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TOS={0x5, 0x4, 0x4}, @IFLA_GENEVE_UDP_ZERO_CSUM6_RX={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40881}, 0x10) (async) 5.491768163s ago: executing program 1 (id=3126): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="1800990000000000000000000001000000850000000e0000850000002a0000009500"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, 0x2}, 0x94) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000002c0)={{{@in6, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000000)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in=@loopback, 0x4e20, 0x0, 0x4e20, 0x0, 0x2, 0xa0, 0x80, 0x2e, 0x0, r2}, {0x7fff, 0x2, 0x7, 0xfffffffffffff415, 0x6, 0x0, 0x5, 0xc9a}, {0x5, 0xfffffffffffffffe, 0xf99, 0xf9f5}, 0x400, 0x6e6bb6, 0x1, 0x1, 0x2, 0x5}, {{@in=@rand_addr=0x64010100, 0x4d4, 0x32}, 0x0, @in6=@local, 0x3507, 0x4, 0x0, 0x2, 0x6, 0x5, 0x3}}, 0xe8) r3 = socket(0x1, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r4, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r3}, 0x20) recvmmsg(r3, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000940)=""/199, 0xc7}], 0x1}}], 0x2, 0x60, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x10) gettid() bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000d40)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007126000000000000bf670000000000005601000000ff07ad67060000020000006a0200000ee60000bf250000000000003d350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56601a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa55eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8d4fee81e3cdd5daf2cdad3d1a74a2f078aa6402483856a6e494408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae060959c9639564f000fc3cdd05a1575c91cf5ba8b2db403681ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc6ae8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f8000000000000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcba6ec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0d642986f8bbc7340bc6393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d6812467c1a4186edd036f15bf847c50f79e1a0ad3d2b5080ecb0148e2b86177869884ae62420c9f1b534e969fce97ffff070000000000dbbfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d62875e5319cd51bdd224878a0b25edf0e83c930633bd9a0c3e28f359608ea326c77a1aa17318f392a0ec6c188916f452533d4327feccfd68ec8278a90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8668f076c659f56d6c7f97a96d6cdf45cfe88b30c170000000001000000effbf33bd1becb0de0a080931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f2be09295e4a8da03d23b48bb38b31a14ffcddd92c38f6b6d86a0e5ed47a82bad5d2a6dce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6423065624f130000000000000000000000000000000000000000002a37163e8d7ef2f3c58d045f0700000094029acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sched_cls=0x2e}, 0x94) 5.355713028s ago: executing program 4 (id=3128): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000180)={{0x3, @null}, [@netrom, @default, @default, @netrom, @bcast, @rose, @null, @netrom]}, &(0x7f0000000040)=0x48) r2 = accept$ax25(r1, 0x0, &(0x7f0000000000)=0xffffffffffffff46) ioctl$sock_ax25_SIOCADDRT(r2, 0x890b, &(0x7f00000000c0)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, 0x2, [@null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000019580)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="31200000000000000c002b8000000800", @ANYRES32, @ANYBLOB='\b\x00;\x00\x00\x00'], 0x34}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 5.341387871s ago: executing program 4 (id=3129): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), r0) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=ANY=[@ANYBLOB="18180000000000000000020000000000000000000600000000000000", @ANYRES32, @ANYBLOB="00000000000000002c000000000000001800000000000000000000000000000095000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r1, 0xe0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10, &(0x7f0000001380)}}, 0x10) 5.324342014s ago: executing program 1 (id=3130): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000a00)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1f, 0xffffffffffffffff, &(0x7f00000003c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x129800, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$sock(r2, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x48094) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0b00000005000000010001000900000001000000", @ANYRES32, @ANYBLOB="ffffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000fcffffff00"/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000013c0)={{r3}, &(0x7f0000001340), &(0x7f0000001380)='%pI4 \x00'}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000001540)=""/155}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000140), &(0x7f00000002c0)=""/4095}, 0x20) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, 0x0, 0x0) syz_open_procfs$namespace(0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000440)=ANY=[@ANYRES16, @ANYBLOB="000027bd7000faffffff010000"], 0x14}}, 0x8084) unshare(0x62040200) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2, 0x0, 0x0) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x82, 0xb7, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)=ANY=[@ANYBLOB="28000000180001002abd7000fddbdf251c149406"], 0x28}, 0x1, 0x0, 0x0, 0x14}, 0x24048010) socket$inet6_tcp(0xa, 0x1, 0x0) 5.243415037s ago: executing program 4 (id=3131): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000042c0)={'gre0\x00', 0x0}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth1_vlan\x00', 0x0}) r2 = gettid() r3 = socket(0x10, 0x803, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x403, 0xfffffff9, 0x25dfdbfe, {0x0, 0x0, 0x74, r1, 0x19c04, 0x55007}, [@IFLA_NET_NS_PID={0x8, 0x13, r2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4802}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb0100180000000000000038000000380000000300000000000000000000030000000003000000020000000200000000000000000000010500000010000000010000000000001101000000000000000061"], 0x0, 0x53}, 0x20) 4.951513219s ago: executing program 2 (id=3134): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = socket(0x400000000010, 0x3, 0x0) (async, rerun: 32) r2 = socket$unix(0x1, 0x1, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000004cc0), r4) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000004e40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000004d00)={0x68, r5, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'bridge_slave_1\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast2}, @NLBL_UNLABEL_A_SECCTX={0x2b, 0x7, 'system_u:object_r:ssh_keygen_exec_t:s0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x84}, 0x48040) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) (async) socket(0x15, 0x5, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_fw={{0x7}, {0x20, 0x2, [@TCA_FW_MASK={0x8, 0x5, 0x8}, @TCA_FW_INDEV={0x14, 0x3, 'gretap0\x00'}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x404c800}, 0x804) 4.867869413s ago: executing program 4 (id=3135): socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000002000010000000000000000000a0020400000000700000000b1ee5472ddce9ae56ac11bbe03162acc4b11"], 0x1c}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008001000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100200}, 0x94) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000300)={'ip6erspan0\x00', &(0x7f00000001c0)=@ethtool_channels={0xfcfff2c93bb40433, 0x6, 0x4, 0x1, 0x5, 0x128, 0x81, 0x9, 0x2000000}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0x5, 0xe, 0x0, &(0x7f0000000040)="6121eed4cd50bb2b01e841acde1a", 0x0, 0x29d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe}, 0x2c) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x24009851}, 0x0) 4.727119717s ago: executing program 4 (id=3137): sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x208}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') syz_emit_ethernet(0x32, &(0x7f00000002c0)=ANY=[], 0x0) unshare(0x6a040000) r1 = socket(0x8, 0x3, 0x3) ioctl$sock_netrom_SIOCADDRT(r1, 0x6180, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) recvmsg$qrtr(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000340)=[{0x0}], 0x1, 0x0, 0x0, 0x10000}, 0x38, 0x10020) r2 = socket$netlink(0x10, 0x3, 0x12) sendmmsg(r2, &(0x7f0000000800), 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) recvmsg$unix(r1, &(0x7f00000001c0)={0x0, 0xfffffffffffffd06, 0x0}, 0x10023) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000003000)={0x2}, 0x2) r3 = socket(0x1e, 0x5, 0x0) recvmmsg(r3, 0x0, 0x0, 0x20, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0xfffffdd7) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) socketpair$unix(0x1, 0x5, 0x0, 0x0) 4.600653662s ago: executing program 2 (id=3139): r0 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x80000) setsockopt$inet6_int(r0, 0x29, 0x0, &(0x7f0000000280)=0x6f, 0x4) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e23, @loopback}, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x1a030}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="440000000206030000000000000000000700000705000100070000000900020073797a31000000000c000780080013400000000e05000500020000000500040001000000d6c0d350148d099914a470c4fbe81a8c081522f41d6f2f521e1aff6e804674eb9d6aa390e6f64849246527f8658bb278d83d7eedda5cdc86e449e466fe696248456c82fb13"], 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000004000000000000000000850000008800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000700)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002abd7000ffdbdf2525000000090000007770616e3100000005002a0001000002"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x8800) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="74aa7078c596bdf9a4be02b03cf6bb675d0b3298d8923fbcc38ddca3da2b7283f1bba442687e6ecf1ed0e5d31b8abd5b8066b9f8f48587696150487cf224e43ef46cc9c53c4dc0ed2943d6ba230a7e34fa61a8d68df0810734e30dccd14a71f990888cdecf84ce9193cc1a7f2c1d173748c5f54c2e03bd0cccd678afb1d741de8e0c2abee44fe86389a9d19abf21b6a2fb833801450b044d63f3074c6edc5eedcb489bcafe89c0f5d2b5fdbbb478f80d348fbd363e24808c", @ANYRES16=r8, @ANYBLOB="050026bd7000fcdbdf2501000000080004000000000008000400ffffffff0a000100776c616e3000000008000c000000000008000c0000000000"], 0x40}}, 0x24004020) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="00000000a82a52a4a6c60465c1b1e1b7f48c2066fad56a2b05602edba3ff5c5100e41843379b1470c61c58db2b4cc14691d36f98b9ed3c12a6b61673325d79c19065f29dff9a498591b19a061762775152b20d3752b610", @ANYRES16=r6, @ANYBLOB="010000000000020000003900000008000300", @ANYRES32=r9, @ANYBLOB="24005a80200004801400050018002948d1b5062009abbdf006008803050004"], 0x40}, 0x1, 0x0, 0x0, 0xc801}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x20000000}, @IFLA_GRE_IFLAGS={0x6, 0x2, 0x30}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040080}, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000240), 0x4) 4.514105345s ago: executing program 2 (id=3140): ioctl$BTRFS_IOC_QUOTA_RESCAN(0xffffffffffffffff, 0x4040942c, &(0x7f0000000340)={0x0, 0x5, [0xfffffffffffffbe5, 0x100000001, 0x8, 0x5, 0x10]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a64000000090a01040000000000000000070000000900020073797a32000000000900010073797a3000000000080005400000002f2800128024000180090001006d6574610000000014000280080001400000000008000240000000210800034000000110140000001000010000000000000000000384000ac7ac4ea158ee3ce39f5a288fd498e1b29e655bbe77c2dde95123701b67e97ba2be44ba1b651777e7682812b5ab63a2c3ccb8682bc35a2b4af1b98f8bcc893d8ab37d06c71273e2c320dadea6506a8941eddfd3e0915f0d2aacc68358b59e0a3210a992f3fc104f28cb1380494be7b72204f689"], 0x8c}}, 0x200508d4) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="14000004f8e2615c97557b1a4ad63ad4220289fafa1812ee4a59c5c8cb9f08648b834e3fbd9e20e7bcdec5932dbb0a1c7cbfbb50769ec3628307c7b36362efadce1067a2f6e19e06b91dd4a1f84ce43fdc1c1d648764eb45f3c97deecfb6a0e7f75d927dedd20b562bca8d352db69d33609b437452089c5aef34c2a47761cf5691bcce3d5914931f131401b238000000", @ANYBLOB="7a2d536e986905d982e1e293c06a7b6c451cf8540a6f2a3cf2215c2fa90a3436c149dba3e80d9af5952a0c13d6bc494fe478e4c9a4d4fa6aee56536b93715995ccbe84d5c0e9633dc1881a8c3d2ff56870ed9ba318eae44f06d8ff3a68a1e9414a0ff95f2b1193930afd30964959cd93cf4b690e0be53e2629f1b81340dd5487d8565d0c9a69f615937c132f5330943d6d63d5176be661272ecdcd212e2099cc88a0e5de6d278d02d97b71cc06a49328ba2f3bb21efa60d700daafb13adc4d8327d7edd4bb4d", @ANYBLOB="010300000000"], 0x14}}, 0x44010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000080)=0x1000, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_GETFSUUID(r2, 0x80111500, &(0x7f00000002c0)) r4 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f00000003c0)=0x6, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e22, @local}], 0x10) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000940)=ANY=[@ANYBLOB="ac01000017000d090000000000000000ffffffff0000000000000000000000000000000000000000fc010000000000000000000000000000fe8000000000000000000000000000bbff020000000000000000000000000001000000004e2100"/104, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000a00000011000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000af00000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008400050000000000000000000000ffff7f000001000004d4ff0000000a000000ffffffff0000000000000000000000000000000004037f00c1005a0387f8ef2aab70e5903d3200000900000043000000e0000002000000000000000000000000000004d6320000000a0000000a010101000000000000000000000000ff340000030304000100000002000000e70000008756c106f9c73438a6e92969baa6b2ca23607c2c7977346f272e59a59e8c03ed6517034234dd5681a342de4f1e4446a14c7beb29e34a2063521b9998e4d789ed8070dbf9e22fd06dc762465881dc367c22a8ac9de673d96584be06e44b21739a302ff0771377d8e5ffead1031de4395e172dca03560b965ae947ab0d8c498d8772d471166fd18443ce6c5b843e929aa6c51b9127c84cd1ef488151bd5c496fe4186466a524685c6885b48a3ad6b4d18bd990767d96df35cde9c86717e72c"], 0x1ac}}, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000140), 0x8) setsockopt$inet_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f0000000400)={@in={{0x2, 0x4e22, @rand_addr=0x64010101}}, 0x0, 0x0, 0x2d, 0x0, "2c563a2eb894ac1de863c527984bfa5ff139aecff086eed112e6f0ffba88c7d0888990f99dc2416c1cbccf99d18464a65c3587c97aee9217b992893cebfc952784a614e782e63da22a6fe97d00"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f00000001c0)={@in={{0x2, 0x4e20, @multicast2}}, 0x0, 0x0, 0x0, 0x0, "f6458f5dce812b9bef6dfd6a024e48c070287c1a02ff37122221178c5eb9fefc9712655b257de87936d391a75e740d2875bd0814b73c57aaf87eb5a05188b46a2f53f1a865528508f3585c3857199fa4"}, 0xd8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{}, &(0x7f00000006c0), &(0x7f0000000700)=r6}, 0x20) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r9, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r9, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x9ffffc}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000003, 0x12, r8, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, &(0x7f00000023c0)=[{0x0}], 0x1}, 0x20001) shutdown(r5, 0x0) 3.854582685s ago: executing program 2 (id=3143): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, 0x0, 0x8000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={0x0}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x6c, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x40, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth0_to_batadv\x00'}, {0x14, 0x1, 'gre0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}]}]}, @NFT_MSG_DELFLOWTABLE={0x48, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip6erspan0\x00'}]}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x10}}, 0xfc}}, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="d1000000", @ANYRES16=r4, @ANYBLOB="010000000000fcffffff1a0000002c00018014000200627269646765300000000000000000001400020076657468315f746f5f62617461647600"], 0x40}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0xce}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) openat$nci(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) syz_extract_tcp_res(&(0x7f0000000000), 0x5, 0x4) 3.630595999s ago: executing program 2 (id=3144): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001500)=ANY=[@ANYBLOB="d8000000000203000000000000000000020000053c0002802c00018014000300fc00000000000000000000000000000114000400000000000000000000000000000000010c00028005000100210000000400038004000180"], 0xd8}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f00000007c0)={'batadv0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=ANY=[@ANYBLOB="28431b0000000000aa3c0d949c648846fceb5f03c44f2c9885e468d76187e4e53a9f24cc0600eaddb6348a4a82880a6560c450ac7b8a53dfb9a535b4ac6f70b41c81d5f70cc814aa11a088da803dfca19d9b574c1488f872d8d36ea389d8fe6a8d476806f37dae8d612da8298f81dec8019a2e204800000000000000000000000000005679ae26c5df70c8964ef5495113d190b374d90059f3a22c29edc7a38fb82bb7a59bbe220d9ca57a4ac6d0321ab0ca5c6838f614e7c7fa663b3c5764e2897205745c9b757a5289da3c04764fa6875d99eb0fd0cbed7b9e0cf6685c94526e970dee83a70791b51574bc13532bce20ed7d5272fbbd252045c353cd7574addc9ff629a93d8046aa6faf1fa916d6f6d9580deef973e78dbe4985cb856739130df3abb43765923d64012054ce12cb9e46066cb5e40e9c6e635418979d653330600f", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB], 0x28}}, 0x2000c058) r6 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x89f0, &(0x7f0000000040)={'team_slave_1\x00', &(0x7f0000000100)=@ethtool_coalesce={0xe, 0x0, 0x1000, 0xffff, 0x400000, 0x7ff, 0x6, 0xc0000000, 0x402, 0xa, 0x5, 0x5, 0x3, 0x4006, 0x4, 0xfffffffc, 0x0, 0x37e9, 0x80000004, 0x4000001, 0x6, 0xfffffff9, 0x3}}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0x4}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x10c}}, 0x0) syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000000340)=@default_ap_ssid, 0x6, 0x2) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)=@flushpolicy={0x38, 0x12, 0x105, 0x0, 0x0, "", [@address_filter={0x28, 0x1a, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xa, 0x6, 0x9}}]}, 0x38}}, 0x20040810) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000180)={0x2d6}, 0x10) r11 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r11, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r11, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bind$tipc(r11, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x1, 0x3}}, 0x10) r12 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r12, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) close(0x3) write(r10, &(0x7f0000000000)="240000001a005f0400f9f407000904018000200000000000000000000800010000000000", 0x24) setsockopt$PNPIPE_ENCAP(r10, 0x113, 0x1, &(0x7f0000000240), 0x4) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r9, &(0x7f0000000480)={0x0, 0xffffffffffffff14, &(0x7f0000000200)={&(0x7f0000000380)={0x64, r13, 0x9c3fa077fa966179, 0x70bd29, 0x0, {{0x7e}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}], @chandef_params, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x7ff}, @NL80211_ATTR_DURATION={0x8}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x2}]}, 0x64}}, 0x200000e0) 3.424210164s ago: executing program 0 (id=3110): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x2, 0x3, &(0x7f0000000200)=@framed={{0x18, 0xa}}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1b, 0xffffffffffffffff}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000200)='GPL\x00', 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x2, 0x3, &(0x7f0000000200)=@framed={{0x18, 0xa}}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1b, 0xffffffffffffffff}, 0x94) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000200)='GPL\x00', 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) (async) 3.052906738s ago: executing program 32 (id=3110): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x2, 0x3, &(0x7f0000000200)=@framed={{0x18, 0xa}}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1b, 0xffffffffffffffff}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000200)='GPL\x00', 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x2, 0x3, &(0x7f0000000200)=@framed={{0x18, 0xa}}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1b, 0xffffffffffffffff}, 0x94) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000200)='GPL\x00', 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) (async) 3.010964409s ago: executing program 2 (id=3148): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000001340), 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8a10ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e23, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x2, 0x7, 0x0, 0x3}}}}}}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001440)=@newqdisc={0x24, 0x24, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xd, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x51}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8b26, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r7, &(0x7f0000000080)='syz0\x00', 0x1ff) r8 = openat$cgroup(r7, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) r9 = openat$cgroup_type(r8, &(0x7f0000000180), 0x2, 0x0) write$cgroup_type(r9, &(0x7f0000000280), 0x9) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000000)={@mcast2={0xff, 0x5}, @private2={0xfc, 0x2, '\x00', 0x4}, @mcast2, 0x4, 0xa, 0x7, 0x500, 0x4000000000000004, 0x240102}) syz_emit_ethernet(0x57, &(0x7f0000000100)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, "9e00", 0x21, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x8, 0x2, 0xfffd, 0x0, 0x3, {[@exp_smc={0xfe, 0x6}, @window={0x3, 0x3, 0x9}]}}, {"c8"}}}}}}}, 0x0) 2.795288416s ago: executing program 33 (id=3148): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000001340), 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8a10ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e23, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x2, 0x7, 0x0, 0x3}}}}}}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001440)=@newqdisc={0x24, 0x24, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xd, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x51}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8b26, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r7, &(0x7f0000000080)='syz0\x00', 0x1ff) r8 = openat$cgroup(r7, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) r9 = openat$cgroup_type(r8, &(0x7f0000000180), 0x2, 0x0) write$cgroup_type(r9, &(0x7f0000000280), 0x9) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000000)={@mcast2={0xff, 0x5}, @private2={0xfc, 0x2, '\x00', 0x4}, @mcast2, 0x4, 0xa, 0x7, 0x500, 0x4000000000000004, 0x240102}) syz_emit_ethernet(0x57, &(0x7f0000000100)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, "9e00", 0x21, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x8, 0x2, 0xfffd, 0x0, 0x3, {[@exp_smc={0xfe, 0x6}, @window={0x3, 0x3, 0x9}]}}, {"c8"}}}}}}}, 0x0) 1.409957335s ago: executing program 1 (id=3155): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), r0) sendmsg$SMC_PNETID_DEL(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x881}, 0x4000800) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_BURST={0x8, 0x6, 0x58}]}}]}, 0x60}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}}}, 0x24}}, 0x0) getsockopt$packet_int(r2, 0x107, 0xb, 0x0, &(0x7f0000000040)) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYRESOCT=r2, @ANYRES32=0x0, @ANYBLOB="1501ff00cbb50200200012030cbb24199c040d6467650000100002800c002300ffff00000000000051491e6d196ccff2d4d39dc7323587ec71fe0228f9084b9b3e78af372b01c466398a1cfc535c99019c4292826284bc47c397fc6c55fceb96c12f3a3dc225952f81346b3d89c0c09ed57410"], 0x40}}, 0x28000000) 1.264011063s ago: executing program 1 (id=3156): mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x11, 0xffffffffffffffff, 0x14a30000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000000000), 0x4) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r0, 0xf501, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0xffffffffffffffff, 0x4) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000080)=0x4, 0x4) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'dummy0\x00', {0x4}, 0x82}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000100)={r0}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000140)={r0}) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@getroute={0x14, 0x1a, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x40) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl1\x00', 0x0, 0x4, 0x2, 0x7, 0x2, 0x36, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x27}}, @mcast1, 0x1, 0x40, 0x2, 0x80000000}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000400)={'erspan0\x00', &(0x7f0000000340)={'ip_vti0\x00', r4, 0x10, 0x780f, 0x4, 0x6, {{0x1c, 0x4, 0x3, 0x2e, 0x70, 0x67, 0x0, 0x1, 0x2f, 0x0, @private=0xa010100, @empty, {[@noop, @timestamp_prespec={0x44, 0x34, 0xcc, 0x3, 0x6, [{@multicast1, 0x100}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x50f}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x400}, {@multicast1, 0x5}, {@initdev={0xac, 0x1e, 0x10, 0x0}, 0x4}, {@local, 0x6}]}, @timestamp={0x44, 0x20, 0x3e, 0x0, 0x8, [0x1, 0xd, 0x5, 0x4, 0xff800000, 0x2, 0x200]}, @generic={0x94, 0x7, "0c0c760795"}]}}}}}) sendmsg$nl_generic(r1, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe0, 0x23, 0x2, 0x70bd2b, 0x25dfdbfd, {0x11}, [@generic="6c30d25e06a57c75f7d90d15a7b8cc228f6cf8b7f79571b27981a5623fdb0ef08c34ee1d2f05fbc55143c1931041b1447e8aba6e9fced1430b4748b718a82a03cd90248a13fcd13b5ec31fe31e374267b6e5b94d4dd6f4b5413ce2abc038b0e809af32102413578c0b32210d5e96778d04b41d36701ee60637af210bc22e981347c53466fa5c1580da7e6f5c999edeab4004c3bbc46bed08e4147ad6d6e52d01d61f503cab146636c63d850660cd", @generic="042fd4c156121b05fcda1ca709080207606cdac742fceb07c7fb1e"]}, 0xe0}, 0x1, 0x0, 0x0, 0x4010}, 0x1) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000600)={0x1b, 0x0, 0x0, 0x40000000, 0x0, 0x1, 0x5, '\x00', r4, 0xffffffffffffffff, 0x3, 0x1, 0x1}, 0x50) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r5, 0x40049366, &(0x7f0000000680)=0x2) r6 = accept$netrom(r1, &(0x7f00000006c0)={{0x3, @netrom}, [@null, @null, @bcast, @bcast, @remote, @rose, @netrom, @default]}, &(0x7f0000000740)=0x48) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r6, 0x8983, &(0x7f0000000780)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), r1) sendmsg$NL80211_CMD_VENDOR(r7, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000940)={&(0x7f0000000840)={0xf8, r8, 0x10, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0xa0}, @NL80211_ATTR_VENDOR_ID={0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x18}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x45e}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0xfb}, @NL80211_ATTR_VENDOR_DATA={0xac, 0xc5, "1126a81d482a577a55628f05b90b092105b55077d506153abced2921e2b0367b1e2b6469d5561a626aa777eb7ec1b572aa085f2566c812a109c9e73ea57ed10c48d7c2f4b239476d634e141be76a7a4465c1ebb6aee53770a9a9ee75d5a0e0315a135c3e14cd0c2a076f3fa3cc40427e21255a9a4dc2a69f123d5ff909286c9a9359a50eb5f39cbd89576efd795d3d4d101586bde995f1853e0c4bcd299f4acc5e465be5a94af113"}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4800}, 0x810) openat$tun(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) getsockopt(r2, 0x7, 0x0, &(0x7f0000000a00)=""/218, &(0x7f0000000b00)=0xda) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000b40)={0xa6cd, 0x1000, 0x1}) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000c80)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x44, 0x9, 0x6, 0x301, 0x0, 0x0, {0x2, 0x0, 0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x884}, 0x4000008) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000d00)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r2, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x40, r8, 0x10, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x4000881) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000e00)) 1.042253882s ago: executing program 1 (id=3158): r0 = socket$rds(0x15, 0x5, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0xffffffff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x50003}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000280)={r1, 0xc, 0xce5, 0x7}) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000640)={0xffffffffffffffff, r3, 0x6, 0xb7, &(0x7f00000002c0)="da62d47f56b2e0784f3a8e96a8975c0d402d47804a0e4d14385bc959aee9241762f87206b8b13ff7795f24d45ffb9e1bd8a2fb3f1f2ca781d291553e1d0dedf0afdb208de2e6e10bc7ac317d9198276500e4d08165f9a09bb22b8aaf984a313ec0b85af8812d10b7655a9a1802aa9e3439c1d9298700d03b9371b0e1956fdd248adce3785452d316f5e6ec357c066fa4a65a5ce9cc6a573ba868a108a4e0216962fe74b61c8cefc4902aa2cc530eca2453db266e8f99ba", 0x3, 0x7f, 0x88, 0x1, 0x3ff, 0x1, 0x7, 'syz0\x00'}) sendmmsg(r1, 0x0, 0x0, 0xffe0) syz_emit_ethernet(0x138, &(0x7f0000000e00)={@remote, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0xf, 0x12a, 0x68, 0x0, 0xf9, 0x2f, 0x0, @remote, @rand_addr=0x64010100}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x1, 0x0, [0x2], "e5"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [], "e990f50a092c2bd98f6bb9f655da038af7610af22f383ffaee4f0a6591090d13921b1616fdc39342b5a497ec47da69d79d3888c120c41ef2d002d0825f1b8c3ecfe784910fe8cc9d8ead38b3239741b03371d29098ceb110b75bcdacb39c2fd8795939c26c06f630139a99d4d4b4bf641d8d9adc5a08f30eaf4966439481227d784da1cbd37bc1c19e257da05d69f8344a7bf22960e2497a5021a8ced5fbc275fe65bfe06dc4637805aa9d7ed73fc28e4c39a12572fd9939cfb8cadf3aeb457779b9e19443c2360d16ec96e225bb14"}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x2, {{0xb, 0x1, 0xff, 0x0, 0x0, 0x2, 0x1}, 0x1, {0xfff}}}, {0x8, 0x22eb, 0x1, {{0x8, 0x2, 0x3, 0x3, 0x1, 0x3, 0x1, 0x6}, 0x2, {0x3, 0x80, 0x0, 0x1, 0x0, 0x0, 0x3, 0x1}}}, {0x8, 0x6558, 0x4}}}}}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r4}, 0x10) sendmsg$inet(0xffffffffffffffff, 0x0, 0x3) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f0000000700)={0x68, 0x13, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_OBJ_USERDATA={0x31, 0x8, "40461d0c3d94032b75ef9d32e217373be90239638ad24ec4aa2c08157d5189458d43e9cf5110e11be26e9d59a3"}]}, 0x68}, 0x1, 0x0, 0x0, 0x4001}, 0x2000c9c1) getpid() bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e00000000000000060000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'/28], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5d}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$IPSET_CMD_FLUSH(r5, 0x0, 0xe821651e0a1b45fc) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfd, 0x2ffffffff}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xb, 0x0, 0x0, 0xadb5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000c}, 0x94) accept$inet6(r1, &(0x7f0000000780)={0xa, 0x0, 0x0, @local}, &(0x7f00000007c0)=0x1c) unshare(0x6a040000) socket$inet6_tcp(0xa, 0x1, 0x0) 847.382127ms ago: executing program 3 (id=3160): syz_emit_ethernet(0x32, &(0x7f00000001c0)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @empty=0xe0000001}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x0, 0x3d}}}}}}}, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r1 = getpid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', 0x0, 0x0, 0x0, 0x0, 0x1, r1}}, 0x40) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'veth0_to_team\x00'}) (async) r3 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r3, &(0x7f0000000dc0)=[{{&(0x7f0000000140)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000240)=[{&(0x7f0000001c00)='{', 0x1}], 0x1}}, {{&(0x7f0000000340)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000500)=[{&(0x7f0000000480)=')', 0x1}], 0x1}}, {{&(0x7f0000000000)={0x2, 0x4e20, @private=0xa010102}, 0x10, &(0x7f0000000680)=[{&(0x7f0000000040)="394545927b", 0x5}], 0x1}}], 0x3, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, 0x0, 0x0) 693.899524ms ago: executing program 3 (id=3161): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000000440)='~\xdbd\n\xe8\xef!8cgr[\xb1\xdfh4\xb9\xb0\xd6\x88H\xb7\xf1*\"\xa4D\xd8\xa9\xcc2\xa0\x7f\xad\xb4\x00T.\x9c\xca\x96\x0e\x17<\xda\x9eq\xe8th\xb4E\xf1j\xee\xe1\xb7\xda~dMhN nW\xa5\x06\xbcn\xd7q\x92\xf1\xe6\xeew/\x06\xb7\xde\xce\xccf\x8cr\xd3\xbc\x11\xcd\xec\x9d\x80z\xc2\xd4OV\x84;+\xc20n\x86df(\x94\xf0\x1b\x06\xf6%\x10\xcb\x00$\xb0\x1e\x02\xcc\xaa\xdbC\xe5\x189\xecz\x85\x1eV7d\x81\xbe\xf6\x12+!t]\xf0A\xfcd\xf5\xafD(\x97.\x7fb\x0f\xac\"t\xefJG{Re\x8d\xbd$\x91\xc9k;\xa5-v\xa70\x9az/\xf4B\xf2QQi\x87O\xc2\xe9\xb748\xb1\x13\x9f\xb7=mT'}, 0x30) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000940)=@nat={'nat\x00', 0x1b, 0x5, 0x5f8, 0xd0, 0x1c0, 0xffffffff, 0x0, 0x0, 0x528, 0x528, 0xffffffff, 0x528, 0x528, 0x5, &(0x7f0000000000), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xc, 0x5d, 0xdff}}}, {{@ipv6={@mcast1, @private2, [0xffffffff, 0xffffffff, 0xff, 0xff000000], [0xff000000, 0xffffff00, 0xff, 0xff], 'lo\x00', 'wlan1\x00', {}, {}, 0x84, 0x8, 0x2, 0x29}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x4, @ipv4=@multicast1, @ipv6=@mcast2, @icmp_id=0x66, @port=0x4e23}}}, {{@ipv6={@empty, @dev={0xfe, 0x80, '\x00', 0x18}, [0xffffff00, 0xff000000, 0x0, 0xffffff00], [0x0, 0xff000000, 0xffffff00, 0xffffffff], 'vlan1\x00', 'nr0\x00', {0xff}, {}, 0xc, 0x1c, 0x6, 0x4}, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@frag={{0x30}, {[0x3, 0x7], 0xfffffff9, 0x2d, 0x2}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x1, @ipv4=@remote, @ipv4=@multicast2, @icmp_id=0x67, @port=0x4e23}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @remote, [0x0, 0xffffff00, 0xffffffff], [0xff, 0xffffffff, 0xff000000], 'ipvlan0\x00', 'batadv0\x00', {}, {}, 0x2b, 0x5a, 0x1, 0x1}, 0x0, 0x200, 0x248, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'nr0\x00', {0x7fffffffffffffff, 0x7, 0x39, 0x3, 0x7, 0xffff, 0xf, 0x6, 0x40, 0x18}, {0x9}}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x6, @ipv4=@rand_addr=0x64010102, @ipv4=@loopback, @port=0x4e22, @icmp_id=0x67}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x658) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x3c1, 0x3, 0x358, 0x288, 0x168, 0x10, 0x0, 0xb, 0x288, 0x250, 0x250, 0x288, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @private1={0xfc, 0x1, '\x00', 0x1}, [], [], 'veth1_to_batadv\x00', 'veth1_to_hsr\x00', {}, {}, 0x3a}, 0x6000000, 0x128, 0x190, 0x0, {0x0, 0x28e}, [@common=@icmp6={{0x28}, {0x0, 'K\r'}}, @common=@inet=@hashlimit1={{0x58}, {'netdevsim0\x00', {0x0, 0x0, 0x9, 0x1, 0x0, 0x10000, 0x80000001}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRESOCT=r3, @ANYBLOB="0100080209000000000066000022ff000300", @ANYRES32=0x0, @ANYBLOB="08002600940900000800b7"], 0x2c}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) sendmsg(r1, &(0x7f0000000300)={&(0x7f00000000c0)=@nfc_llcp={0x27, r2, 0x1, 0x5, 0x4, 0x9, "df3b37978e5ae4d541f004ed9728c98dbe22a6dda551b3b74260bd8a5809b3c9eef4b24e6d827b407ca26913f6e0e0b6e1bb254ac99d3766bc47aa7e12818c", 0x1f}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000140)="80f3c544f1b3687fc9c9683f237a797204f24ae7d6391c0b806ec6fb9614f5724bfcaae256479eee1cdb251ed62473f3afc38f92c91b3043740f22cc09460b14ca5bc2375480c475c727b0aa74a38414e6f1b3a431e6dc56056fe78b13b317c94be6923a51f69d9ec7a21d9c025178f6fc7bda16461118fc851f48365419a6d980d4a506e8cb72eaa4d36cdaa4c241bd41a1e8f93dbda46d73d12d30f92d2cae0504372dda552056af8b9fcd3c7039bcb805f767bea504971d646ac6200dbac9a4e883b1addb969a99155a4ac7681a7cb5923b65870ccdf6e720c8f39ee27057ac314cffe9787b37f354f8f55db0b683d893f5", 0xf3}], 0x1}, 0x11) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r5, &(0x7f0000000040)='cpu.idle\x00', 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty, 0x1}, 0x1c) setsockopt$sock_linger(r6, 0x1, 0x3d, &(0x7f00000001c0)={0xb}, 0xfedb) sendmmsg$sock(r6, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="74b17a07", 0x4}], 0x1}}], 0x1, 0x20000000) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001240)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="05000000040000000300000000000000005d1d5974b3ccc5cc9c297ea80a557300000000008acf86c751a256591edb2c1646f197536a771dfbd8e7a207a96c8b133b4083db9cc74d64bc0a2f8085dde792ba76fe5dbd38333470471f5e7c5e0ed2e66a919e50ad778fccb5cf534cb0bdb7cfd77ebe57e3f5d1a2efed000000000000"], 0x50) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000011c0)=ANY=[@ANYBLOB="02000000040000f0cb3fb144318dc46fc84f3c00080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r9, 0xffffffffffffffff}, 0x4) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="ecffffffffffff7300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x1c, &(0x7f0000001080)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000040b7f2f402000000000000f6ffa568f10000914590d8b722000000000000810000000008800081b7bc4d8bef00000000003634453d4af4ed5b0a0e62f8c8b943fa80bacb59ecd21bde5f2bb6f2c14b86486b1ac1422f6de1b5a3b355f45222046d789698467538"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r12, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001040)={{r8}, &(0x7f0000000280), &(0x7f0000000400)=r12}, 0x20) r13 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000001300), r7) sendmsg$NLBL_CIPSOV4_C_ADD(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16=r13, @ANYBLOB="0100d8000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000000000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008000900975b9b5e04000b801c000b8008000900000009"], 0x184}}, 0x0) 471.440563ms ago: executing program 3 (id=3162): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000010000104040002005404000000060000", @ANYRES32=0x0, @ANYBLOB="8b90000010e3040008000500", @ANYRES32=r1, @ANYBLOB="3000128009000100766c616e00000000200002800600010004000000100004800c000100ff0f00000300000004000380"], 0x58}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000000)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="680000000000000029000000370000003309000000000000040106040101040100000100010500000000000728"], 0xd8}}], 0x1, 0x20004000) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c02000019000100fcffffff10000000ffffffff000000000000000000000000ac1414bb00000000000000000000000000000000ffff20000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000009000000000000000800000000000000000000000000000000000000000000000000000000000000010000000000000009000000000000008000000000000000000000000000000000000000000000000101000300000000840105007f000001000000000000000000000000000004d43200000000000000ac14143b00000000000000000000000000000000000002000000000000000000000000007f000001000000000000000000000000000000002b"], 0x23c}}, 0x0) r5 = socket(0x2b, 0x80801, 0x1) r6 = socket$kcm(0xa, 0x3, 0x11) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x80108907, 0x0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x10000, @empty}, 0x1c) listen(r5, 0x2) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x8}]}}}]}, 0x50}}, 0x0) 384.109464ms ago: executing program 3 (id=3163): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000100010000404eed02e2d3812900", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, &(0x7f0000002d00)=[{{&(0x7f0000001080)={0xa, 0x4e22, 0x1, @private2, 0x10001}, 0x1c, &(0x7f00000010c0)=[{&(0x7f00000011c0)="e6e2", 0x2}], 0x1}}, {{&(0x7f0000001100)={0xa, 0x4e20, 0x7fff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xfffffff7}, 0x1c, &(0x7f00000019c0)=[{&(0x7f0000001140)="a5", 0x1}], 0x1}}], 0x2, 0x0) shutdown(r3, 0x1) getsockopt$bt_hci(r3, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='thermal_power_cpu_get_power\x00', r2, 0x0, 0x80000001}, 0x18) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="14000000"], 0x14}}, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x18) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r5}, 0x8) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r7, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="002abd7000fe040025000000000000005be2618e1394a75579fd7b08fa572b8edbce202028737b5a615825ad6982456b8fa53aea1c3d2fecc24343f4a907b9b1042bafe13edf57b6f07ac28385531979fd8309473dddc908773cda5c6631afe50bd714fa195a9104f785049a09e993924e9200a3170fbf5a77b94a807e0bef5f6934f5bac18977e2864a486fa732442f0aeca950d514e93469e3d7ec1d005a822d3ecbc706b5dbf535a495963a0bb3ea2dedbe1d70dc92dcf835ebf95b574b47e01154348c510fdfaaa85c2016150233d94a395430236da2568dfeea7dcff683aa52a9415a35cfc4d77f96cc4c5427dba70fba26b5c643865393fab5177c9153e5f8d2997dfb90934b77a90c8134bc06e2f1e628e4c0a83ecd7e3955c8692baf3d77e15e1cb2"], 0x10}, 0x1, 0x0, 0x0, 0x20000014}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) 83.372736ms ago: executing program 3 (id=3164): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) getpeername(0xffffffffffffffff, &(0x7f0000000040)=@l2tp={0x2, 0x0, @empty}, &(0x7f00000000c0)=0x80) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f0000000100)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x40000}, 0x1c) sendto$inet6(r2, &(0x7f0000000140)="9f", 0x1, 0x4040000, 0x0, 0x0) recvfrom(r2, &(0x7f0000000200)=""/62, 0x3e, 0x99bcb88de02507d2, 0x0, 0x0) r3 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000340)={0xffffffffffffffff, 0xfffffffffffffff7, 0x4, 0x0, 0x0, [{{r3}, 0x80000001}, {{r0}, 0xa}, {{r1}, 0x5}, {{r1}, 0x9}]}) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000017c0)={0xf8, 0x2f, 0x100, 0x0, 0x25dfdbfc, "", [@nested={0xe8, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0x1000000fac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@private0}, @typed={0x8, 0x44, 0x0, 0x0, @uid}, @nested={0xb9, 0x66, 0x0, 0x1, [@typed={0x8, 0x14f, 0x0, 0x0, @u32=0x7}, @nested={0x4, 0xa1}, @generic="c073bf8f025953f538087c2947af34d793a12e66cd988ba2df542272ddf8f3b0634ff9883b7914bc9c92aafa8bb7b0c0552ff62f4a9716d08229fbc0558c09235f84d6771d08666d8b337ac75c741e4e77f4a9bc443c6a07af22469f8689554aa0e81e897ed6146a5b6cb1adf5cecbe76fb27a1c2610d17b8d3c80cfe639ce824597e338c1bb6a7d118257e8e8ac7e1f1c03054e4ec9bce7dfd5f3620229ab929fb9ebb5658776ab26"]}]}]}, 0xf8}, {&(0x7f0000000200)={0x134, 0x2a, 0x1, 0x70bd2b, 0x25dfdbfc, "", [@typed={0x8, 0x18, 0x0, 0x0, @u32=0x6b6b}, @nested={0x10f, 0x29, 0x0, 0x1, [@generic="711047d9b47605f3e9fd54a4eabd8c6bdf6abd0c5cb8df51239665af8df42e4a736bcb0a86d47dd5e7c0938d9cb854f165af8f5cd6bf3162c5a8408dade70d49d1cbac473c9473c43531a7b899723a2340adfc120f783fc1720c7842792e132d80b55f68401e81d72770ddeff3357d61965de2eb4f6ba2ade9c8c47cc6dc61f5da275f6d378ce395fbc24d012942e360b77c9778e9a6f7a4b85ef9f490512c534c2836de69758b544a038d9955714e34e16057e5feb1c3e09db528233798dd3880f31471a0dc7c6e75218220cc765f2b5fd1e997d502c7b7416739a71d4c9c6022ee77f5c98e6e0cc76fd07a7bc129ef4c8cd53bd77736", @typed={0x5, 0x150, 0x0, 0x0, @str='\x00'}, @typed={0xc, 0x14e, 0x0, 0x0, @u64}]}, @typed={0xc, 0xa5, 0x0, 0x0, @u64=0xd30}]}, 0x134}], 0x2, 0x0, 0x0, 0x1}, 0x0) 0s ago: executing program 3 (id=3165): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x2, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) unshare(0x62040200) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x2042, 0x4, 0x1}, 0x10) bind$tipc(0xffffffffffffffff, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x4, 0x10000000}}, 0x10) setsockopt$inet_tcp_buf(r1, 0x6, 0xe, &(0x7f0000000040)="e304d0eb7e", 0x5) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000180)={r3, r3, 0xfffa, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x6, 0x0, 0x8, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r4, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}) close(0x4) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000240)='sched_move_numa\x00', 0xffffffffffffffff, 0x0, 0x4}, 0x18) socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x2, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) (async) unshare(0x62040200) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) (async) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x2042, 0x4, 0x1}, 0x10) (async) bind$tipc(0xffffffffffffffff, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x4, 0x10000000}}, 0x10) (async) setsockopt$inet_tcp_buf(r1, 0x6, 0xe, &(0x7f0000000040)="e304d0eb7e", 0x5) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000180)={r3, r3, 0xfffa, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x6, 0x0, 0x8, 'syz1\x00'}) (async) ioctl$sock_bt_hidp_HIDPCONNDEL(r4, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}) (async) close(0x4) (async) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000240)='sched_move_numa\x00', 0xffffffffffffffff, 0x0, 0x4}, 0x18) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) (async) kernel console output (not intermixed with test programs): 12318] netlink: 'syz.3.1618': attribute type 9 has an invalid length. [ 231.542152][T12318] netlink: 'syz.3.1618': attribute type 10 has an invalid length. [ 231.550696][T12318] netlink: 'syz.3.1618': attribute type 11 has an invalid length. [ 231.576453][T12321] hsr_slave_0: left promiscuous mode [ 231.583138][T12321] hsr_slave_1: left promiscuous mode [ 231.616979][T12317] syzkaller0: entered promiscuous mode [ 231.624911][T12317] syzkaller0: entered allmulticast mode [ 231.661852][T12325] wg1 speed is unknown, defaulting to 1000 [ 231.724994][T12325] ip6_vti0 speed is unknown, defaulting to 1000 [ 231.969423][T12331] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 231.977393][T12331] IPv6: NLM_F_CREATE should be set when creating new route [ 232.020540][T12330] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 232.027850][T12330] IPv6: NLM_F_CREATE should be set when creating new route [ 232.245306][ T12] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.255492][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.270323][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.289703][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.314040][T12353] tipc: Failed to obtain node identity [ 232.332867][T12353] tipc: Enabling of bearer rejected, failed to enable media [ 232.365102][T12348] netlink: 'syz.0.1626': attribute type 1 has an invalid length. [ 232.381704][T12348] netlink: 'syz.0.1626': attribute type 7 has an invalid length. [ 232.390373][T12348] netlink: 'syz.0.1626': attribute type 8 has an invalid length. [ 233.396287][ T5834] Bluetooth: hci4: command 0x0405 tx timeout [ 234.013116][T12407] __nla_validate_parse: 15 callbacks suppressed [ 234.013137][T12407] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1638'. [ 234.976468][T12415] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1640'. [ 234.985695][T12415] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1640'. [ 235.147610][T12430] delete_channel: no stack [ 235.239366][T12433] 8021q: adding VLAN 0 to HW filter on device bond6 [ 235.253717][T12447] netlink: 'syz.2.1644': attribute type 1 has an invalid length. [ 235.253717][T12444] netlink: 'syz.2.1644': attribute type 1 has an invalid length. [ 235.557270][T12466] wg1 speed is unknown, defaulting to 1000 [ 235.576378][T12466] ip6_vti0 speed is unknown, defaulting to 1000 [ 235.688041][T12476] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1654'. [ 235.731029][T12472] wg1 speed is unknown, defaulting to 1000 [ 235.914191][T12484] tipc: Enabling of bearer rejected, failed to enable media [ 236.022349][T12472] ip6_vti0 speed is unknown, defaulting to 1000 [ 236.190386][T12495] wg1 speed is unknown, defaulting to 1000 [ 236.296593][T12504] vti0: entered promiscuous mode [ 236.306065][T12504] vti0: entered allmulticast mode [ 236.425872][T12512] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1664'. [ 236.647839][T12495] ip6_vti0 speed is unknown, defaulting to 1000 [ 236.667972][T12520] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1666'. [ 236.735634][T12520] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1666'. [ 236.779077][T12527] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.1668'. [ 236.790122][T12527] openvswitch: netlink: Missing key (keys=40, expected=100) [ 236.851142][T12530] netlink: 'syz.3.1669': attribute type 30 has an invalid length. [ 236.963110][T12521] siw: device registration error -23 [ 237.477589][T12544] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1673'. [ 237.518801][T12544] gre0: left promiscuous mode [ 237.912123][T12555] sctp: [Deprecated]: syz.1.1675 (pid 12555) Use of int in max_burst socket option. [ 237.912123][T12555] Use struct sctp_assoc_value instead [ 238.247998][ T12] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.267704][ T12] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.284093][ T12] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.293845][ T12] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 238.351640][T12564] wg1 speed is unknown, defaulting to 1000 [ 238.421781][T12564] ip6_vti0 speed is unknown, defaulting to 1000 [ 238.425379][T12568] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 238.837173][T12588] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1684'. [ 239.170209][T12597] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1688'. [ 239.201247][T12603] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 239.515303][T12618] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1693'. [ 239.522945][T12620] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1690'. [ 239.719477][T12620] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 240.048328][T12634] xt_CT: You must specify a L4 protocol and not use inversions on it [ 240.093887][T12640] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1699'. [ 240.143154][T12642] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1699'. [ 240.158123][T12646] Bluetooth: MGMT ver 1.23 [ 240.205678][T12649] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1701'. [ 240.233527][T12645] geneve2: entered promiscuous mode [ 240.275937][T12646] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1700'. [ 240.345429][T12653] tipc: Enabled bearer , priority 0 [ 240.391155][T12652] tipc: Disabling bearer [ 240.921375][T12686] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1711'. [ 240.974821][T12683] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1710'. [ 241.018245][T12689] ieee802154 phy1 wpan1: encryption failed: -22 [ 241.089546][T12689] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1712'. [ 241.317132][T12707] Bluetooth: MGMT ver 1.23 [ 241.540975][T12725] netlink: 'syz.0.1718': attribute type 2 has an invalid length. [ 241.572655][T12724] netlink: 'syz.0.1718': attribute type 2 has an invalid length. [ 241.605210][T12725] !9: entered promiscuous mode [ 241.640925][T12717] netlink: 'syz.0.1718': attribute type 2 has an invalid length. [ 241.656936][T12717] !9: left promiscuous mode [ 241.879845][T12734] dummy0: left promiscuous mode [ 242.182206][T12734] geneve0: left promiscuous mode [ 242.208313][T12734] macsec1: left promiscuous mode [ 242.246776][T12734] macvtap1: left promiscuous mode [ 242.251859][T12734] macvtap1: left allmulticast mode [ 242.306653][T12734] ipvlan0: left promiscuous mode [ 242.311826][T12734] ipvlan0: left allmulticast mode [ 242.321970][T12734] geneve1: left allmulticast mode [ 242.338723][T12734] bond5: left promiscuous mode [ 242.354290][T12734] geneve2: left promiscuous mode [ 242.381045][ T12] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.402512][ T12] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.445761][ T12] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.816706][ T12] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.331824][T12783] netlink: 'syz.2.1733': attribute type 5 has an invalid length. [ 243.781119][T12771] Bluetooth: hci4: Opcode 0x0401 failed: -4 [ 244.078626][T12782] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 244.087192][T12782] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 244.502960][T12768] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 244.528917][T12784] gre0: left allmulticast mode [ 244.714298][T12784] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.722066][T12784] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.786144][T12801] __nla_validate_parse: 10 callbacks suppressed [ 244.799534][T12801] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1737'. [ 244.885933][T12784] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 244.905936][T12784] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 245.010995][ T5099] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.040767][ T5099] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.076497][ T5834] Bluetooth: hci4: command 0x0405 tx timeout [ 245.101165][ T5099] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.125492][ T5099] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.132037][T12816] netlink: 'syz.2.1742': attribute type 1 has an invalid length. [ 245.162378][T12816] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1742'. [ 245.443974][T12833] veth6: entered allmulticast mode [ 245.479312][T12834] netlink: 'syz.0.1747': attribute type 1 has an invalid length. [ 245.507453][T12834] netlink: 16070 bytes leftover after parsing attributes in process `syz.0.1747'. [ 245.551969][T12839] tipc: Enabled bearer , priority 0 [ 245.672297][T12851] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1752'. [ 245.688187][T12839] syzkaller0: entered promiscuous mode [ 245.695132][T12839] syzkaller0: entered allmulticast mode [ 245.697046][T12843] netlink: 'syz.4.1748': attribute type 33 has an invalid length. [ 245.710038][T12843] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1748'. [ 245.739626][T12855] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1500) ! [ 247.164880][T12869] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1755'. [ 247.181219][T12869] unsupported nlmsg_type 40 [ 247.291222][T12846] tipc: Resetting bearer [ 247.307337][T12864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 247.364620][T12838] tipc: Resetting bearer [ 247.383838][T12876] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1759'. [ 247.399311][T12877] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1758'. [ 247.420277][T12838] tipc: Disabling bearer [ 247.447154][T12876] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 247.458281][T12876] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 247.471827][T12876] bond0 (unregistering): Released all slaves [ 247.495185][T12881] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 247.525988][T12877] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1758'. [ 247.585430][T12881] xt_TCPMSS: Only works on TCP SYN packets [ 247.850718][T12900] x_tables: duplicate underflow at hook 1 [ 249.521754][T12894] wg1 speed is unknown, defaulting to 1000 [ 249.529604][T12894] ip6_vti0 speed is unknown, defaulting to 1000 [ 250.085711][T12946] pimreg: entered allmulticast mode [ 250.239760][T12951] syzkaller1: entered promiscuous mode [ 250.255539][T12951] syzkaller1: entered allmulticast mode [ 250.771547][T12985] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 250.778722][T12987] IPVS: dh: FWM 3 0x00000003 - no destination available [ 250.899980][T12995] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1783'. [ 250.993397][T12976] wg1 speed is unknown, defaulting to 1000 [ 251.001268][T12976] ip6_vti0 speed is unknown, defaulting to 1000 [ 251.822753][T13031] xt_CT: No such helper "syz1" [ 251.841131][T13037] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1796'. [ 252.049412][T13050] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1799'. [ 252.073548][T13051] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1797'. [ 252.479803][T13073] bpq0: left promiscuous mode [ 252.563449][T13077] macsec3: entered promiscuous mode [ 252.569108][T13077] hsr0: entered promiscuous mode [ 252.577584][T13077] hsr0: left promiscuous mode [ 252.616436][T13079] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1807'. [ 252.625700][T13079] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1807'. [ 252.701855][T13081] tipc: Enabled bearer , priority 0 [ 252.703005][T13083] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1809'. [ 252.709609][T13081] syzkaller0: entered promiscuous mode [ 252.723712][T13081] syzkaller0: entered allmulticast mode [ 252.737758][T13081] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 252.933339][T13090] netlink: 364 bytes leftover after parsing attributes in process `syz.0.1810'. [ 253.035285][T13094] netlink: 'syz.0.1811': attribute type 83 has an invalid length. [ 253.239169][T13095] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1808'. [ 253.262818][T13087] tipc: Resetting bearer [ 253.290519][T13080] tipc: Resetting bearer [ 253.367750][T13080] tipc: Disabling bearer [ 253.438114][T13107] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 253.596569][T13125] netlink: 'syz.2.1820': attribute type 1 has an invalid length. [ 253.761593][T13138] netlink: 'syz.3.1821': attribute type 1 has an invalid length. [ 253.762042][T13125] 8021q: adding VLAN 0 to HW filter on device bond1 [ 253.867334][T13143] bond1: option lacp_rate: unable to set because the bond device is up [ 254.121103][T13151] syzkaller1: entered promiscuous mode [ 254.127136][T13151] syzkaller1: entered allmulticast mode [ 254.354110][T13187] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1829'. [ 254.382153][T13189] Unsupported ieee802154 address type: 0 [ 254.500776][T13199] 0{X: renamed from gretap0 [ 254.572882][T13205] xt_TPROXY: Can be used only with -p tcp or -p udp [ 254.880724][T13199] 0{X: entered allmulticast mode [ 254.942654][T13199] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 255.122049][T13222] pim6reg: entered allmulticast mode [ 255.687036][T13254] netlink: 'syz.2.1846': attribute type 1 has an invalid length. [ 255.742025][T13253] Timeout policy `syz0' can only be used by L3 protocol number 35085 [ 255.902758][T13269] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 255.925305][T13275] __nla_validate_parse: 5 callbacks suppressed [ 255.925325][T13275] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1854'. [ 255.955879][T13272] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1854'. [ 255.966042][T13279] netlink: 616 bytes leftover after parsing attributes in process `syz.0.1851'. [ 256.518290][T13316] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1865'. [ 256.548787][T13322] wg1 speed is unknown, defaulting to 1000 [ 256.559090][T13322] ip6_vti0 speed is unknown, defaulting to 1000 [ 256.633027][T13323] warn_alloc: 1 callbacks suppressed [ 256.633045][T13323] syz.0.1867: vmalloc error: size 16781312, failed to allocated page array size 32776, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 256.706306][T13323] CPU: 1 UID: 0 PID: 13323 Comm: syz.0.1867 Not tainted syzkaller #0 PREEMPT(full) [ 256.706331][T13323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 256.706342][T13323] Call Trace: [ 256.706349][T13323] [ 256.706358][T13323] dump_stack_lvl+0x189/0x250 [ 256.706382][T13323] ? __pfx_dump_stack_lvl+0x10/0x10 [ 256.706399][T13323] ? __pfx__printk+0x10/0x10 [ 256.706420][T13323] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 256.706444][T13323] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 256.706467][T13323] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 256.706494][T13323] warn_alloc+0x214/0x310 [ 256.706522][T13323] ? __pfx_warn_alloc+0x10/0x10 [ 256.706556][T13323] ? __get_vm_area_node+0x28f/0x300 [ 256.706577][T13323] ? xskq_create+0xbf/0x170 [ 256.706599][T13323] __vmalloc_node_range_noprof+0x690/0x12d0 [ 256.706650][T13323] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 256.706675][T13323] ? __kasan_kmalloc+0x93/0xb0 [ 256.706703][T13323] vmalloc_user_noprof+0xad/0xf0 [ 256.706730][T13323] ? xskq_create+0xbf/0x170 [ 256.706749][T13323] xskq_create+0xbf/0x170 [ 256.706770][T13323] xsk_init_queue+0xb0/0x110 [ 256.706791][T13323] xsk_setsockopt+0x57b/0x8d0 [ 256.706812][T13323] ? __pfx_xsk_setsockopt+0x10/0x10 [ 256.706832][T13323] ? __pfx_aa_sk_perm+0x10/0x10 [ 256.706858][T13323] ? aa_sock_opt_perm+0xff/0x1a0 [ 256.706878][T13323] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 256.706899][T13323] ? __pfx_xsk_setsockopt+0x10/0x10 [ 256.706918][T13323] do_sock_setsockopt+0x17c/0x1b0 [ 256.706946][T13323] __x64_sys_setsockopt+0x13f/0x1b0 [ 256.706975][T13323] do_syscall_64+0xfa/0xf80 [ 256.706996][T13323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 256.707013][T13323] ? clear_bhb_loop+0x60/0xb0 [ 256.707034][T13323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 256.707049][T13323] RIP: 0033:0x7f4c8dd8f749 [ 256.707064][T13323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 256.707079][T13323] RSP: 002b:00007f4c8ebf1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 256.707098][T13323] RAX: ffffffffffffffda RBX: 00007f4c8dfe6180 RCX: 00007f4c8dd8f749 [ 256.707110][T13323] RDX: 0000000000000003 RSI: 000000000000011b RDI: 000000000000000b [ 256.707120][T13323] RBP: 00007f4c8de13f91 R08: 0000000000000004 R09: 0000000000000000 [ 256.707131][T13323] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 256.707141][T13323] R13: 00007f4c8dfe6218 R14: 00007f4c8dfe6180 R15: 00007ffe7dd56d88 [ 256.707172][T13323] [ 256.795591][T13331] netlink: 'syz.3.1870': attribute type 16 has an invalid length. [ 256.798621][T13323] Mem-Info: [ 256.825028][T13331] netlink: 'syz.3.1870': attribute type 3 has an invalid length. [ 256.828332][T13323] active_anon:3905 inactive_anon:0 isolated_anon:0 [ 256.828332][T13323] active_file:3205 inactive_file:39953 isolated_file:0 [ 256.828332][T13323] unevictable:768 dirty:89 writeback:0 [ 256.828332][T13323] slab_reclaimable:11757 slab_unreclaimable:132474 [ 256.828332][T13323] mapped:28936 shmem:1358 pagetables:1065 [ 256.828332][T13323] sec_pagetables:0 bounce:0 [ 256.828332][T13323] kernel_misc_reclaimable:0 [ 256.828332][T13323] free:1294724 free_pcp:14372 free_cma:0 [ 256.828380][T13323] Node 0 active_anon:15620kB inactive_anon:0kB active_file:12820kB inactive_file:159612kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:115744kB dirty:352kB writeback:0kB shmem:3896kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13348kB pagetables:4128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 256.872460][T13331] netlink: 64066 bytes leftover after parsing attributes in process `syz.3.1870'. [ 257.074184][T13323] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 257.144914][T13323] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 257.223626][T13323] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 257.240588][T13323] Node 0 DMA32 free:1272128kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:15480kB inactive_anon:0kB active_file:12820kB inactive_file:159612kB unevictable:1536kB writepending:360kB zspages:0kB present:3129332kB managed:2564516kB mlocked:0kB bounce:0kB free_pcp:39224kB local_pcp:19272kB free_cma:0kB [ 257.288516][T13323] lowmem_reserve[]: 0 0 0 0 0 [ 257.293378][T13323] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 257.295831][T13328] wg1 speed is unknown, defaulting to 1000 [ 257.345743][T13323] lowmem_reserve[]: 0 0 0 0 0 [ 257.384233][T13328] ip6_vti0 speed is unknown, defaulting to 1000 [ 257.392790][T13323] Node 1 Normal free:3891256kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17696kB local_pcp:7296kB free_cma:0kB [ 257.427076][T13323] lowmem_reserve[]: 0 0 0 0 0 [ 257.431834][T13323] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 257.445828][T13323] Node 0 DMA32: 714*4kB (UME) 1197*8kB (UME) 503*16kB (UME) 1620*32kB (UME) 556*64kB (UME) 155*128kB (UME) 60*256kB (UME) 33*512kB (UME) 16*1024kB (UME) 7*2048kB (UME) 264*4096kB (UM) = 1272064kB [ 257.519038][T13354] netlink: 'syz.3.1874': attribute type 10 has an invalid length. [ 257.522869][T13323] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 257.543806][T13323] Node 1 Normal: 222*4kB (UME) 62*8kB (UME) 39*16kB (UME) 127*32kB (UME) 50*64kB (UME) 6*128kB (UME) 3*256kB (UM) 3*512kB (UM) 2*1024kB (ME) 1*2048kB (E) 946*4096kB (M) = 3891256kB [ 257.563863][T13323] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 257.576683][T13323] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 257.585998][T13323] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 257.596005][T13323] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 257.596955][T13354] veth0_vlan: left promiscuous mode [ 257.605635][T13323] 44513 total pagecache pages [ 257.615598][T13323] 0 pages in swap cache [ 257.620105][T13323] Free swap = 124996kB [ 257.624275][T13323] Total swap = 124996kB [ 257.628700][T13323] 2097051 pages RAM [ 257.632518][T13323] 0 pages HighMem/MovableOnly [ 257.639964][T13354] veth0_vlan: entered promiscuous mode [ 257.677450][T13323] 424280 pages reserved [ 257.678351][T13354] team0: Device veth0_vlan failed to register rx_handler [ 257.681722][T13323] 0 pages cma reserved [ 257.705022][T13358] netlink: 'syz.4.1876': attribute type 1 has an invalid length. [ 257.762887][T13358] netlink: 'syz.4.1876': attribute type 1 has an invalid length. [ 257.912723][T13374] tipc: Failed to remove unknown binding: 66,1,1/1:4240976640/4240976642 [ 258.064087][T13381] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1882'. [ 258.464844][T13415] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1890'. [ 258.510761][T13415] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1890'. [ 258.690439][T13415] 8021q: adding VLAN 0 to HW filter on device bond7 [ 258.694631][T13416] RDS: rds_bind could not find a transport for c02f:0:20:0:c002:0:20:0, load rds_tcp or rds_rdma? [ 258.803970][T13430] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1895'. [ 258.849555][T13425] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1893'. [ 258.874952][T13425] netlink: 'syz.4.1893': attribute type 33 has an invalid length. [ 258.982347][T13437] tipc: Enabled bearer , priority 0 [ 258.998394][T13437] syzkaller0: entered promiscuous mode [ 259.007460][T13437] syzkaller0: entered allmulticast mode [ 259.098930][T13437] tipc: Resetting bearer [ 259.290499][T13464] wg1 speed is unknown, defaulting to 1000 [ 259.299366][T13464] ip6_vti0 speed is unknown, defaulting to 1000 [ 259.381134][T13466] wg1 speed is unknown, defaulting to 1000 [ 259.455919][T13470] wg1 speed is unknown, defaulting to 1000 [ 259.541670][T13466] ip6_vti0 speed is unknown, defaulting to 1000 [ 259.953996][T13470] ip6_vti0 speed is unknown, defaulting to 1000 [ 260.063646][T13492] ipt_REJECT: ECHOREPLY no longer supported. [ 260.081737][ T24] tipc: Node number set to 873585452 [ 260.193666][T13496] openvswitch: netlink: Message has -2 unknown bytes. [ 260.203997][T13496] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 260.523872][T13502] netlink: 'syz.4.1910': attribute type 12 has an invalid length. [ 260.911793][T13514] syzkaller1: entered promiscuous mode [ 260.918033][T13514] syzkaller1: entered allmulticast mode [ 261.137022][T13530] __nla_validate_parse: 8 callbacks suppressed [ 261.137040][T13530] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1918'. [ 261.174544][T13527] wg1 speed is unknown, defaulting to 1000 [ 261.210352][T13527] ip6_vti0 speed is unknown, defaulting to 1000 [ 261.235063][T13535] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1920'. [ 261.354350][T13539] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1922'. [ 261.644912][T13556] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1928'. [ 261.903123][T13572] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1933'. [ 261.929594][T13436] tipc: Resetting bearer [ 261.964429][T13436] tipc: Disabling bearer [ 262.144762][T13581] tipc: Enabling of bearer rejected, failed to enable media [ 262.353585][T13593] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 262.414409][T13595] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1939'. [ 262.464438][T13597] netlink: 'syz.3.1940': attribute type 1 has an invalid length. [ 262.533027][T13601] bond4: (slave dummy0): Releasing active interface [ 262.541712][T13601] dummy0: left promiscuous mode [ 262.672259][T13605] ip6gretap0: entered promiscuous mode [ 262.685052][T13605] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 262.696451][T13605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 262.705542][T13605] 8021q: adding VLAN 0 to HW filter on device team0 [ 262.717226][T13605] batman_adv: batadv0: Interface activated: veth0_virt_wifi [ 262.737411][T13605] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 263.058252][T13640] xt_TCPMSS: Only works on TCP SYN packets [ 263.087382][T13642] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1951'. [ 263.250625][T13656] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1958'. [ 263.291057][T13660] openvswitch: netlink: Key 6 has unexpected len 4 expected 2 [ 263.370706][T13660] 8021q: adding VLAN 0 to HW filter on device bond2 [ 263.530946][T13675] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1961'. [ 263.616126][T13681] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1964'. [ 266.793407][T13698] __nla_validate_parse: 2 callbacks suppressed [ 266.793423][T13698] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1967'. [ 266.823562][T13694] syzkaller0: entered promiscuous mode [ 266.839659][T13694] syzkaller0: entered allmulticast mode [ 266.870357][T13698] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1967'. [ 266.929322][T13698] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1967'. [ 267.032641][T13710] wg1 speed is unknown, defaulting to 1000 [ 267.041271][T13710] ip6_vti0 speed is unknown, defaulting to 1000 [ 267.122931][T13716] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1975'. [ 267.263728][T13717] xt_CT: No such helper "netbios-ns" [ 267.504417][T13736] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 267.776104][T13757] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1984'. [ 268.101063][T13768] syzkaller1: entered promiscuous mode [ 268.114691][T13768] syzkaller1: entered allmulticast mode [ 268.217593][T13776] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1991'. [ 268.227793][T13776] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1991'. [ 268.238956][T13776] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1991'. [ 268.248294][T13776] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1991'. [ 268.265429][T13776] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1991'. [ 268.275166][T13771] wg1 speed is unknown, defaulting to 1000 [ 268.286284][T13771] ip6_vti0 speed is unknown, defaulting to 1000 [ 268.325655][T13770] wg1 speed is unknown, defaulting to 1000 [ 268.430465][T13780] can: request_module (can-proto-4) failed. [ 268.782995][T13770] ip6_vti0 speed is unknown, defaulting to 1000 [ 269.345584][T13815] IPVS: set_ctl: invalid protocol: 43 224.0.0.2:20000 [ 269.407934][T13811] wg1 speed is unknown, defaulting to 1000 [ 269.440652][T13811] ip6_vti0 speed is unknown, defaulting to 1000 [ 269.560581][T13825] xt_connbytes: Forcing CT accounting to be enabled [ 269.681636][T13830] netlink: 'syz.0.2003': attribute type 4 has an invalid length. [ 270.182423][T13845] netlink: 'syz.1.2006': attribute type 6 has an invalid length. [ 270.216477][T13845] netlink: 'syz.1.2006': attribute type 5 has an invalid length. [ 270.949281][T13861] sch_tbf: burst 88 is lower than device veth7 mtu (1514) ! [ 271.254534][T13852] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 271.718852][T13891] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 271.781971][T13891] netlink: 'syz.0.2020': attribute type 10 has an invalid length. [ 271.790767][T13891] bond0: (slave wlan1): Opening slave failed [ 271.961919][T13902] lo: entered allmulticast mode [ 271.967573][T13902] lo: left allmulticast mode [ 272.256706][T13913] syzkaller0: entered promiscuous mode [ 272.262223][T13913] syzkaller0: entered allmulticast mode [ 272.432339][T13921] dummy0: left allmulticast mode [ 272.457132][T13923] sctp: [Deprecated]: syz.1.2030 (pid 13923) Use of int in max_burst socket option. [ 272.457132][T13923] Use struct sctp_assoc_value instead [ 272.468116][T13921] bridge0: port 3(dummy0) entered disabled state [ 272.525357][T13921] bridge_slave_1: left allmulticast mode [ 272.563399][T13921] bridge_slave_1: left promiscuous mode [ 272.586522][T13921] bridge0: port 2(bridge_slave_1) entered disabled state [ 272.693090][T13921] bridge_slave_0: left allmulticast mode [ 272.716392][T13921] bridge_slave_0: left promiscuous mode [ 272.732429][T13921] bridge0: port 1(bridge_slave_0) entered disabled state [ 272.833820][T13928] tipc: Enabling of bearer rejected, failed to enable media [ 272.976330][T13944] netlink: 'syz.2.2034': attribute type 21 has an invalid length. [ 273.019084][T13944] __nla_validate_parse: 11 callbacks suppressed [ 273.019102][T13944] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2034'. [ 273.045081][T13951] netlink: 'syz.0.2035': attribute type 1 has an invalid length. [ 273.066494][T13951] netlink: 'syz.0.2035': attribute type 3 has an invalid length. [ 273.074345][T13951] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2035'. [ 273.445451][T13970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2040'. [ 273.499989][T13976] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2040'. [ 273.539602][T13978] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2041'. [ 273.560113][T13970] 8021q: adding VLAN 0 to HW filter on device bond8 [ 273.585482][T13972] syzkaller0: entered promiscuous mode [ 273.627609][T13972] syzkaller0: entered allmulticast mode [ 273.807031][T13990] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2046'. [ 273.824867][T13991] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2045'. [ 273.827583][T13992] RDS: rds_bind could not find a transport for ::ffff:172.30.1.2, load rds_tcp or rds_rdma? [ 273.877837][T13970] bond8 (unregistering): Released all slaves [ 274.031719][T13996] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2047'. [ 274.232697][T14002] wg1 speed is unknown, defaulting to 1000 [ 274.282668][T14002] ip6_vti0 speed is unknown, defaulting to 1000 [ 274.882051][T14036] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 275.225409][T14043] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2059'. [ 275.323488][T14048] netlink: 87 bytes leftover after parsing attributes in process `syz.2.2061'. [ 275.441999][T14049] siw: device registration error -23 [ 275.447744][T14048] siw: device registration error -23 [ 275.455708][T14054] netlink: zone id is out of range [ 275.639584][T14057] team1: entered promiscuous mode [ 275.654710][T14057] team1: entered allmulticast mode [ 275.661936][T14057] 8021q: adding VLAN 0 to HW filter on device team1 [ 275.682166][T14064] netlink: 'syz.0.2066': attribute type 29 has an invalid length. [ 275.706903][T14063] netlink: 'syz.0.2066': attribute type 29 has an invalid length. [ 275.911134][T14076] x_tables: duplicate underflow at hook 2 [ 276.065642][T14082] wg1 speed is unknown, defaulting to 1000 [ 276.104173][T14082] ip6_vti0 speed is unknown, defaulting to 1000 [ 276.436944][T14093] nbd4: detected capacity change from 0 to 63 [ 276.444204][T14091] block nbd4: NBD_DISCONNECT [ 276.450655][T14091] block nbd4: Disconnected due to user request. [ 276.457982][T14091] block nbd4: shutting down sockets [ 276.465396][T14098] bond0: (slave bridge8): Enslaving as an active interface with an up link [ 276.529393][T14095] macvlan2: entered promiscuous mode [ 276.546598][T14095] macvlan2: entered allmulticast mode [ 276.554459][T14095] bond0: entered promiscuous mode [ 276.571980][T14095] bridge8: entered promiscuous mode [ 276.584928][T14095] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 276.616983][T14095] bond0: left promiscuous mode [ 276.634437][T14095] bridge8: left promiscuous mode [ 276.946847][T14105] mpoa:atm_mpoa_vcc_attach: mpoa:Short read (missed 12 bytes) from userland [ 277.697915][T14118] wg1 speed is unknown, defaulting to 1000 [ 277.705529][T14118] ip6_vti0 speed is unknown, defaulting to 1000 [ 277.721535][T14124] syzkaller1: entered promiscuous mode [ 277.727238][T14124] syzkaller1: entered allmulticast mode [ 278.203760][T14119] netlink: 'syz.0.2079': attribute type 2 has an invalid length. [ 278.328835][T14137] wg1 speed is unknown, defaulting to 1000 [ 278.347104][T14137] ip6_vti0 speed is unknown, defaulting to 1000 [ 278.765784][T14157] __nla_validate_parse: 6 callbacks suppressed [ 278.765804][T14157] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2091'. [ 278.783376][T14157] netlink: 'syz.1.2091': attribute type 7 has an invalid length. [ 278.792740][T14157] netlink: 'syz.1.2091': attribute type 8 has an invalid length. [ 278.800810][T14157] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2091'. [ 278.826069][T14159] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2091'. [ 278.903582][T14162] x_tables: duplicate underflow at hook 1 [ 279.723066][T14196] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 279.762061][T14196] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 279.805099][T14196] netlink: 'syz.4.2098': attribute type 1 has an invalid length. [ 279.826579][T14196] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2098'. [ 279.903398][T14200] vxcan0: entered allmulticast mode [ 280.068269][T14208] netlink: 'syz.3.2102': attribute type 1 has an invalid length. [ 280.109198][T14208] netlink: 'syz.3.2102': attribute type 4 has an invalid length. [ 280.118318][T14208] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2102'. [ 280.151013][T14212] netlink: 'syz.3.2102': attribute type 1 has an invalid length. [ 280.164543][T14212] netlink: 'syz.3.2102': attribute type 4 has an invalid length. [ 280.172966][T14212] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2102'. [ 280.180853][T14206] wg1 speed is unknown, defaulting to 1000 [ 280.193901][T14206] ip6_vti0 speed is unknown, defaulting to 1000 [ 280.430291][T14216] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2103'. [ 280.748122][T14223] bond7: entered promiscuous mode [ 280.753815][T14223] 8021q: adding VLAN 0 to HW filter on device bond7 [ 280.796146][T14230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2105'. [ 280.806238][T14229] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2105'. [ 280.825418][T14239] ip6tnl1: entered allmulticast mode [ 281.560518][T14228] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 281.794223][T14271] siw: device registration error -23 [ 281.949813][T14289] set match dimension is over the limit! [ 281.990816][T14280] dvmrp1: entered allmulticast mode [ 282.000040][T14280] dvmrp1: left allmulticast mode [ 282.936711][T14323] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2131'. [ 283.095659][T14339] vti1: entered promiscuous mode [ 283.100002][T14343] sctp: [Deprecated]: syz.0.2135 (pid 14343) Use of struct sctp_assoc_value in delayed_ack socket option. [ 283.100002][T14343] Use struct sctp_sack_info instead [ 283.349117][T14353] geneve5: entered promiscuous mode [ 283.398902][ T3506] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.410653][ T3506] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.424087][ T3506] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.517617][ T3506] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.541324][T14370] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 285.494837][T14391] tunl0: Caught tx_queue_len zero misconfig [ 285.500852][T14391] __nla_validate_parse: 4 callbacks suppressed [ 285.500863][T14391] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2146'. [ 285.633759][T14407] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2149'. [ 285.659936][T14407] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2149'. [ 285.961533][T14431] validate_nla: 1 callbacks suppressed [ 285.961550][T14431] netlink: 'syz.2.2159': attribute type 2 has an invalid length. [ 285.987600][T14428] wg1 speed is unknown, defaulting to 1000 [ 285.998845][T14432] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2157'. [ 286.009704][T14428] ip6_vti0 speed is unknown, defaulting to 1000 [ 286.067253][T14425] wg1 speed is unknown, defaulting to 1000 [ 286.239565][T14442] netlink: 5 bytes leftover after parsing attributes in process `syz.2.2159'. [ 286.251457][T14442] 0{X: renamed from gretap0 [ 286.278198][T14442] 0{X: entered allmulticast mode [ 286.298572][T14442] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 286.334162][T14425] ip6_vti0 speed is unknown, defaulting to 1000 [ 286.412098][T14440] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.459611][T14447] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2161'. [ 286.524165][T14440] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.603506][T14440] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.655644][T14440] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.030985][ T4249] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.152504][ T6004] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.191639][ T6004] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.236765][T14473] netlink: 'syz.1.2170': attribute type 13 has an invalid length. [ 287.247344][ T4249] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 287.472614][T14486] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2171'. [ 287.482217][T14486] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2171'. [ 287.509213][T14476] wg1 speed is unknown, defaulting to 1000 [ 287.534240][T14476] ip6_vti0 speed is unknown, defaulting to 1000 [ 287.791367][T14496] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2175'. [ 287.801195][T14494] gretap0: entered promiscuous mode [ 287.809007][T14494] batman_adv: batadv0: Adding interface: gretap0 [ 287.815384][T14494] batman_adv: batadv0: The MTU of interface gretap0 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 287.877880][T14494] batman_adv: batadv0: Not using interface gretap0 (retrying later): interface not active [ 288.002258][T14496] 8021q: adding VLAN 0 to HW filter on device bond4 [ 288.027088][T14498] bond4: (slave vlan0): Opening slave failed [ 288.068978][T14496] netlink: 'syz.1.2175': attribute type 3 has an invalid length. [ 289.153195][T14547] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2189'. [ 289.244050][T14547] bond5: entered allmulticast mode [ 289.266840][T14547] 8021q: adding VLAN 0 to HW filter on device bond5 [ 289.332204][T14558] 8021q: adding VLAN 0 to HW filter on device bond6 [ 289.340614][T14558] bond6: entered allmulticast mode [ 289.346572][T14558] bond5: (slave bond6): Enslaving as an active interface with an up link [ 290.099151][T14575] netlink: 'syz.0.2196': attribute type 3 has an invalid length. [ 290.589925][T14598] tipc: Enabled bearer , priority 0 [ 290.614677][T14598] syzkaller0: entered promiscuous mode [ 290.642064][T14598] syzkaller0: entered allmulticast mode [ 290.780320][T14598] tipc: Resetting bearer [ 290.805807][T14597] tipc: Resetting bearer [ 290.907881][T14597] tipc: Disabling bearer [ 291.027674][T14610] wg1 speed is unknown, defaulting to 1000 [ 291.219735][T14617] wg1 speed is unknown, defaulting to 1000 [ 291.236023][T14610] ip6_vti0 speed is unknown, defaulting to 1000 [ 291.381145][T14633] xt_hashlimit: size too large, truncated to 1048576 [ 291.447959][T14636] __nla_validate_parse: 4 callbacks suppressed [ 291.447979][T14636] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2206'. [ 291.676240][T14617] ip6_vti0 speed is unknown, defaulting to 1000 [ 291.807003][ T6607] IPVS: starting estimator thread 0... [ 291.814521][T14644] IPVS: sh: SCTP 172.20.20.187:0 - no destination available [ 291.891839][T14642] wg1 speed is unknown, defaulting to 1000 [ 291.903374][T14649] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2210'. [ 291.903389][T14648] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2210'. [ 291.922927][T14645] IPVS: using max 32 ests per chain, 76800 per kthread [ 292.169868][T14642] ip6_vti0 speed is unknown, defaulting to 1000 [ 292.427955][T14680] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2218'. [ 293.098571][T14697] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 293.104630][T14697] syzkaller1: linktype set to 823 [ 293.158558][T14703] tipc: Enabled bearer , priority 0 [ 293.181938][T14703] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2225'. [ 293.214098][T14702] tipc: Disabling bearer [ 293.331067][T14705] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2226'. [ 293.510635][T14720] netlink: 'syz.4.2229': attribute type 3 has an invalid length. [ 293.526818][ T5834] block nbd2: Receive control failed (result -32) [ 293.570265][T14720] dvmrp0: left allmulticast mode [ 293.694260][T14725] 8021q: adding VLAN 0 to HW filter on device bond0 [ 293.725084][T14725] 8021q: adding VLAN 0 to HW filter on device ` [ 293.744020][T14735] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 293.753541][T14725] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 293.787047][T14730] netlink: 'syz.1.2231': attribute type 3 has an invalid length. [ 293.929377][T14739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 294.121529][T14749] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 294.205058][T14765] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2237'. [ 294.381250][T14773] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2237'. [ 294.561122][T14782] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2238'. [ 294.595712][T14779] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2240'. [ 294.623553][T14783] tipc: Enabled bearer , priority 0 [ 294.639281][T14783] syzkaller0: entered promiscuous mode [ 294.644884][T14783] syzkaller0: entered allmulticast mode [ 294.709801][T14779] sctp: [Deprecated]: syz.2.2240 (pid 14779) Use of struct sctp_assoc_value in delayed_ack socket option. [ 294.709801][T14779] Use struct sctp_sack_info instead [ 294.764114][T14781] tipc: Resetting bearer [ 294.825221][T14781] tipc: Disabling bearer [ 295.068116][T14818] netlink: 'syz.1.2251': attribute type 1 has an invalid length. [ 295.087635][T14812] trusted_key: syz.4.2248 sent an empty control message without MSG_MORE. [ 295.125615][T14818] 8021q: adding VLAN 0 to HW filter on device bond8 [ 295.139431][T14818] bond7: (slave bond8): making interface the new active one [ 295.166806][T14818] bond7: (slave bond8): Enslaving as an active interface with an up link [ 295.784112][T14857] netlink: 'syz.2.2261': attribute type 1 has an invalid length. [ 295.822112][T14857] netlink: 'syz.2.2261': attribute type 83 has an invalid length. [ 295.910960][T14860] x_tables: unsorted entry at hook 3 [ 296.056639][T14872] tipc: Enabled bearer , priority 0 [ 296.082768][T14881] syzkaller0: entered promiscuous mode [ 296.088647][T14881] syzkaller0: entered allmulticast mode [ 296.177966][T14872] tipc: Resetting bearer [ 296.215037][T14871] tipc: Resetting bearer [ 296.243777][T14871] tipc: Disabling bearer [ 296.381678][T14901] netlink: 'syz.0.2273': attribute type 30 has an invalid length. [ 296.517298][T14901] bond8: option arp_missed_max: mode dependency failed, not supported in mode 802.3ad(4) [ 296.539088][T14901] bond8 (unregistering): Released all slaves [ 296.802558][T14927] __nla_validate_parse: 11 callbacks suppressed [ 296.802576][T14927] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2282'. [ 296.840661][T14927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2282'. [ 296.863129][T14927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2282'. [ 297.048187][T14935] bond9: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 297.067075][T14935] bond9 (unregistering): Released all slaves [ 297.283313][T14941] wg1 speed is unknown, defaulting to 1000 [ 297.291618][T14941] ip6_vti0 speed is unknown, defaulting to 1000 [ 297.386447][T14947] netlink: 'syz.3.2287': attribute type 13 has an invalid length. [ 297.405994][T14945] bond12: option arp_validate: invalid value (18446744073491447809) [ 297.451780][T14945] bond12 (unregistering): Released all slaves [ 297.668690][ T5099] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.698274][ T5099] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.731393][ T5099] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.740173][ T5099] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.950030][T14977] dummy0: left promiscuous mode [ 298.002322][T14974] syzkaller0: entered promiscuous mode [ 298.017758][T14974] syzkaller0: entered allmulticast mode [ 298.073168][T14976] wg1 speed is unknown, defaulting to 1000 [ 298.122390][T14976] ip6_vti0 speed is unknown, defaulting to 1000 [ 298.392366][T14999] xt_hashlimit: max too large, truncated to 1048576 [ 298.424566][T15001] netlink: 'syz.1.2303': attribute type 1 has an invalid length. [ 299.710112][T15046] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2313'. [ 299.864820][T15050] netlink: 212 bytes leftover after parsing attributes in process `syz.1.2315'. [ 299.890639][T15052] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 300.043781][T15061] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2317'. [ 300.057069][T15064] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2318'. [ 300.243361][T15068] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2320'. [ 300.243786][T15071] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2319'. [ 300.299735][T15068] macvlan2: entered promiscuous mode [ 300.309400][T15068] macvlan2: entered allmulticast mode [ 300.314837][T15068] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 300.324975][T15074] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2321'. [ 300.490481][T15079] netlink: 'syz.3.2323': attribute type 29 has an invalid length. [ 301.344856][T15115] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 301.522708][T15122] : renamed from veth0_to_bond [ 301.770839][T15129] wg1 speed is unknown, defaulting to 1000 [ 301.791996][T15129] ip6_vti0 speed is unknown, defaulting to 1000 [ 302.299477][T15143] tipc: Started in network mode [ 302.304392][T15143] tipc: Node identity dac45a4ce045, cluster identity 4711 [ 302.315065][T15143] tipc: Enabled bearer , priority 0 [ 302.490908][T15143] tipc: Disabling bearer [ 302.663543][T15153] __nla_validate_parse: 3 callbacks suppressed [ 302.663564][T15153] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2340'. [ 303.865842][T15181] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2348'. [ 304.604367][T15205] delete_channel: no stack [ 304.640369][T15208] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2355'. [ 304.722302][T15210] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 305.075530][T15232] tipc: Enabled bearer , priority 0 [ 305.200213][T15232] syzkaller0: entered promiscuous mode [ 305.205819][T15232] syzkaller0: entered allmulticast mode [ 305.212127][T15232] tipc: Resetting bearer [ 305.240168][T15217] wg1 speed is unknown, defaulting to 1000 [ 305.265246][T15217] ip6_vti0 speed is unknown, defaulting to 1000 [ 305.278503][T15231] tipc: Resetting bearer [ 307.720302][T15231] tipc: Disabling bearer [ 308.247990][T15286] : renamed from vlan0 [ 308.366559][T15275] syzkaller1: entered promiscuous mode [ 308.372101][T15275] syzkaller1: entered allmulticast mode [ 308.632979][T15307] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2377'. [ 308.942720][T15331] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2383'. [ 309.052131][T15345] mac80211_hwsim hwsim10 wlan0: left promiscuous mode [ 309.069413][T15345] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 309.129251][T15342] wg1 speed is unknown, defaulting to 1000 [ 309.166860][T15342] ip6_vti0 speed is unknown, defaulting to 1000 [ 309.174541][T15347] wg1 speed is unknown, defaulting to 1000 [ 309.351705][T15361] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2389'. [ 309.580941][T15347] ip6_vti0 speed is unknown, defaulting to 1000 [ 309.792589][T15384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2393'. [ 310.177164][T15396] wg1 speed is unknown, defaulting to 1000 [ 310.184908][T15396] ip6_vti0 speed is unknown, defaulting to 1000 [ 310.532164][T15403] 0{X: entered promiscuous mode [ 310.838156][T15423] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2405'. [ 310.871635][T15424] netlink: 26 bytes leftover after parsing attributes in process `syz.0.2405'. [ 311.276975][T15430] netlink: 'syz.0.2407': attribute type 39 has an invalid length. [ 311.970782][T15453] lo: Caught tx_queue_len zero misconfig [ 312.260725][T15466] bond9: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 312.280013][T15466] bond9 (unregistering): Released all slaves [ 312.342138][ T5099] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.369253][ T5099] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.387263][ T5099] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.399726][ T5099] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.437912][T15488] IPv6: addrconf: prefix option has invalid lifetime [ 312.915673][T15516] wg1 speed is unknown, defaulting to 1000 [ 313.007889][T15516] ip6_vti0 speed is unknown, defaulting to 1000 [ 314.661711][T15610] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2453'. [ 314.673924][T15610] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2453'. [ 314.714784][T15610] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2453'. [ 314.732179][T15610] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2453'. [ 314.877264][T15618] wg1 speed is unknown, defaulting to 1000 [ 314.884783][T15618] ip6_vti0 speed is unknown, defaulting to 1000 [ 315.373500][T15640] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2459'. [ 315.708026][T15659] netlink: 260 bytes leftover after parsing attributes in process `syz.0.2465'. [ 315.763205][T15665] gretap1: entered allmulticast mode [ 315.848188][T15659] bond8: option lp_interval: invalid value (0) [ 315.854005][T15671] xt_TCPMSS: Only works on TCP SYN packets [ 315.855753][T15659] bond8: option lp_interval: allowed values 1 - 2147483647 [ 315.879339][T15659] bond8 (unregistering): Released all slaves [ 316.302120][T15693] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2471'. [ 316.345202][T15696] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2470'. [ 316.377575][T15698] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2473'. [ 316.407143][T15698] sctp: [Deprecated]: syz.4.2473 (pid 15698) Use of int in max_burst socket option. [ 316.407143][T15698] Use struct sctp_assoc_value instead [ 316.485422][T15705] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2470'. [ 316.494836][T15702] syzkaller1: entered promiscuous mode [ 316.513411][T15702] syzkaller1: entered allmulticast mode [ 316.717255][T15721] SET target dimension over the limit! [ 316.727619][T15721] SET target dimension over the limit! [ 316.740061][T15721] SET target dimension over the limit! [ 316.754545][T15721] SET target dimension over the limit! [ 316.761984][T15721] SET target dimension over the limit! [ 316.773669][T15721] SET target dimension over the limit! [ 316.792452][T15721] SET target dimension over the limit! [ 316.800527][T15721] SET target dimension over the limit! [ 316.812144][T15726] netlink: 'syz.0.2481': attribute type 12 has an invalid length. [ 316.822875][T15721] SET target dimension over the limit! [ 316.873455][T15721] SET target dimension over the limit! [ 317.098476][T15747] batadv_slave_1: entered promiscuous mode [ 317.130024][T15749] vlan0: entered promiscuous mode [ 317.135119][T15749] bond0: entered promiscuous mode [ 317.212584][T15751] SET target dimension over the limit! [ 317.441315][T15767] nbd: nbd2 already in use [ 317.446778][T15767] block nbd2: NBD_DISCONNECT [ 317.451518][T15767] block nbd2: Send disconnect failed -32 [ 317.463627][T15767] block nbd2: shutting down sockets [ 317.532988][T15770] sch_tbf: peakrate 65535 is lower than or equals to rate 15348107221646557341 ! [ 317.837670][T15744] batadv_slave_1: left promiscuous mode [ 318.639448][T15836] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 318.654087][T15836] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 318.665362][T15836] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 318.926727][ T5834] Bluetooth: hci4: link tx timeout [ 318.933330][ T5834] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 318.944226][ T5850] Bluetooth: hci4: link tx timeout [ 318.949694][ T5850] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 318.957731][ T5850] Bluetooth: hci4: link tx timeout [ 318.962847][ T5850] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 318.999515][T15857] netlink: 'syz.0.2521': attribute type 10 has an invalid length. [ 319.009416][T15857] batman_adv: batadv0: Adding interface: macvtap0 [ 319.015872][T15857] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 319.042034][T15857] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 319.799449][T15882] __nla_validate_parse: 14 callbacks suppressed [ 319.799466][T15882] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2524'. [ 320.996422][ T5850] Bluetooth: hci4: command 0x0405 tx timeout [ 324.182054][T15932] netlink: 388 bytes leftover after parsing attributes in process `syz.3.2538'. [ 324.229207][T15936] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2540'. [ 324.247901][T15940] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2542'. [ 324.333346][T15945] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2539'. [ 324.455737][T15956] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2545'. [ 324.771865][T15977] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2550'. [ 324.783736][T15968] netlink: set zone limit has 4 unknown bytes [ 324.886074][T15977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2550'. [ 324.971989][T15991] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2554'. [ 325.007843][T15993] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2554'. [ 325.120767][T15998] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2556'. [ 325.125872][T16001] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2555'. [ 325.178241][T16003] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2557'. [ 325.235259][T16003] dummy0: entered promiscuous mode [ 325.266915][T16003] macsec3: entered allmulticast mode [ 325.272259][T16003] dummy0: entered allmulticast mode [ 325.289087][T16003] dummy0: left allmulticast mode [ 325.326900][T16003] dummy0: left promiscuous mode [ 325.390803][T16010] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2558'. [ 325.400848][T16015] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 325.514522][T16019] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2563'. [ 325.566802][T16025] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2563'. [ 326.432161][T16035] ip6tnl4: entered promiscuous mode [ 326.642352][T16048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2570'. [ 326.787480][T16062] syzkaller0: entered promiscuous mode [ 326.793117][T16062] syzkaller0: entered allmulticast mode [ 326.968175][T16069] IPVS: set_ctl: invalid protocol: 94 224.0.0.1:20000 [ 327.982249][T16103] mac80211_hwsim hwsim10 wlan0: left allmulticast mode [ 328.000009][T16103] bond7: left promiscuous mode [ 328.012255][T16103] ip6tnl1: left allmulticast mode [ 328.090756][T16103] vlan0: left promiscuous mode [ 328.113041][T16103] bond0: left promiscuous mode [ 328.186888][T16113] bond1: left promiscuous mode [ 328.192005][T16113] bond1: left allmulticast mode [ 328.199220][T16113] geneve3: left promiscuous mode [ 328.204873][T16113] bond3: left allmulticast mode [ 328.210649][T16113] ip6gretap1: left promiscuous mode [ 328.216126][T16113] team1: left promiscuous mode [ 328.221517][T16113] team1: left allmulticast mode [ 328.227193][T16113] veth5: left promiscuous mode [ 328.237374][T16113] veth6: left allmulticast mode [ 328.247266][T16113] geneve5: left promiscuous mode [ 328.273611][T16123] hsr_slave_0: left promiscuous mode [ 328.286972][T16123] hsr_slave_1: left promiscuous mode [ 328.358001][ T6031] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.366741][ T36] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.396793][ T36] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.405243][ T36] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.595583][T16160] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 328.605717][T16151] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 328.872789][T16180] wg1 speed is unknown, defaulting to 1000 [ 328.901446][T16180] ip6_vti0 speed is unknown, defaulting to 1000 [ 328.927332][T16184] macvtap1: entered promiscuous mode [ 328.936292][T16184] mac80211_hwsim hwsim26 wlan1: entered promiscuous mode [ 328.986742][T16186] netlink: 'syz.3.2608': attribute type 2 has an invalid length. [ 329.382355][T16205] x_tables: duplicate underflow at hook 1 [ 329.558639][T16214] netlink: 'syz.0.2613': attribute type 1 has an invalid length. [ 329.776752][T16214] 8021q: adding VLAN 0 to HW filter on device bond8 [ 329.798024][T16225] netlink: 'syz.1.2616': attribute type 4 has an invalid length. [ 329.895864][T16214] veth11: entered promiscuous mode [ 329.959627][T16214] bond8: (slave veth11): Enslaving as an active interface with an up link [ 330.131885][T16236] syzkaller1: entered promiscuous mode [ 330.143477][T16236] syzkaller1: entered allmulticast mode [ 330.204365][T16243] netlink: 'syz.0.2620': attribute type 29 has an invalid length. [ 330.217350][T16243] netlink: 'syz.0.2620': attribute type 29 has an invalid length. [ 330.226064][T16243] __nla_validate_parse: 12 callbacks suppressed [ 330.226082][T16243] netlink: 500 bytes leftover after parsing attributes in process `syz.0.2620'. [ 330.255479][T16237] af_packet: tpacket_rcv: packet too big, clamped from 3960 to 3942. macoff=106 [ 330.330344][T16254] netlink: 'syz.4.2621': attribute type 8 has an invalid length. [ 330.386615][T16248] wg1 speed is unknown, defaulting to 1000 [ 330.395497][T16248] ip6_vti0 speed is unknown, defaulting to 1000 [ 330.421185][T16261] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2621'. [ 330.789870][T16271] tipc: Enabled bearer , priority 0 [ 330.807931][T16271] syzkaller0: entered promiscuous mode [ 330.819195][T16271] syzkaller0: entered allmulticast mode [ 330.872054][T16271] tipc: Resetting bearer [ 330.908180][T16270] tipc: Resetting bearer [ 330.937013][T16270] tipc: Disabling bearer [ 330.956321][T16276] wg1 speed is unknown, defaulting to 1000 [ 330.985098][T16276] ip6_vti0 speed is unknown, defaulting to 1000 [ 331.877906][T16321] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 332.115138][T16332] netlink: 'syz.1.2642': attribute type 2 has an invalid length. [ 332.158957][T16332] netlink: 'syz.1.2642': attribute type 1 has an invalid length. [ 332.200011][T16332] netlink: 'syz.1.2642': attribute type 1 has an invalid length. [ 332.258120][T16332] netlink: 55 bytes leftover after parsing attributes in process `syz.1.2642'. [ 332.429130][T16342] netlink: 'syz.4.2645': attribute type 13 has an invalid length. [ 332.456669][T16342] macvtap0: entered promiscuous mode [ 332.491137][T16342] macvtap0: refused to change device tx_queue_len [ 332.599960][T16354] wg1 speed is unknown, defaulting to 1000 [ 332.621182][T16354] ip6_vti0 speed is unknown, defaulting to 1000 [ 332.730930][T16363] netlink: 4308 bytes leftover after parsing attributes in process `syz.4.2649'. [ 332.758021][T16363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2649'. [ 332.790234][T16363] bond0: Device is already in use. [ 333.075190][T16377] tipc: Enabled bearer , priority 0 [ 333.085127][T16377] syzkaller0: entered promiscuous mode [ 333.090883][T16377] syzkaller0: entered allmulticast mode [ 333.208094][T16377] tipc: Resetting bearer [ 333.223609][T16376] tipc: Resetting bearer [ 333.259639][T16376] tipc: Disabling bearer [ 333.438777][T16384] netlink: 14436 bytes leftover after parsing attributes in process `syz.4.2655'. [ 333.448288][T16385] netlink: 14436 bytes leftover after parsing attributes in process `syz.4.2655'. [ 333.654544][T16398] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2660'. [ 333.714433][T16394] xt_hashlimit: size too large, truncated to 1048576 [ 333.723913][T16394] xt_hashlimit: max too large, truncated to 1048576 [ 333.726514][T16401] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 333.764722][T16394] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 333.985383][T16408] RDS: rds_bind could not find a transport for ::1400:0:0:0, load rds_tcp or rds_rdma? [ 334.876455][T16452] netlink: 348 bytes leftover after parsing attributes in process `syz.0.2673'. [ 335.303645][T16471] validate_nla: 2 callbacks suppressed [ 335.303663][T16471] netlink: 'syz.0.2676': attribute type 13 has an invalid length. [ 335.320977][T16471] netlink: 'syz.0.2676': attribute type 17 has an invalid length. [ 335.352155][T16471] 8021q: adding VLAN 0 to HW filter on device bond0 [ 335.361106][T16471] 8021q: adding VLAN 0 to HW filter on device team0 [ 335.373312][T16471] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 335.390159][ T6606] ip6_vti0 speed is unknown, defaulting to 1000 [ 335.398267][ T6606] syz2: Port: 1 Link ACTIVE [ 335.405166][ T6606] ip6_vti0 speed is unknown, defaulting to 1000 [ 335.672794][T16491] netlink: 'syz.4.2680': attribute type 2 has an invalid length. [ 335.759100][T16495] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2679'. [ 335.857366][T16498] netlink: 'syz.0.2677': attribute type 20 has an invalid length. [ 335.882150][T16500] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2683'. [ 335.919026][T16505] ip6tnl0: Caught tx_queue_len zero misconfig [ 335.945188][T16506] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2683'. [ 336.045438][T16505] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2684'. [ 336.065915][T16506] netlink: 'syz.4.2683': attribute type 4 has an invalid length. [ 336.079166][T16506] netlink: 'syz.4.2683': attribute type 4 has an invalid length. [ 336.287830][T16533] netlink: 'syz.3.2690': attribute type 83 has an invalid length. [ 336.351177][T16537] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2694'. [ 336.428009][T16539] 8021q: adding VLAN 0 to HW filter on device bond10 [ 336.435822][T16539] bond10: entered promiscuous mode [ 336.458053][T16544] netlink: 'syz.2.2695': attribute type 1 has an invalid length. [ 336.497683][T16539] bond10: entered allmulticast mode [ 336.517241][T16539] team0: Port device bond10 added [ 336.567643][T16544] 8021q: adding VLAN 0 to HW filter on device bond3 [ 336.594565][T16552] bond3: entered promiscuous mode [ 336.613850][T16556] netlink: 'syz.1.2698': attribute type 6 has an invalid length. [ 336.624772][T16548] bond3: (slave geneve2): making interface the new active one [ 336.632942][T16548] geneve2: entered promiscuous mode [ 336.638918][T16548] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 336.686816][T16558] netlink: 'syz.1.2698': attribute type 6 has an invalid length. [ 336.880752][T16566] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2701'. [ 336.896905][T16566] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2701'. [ 337.057030][T16568] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.2.2702:16568 [ 337.201383][T16573] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2703'. [ 337.583687][T16593] team0: Device is already in use. [ 337.871459][T16617] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2715'. [ 337.914468][T16622] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2717'. [ 337.990953][T16629] tipc: Enabled bearer , priority 0 [ 337.998034][T16628] tipc: Enabling of bearer rejected, already enabled [ 338.029740][T16628] tipc: Resetting bearer [ 338.051086][T16626] tipc: Disabling bearer [ 338.068531][ T30] audit: type=1107 audit(1765238931.931:3): pid=16619 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='=7Nmf1~p# [ 338.068531][ T30] mO$mCUC37K m/'jEF~Vފ[$EBx9#"f' [ 338.203796][T16638] macvtap0: left promiscuous mode [ 338.233054][T16638] hsr_slave_0: left promiscuous mode [ 338.240437][T16638] hsr_slave_1: left promiscuous mode [ 338.627097][T16653] tipc: Enabled bearer , priority 0 [ 338.635564][T16653] syzkaller0: entered promiscuous mode [ 338.641462][T16653] syzkaller0: entered allmulticast mode [ 338.708664][T16653] tipc: Resetting bearer [ 338.735209][T16651] tipc: Resetting bearer [ 338.932298][T16651] tipc: Disabling bearer [ 338.972478][T16664] bond12: option arp_validate: invalid value (18446744073491447809) [ 338.988874][T16664] bond12 (unregistering): Released all slaves [ 339.320241][T16670] infiniband !yz!: set down [ 339.325327][T16670] infiniband !yz!: added team_slave_0 [ 339.332824][T16670] !yz!: rxe_create_cq: returned err = -12 [ 339.341258][T16670] infiniband !yz!: Couldn't create ib_mad CQ [ 339.349046][T16670] infiniband !yz!: Couldn't open port 1 [ 339.389156][T16670] RDS/IB: !yz!: added [ 339.393240][T16670] smc: adding ib device !yz! with port count 1 [ 339.399607][T16670] smc: ib device !yz! port 1 has no pnetid [ 339.802970][T16698] syzkaller0: entered promiscuous mode [ 339.809708][T16698] syzkaller0: entered allmulticast mode [ 340.044523][T16709] wg1 speed is unknown, defaulting to 1000 [ 340.057049][T16709] ip6_vti0 speed is unknown, defaulting to 1000 [ 340.135656][T16716] IPVS: set_ctl: invalid protocol: 41 0.0.0.0:0 [ 340.158276][T16716] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 340.569133][T16732] validate_nla: 3 callbacks suppressed [ 340.569152][T16732] netlink: 'syz.3.2745': attribute type 9 has an invalid length. [ 340.582702][T16732] netlink: 'syz.3.2745': attribute type 11 has an invalid length. [ 340.606240][T16732] netlink: 'syz.3.2745': attribute type 12 has an invalid length. [ 340.924622][T16745] bridge_slave_0: default FDB implementation only supports local addresses [ 341.100212][T16754] __nla_validate_parse: 7 callbacks suppressed [ 341.100231][T16754] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2748'. [ 341.319024][T16760] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2751'. [ 341.393479][T16765] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2752'. [ 341.441101][T16765] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2752'. [ 341.647168][T16775] x_tables: ip6_tables: SYNPROXY target: used from hooks PREROUTING, but only usable from INPUT/FORWARD [ 341.757936][T16776] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2756'. [ 342.209980][T16792] syzkaller0: entered promiscuous mode [ 342.215504][T16792] syzkaller0: entered allmulticast mode [ 342.251327][T16796] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2762'. [ 342.719011][T16807] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2764'. [ 342.748351][T16813] syzkaller0: entered promiscuous mode [ 342.753976][T16813] syzkaller0: entered allmulticast mode [ 342.841260][T16818] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2765'. [ 342.944698][T16824] bridge9: entered allmulticast mode [ 343.183654][T16842] netlink: 'syz.4.2773': attribute type 1 has an invalid length. [ 343.266007][T16842] 8021q: adding VLAN 0 to HW filter on device bond8 [ 343.298923][ T1114] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 343.309758][T16838] wg1 speed is unknown, defaulting to 1000 [ 343.342884][T16838] ip6_vti0 speed is unknown, defaulting to 1000 [ 343.369805][T16842] gretap2: entered promiscuous mode [ 343.401499][T16854] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 343.459752][T16865] wg1 speed is unknown, defaulting to 1000 [ 343.581209][T16865] ip6_vti0 speed is unknown, defaulting to 1000 [ 343.643780][T16871] netlink: 'syz.4.2776': attribute type 39 has an invalid length. [ 344.041422][T16860] netlink: 'syz.2.2775': attribute type 6 has an invalid length. [ 344.223934][T16877] netlink: 'syz.1.2778': attribute type 39 has an invalid length. [ 344.852376][T16897] wg1 speed is unknown, defaulting to 1000 [ 344.860126][T16897] ip6_vti0 speed is unknown, defaulting to 1000 [ 344.983236][T16892] x_tables: ip6_tables: DNPT target: used from hooks FORWARD, but only usable from PREROUTING/OUTPUT [ 345.188078][T16900] tipc: Enabled bearer , priority 0 [ 345.207045][T16900] syzkaller0: entered promiscuous mode [ 345.212566][T16900] syzkaller0: entered allmulticast mode [ 345.252493][T16900] tipc: Resetting bearer [ 345.287027][T16899] tipc: Resetting bearer [ 345.407179][T16899] tipc: Disabling bearer [ 345.704064][T16915] tipc: Enabled bearer , priority 0 [ 345.726133][T16915] syzkaller0: entered promiscuous mode [ 345.749690][T16915] syzkaller0: entered allmulticast mode [ 345.955742][T16915] tipc: Resetting bearer [ 345.964986][T16914] tipc: Resetting bearer [ 346.005274][T16914] tipc: Disabling bearer [ 346.071908][T16920] netlink: 'syz.3.2790': attribute type 6 has an invalid length. [ 346.082991][T16920] Cannot find del_set index 4 as target [ 346.095193][T16920] netlink: 'syz.3.2790': attribute type 10 has an invalid length. [ 346.103603][T16920] netlink: 228 bytes leftover after parsing attributes in process `syz.3.2790'. [ 346.153986][T16910] wg1 speed is unknown, defaulting to 1000 [ 346.212398][T16925] syzkaller0: entered promiscuous mode [ 346.228657][T16910] ip6_vti0 speed is unknown, defaulting to 1000 [ 346.238078][T16925] syzkaller0: entered allmulticast mode [ 346.383563][T16928] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2793'. [ 346.494600][T16932] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2795'. [ 346.995664][T16943] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2798'. [ 347.027821][T16943] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2798'. [ 347.098595][T16948] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2800'. [ 347.153992][T16950] netlink: 'syz.0.2801': attribute type 1 has an invalid length. [ 347.301677][T16955] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2803'. [ 347.677772][T16975] syzkaller0: entered promiscuous mode [ 347.683285][T16975] syzkaller0: entered allmulticast mode [ 347.895095][T16990] syzkaller0: entered promiscuous mode [ 347.901011][T16990] syzkaller0: entered allmulticast mode [ 348.092533][T16999] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2813'. [ 348.103347][T16999] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2813'. [ 348.112654][T16999] netlink: 'syz.3.2813': attribute type 14 has an invalid length. [ 348.167397][T16996] tipc: Enabled bearer , priority 0 [ 348.174958][T16996] syzkaller0: entered promiscuous mode [ 348.184270][T16996] syzkaller0: entered allmulticast mode [ 348.231020][T17007] netlink: 'syz.0.2814': attribute type 83 has an invalid length. [ 348.291981][T17000] tipc: Resetting bearer [ 348.308523][T16995] tipc: Resetting bearer [ 348.359463][T16995] tipc: Disabling bearer [ 348.437371][T17018] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2818'. [ 348.469658][T17018] vlan5: entered promiscuous mode [ 348.480379][T17018] bond0: entered promiscuous mode [ 348.485454][T17018] bridge8: entered promiscuous mode [ 348.535844][T17016] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2817'. [ 348.546047][T17023] syzkaller0: entered promiscuous mode [ 348.551988][T17023] syzkaller0: entered allmulticast mode [ 348.641453][T17009] tipc: Cannot configure node identity twice [ 348.652031][ T1114] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 348.698393][ T1114] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 348.809037][ T1114] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 348.837356][ T1114] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 348.850806][T17030] netlink: 'syz.4.2823': attribute type 1 has an invalid length. [ 349.759737][T17068] 8021q: adding VLAN 0 to HW filter on device bond11 [ 349.827012][T17068] bond11: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 349.958453][T17068] 8021q: adding VLAN 0 to HW filter on device bond11 [ 349.981932][T17068] bond11: (slave lo): Enslaving as an active interface with an up link [ 350.311736][T17075] bond11 (unregistering): (slave lo): Releasing backup interface [ 350.320838][T17075] bond11 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 350.350496][T17075] bond11 (unregistering): Released all slaves [ 350.513346][T17096] xt_policy: output policy not valid in PREROUTING and INPUT [ 350.861636][T17097] netlink: 'syz.0.2839': attribute type 30 has an invalid length. [ 350.917146][T17097] bond9: option arp_missed_max: invalid value (0) [ 350.923828][T17097] bond9: option arp_missed_max: allowed values 1 - 255 [ 350.933608][T17097] bond9 (unregistering): Released all slaves [ 351.340794][T17141] syzkaller0: entered promiscuous mode [ 351.359426][T17141] syzkaller0: entered allmulticast mode [ 351.372443][T17145] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 351.379735][T17145] IPv6: NLM_F_CREATE should be set when creating new route [ 351.387045][T17145] IPv6: NLM_F_CREATE should be set when creating new route [ 351.429460][T17149] __nla_validate_parse: 7 callbacks suppressed [ 351.429479][T17149] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2856'. [ 351.438987][T17141] wg1 speed is unknown, defaulting to 1000 [ 351.525944][T17149] geneve3: entered promiscuous mode [ 351.531561][T17149] geneve3: entered allmulticast mode [ 351.540669][ T5099] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 42830 - 0 [ 351.553177][T17141] ip6_vti0 speed is unknown, defaulting to 1000 [ 351.663989][T17154] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.704367][ T5099] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 42830 - 0 [ 351.713869][ T5099] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 42830 - 0 [ 351.743568][ T4249] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 42830 - 0 [ 351.807025][T17154] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.810885][T17178] netlink: 'syz.3.2862': attribute type 1 has an invalid length. [ 351.839431][T17178] netlink: 'syz.3.2862': attribute type 4 has an invalid length. [ 351.855049][T17169] wg1 speed is unknown, defaulting to 1000 [ 351.861890][T17178] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2862'. [ 351.862718][T17179] netlink: 'syz.3.2862': attribute type 1 has an invalid length. [ 351.908073][T17154] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.916053][T17178] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2862'. [ 351.932202][T17178] veth0_to_bridge: left allmulticast mode [ 351.938584][T17179] netlink: 'syz.3.2862': attribute type 4 has an invalid length. [ 351.938751][T17178] veth0_to_bridge: left promiscuous mode [ 351.952746][T17178] bridge0: port 4(veth0_to_bridge) entered disabled state [ 351.956781][T17179] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2862'. [ 351.974619][T17178] team0: left allmulticast mode [ 351.980028][T17178] team_slave_0: left allmulticast mode [ 351.985669][T17178] team_slave_1: left allmulticast mode [ 351.991514][T17178] team0: left promiscuous mode [ 351.996560][T17178] team_slave_0: left promiscuous mode [ 352.008405][T17178] team_slave_1: left promiscuous mode [ 352.015033][T17178] bridge0: port 3(team0) entered disabled state [ 352.023513][T17178] bridge_slave_1: left allmulticast mode [ 352.029565][T17178] bridge_slave_1: left promiscuous mode [ 352.035327][T17178] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.044616][T17178] bridge_slave_0: left promiscuous mode [ 352.050579][T17178] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.078358][T17178] vlan4 (unregistering): left promiscuous mode [ 352.084636][T17178] bridge0 (unregistering): left promiscuous mode [ 352.091133][T17178] bridge5: port 1(vlan4) entered disabled state [ 352.161962][T17154] bond0: (slave netdevsim0): Releasing backup interface [ 352.183823][T17154] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.200882][T17169] ip6_vti0 speed is unknown, defaulting to 1000 [ 352.334808][T17187] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2864'. [ 352.362636][ T36] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 352.368343][T17187] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2864'. [ 352.475888][ T6004] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 352.580662][ T36] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 352.635421][T17194] wg1 speed is unknown, defaulting to 1000 [ 352.654093][ T6004] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 352.782280][T17194] ip6_vti0 speed is unknown, defaulting to 1000 [ 353.428424][T17217] IPv6: Can't replace route, no match found [ 353.482564][T17216] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2872'. [ 353.606630][T17217] syzkaller1: entered promiscuous mode [ 353.618361][T17217] syzkaller1: entered allmulticast mode [ 353.769939][T17208] wg1 speed is unknown, defaulting to 1000 [ 353.854181][T17208] ip6_vti0 speed is unknown, defaulting to 1000 [ 353.957934][T17224] tipc: Enabled bearer , priority 0 [ 354.066672][T17224] syzkaller0: entered promiscuous mode [ 354.076453][T17224] syzkaller0: entered allmulticast mode [ 354.112632][T17224] tipc: Resetting bearer [ 354.130685][T17223] tipc: Resetting bearer [ 354.194739][T17223] tipc: Disabling bearer [ 354.837890][T17243] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2880'. [ 355.267824][T17254] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2882'. [ 355.288713][T17253] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2882'. [ 355.464395][ T5850] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 355.474989][ T5850] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 355.485672][ T5850] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 355.498329][ T5850] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 355.506097][ T5850] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 355.766975][T17262] wg1 speed is unknown, defaulting to 1000 [ 355.791684][T17262] ip6_vti0 speed is unknown, defaulting to 1000 [ 356.617772][T17313] syzkaller0: entered promiscuous mode [ 356.623292][T17313] syzkaller0: entered allmulticast mode [ 356.658081][T17313] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 356.675636][T17313] tipc: Enabled bearer , priority 0 [ 356.691170][T17312] tipc: Resetting bearer [ 356.746976][T17312] tipc: Disabling bearer [ 356.958076][T17325] netlink: 'syz.1.2900': attribute type 3 has an invalid length. [ 356.988277][T17326] netlink: 'syz.1.2900': attribute type 3 has an invalid length. [ 357.045879][T17325] netlink: 'syz.1.2900': attribute type 1 has an invalid length. [ 357.215278][T17336] x_tables: duplicate underflow at hook 1 [ 357.354414][T17262] chnl_net:caif_netlink_parms(): no params data found [ 357.496155][T17356] __nla_validate_parse: 2 callbacks suppressed [ 357.517332][T17356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2907'. [ 357.558825][T17356] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2907'. [ 357.567576][ T5850] Bluetooth: hci2: command tx timeout [ 357.568319][T17356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2907'. [ 357.627179][T17262] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.636896][T17262] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.644162][T17262] bridge_slave_0: entered allmulticast mode [ 357.654141][T17262] bridge_slave_0: entered promiscuous mode [ 357.663373][T17262] bridge0: port 2(bridge_slave_1) entered blocking state [ 357.671657][T17262] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.679850][T17262] bridge_slave_1: entered allmulticast mode [ 357.688304][T17262] bridge_slave_1: entered promiscuous mode [ 357.764575][T17262] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 357.805486][T17262] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 357.864054][T17378] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2912'. [ 357.875819][T17378] openvswitch: netlink: Flow actions attr not present in new flow. [ 357.887987][T17374] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2911'. [ 357.909689][T17262] team0: Port device team_slave_0 added [ 357.925739][T17262] team0: Port device team_slave_1 added [ 357.989968][T17262] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 358.029456][T17262] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.058166][T17262] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 358.085644][T17262] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 358.092918][T17262] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.120212][T17262] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 358.218183][ T12] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 358.239315][ T12] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 358.248374][ T10] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 358.278942][T17262] hsr_slave_0: entered promiscuous mode [ 358.294132][T17262] hsr_slave_1: entered promiscuous mode [ 358.311930][T17262] debugfs: 'hsr0' already exists in 'hsr' [ 358.321358][T17262] Cannot create hsr debugfs directory [ 358.552900][T17405] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2921'. [ 358.749991][T17418] pimreg: entered allmulticast mode [ 358.808156][T17414] batman_adv: batadv0: Interface deactivated: macsec1 [ 358.828077][T17414] batman_adv: batadv0: Removing interface: macsec1 [ 358.842232][T17414] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 358.888930][T17418] pimreg: left allmulticast mode [ 358.981984][T17427] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 359.012896][T17431] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 359.087523][ T10] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 359.239907][ T9] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 359.280487][T17262] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 359.335511][T17262] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 359.367225][T17262] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 359.389976][T17262] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 359.414687][T17447] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2931'. [ 359.431238][T17447] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2931'. [ 359.590688][T17444] wg1 speed is unknown, defaulting to 1000 [ 359.627035][T17262] 8021q: adding VLAN 0 to HW filter on device bond0 [ 359.635505][T17444] ip6_vti0 speed is unknown, defaulting to 1000 [ 359.646410][ T5850] Bluetooth: hci2: command tx timeout [ 359.668133][T17450] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2933'. [ 359.699551][T17262] 8021q: adding VLAN 0 to HW filter on device team0 [ 359.727733][ T4249] bridge0: port 1(bridge_slave_0) entered blocking state [ 359.734907][ T4249] bridge0: port 1(bridge_slave_0) entered forwarding state [ 359.765448][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 359.772658][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 360.554587][T17471] syzkaller0: entered promiscuous mode [ 360.560232][T17471] syzkaller0: entered allmulticast mode [ 360.671318][T17482] nbd: must specify a size in bytes for the device [ 361.726383][ T5850] Bluetooth: hci2: command tx timeout [ 362.438840][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 362.604706][T17262] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 362.690558][T17510] bond9 (unregistering): Released all slaves [ 362.803349][T17510] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2945'. [ 362.823047][T17520] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2946'. [ 362.841336][T17516] wg1 speed is unknown, defaulting to 1000 [ 362.876084][T17516] ip6_vti0 speed is unknown, defaulting to 1000 [ 362.935100][T17262] veth0_vlan: entered promiscuous mode [ 362.995474][T17526] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2949'. [ 363.007617][T17526] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2949'. [ 363.037642][T17262] veth1_vlan: entered promiscuous mode [ 363.065471][T17529] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 363.151840][T17262] veth0_macvtap: entered promiscuous mode [ 363.165069][T17262] veth1_macvtap: entered promiscuous mode [ 363.224635][T17262] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 363.257886][T17262] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 363.295368][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.305855][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.318815][T17533] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2951'. [ 363.328589][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.347742][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 363.509591][T17537] IPVS: set_ctl: invalid protocol: 135 172.20.20.170:20003 [ 363.517778][ T3070] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 363.528474][ T3070] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 363.552626][T17537] Cannot find del_set index 4 as target [ 363.606985][ T3070] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 363.615021][ T3070] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 363.796764][ T5850] Bluetooth: hci2: command tx timeout [ 363.842590][T17548] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2954'. [ 363.854629][T17548] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2954'. [ 364.136083][T17559] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2956'. [ 364.160028][T17559] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2956'. [ 364.186996][T17559] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2956'. [ 364.780851][T17576] wg1 speed is unknown, defaulting to 1000 [ 364.834234][T17576] ip6_vti0 speed is unknown, defaulting to 1000 [ 364.854973][T17582] tipc: Enabled bearer , priority 0 [ 364.862505][T17582] syzkaller0: entered promiscuous mode [ 364.868083][T17582] syzkaller0: entered allmulticast mode [ 364.927831][T17582] tipc: Resetting bearer [ 364.994811][T17593] netlink: 'syz.2.2968': attribute type 27 has an invalid length. [ 365.027808][T17582] tipc: Disabling bearer [ 365.274370][ T5834] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 365.285897][ T5834] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 365.296524][ T5834] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 365.305732][ T5834] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 365.313859][ T5834] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 365.338649][T17607] netlink: 'syz.3.2972': attribute type 1 has an invalid length. [ 365.450792][T17604] wg1 speed is unknown, defaulting to 1000 [ 365.481144][T17604] ip6_vti0 speed is unknown, defaulting to 1000 [ 366.176270][ T4249] bond0: (slave bond_slave_0): interface is now down [ 366.190055][ T4249] bond0: (slave bond_slave_1): interface is now down [ 366.219509][ T4249] bond0: now running without any active interface! [ 366.415852][T17646] 0{X: left allmulticast mode [ 366.459056][T17646] 8021q: adding VLAN 0 to HW filter on device team0 [ 366.478034][T17646] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 367.233385][T17677] netlink: 'syz.4.2991': attribute type 1 has an invalid length. [ 367.294815][T17677] 8021q: adding VLAN 0 to HW filter on device bond9 [ 367.385735][T17604] chnl_net:caif_netlink_parms(): no params data found [ 367.396672][ T5834] Bluetooth: hci0: command tx timeout [ 367.793497][T17708] tipc: Enabling of bearer rejected, failed to enable media [ 367.914497][T17723] __nla_validate_parse: 4 callbacks suppressed [ 367.914517][T17723] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2998'. [ 368.032549][T17604] bridge0: port 1(bridge_slave_0) entered blocking state [ 368.047335][T17604] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.072345][T17604] bridge_slave_0: entered allmulticast mode [ 368.088329][T17604] bridge_slave_0: entered promiscuous mode [ 368.130211][T17604] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.157948][T17604] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.165250][T17604] bridge_slave_1: entered allmulticast mode [ 368.186701][T17604] bridge_slave_1: entered promiscuous mode [ 368.380629][T17604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 368.427807][T17604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 368.504602][T17748] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3004'. [ 368.510250][T17604] team0: Port device team_slave_0 added [ 368.555993][T17604] team0: Port device team_slave_1 added [ 368.649982][T17604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 368.659304][T17604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 368.704110][T17604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 368.747521][T17604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 368.771247][T17604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 368.823625][T17604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 368.949379][T17765] warn_alloc: 1 callbacks suppressed [ 368.949395][T17765] syz.0.3009: vmalloc error: size 33558528, failed to allocated page array size 65544, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 368.974767][T17765] CPU: 0 UID: 0 PID: 17765 Comm: syz.0.3009 Not tainted syzkaller #0 PREEMPT(full) [ 368.974792][T17765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 368.974811][T17765] Call Trace: [ 368.974821][T17765] [ 368.974829][T17765] dump_stack_lvl+0x189/0x250 [ 368.974857][T17765] ? __pfx_dump_stack_lvl+0x10/0x10 [ 368.974876][T17765] ? __pfx__printk+0x10/0x10 [ 368.974899][T17765] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 368.974924][T17765] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 368.974951][T17765] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 368.974977][T17765] warn_alloc+0x214/0x310 [ 368.975005][T17765] ? __pfx_warn_alloc+0x10/0x10 [ 368.975035][T17765] ? __get_vm_area_node+0x28f/0x300 [ 368.975061][T17765] ? xskq_create+0xbf/0x170 [ 368.975085][T17765] __vmalloc_node_range_noprof+0x690/0x12d0 [ 368.975132][T17765] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 368.975154][T17765] ? __kasan_kmalloc+0x93/0xb0 [ 368.975181][T17765] vmalloc_user_noprof+0xad/0xf0 [ 368.975201][T17765] ? xskq_create+0xbf/0x170 [ 368.975220][T17765] xskq_create+0xbf/0x170 [ 368.975241][T17765] xsk_init_queue+0xb0/0x110 [ 368.975260][T17765] xsk_setsockopt+0x57b/0x8d0 [ 368.975280][T17765] ? __pfx_xsk_setsockopt+0x10/0x10 [ 368.975301][T17765] ? __pfx_aa_sk_perm+0x10/0x10 [ 368.975327][T17765] ? aa_sock_opt_perm+0xff/0x1a0 [ 368.975344][T17765] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 368.975364][T17765] ? __pfx_xsk_setsockopt+0x10/0x10 [ 368.975382][T17765] do_sock_setsockopt+0x17c/0x1b0 [ 368.975410][T17765] __x64_sys_setsockopt+0x13f/0x1b0 [ 368.975437][T17765] do_syscall_64+0xfa/0xf80 [ 368.975458][T17765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.975474][T17765] ? clear_bhb_loop+0x60/0xb0 [ 368.975494][T17765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.975510][T17765] RIP: 0033:0x7f4c8dd8f749 [ 368.975526][T17765] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 368.975541][T17765] RSP: 002b:00007f4c8ec33038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 368.975560][T17765] RAX: ffffffffffffffda RBX: 00007f4c8dfe5fa0 RCX: 00007f4c8dd8f749 [ 368.975572][T17765] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000005 [ 368.975582][T17765] RBP: 00007f4c8de13f91 R08: 0000000000000004 R09: 0000000000000000 [ 368.975593][T17765] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000 [ 368.975602][T17765] R13: 00007f4c8dfe6038 R14: 00007f4c8dfe5fa0 R15: 00007ffe7dd56d88 [ 368.975633][T17765] [ 368.975650][T17765] Mem-Info: [ 369.048768][T17785] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3010'. [ 369.053780][T17765] active_anon:3865 inactive_anon:0 isolated_anon:0 [ 369.053780][T17765] active_file:3333 inactive_file:40004 isolated_file:0 [ 369.053780][T17765] unevictable:768 dirty:82 writeback:0 [ 369.053780][T17765] slab_reclaimable:12864 slab_unreclaimable:140064 [ 369.053780][T17765] mapped:29005 shmem:1358 pagetables:1051 [ 369.053780][T17765] sec_pagetables:0 bounce:0 [ 369.053780][T17765] kernel_misc_reclaimable:0 [ 369.053780][T17765] free:1283872 free_pcp:15669 free_cma:0 [ 369.078198][T17604] hsr_slave_0: entered promiscuous mode [ 369.079300][T17604] hsr_slave_1: entered promiscuous mode [ 369.096833][T17765] Node 0 active_anon:15460kB inactive_anon:0kB active_file:13332kB inactive_file:159816kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116020kB dirty:324kB writeback:0kB shmem:3896kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14232kB pagetables:3972kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 369.096885][T17765] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 369.096936][T17765] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 369.096990][T17765] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 369.097028][T17765] Node 0 DMA32 free:1226536kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:15460kB inactive_anon:0kB active_file:13332kB inactive_file:159816kB unevictable:1536kB writepending:324kB zspages:0kB present:3129332kB managed:2564516kB mlocked:0kB bounce:0kB free_pcp:47072kB local_pcp:19852kB free_cma:0kB [ 369.097079][T17765] lowmem_reserve[]: 0 0 0 0 0 [ 369.097115][T17765] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 369.097164][T17765] lowmem_reserve[]: 0 0 0 0 0 [ 369.097202][T17765] Node 1 Normal free:3893340kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:15616kB local_pcp:10144kB free_cma:0kB [ 369.109075][T17604] debugfs: 'hsr0' already exists in 'hsr' [ 369.112809][T17765] lowmem_reserve[]: [ 369.126349][T17604] Cannot create hsr debugfs directory [ 369.128710][T17765] 0 [ 369.404613][T17789] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3010'. [ 369.466273][T17765] 0 [ 369.484244][ T5834] Bluetooth: hci0: command tx timeout [ 369.509127][T17765] 0 [ 369.541245][T17774] syzkaller0: entered promiscuous mode [ 369.550886][T17774] syzkaller0: entered allmulticast mode [ 369.592051][T17765] 0 0 [ 369.615379][T17765] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 369.635080][T17765] Node 0 DMA32: 1056*4kB (ME) 145*8kB (UME) 200*16kB (UM) 142*32kB (UM) 599*64kB (UM) 182*128kB (UM) 127*256kB (UME) 74*512kB (UM) 28*1024kB (UM) 4*2048kB (UM) 255*4096kB (UM) = 1226504kB [ 369.655299][T17765] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 369.667901][T17765] Node 1 Normal: 219*4kB (UME) 62*8kB (UME) 40*16kB (UME) 166*32kB (UME) 59*64kB (UME) 8*128kB (UME) 3*256kB (UM) 3*512kB (UM) 2*1024kB (ME) 1*2048kB (E) 946*4096kB (M) = 3893340kB [ 369.686617][T17765] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 369.697839][T17765] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 369.707827][T17765] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 369.722134][T17765] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 369.804174][T17765] 44692 total pagecache pages [ 369.813160][T17765] 0 pages in swap cache [ 369.817845][T17765] Free swap = 124996kB [ 369.822448][T17765] Total swap = 124996kB [ 369.826942][T17765] 2097051 pages RAM [ 369.830848][T17765] 0 pages HighMem/MovableOnly [ 369.835753][T17765] 424280 pages reserved [ 369.840489][T17765] 0 pages cma reserved [ 369.853267][T17802] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 369.895352][T17604] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 369.927450][T17806] netem: change failed [ 369.978127][T17604] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 369.991643][T17814] IPVS: set_ctl: invalid protocol: 10786 35.245.172.1:0 [ 370.004419][T17811] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3018'. [ 370.070701][T17604] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 370.174630][T17604] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 370.278702][T17837] netlink: 'syz.2.3025': attribute type 1 has an invalid length. [ 370.355066][T17837] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3025'. [ 370.365902][T17837] netlink: 'syz.2.3025': attribute type 1 has an invalid length. [ 370.507174][T17852] netlink: 'syz.3.3029': attribute type 1 has an invalid length. [ 370.542639][T17852] 8021q: adding VLAN 0 to HW filter on device bond1 [ 370.633678][T17852] 8021q: adding VLAN 0 to HW filter on device bond1 [ 370.648530][T17852] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 370.660331][T17852] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 370.788808][T17858] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode [ 370.832581][T17858] bond1: (slave wlan0): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 370.872740][T17604] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 370.893585][T17604] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 370.916625][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 370.952453][T17604] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 370.980810][T17604] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 371.281143][T17604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.322713][T17604] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.348948][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.356132][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.418531][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.425824][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.556719][ T5834] Bluetooth: hci0: command tx timeout [ 371.741324][T17604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 371.795868][T17903] xfrm1: entered allmulticast mode [ 371.854815][T17604] veth0_vlan: entered promiscuous mode [ 371.863671][T17907] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3043'. [ 371.880181][T17604] veth1_vlan: entered promiscuous mode [ 371.936242][T17907] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3043'. [ 371.943068][T17604] veth0_macvtap: entered promiscuous mode [ 371.962315][T17604] veth1_macvtap: entered promiscuous mode [ 371.992655][T17910] netlink: zone id is out of range [ 372.018652][T17910] netlink: zone id is out of range [ 372.027036][T17604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 372.044896][T17910] netlink: zone id is out of range [ 372.062563][T17910] netlink: zone id is out of range [ 372.080322][T17604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 372.103120][T17910] netlink: zone id is out of range [ 372.117113][T17910] netlink: zone id is out of range [ 372.124399][ T62] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.126492][T17910] netlink: zone id is out of range [ 372.138637][T17910] netlink: zone id is out of range [ 372.143764][T17910] netlink: zone id is out of range [ 372.154919][ T62] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.175465][ T62] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.198029][ T62] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 372.267553][T17924] xt_TPROXY: Can be used only with -p tcp or -p udp [ 372.339413][T17926] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3050'. [ 372.371314][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.380789][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.431785][ T3506] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.469324][ T3506] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 372.513773][T17935] wg1 speed is unknown, defaulting to 1000 [ 372.522458][T17935] ip6_vti0 speed is unknown, defaulting to 1000 [ 373.636391][ T5845] Bluetooth: hci0: command tx timeout [ 373.654525][ T5850] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 373.666585][ T5850] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 373.674845][ T5850] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 373.691314][T17970] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3060'. [ 373.691332][ T5850] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 373.708947][ T5850] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 373.853279][T17972] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 373.883694][T17972] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 373.927101][T17972] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 42830 - 0 [ 373.969192][T17968] wg1 speed is unknown, defaulting to 1000 [ 373.984614][T17968] ip6_vti0 speed is unknown, defaulting to 1000 [ 374.033778][T17972] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.046018][T17972] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 374.059859][T17972] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 42830 - 0 [ 374.263647][T17972] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.323708][T17972] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 374.370112][T17972] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 42830 - 0 [ 374.563576][T17972] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.582949][T17972] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 374.598321][T17972] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 42830 - 0 [ 374.664046][T17982] wg1 speed is unknown, defaulting to 1000 [ 374.723506][T17994] gretap1: entered promiscuous mode [ 374.763666][T17982] ip6_vti0 speed is unknown, defaulting to 1000 [ 374.801938][ T36] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.836278][ T36] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 42830 - 0 [ 374.844577][ T36] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 374.894458][ T36] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.906577][ T36] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 42830 - 0 [ 374.925292][ T36] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 374.986912][ T5099] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.995117][ T5099] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 42830 - 0 [ 375.043448][ T5099] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 375.106340][ T1114] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 375.114559][ T1114] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 42830 - 0 [ 375.138046][ T1114] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 375.454021][T18009] wg1 speed is unknown, defaulting to 1000 [ 375.485493][T18009] ip6_vti0 speed is unknown, defaulting to 1000 [ 375.532686][T17968] chnl_net:caif_netlink_parms(): no params data found [ 375.544556][T18025] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3072'. [ 375.722497][T18023] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.796598][ T5834] Bluetooth: hci5: command tx timeout [ 375.804845][ T30] audit: type=1800 audit(1765238969.661:4): pid=18032 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3074" name="blkio.bfq.time_recursive" dev="tmpfs" ino=3120 res=0 errno=0 [ 375.892250][T18023] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.931542][T18036] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 375.988260][T17968] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.995841][T17968] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.008762][T17968] bridge_slave_0: entered allmulticast mode [ 376.016805][T17968] bridge_slave_0: entered promiscuous mode [ 376.074604][T18023] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.080117][T18042] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3077'. [ 376.103885][T17968] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.111528][T17968] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.119496][T17968] bridge_slave_1: entered allmulticast mode [ 376.129958][T17968] bridge_slave_1: entered promiscuous mode [ 376.214851][T18023] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.296474][T17968] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.327426][T18042] wg1 speed is unknown, defaulting to 1000 [ 376.334316][T17968] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 376.363847][T18042] ip6_vti0 speed is unknown, defaulting to 1000 [ 376.528368][T17968] team0: Port device team_slave_0 added [ 376.553713][ T62] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 376.566901][T17968] team0: Port device team_slave_1 added [ 376.592574][ T62] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 376.644632][ T62] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 376.654290][T17968] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 376.662430][T18046] netlink: 'syz.0.3077': attribute type 6 has an invalid length. [ 376.670618][T17968] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.699944][T17968] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 376.717117][T17968] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 376.726285][T17968] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 376.752565][T17968] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 376.872427][ T62] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.010918][T17968] hsr_slave_0: entered promiscuous mode [ 377.037752][T17968] hsr_slave_1: entered promiscuous mode [ 377.044164][T17968] debugfs: 'hsr0' already exists in 'hsr' [ 377.064283][T17968] Cannot create hsr debugfs directory [ 377.876743][ T5834] Bluetooth: hci5: command tx timeout [ 377.959570][ T5834] Bluetooth: hci0: command 0x0c1a tx timeout [ 378.282040][T17968] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 378.330938][T17968] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 378.348563][T17968] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 378.362042][T17968] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 378.608892][T17968] 8021q: adding VLAN 0 to HW filter on device bond0 [ 378.646137][T17968] 8021q: adding VLAN 0 to HW filter on device team0 [ 378.662379][ T4249] bridge0: port 1(bridge_slave_0) entered blocking state [ 378.669555][ T4249] bridge0: port 1(bridge_slave_0) entered forwarding state [ 378.738209][ T4249] bridge0: port 2(bridge_slave_1) entered blocking state [ 378.745367][ T4249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.814407][T18092] netlink: 'syz.3.3087': attribute type 30 has an invalid length. [ 378.840830][T18091] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3089'. [ 379.204623][T17968] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 379.224630][T18111] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3093'. [ 379.342654][T18110] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3092'. [ 379.360249][T18117] netlink: 'syz.2.3094': attribute type 83 has an invalid length. [ 379.551524][T18124] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3095'. [ 379.615782][T18127] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3094'. [ 379.628888][T18124] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3095'. [ 379.646409][T18124] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3095'. [ 379.665788][T18124] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3095'. [ 379.945422][T17968] veth0_vlan: entered promiscuous mode [ 379.958847][ T5834] Bluetooth: hci5: command tx timeout [ 379.971375][T17968] veth1_vlan: entered promiscuous mode [ 380.047888][T17968] veth0_macvtap: entered promiscuous mode [ 380.075256][T17968] veth1_macvtap: entered promiscuous mode [ 380.140520][T17968] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 380.165135][T17968] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 380.185783][ T6031] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.230015][ T6031] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.252458][ T6031] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.280612][ T6031] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.350071][T18150] pim6reg1: entered promiscuous mode [ 380.359522][T18150] pim6reg1: entered allmulticast mode [ 380.378337][T18147] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3102'. [ 380.463270][T18147] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3102'. [ 380.507273][ T6031] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.548412][ T6031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 380.628411][T18159] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 380.645677][ T1114] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 380.678309][ T1114] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.658358][ T5850] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 381.679358][ T5850] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 381.697059][ T5850] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 381.705076][ T5850] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 381.726643][T18187] team0 (unregistering): Port device team_slave_0 removed [ 381.729884][ T5850] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 381.741923][T18187] team0 (unregistering): Port device team_slave_1 removed [ 381.947585][T18209] wg1 speed is unknown, defaulting to 1000 [ 381.957377][T18209] ip6_vti0 speed is unknown, defaulting to 1000 [ 381.981464][T18221] tipc: Enabled bearer , priority 0 [ 381.989203][T18221] syzkaller0: entered promiscuous mode [ 381.994774][T18221] syzkaller0: entered allmulticast mode [ 382.046878][ T5850] Bluetooth: hci5: command tx timeout [ 382.051804][T18223] 8021q: adding VLAN 0 to HW filter on device bond1 [ 382.157202][T18221] tipc: Resetting bearer [ 382.195219][T18220] tipc: Resetting bearer [ 382.258418][T18220] tipc: Disabling bearer [ 382.430561][T18249] wg1 speed is unknown, defaulting to 1000 [ 382.443191][T18256] bridge_slave_1: left allmulticast mode [ 382.456365][T18256] bridge_slave_1: left promiscuous mode [ 382.462243][T18256] bridge0: port 2(bridge_slave_1) entered disabled state [ 382.591795][T18249] ip6_vti0 speed is unknown, defaulting to 1000 [ 382.826764][T18272] netlink: 'syz.3.3136': attribute type 11 has an invalid length. [ 383.147137][T18280] wg1 speed is unknown, defaulting to 1000 [ 383.239492][T18280] ip6_vti0 speed is unknown, defaulting to 1000 [ 383.542878][T18289] wg1 speed is unknown, defaulting to 1000 [ 383.594358][T18209] chnl_net:caif_netlink_parms(): no params data found [ 383.749166][T18307] netlink: 'syz.3.3142': attribute type 2 has an invalid length. [ 383.796754][ T5850] Bluetooth: hci1: command tx timeout [ 383.874322][T18307] 9: entered promiscuous mode [ 383.910014][T18289] ip6_vti0 speed is unknown, defaulting to 1000 [ 384.491120][ T4249] bond0 (unregistering): Released all slaves [ 385.083766][ T5834] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 385.096994][ T5834] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 385.107884][ T5834] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 385.116790][ T5834] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 385.124571][ T5834] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 385.369066][ T5850] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 385.386676][ T5850] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 385.395262][ T5850] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 385.404883][ T5850] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 385.413593][ T5850] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 385.562560][T18332] wg1 speed is unknown, defaulting to 1000 [ 385.665721][T18342] __nla_validate_parse: 4 callbacks suppressed [ 385.665739][T18342] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3152'. [ 385.672228][T18332] ip6_vti0 speed is unknown, defaulting to 1000 [ 386.077148][T18339] wg1 speed is unknown, defaulting to 1000 [ 386.085065][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3154'. [ 386.217367][T18351] netlink: 'syz.3.3154': attribute type 33 has an invalid length. [ 386.225233][T18351] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3154'. [ 386.243309][T18354] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3155'. [ 386.254811][T18354] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3155'. [ 386.292346][T18351] syzkaller0: entered promiscuous mode [ 386.301493][T18351] syzkaller0: entered allmulticast mode [ 386.328958][T18339] ip6_vti0 speed is unknown, defaulting to 1000 [ 386.889950][T18358] wg1 speed is unknown, defaulting to 1000 [ 386.904703][T18367] x_tables: duplicate underflow at hook 1 [ 386.908009][T18358] ip6_vti0 speed is unknown, defaulting to 1000 [ 386.934446][T18367] No such timeout policy "syz1" [ 386.987748][T18367] netlink: 216 bytes leftover after parsing attributes in process `syz.3.3161'. [ 386.997396][T18367] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3161'. [ 387.007133][T18367] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3161'. [ 387.246979][ T5850] Bluetooth: hci1: command tx timeout [ 387.298955][T18371] pim6reg1: entered promiscuous mode [ 387.304523][T18371] pim6reg1: entered allmulticast mode [ 387.482131][ T5850] Bluetooth: hci3: command tx timeout [ 387.556441][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 387.673608][T18379] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input6 [ 387.793366][T18377] wg1 speed is unknown, defaulting to 1000 [ 387.829783][T18332] chnl_net:caif_netlink_parms(): no params data found [ 387.843091][T18377] ip6_vti0 speed is unknown, defaulting to 1000 [ 388.205923][T18332] bridge0: port 1(bridge_slave_0) entered blocking state [ 388.219217][T18332] bridge0: port 1(bridge_slave_0) entered disabled state [ 388.254347][T18332] bridge_slave_0: entered allmulticast mode [ 388.266566][T18332] bridge_slave_0: entered promiscuous mode [ 388.366008][T18332] bridge0: port 2(bridge_slave_1) entered blocking state [ 388.373971][T18332] bridge0: port 2(bridge_slave_1) entered disabled state [ 388.386574][T18332] bridge_slave_1: entered allmulticast mode [ 388.395868][T18332] bridge_slave_1: entered promiscuous mode [ 388.696334][T18339] chnl_net:caif_netlink_parms(): no params data found Connection to 10.128.0.231 closed by remote host. [ 388.751134][T18332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 389.318134][ T5850] Bluetooth: hci1: command tx timeout [ 389.557541][ T5850] Bluetooth: hci3: command tx timeout [ 389.651215][T18339] [ 389.653578][T18339] ====================================================== [ 389.660600][T18339] WARNING: possible circular locking dependency detected [ 389.667627][T18339] syzkaller #0 Not tainted [ 389.672038][T18339] ------------------------------------------------------ [ 389.679055][T18339] syz-executor/18339 is trying to acquire lock: [ 389.685293][T18339] ffff8880672fb840 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}, at: __flush_work+0xd2/0xbc0 [ 389.696769][T18339] [ 389.696769][T18339] but task is already holding lock: [ 389.704117][T18339] ffff8880672fbb38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 389.712982][T18339] [ 389.712982][T18339] which lock already depends on the new lock. [ 389.712982][T18339] [ 389.723374][T18339] [ 389.723374][T18339] the existing dependency chain (in reverse order) is: [ 389.732377][T18339] [ 389.732377][T18339] -> #1 (&conn->lock#2){+.+.}-{4:4}: [ 389.739853][T18339] __mutex_lock+0x187/0x1350 [ 389.744976][T18339] l2cap_info_timeout+0x60/0xa0 [ 389.750608][T18339] process_scheduled_works+0xad1/0x1770 [ 389.756675][T18339] worker_thread+0x8a0/0xda0 [ 389.761773][T18339] kthread+0x711/0x8a0 [ 389.766351][T18339] ret_from_fork+0x599/0xb30 [ 389.771459][T18339] ret_from_fork_asm+0x1a/0x30 [ 389.776748][T18339] [ 389.776748][T18339] -> #0 ((work_completion)(&(&conn->info_timer)->work)){+.+.}-{0:0}: [ 389.786984][T18339] __lock_acquire+0x15a6/0x2cf0 [ 389.792346][T18339] lock_acquire+0x117/0x340 [ 389.797355][T18339] __flush_work+0x6b8/0xbc0 [ 389.802425][T18339] __cancel_work_sync+0xbe/0x110 [ 389.807878][T18339] l2cap_conn_del+0x4f3/0x680 [ 389.813063][T18339] hci_conn_hash_flush+0x10d/0x230 [ 389.818699][T18339] hci_dev_close_sync+0x821/0xff0 [ 389.824251][T18339] hci_unregister_dev+0x21a/0x510 [ 389.829799][T18339] vhci_release+0x152/0x1a0 [ 389.834831][T18339] __fput+0x44c/0xa70 [ 389.839330][T18339] task_work_run+0x1d4/0x260 [ 389.844447][T18339] do_exit+0x6c5/0x2310 [ 389.849213][T18339] do_group_exit+0x21c/0x2d0 [ 389.854317][T18339] get_signal+0x1285/0x1340 [ 389.859449][T18339] arch_do_signal_or_restart+0x9a/0x7a0 [ 389.865528][T18339] exit_to_user_mode_loop+0x87/0x4f0 [ 389.871425][T18339] do_syscall_64+0x2e3/0xf80 [ 389.876540][T18339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.882956][T18339] [ 389.882956][T18339] other info that might help us debug this: [ 389.882956][T18339] [ 389.893170][T18339] Possible unsafe locking scenario: [ 389.893170][T18339] [ 389.900606][T18339] CPU0 CPU1 [ 389.905955][T18339] ---- ---- [ 389.911300][T18339] lock(&conn->lock#2); [ 389.915534][T18339] lock((work_completion)(&(&conn->info_timer)->work)); [ 389.925071][T18339] lock(&conn->lock#2); [ 389.931838][T18339] lock((work_completion)(&(&conn->info_timer)->work)); [ 389.938862][T18339] [ 389.938862][T18339] *** DEADLOCK *** [ 389.938862][T18339] [ 389.947003][T18339] 5 locks held by syz-executor/18339: [ 389.952359][T18339] #0: ffff888059bb8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 389.962269][T18339] #1: ffff888059bb80c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0xff0 [ 389.971827][T18339] #2: ffffffff8f467308 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 389.981832][T18339] #3: ffff8880672fbb38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 389.991255][T18339] #4: ffffffff8df41cc0 (rcu_read_lock){....}-{1:3}, at: __flush_work+0xd2/0xbc0 [ 390.000393][T18339] [ 390.000393][T18339] stack backtrace: [ 390.006285][T18339] CPU: 1 UID: 0 PID: 18339 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 390.006308][T18339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 390.006318][T18339] Call Trace: [ 390.006327][T18339] [ 390.006335][T18339] dump_stack_lvl+0x189/0x250 [ 390.006356][T18339] ? __pfx_dump_stack_lvl+0x10/0x10 [ 390.006370][T18339] ? __pfx__printk+0x10/0x10 [ 390.006392][T18339] ? print_lock_name+0xde/0x100 [ 390.006413][T18339] print_circular_bug+0x2e2/0x300 [ 390.006439][T18339] check_noncircular+0x12e/0x150 [ 390.006461][T18339] __lock_acquire+0x15a6/0x2cf0 [ 390.006479][T18339] ? do_raw_spin_unlock+0x122/0x240 [ 390.006500][T18339] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 390.006519][T18339] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 390.006546][T18339] ? __flush_work+0xd2/0xbc0 [ 390.006561][T18339] lock_acquire+0x117/0x340 [ 390.006573][T18339] ? __flush_work+0xd2/0xbc0 [ 390.006587][T18339] ? _raw_spin_unlock_irq+0x23/0x50 [ 390.006601][T18339] ? __flush_work+0xd2/0xbc0 [ 390.006613][T18339] __flush_work+0x6b8/0xbc0 [ 390.006626][T18339] ? __flush_work+0xd2/0xbc0 [ 390.006639][T18339] ? __flush_work+0xd2/0xbc0 [ 390.006652][T18339] ? __pfx___flush_work+0x10/0x10 [ 390.006665][T18339] ? __pfx_wq_barrier_func+0x10/0x10 [ 390.006688][T18339] ? __pfx___cancel_work+0x10/0x10 [ 390.006701][T18339] ? hci_conn_drop+0x153/0x280 [ 390.006717][T18339] ? __cancel_work_sync+0x5c/0x110 [ 390.006731][T18339] __cancel_work_sync+0xbe/0x110 [ 390.006745][T18339] l2cap_conn_del+0x4f3/0x680 [ 390.006761][T18339] ? __pfx_l2cap_disconn_cfm+0x10/0x10 [ 390.006775][T18339] hci_conn_hash_flush+0x10d/0x230 [ 390.006792][T18339] hci_dev_close_sync+0x821/0xff0 [ 390.006808][T18339] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 390.006819][T18339] ? up_write+0x1ac/0x410 [ 390.006834][T18339] ? rcu_is_watching+0x15/0xb0 [ 390.006850][T18339] hci_unregister_dev+0x21a/0x510 [ 390.006868][T18339] vhci_release+0x152/0x1a0 [ 390.006884][T18339] ? __pfx_vhci_release+0x10/0x10 [ 390.006898][T18339] __fput+0x44c/0xa70 [ 390.006915][T18339] task_work_run+0x1d4/0x260 [ 390.006931][T18339] ? __pfx_task_work_run+0x10/0x10 [ 390.006946][T18339] ? kmem_cache_free+0x197/0x620 [ 390.006962][T18339] ? do_exit+0x6c0/0x2310 [ 390.006977][T18339] do_exit+0x6c5/0x2310 [ 390.006993][T18339] ? do_raw_spin_lock+0x121/0x290 [ 390.007008][T18339] ? __pfx_do_exit+0x10/0x10 [ 390.007021][T18339] ? netlink_sendmsg+0x840/0xb30 [ 390.007039][T18339] do_group_exit+0x21c/0x2d0 [ 390.007054][T18339] ? lockdep_hardirqs_on+0x98/0x140 [ 390.007070][T18339] get_signal+0x1285/0x1340 [ 390.007094][T18339] arch_do_signal_or_restart+0x9a/0x7a0 [ 390.007112][T18339] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 390.007132][T18339] ? exit_to_user_mode_loop+0x55/0x4f0 [ 390.007145][T18339] exit_to_user_mode_loop+0x87/0x4f0 [ 390.007156][T18339] ? rcu_is_watching+0x15/0xb0 [ 390.007171][T18339] do_syscall_64+0x2e3/0xf80 [ 390.007187][T18339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.007200][T18339] ? clear_bhb_loop+0x60/0xb0 [ 390.007213][T18339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.007226][T18339] RIP: 0033:0x7f527ed915dc [ 390.007237][T18339] Code: Unable to access opcode bytes at 0x7f527ed915b2. [ 390.007244][T18339] RSP: 002b:00007fff44a59100 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 390.007258][T18339] RAX: 0000000000000038 RBX: 00007f527fb14620 RCX: 00007f527ed915dc [ 390.007267][T18339] RDX: 0000000000000038 RSI: 00007f527fb14670 RDI: 0000000000000003 [ 390.007275][T18339] RBP: 0000000000000000 R08: 00007fff44a59154 R09: 000000000000000c [ 390.007283][T18339] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 390.007291][T18339] R13: 0000000000000000 R14: 00007f527fb14670 R15: 0000000000000000 [ 390.007304][T18339] [ 391.397562][ T5850] Bluetooth: hci1: command tx timeout