last executing test programs: 4.253300166s ago: executing program 0 (id=3801): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x9, 0xb, 0xfffffffffffffffe, 0x2b1, 0x202000000002e0], 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000060000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff00000000"]}, 0x108) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000180)={'filter\x00', 0x7, 0x4, 0x418, 0x330, 0x110, 0x220, 0x330, 0x330, 0x330, 0x4, &(0x7f0000000140), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @loopback, @rand_addr=0x64010100, 0x8, 0x1}}}, {{@arp={@multicast1, @local, 0xff, 0x0, 0xf, 0x4, {@empty, {[0x0, 0x0, 0x0, 0x0, 0xff, 0xff]}}, {@mac=@multicast, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}}, 0x8, 0x7, 0x4, 0xb, 0x0, 0x3, 'syz_tun\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x0, 0x8}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x468) 4.077640801s ago: executing program 2 (id=3803): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newlink={0x2c, 0x10, 0x801, 0x70bd2d, 0x25dfdbff, {}, [@IFLA_GROUP={0x8}, @IFLA_VF_PORTS={0x4}]}, 0x2c}}, 0x0) recvfrom(r0, &(0x7f0000000180)=""/143, 0x8f, 0x10002, &(0x7f00000002c0)=@ll={0x11, 0xd, 0x0, 0x1, 0x1c, 0x6, @link_local}, 0x80) 4.076902537s ago: executing program 0 (id=3804): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0xa, 0x3032, 0xffffffffffffffff, 0xe08b8000) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={0x2, 0xf, 0x0, 0x0, 0x2}, 0x10}}, 0x44000) write$nci(r0, &(0x7f0000000940)=ANY=[@ANYBLOB="510601"], 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r7, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r7, 0x40305829, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x20b7ee}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x13, r6, 0x7ca8e000) writev(r7, &(0x7f0000000080)=[{0x0}], 0x1) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r8], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r10, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 3.877087961s ago: executing program 2 (id=3808): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x12) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000000c0), 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r1], 0x448}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000000808"], 0x80}}, 0x0) sendmmsg$inet(r1, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}, {{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000000340)="83ae11083890a042cfb5f741189432bb0e41eb6db3df0bd2f8c4785edecfddf1aa487d1d9cd39ecaedf637148af83ef5184031a08e034bdbaec522577b9c230c52c8542142e31522166a938dbcab8cf5b216c212559a185a3d958a67a3c5b5ea78ef6f088c7607d12cbdb13bae58f2474fad8d88de464300e20f3b51ac2c1eeeae8bf2dcbc80e3d0674c8b4eb4e0ab6330af6cb19afcc562e93c24ceec2d455024d3ba064a8d5f597033c9b45d0703b9934ba5444c7574d41c37cb4d429a9d58f58fbccc21378cea81341b76b4f36ea59eed069741a301047a1d8332b9fa8656d1696ec210b3b2e33300d3a2f34489aeef8295d7fef77554300f", 0xfa}, {&(0x7f0000000480)="7ada72a1ef3bd50768ad39ee60d2abd182a677eb950a521351168f202f0760d65bcc5a48cbd9605533d1b58f892bf4dc9cb751ff20fa30d1166a", 0x3a}, {&(0x7f00000004c0)="5d858c73ec9915165a6faa0153eddedc384012d95120dd1523d532ca9d55ca8d2aa06d14e3b3b739d5e8e8ee69ccfef2c33ab5c7ddab976e5d5908d4dac03ac3ea13826dee6d4676b8df4c49d8d2f5694e1dec63ec1223bc696598ed50d4052fe2464036244f9d071240291e70464d77ad52d965db8abd87477b1e61404e27c703393053f680c56fd68eb3c72e43c9835bbf2ef03bb89664baec0d4f160a3d374e5c1ea7f736aa47bb6d88a92fb61a29d8af9cc97a50caab2f27fadb143dac5ac87695605a89ee8bec8a25f8d1606e90ddbfb0815d9e9e12127781dcb88c", 0xde}, {&(0x7f00000005c0)}, {&(0x7f0000000600)="ba06e95ccbd2eeda355b78080d303ad1c96afdceb303a853e32366c0b8e3ee921d99cb48772e2d6eec2d6e6bac16f3535d04b789e320ecf58c19bae20c8c59d4d4d4cfef1e5b66d20d6d0ac1ce43359fcff1f5a3a789c7f4c062907751a10a93b888f3158cf92ca79fc8b772d7750bc16207ae781747e39824869718c0cab90f703fda78deac48ad0f673f98bd9ff2cd2cd6655f1a67da4278addcd7df50178f4f53792d90d4f225336d0bd902b1", 0xae}, {&(0x7f0000000880)="462e53f8b5d4f6c7115205d508eb4cdfea448940766df1207d57c886033dca0a27e616f955694e0c18f33ff7c5dce11a9f2484b179b459348470760f267e981aedd493d039ff9acdee9839de205a4ed9522e5ade33af0ec63ac1e1a3bd1b0b5458f3f0f30d76f0dfaf79fc3bc72ac0289ad46b91c3b65b3616243a62ab2878400c1c61207525a3c21c3cb2e7e790cec5fff4f35fea889a2f7a798c8edd0eff4cbf6ada4132ac7c622d9c1221a59e01fa18bdce03fcbc99a950ebbc6c2e3ec1e4b8a9ee455e10975a8fa714f764e9f85a781d09e8c24837860363d058d3a30b304d54fe4d1076e603d9f469392ab3d581e3103b470255440e77a09f129417f53ae7c2d78699a8cde66e30f6ec851e8190e1bde63345feadc9bd7aa023c16bd85e03a7adeed864bdc525ac390fc73a6119a82ff9562373da945a8fa091d12ab76cd7276cffd0dbf5a85c4c73b03f797519df5dab2183002edd9672f4f80c1096066fb7e947ec83c5180372103ec2641342fea0ae5d7cb7a5a6fad852abd890a511f24503938c9eca98e371ecb1f80c82012e9809eb456ef70431ac19729768ee6d6412066be0c74126f5a782b42b8cc805361c36ac300ce2d7db36aa425c77676cf7e770d1ac50a0bd1010a49f5ac05c5baf01201d73cdfcc4c9fa542aeab747fd12010129d4b7d45040e66f5cb1a778e0ff3d7359b3e384530e9bc3ad6eca83c77686b7c40ff616a69feef1411c28d07e2efc4fd0b24048959ee0086cf84681883e5ad42d16dd233361d63b6addd1db17397b85593786732404be6ad9019466387f0749613165ec8770316ef0a9607a0be504b741f2f60e63b4354e24436214bb47325660f67ac83f309c47fce459ef804bf8f75fb5dea4426fccf8137b8c6f3a28159a04c7cbc4bd9939d01788baaa443676f77c47e5d34f095a80132f902670d6c26842eadf3be69c6b8b3acde541409bbff03a1aee8d7ce7d74a40d036e121f8260f432320ec9150d872716d1d9f0240637833880786b7e14a734fc7d201697811219642168f19017be23bbbb87d46f20560ecb26ee74ecacd754d6ab1f4374ad97fa5063046b2f020bc694b70c49b844589b381a89f66925b5a207fde0c89281c42ade1499bd83cb3d86d56f0a1f9a6474397754e632796312e0e0ee801296c37c996d01d8a4c196ef7958cd6154949bb4e4bb776746328104303089f9a62cebd8a51eabfdc7c93aa22d343c4f3f6782e669b5fa34486bad0bf0868bcb8f227f8e7d0c373a3c9efa9dbbf4ddda61769226cbd78a15f1e4d3acaa2414026816ba276c7583d8e309c7d0abf8da4aa06cd81e4ec4318bdd1589064974a63ecb1f78406ddbee00791eef7150ca4e379e0c2a7838cfac8c7e66aa3844a02122e914744f604d253a06a28cefc6b5c49d4300182fc66043a1bc1c61aee79a3a926e158f97041b3f495dcf54d82a0da33b62a548186afb2e80722e89a6319e0b3dcbb82f51736032265b07737fbb5e1dc3abc8b4839b57add0e64d290ddc3249deeb3faa771174f4a9fa30d068ee0b686c80066df917d79547198e7dc1b665f0f9d8ccf00805e41cd1d13511a51602bd91ec85e1d8e3d9132557b5d9c171a1ac44c32514d5b7c7882d7a55cf63b9cda43d3f16eac521e573797a7875a82dc54b316251eb3839e226429d04fbb2a7402bc4c0c8623e369bd67a04266eaa24d22a160f23923e2da670c58ed6d9f8d48f03ae438aaefe4bbbb6222765ee60a9199131ea2f55cac4b57be86601f3bba0c05ac5764083fc13eeaa6a3a9c4a8e12bfc82b9aaf26ac5e7463f21b72c5154bc5fe5eac1a049348b3041707cb3408d52d7bb54af5063c4a9cf9e7a58fa5b0cd0367fb51c1efb299f3d8ad947faea86c387e245b2cdacde7ccc0af70fe0b5cc997ca2e3e1b85b942386369969718253f891aabe13dae68598adc00762b9a44666d623ab22d159b40206e134af6fac3ad13e376346e5a1cb6f872c0a912e35096d0bbbbef37a94e4d1cadbaa6ed78b044984db6d3f293742233be183b1157fef0eb36afc5fe16dfe3b1496c751e093be33139d1e1ac91174ce289ae434ed88bee5121598d8209fbe417dab9213be2da8f505a92d0b3091c0a82f5f2c121f39a6576e3f2b87c4611a24ecb7ddd39aeaddfb4d2b2ec3077f07197c78d73f26ce686ed0a689872cd65609ff0311794890e89f204c96e246a627f26b37d35e74c94d3136509b1757d4f0bf729685e4fb7ea60ee36511fc6115fffcf3ddf40115f656e30d5b134635ca13e3b6e7cbbd2acf2e6f43a2833cda299d48181c128fb6f3232d2b48d4129461953881b5e2effd1dbd2619b2de2e17e88fb7246c91abe76b611bad78f4ee8e1e57464d9591dd220cf82e0afa6eb99bebac331c6a7fb774656bbbd04cdcd41fbbb4bc78ad7a6b8e31e54e1e51f6cc5f61cb400831aa196b32f4ea0d31657d38584e06007d1641d004a3d9aa5f48e9257b1b37c45451ef09f9c98239d89a9bb883af18dfc606b46da116fb0b85654a3b48ff3c8815872d8fc55fdfb79938b5e6ebe8c4801cbb3e29c81c8a103098c2ab0eb1be1558f17f19d5d9d9d9048440d22a62e3558eae31457e5be64554f29074031f487ef8f7a51fb68babbb3ac91a3c2253eaa29687b8aaf6225365c70606b1fab15923d79ff80f7f8b8e552d6323860eb4cd898898c6cf4445fbe980f82576590a65d7fb0edd4b09edf4a6cfcffd294188cd42fdb38c966e2ee9fdf22ac29a6d9a235044a57192efa574d0eedb27142f0f3369b5d3f03ac85efd658e60b6baa553627d7f0f3410d498bb71c973c7251363d2223ce11ac6a503322170774a1e04c7d6330a0f4477da72af946852c27e0a4de6126ec2287a0e434d5ea618c4d3fba6ebfa63781c335cb0c96507e446b7398314d3506768c14ef9737cd5b402c65bb9115f6451a8c7e8ae2ea0a909b961694f2e6aa86bafadc2cbde820610b5d293d2914281a1cd6aecd6ca2571dcb7f28e270cff5bcc928ffdb1d9d7e9fdd199433bcf627ad5ae871265f3f9ef4e32dc0803b15d3451e788f81eabdaeb10a9caad0020055ce60c901c767c4c84984ffa66197cfc5ce00a5cf117d059b8cc3012283d7bab37ffc883ec513b451139608cae50510b1c02cf40c15ee816532ab550b177274f7c448ae35ef68a463aa1f4174fded5175f6f0c51cefab26e50f78bb0b5cb873eb4e8c88528c1b0aa165f0669754a156cc4e8325070087ca90321edad2a3d69509226378ee6c9139a3a7a387f88b81f9874ce064d19aace1b5cd344a8837a8b457e6ad39ab53806a5e253ed5a1562b98e75a622ad6ac1598ee8932f347da01483bb9774a9764504b71da2c93881abb15849360e6f81e7e14f8bbb17fff2cab02287885c58efdc69730f9ee4bd8208bbec1eb8ff77a49d752392b1f9418ec619094fb46bbd61d1f8b05f2ce2d42d9156aeb38e2b8beb03bbd03f150c521aae9775f30100c0e89cd30a23d208526612e01232f0a9bfa63fb7034c17eb5a3d087329aa14114fcb4fb3167a77b0c3057f01afe74214ce2959df0b3e60174e22b4b5d1253dba163fc2a1813e4d20cc38820e85f1407e36b411bfa3d5d8fa7304999b5a11367a21f6e5d96b842a361dbd5da71e248260ffece42ea2faf134ded3ea359ea8a9dedbe5d51c988e24f9580b559cc8269830799ee75a761c2d71f222eb96c49eba1dfc201956c1e0ab11398264b38246e41282ecc4a3aad0e175c5df6ca515d166696a204a4de933d2725182079e0089f049ab5162593f2811653f769368203ec77fe826d33e1f2d4b126391bc31c275fe612d884054ffc014fe75a6bfd3d74f81f81862b5292cacf6089a7a26aef3428691fd72c173bc08f56c4b8e36755ae7e177bc249939a6517ff3f35eee66a87b929d096e772a9f2624415ec425855e96f4d33144a6a664a38d5a7e679eb011b22f99ab2e0f1c594d6e604909b42d4584bac46b87f057d0dd3564a8c455a4b85de1763b80dffc2c963a7be895e5ac2363ae66bff5772a6943ef0884bca802950db4faacd698436d901ad4af24939351b1ef1d593a4e9170d62396e73c38585aadd00a8d059dc359e3ce583b77ecb545a87d73f84c005ede250960fe7efe051ae3d8b38315ee65a9bc787af6cb0e4c1c6b5c8afee358073b92156c7aa13022ddc66075eaaa7f6126b25c808f04a540ec59eaa7d8738cf772a28a4d802158181d0d5df17aff4305b4e8c4f6fb652a48357c9ede80dadb34835becb2ee544a229413e7581c599abdcc574bc082ba77f8b55de64fffdb662789cc09f86fef1ad439ecc280bf340076e579afe0752dfe14a413b2f08148011a3f2b55c1c75ce9c660352e796aab3ef3a3e7c890a2b0377f4fcd6e31428b34f576a346fe816896949466787d9019d48268ca5b3d2a39727928d2c7cb396f771981bab0e60d31321885913025d16bf9f26749d0979b80d8926a9027f20173de0847841aeb16991e0bd9c8097c60dc7aa259cf5ae734e8b39dadc3c2b399583187f4ceb6d0854b68d773b49cd629e63ecf246804078e6637f5c097e45d9504004142d2c39603f4b72786d16c6d949c1637c854184f2cecc66de98377c711c44d2c39865b157902032bd125c54930e2331b5c95c02c2881bc6b615b93cf7eef97b9eb186aaf513eeb396db4be13d83f3066e79eca7f9f2fc3f223bae5dae2755d2d23db824a5a9bdbf2562aa5b06242bbbe223498a150fdd144ae41adea9e04e4e54422dabbee9116dffbe16a789fb9b6d31c9be5a5c2a7edf42b8939a9c236bf3825f625daa5c9ea832b586b73f9498bd166f01bfaf0c15f789d3f569badc2c2c9cf9dad785bf12591ef4c076372e06f0b9e81000280fb46416e882fc871d707e4e649d7dea4dceb49aa62be6f89319c9f170ea265f418dfb98962d2f5107778aea547ffeb44c6be92a290a2726232c75a24102aff0defa9fdd0034464b994faf45cd1b516cd2bf1e151c137fadd002af7e9b10051e0874f20962eb0c42d88ea6fae72013bce59a49931c1d07e79fe50be6c4799f9b3f77fd893575b96866537a30871eb4aa0f847e00080ac5fd9267a1215e7d17daf85e3116ef409258a3e773f190fe686f59a206558959ac94438c2b13c90e35c756689cc3ce1316a5406e040a026935594dd7b26e1ed0af9ddc2ada4b2d5d79a07a3de8f97de48edbbfa64cbfdbbb2e256da87c0adccb9c146ecb566b0972d50299370745e5e7d49efa6d6e6afe57f816a1790daa7e606c0e1455970ae428702181656131b722df8de004b1e5ac8f5b0972731654bb988a4600969dff875df9b6c1d592823ca82a3e5413b0fdf3efb41982bfa83c6d97fa541333754c4b6b9e9ff81c89fa51375d1530f871fc5a081869d495fc2d53204daab6b570ed7b37a90a1054f6431151e66827a3f92902fdd9cee6b1f05a9ffc4ef329d9cfff720c11837676531647848bd242753b39970fd4a80b3b0b537333e3a08be59d4d4da3b0f08b10581c1eb6518b9dcf2adc9a63f359b619ff780fbf509a9856cc8de6aa5338458d09ee1c7c7ec6e3bf0d07f34203135e39534ba3c8eaa2f77b88700955d03e0281e35015bb657c52bd1fa888b531be140736b56c9d71c02a57af381958a4228570cbb64e18fc8f6a17e7e67d31c2ccc029a816b87e627416ad2b10f75c2e671f79fcea5a154366623d3397ca6ee3a8c92ae49742b2df584544cda90df417c3cde6c680bf6a2f17c49181e9d9b955ec5eaca73016483fe03efae9f2e670676", 0x1000}, {&(0x7f0000001880)="e825", 0x2}], 0x7}}], 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)={0x18, 0x52, 0x1, 0x0, 0x0, {0x2, 0x3}, [@generic='2']}, 0x18}}, 0x0) ioctl$AUTOFS_IOC_FAIL(r1, 0x9361, 0x55b6) r4 = socket$kcm(0x23, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000140)={&(0x7f0000000000)=@l2tp, 0x80, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="0000000007800b0b0167a7b6d296e71c529e008e76cb9b00009087dd0e8a6ce8c8816b0cb04d87332c22e3e5", @ANYRESHEX=r4, @ANYRES32=r2], 0x3c}}, 0x800) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x1437c0b97b9646a5, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xc15, 0x3028}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipoib={{0xa}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x108) 3.578214174s ago: executing program 1 (id=3811): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000540)={&(0x7f0000000300)={0x220, r2, 0x4, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x172, 0x48}}}}, [@NL80211_ATTR_TESTDATA={0x57, 0x45, "e9348a757224d70fd1eb21f252bcd097f1d47a81064f9024cfb36e14e2218776515faa46bf9274ee8fb65afffcf10273c4403b759e1d2baf3cd91bdd1e47395fd0ce39bc6decb00a9cbbfc628a312e1d467435"}, @NL80211_ATTR_TESTDATA={0xed, 0x45, "e37462112b0a50ea46d0d31193f22c6d4376d8b1ef059c30e049d264b4fba9cb71e2012c2b028a90c1b41b30555bbeca005d14414b64a835b872170676413b081fecd61daf742e355524da4f8453005e7c737bbf1e29fc95b6e98cd5591fd61280874121c87ec80c9ed0cfa432eb35c836b5f5e5b006b07847213de140373c5440dbf9e223196ca57a27b3c51467212a2c779900a71f3d7fccf7f6e3e623f2f268e8f3f075f7ce40809ad6b8aa556e2c7a47449102d47c2efad557f6e68fa124ef0f5b8d916d10f2776fa6f56ff134ebe62f2fd8ebe0bc132508ab7b1253e129dadc8447d80481543f"}, @NL80211_ATTR_TESTDATA={0xb6, 0x45, "46913ce2318731ff7691b5f262d8b075deffb75d2873c0f2c993121dbb55ac40afc1860fd41fdb9736669d8ad1cae3bae7e5bd8dffded3b9e44b79bd48c916d2489cf0679c32a2d10e2b637d5c4424078b5bd0820f468cb02eb446ba89c8498b5b8c4ee3935a3618af939731bc9cccea947d7d4564dd319ccb9580656e4543858bb98b4116fc8aa6031a2e89fd4cc494c7fe1b6354cc5e399db8938c6d99a2d68f79d61a1652eb512a4da1ea8af11328485d"}]}, 0x220}, 0x1, 0x0, 0x0, 0x20004000}, 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000080), &(0x7f00000001c0)=r1}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0xf, &(0x7f0000000740)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x20, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x20}}, 0x80) 3.346888951s ago: executing program 1 (id=3813): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0x8}, {0xc, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4028000}, 0x20000c40) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0xb, 0xfff3}, {}, {0x9, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0xc080) r12 = socket$unix(0x1, 0x1, 0x0) r13 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r13, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r14, 0x3c}, 0x80, &(0x7f0000000500)=[{&(0x7f00000002c0)="f2", 0x14}], 0x1}, 0x4011) r15 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r15) socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) 3.049372321s ago: executing program 2 (id=3817): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001f80)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x1, 0xfffffffe, 0x0, 0x8000, 0x3, 0x5, 0x5, 0xb762, 0x6, 0x7, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x7fc, 0xffff8000, 0x6, 0x401, 0x9, 0xb89, 0xffffe4f5, 0xd6, 0x4, 0xffff, 0x7, 0x0, 0x2, 0x101, 0x6, 0xfffffffc, 0x4, 0x1, 0x1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0x7, 0x4, 0x99, 0x9, 0x2, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x9, 0x44, 0x8, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x80000001, 0x400, 0x8, 0xfffffa72, 0xcd, 0xffffff80, 0x80000000, 0xc, 0x4, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x8, 0x8, 0x7, 0x1, 0x1, 0xffffffff, 0x7, 0x40, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0x3, 0x0, 0xff, 0x9, 0xa7, 0x12, 0x2, 0x0, 0x3, 0x1000, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4, 0xffffffff, 0x80000000, 0x1966f9ab, 0x200, 0x20200, 0x3, 0xfffffc00, 0x6, 0x4, 0x800008, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0xcab1, 0x10000, 0xffffffff, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc01, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x3, 0xfffffffb, 0x1, 0x0, 0x0, 0x2, 0x5, 0x9, 0x3, 0x0, 0x800, 0x2, 0x800008, 0x7ff, 0x1, 0x80000009, 0x6, 0x5, 0x5, 0x4d15, 0x1ff, 0xfffff060, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x1, 0x8, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0x7, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0xfff, 0x1ff, 0x8000, 0x3, 0x8, 0x3, 0x9, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x3e, 0x9b4, 0x1, 0x8, 0x2, 0x8, 0x0, 0x9, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x4, 0x1, 0x6, 0x1fd, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x8, 0x7200, 0xd, 0x400, 0x0, 0x3, 0x5, 0x10000, 0x7, 0x4, 0x81, 0x0, 0x8, 0x0, 0x9, 0x5, 0xc0000, 0x8001, 0x1, 0x2000, 0x1, 0x8da5, 0x1, 0x4, 0x2, 0x6, 0x58, 0x7, 0x6f, 0x8, 0x3, 0x4, 0x9, 0x1000, 0x4, 0x80000000, 0x6, 0x80000001, 0x3, 0x1, 0x9bc, 0x103, 0xa, 0xfff, 0x8, 0x9, 0x7, 0x7fffffff, 0xf4b3, 0x1, 0x0, 0x8, 0x8, 0x6, 0xd815, 0xfffffff9, 0x2, 0x401, 0x9, 0x36, 0xf, 0x74, 0xbbc, 0x9, 0x0, 0x6, 0x8, 0x5, 0x6, 0x40000b, 0x5, 0x5, 0x4e3, 0x200, 0x0, 0x9, 0x8001, 0x2, 0x1000, 0x7fffffff, 0x46a3, 0x6, 0x2, 0x1dd50645, 0x401, 0x5, 0x101, 0x4bf, 0x0, 0x9, 0x3, 0x65, 0xffffff13, 0x2, 0x30, 0x1a3f, 0x2, 0x389c, 0x4, 0x3, 0x3ff, 0x4, 0x4, 0x6, 0xf3bb, 0x1ff, 0x8, 0xf, 0xb, 0x401, 0x8600, 0x1000, 0x1, 0x8, 0x1, 0x7ff, 0x7fff, 0x8, 0x408, 0x3ff, 0x4, 0x1, 0xffff, 0x7fff, 0x2, 0x9, 0x1, 0xfff, 0x0, 0xfffffffe, 0x4, 0x0, 0x101, 0x78f0, 0xf, 0x7, 0x0, 0x3, 0xf1c7, 0x100, 0x3, 0x4, 0xfffffffe, 0xffffff7f, 0x3, 0x0, 0x6, 0xd, 0x3, 0xa, 0x8, 0x200, 0x0, 0x400, 0x9, 0x6, 0x132f, 0xaba3, 0x1, 0x3, 0x1, 0x5, 0x6f788000, 0xc, 0x1ff, 0x40, 0x8, 0x3, 0x2, 0x1, 0x0, 0x71, 0xb13, 0x4, 0xbc5, 0x0, 0x7, 0xffff, 0x100, 0x7b58, 0x0, 0x807, 0x1ff, 0x3, 0x400, 0xffffffff, 0x1040, 0x3, 0xfffffffa, 0x9a6, 0x8, 0x5, 0x1, 0x9, 0x3, 0x9, 0x7, 0x3, 0x1, 0x101, 0x2, 0x6, 0x598f, 0x5, 0x8e, 0x0, 0xa, 0x9, 0x1000, 0x8, 0xd00f, 0x2, 0x1, 0x6, 0x2a, 0x7, 0x100, 0x24e, 0xbd, 0x2, 0x2800000, 0x807, 0x0, 0x401, 0x6, 0x2, 0x9, 0x7039, 0x4, 0x1, 0x9, 0x1, 0xb18, 0x2, 0xfffffffe, 0x26e, 0x6, 0x5c, 0x8, 0x100, 0x3ff, 0x1, 0x0, 0xb, 0x10000, 0x8, 0x6, 0x2, 0x6, 0x7, 0x2, 0x7ff, 0x0, 0x4, 0x8001, 0x3]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.955271257s ago: executing program 4 (id=3818): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x798, 0x478, 0x270, 0x478, 0x478, 0x0, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x21}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {0xff}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@dccp={{0x30}, {[0x4e24, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x0, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xd0, 0x118, 0x48000000, {}, [@inet=@rpfilter={{0x28}, {0x7}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@multicast2, @ipv6=@empty, 0x6, 0x8, 0x6}}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0x208, 0x250, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @private0, @mcast2, @private0, @empty, @private2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@multicast1, @ipv6=@mcast1, 0x23, 0x29, 0x4}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7f8) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet(0xa, 0x801, 0x84) (async) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r1, 0x8) (async) accept4(r1, 0x0, 0x0, 0x0) (async) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x798, 0x478, 0x270, 0x478, 0x478, 0x0, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x21}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {0xff}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@dccp={{0x30}, {[0x4e24, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x0, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xd0, 0x118, 0x48000000, {}, [@inet=@rpfilter={{0x28}, {0x7}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@multicast2, @ipv6=@empty, 0x6, 0x8, 0x6}}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0x208, 0x250, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @private0, @mcast2, @private0, @empty, @private2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@multicast1, @ipv6=@mcast1, 0x23, 0x29, 0x4}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7f8) (async) 2.920324078s ago: executing program 2 (id=3819): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0xebbe, 0x3}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_GET(r0, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x58, r1, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4004}, 0x40804) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=@getqdisc={0x24, 0x26, 0x10, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0x3, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x20044081) r2 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x5c, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0x8}, {0xffff, 0xffff}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe, 0x4, 0x7, 0x4, 0x2, 0x2cf, 0x6, 0x1}}, {0x6, 0x2, [0xffff]}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x80d1}, 0x34008098) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.83462399s ago: executing program 4 (id=3820): ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x3}, [@alu={0x4, 0x1, 0x9, 0x0, 0x0, 0x1}]}, &(0x7f00000005c0)='syzkaller\x00', 0x2}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x28, r2, 0x331, 0x0, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED]}, 0x28}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004081}, 0x40000) 960.755124ms ago: executing program 1 (id=3821): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) (rerun: 32) sendmsg$DEVLINK_CMD_TRAP_SET(r0, &(0x7f0000000300)={&(0x7f00000001c0), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x58, r1, 0x1, 0x0, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x9}}]}, 0x58}}, 0x110) (async) syz_genetlink_get_family_id$smc(&(0x7f0000000000), r0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0xe, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000071106f000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r2, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000001880)={0xa, 0x0, 0x0, &(0x7f0000000480)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r2, 0xffffffffffffffff, 0x0, &(0x7f00000017c0), 0x0, 0x10, 0x4}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x5, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f00000001c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 913.592469ms ago: executing program 4 (id=3822): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) syz_emit_ethernet(0x41, &(0x7f00000020c0)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "430093", 0xb, 0x3a, 0xff, @dev, @mcast2, {[], @echo_request={0x80, 0x0, 0x0, 0xd, 0x120, "9baff4"}}}}}}, 0x0) 865.55342ms ago: executing program 2 (id=3823): socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x140, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$netlink(0x10, 0x3, 0xf) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x0) close(r1) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$inet6_sctp(0xa, 0x0, 0x84) sendmmsg$inet(r4, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @dev={0xac, 0x14, 0x14, 0x41}, @broadcast}}}], 0x20}}], 0x1, 0x8000004) 864.926228ms ago: executing program 3 (id=3824): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@cgroup, 0xffffffffffffffff, 0x37, 0xd416a90e1556646a}, 0x20) r2 = socket$rds(0x15, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000018c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "ec9700", 0xf98, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x3a}], @pkt_toobig={0x2, 0x0, 0x0, 0x800, {0xf, 0x6, '*zc', 0x3ff, 0x0, 0x1, @loopback, @loopback, [@routing={0x11, 0x10, 0x0, 0xa3, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @local, @private2, @empty, @remote, @loopback, @remote, @private1={0xfc, 0x1, '\x00', 0x1}]}, @hopopts={0x3a, 0x1d8, '\x00', [@generic={0x2, 0xebf, "c9ac4a70ba84646eba50f5859f31f4d9286aaa1792ed14ee4547c4956d4a971cbb5943ff64def2e0d1ded05bd5360357e2296fe1969dda8dda4c22b408f36fa9304a55e25c397d7549ced7ea2a33d05664862232e0c905d4787a86f07900b5e46bafb81c0172b1a37f80d45da7d7db810f0ce8cf826a145c82e35954006a0983dc7ea81e60c7fc155f021fd73f84c23b5a2fffed1a8a6557200050872970c9c98557b169f6da6be0c8e68640cc68607cf8aae3cd6769f0d553e7b5637b912f421157bc5e0a561ec9afe882b9555df4e2fb81b44925179b6021ad454c87a8fcd5e995696ff452611f000126d09297b3b8ed118dd6aa049f386fa0805cdbd997e6dd1622e5c9715458b79e11a9117a786b86a332ad123bbbe1854d4b4a4f1894a52b045516d73880e6be6f2ab043d75f145ebf5ea5ce7fc48fc6fef5d3668b5e68b394e596f44e08b70f966da035f95ad9fce927f6cf9431ab0e918622cb409a58effbbbd81760159a00010765b80e651d81d3850f1ea176347f1672f8d0c9f995c300c97563eeb8dd8bc9d39d40040ed36c0beb6d760f975944a7991739fa296c23c80a2f50c55d69c3741aeeac2e2ff5ba1331adee3590ffa1da2eda6406d8bfa19bc633582baa5f4e85383c6dcee60e47558f43dd6ec67522084c07b6739b391a9728cee6e86ad90c6ec699a5ff20511625e0fc207c405efd1993535116766cc2d29e427dac73da1338211d075cbc352321530b6b98346ade12f626c0be812d2eb571b0bd3c4b335d797bb37bd3826db203e3c89ded2a6d6f95f1744410a0da344329d3bd0cabbfa8e22ec43a8ae8ce43ed8facf77c4f0709e84c8f31d0612485475ae27a3302ecfc04172553c019c3c29a134ec62b4f5ae1c49674af502b2076c4d2e9ed108147135072472fd321dbbe32e15f123d7c9229ad7edc90b0ad3e1dc2ee48a7f384e0271c91c44a0a508df345fbebf9559ad6e3496593ef62139aa5723033209fd80f807638d5b24088e8cb896b499d6d872d42a8d938a77651c28cef73f00ada83257742e08c8c79aef569198542584b408ada5df6f0096ec9a6a8c78fd6d78c5c0944845a5fbcb1936e16a59f05ac6d82c6c2c99c9cae379ece8ddf805e618a61e35361cc4c83b5a07dafe2fe96c7599d6de1a3c5035c77a86b021b72d81bff0c2b6f9665840bf8c98debc219d3d75d451b60293f099ed171c5e566d2591e4bd507a51b925d09aa3ce8c7b8f56d1e35158839484e663de76545c818b0ea8646120eca0b75da4c0e648ae0d56aa168b19f48460923d8d38d3cd570a4c9d6ae1af48b28964db4d5eb89aa2845b8bdddd89f9272ad3e5d04e5624089ae1d124b0eef9ad7ebae1ea2557f946e2a824ed497d45826f26f089fabd54be895fece37564a13f716451a3cb549bece785de9ffa233c8cd10591986b5e5d2bd7349d508b6b504fff44ca31f386383b9da747d0c688bfde3725ebe669571340addd8f83157cdd04bfa060a6b9446e6231d235ecc28ff84ec9f6882bf1eefba15d7b1e47f3233a9dba73c6a027dc9be90e21892545b5d0a4402e9b69b82658b5f8a05977f4b385854814747655b0795e738723ef152b6b3199c41521c8bd86a9d3868b2a969697301b5fbca39bf541849ace04ed8b1b481a3bc80baeaece999cd09a828ae1471482a74cd5e63bb5c80c20050c053fe22fe7375267f84370f0ef1832732f1e0c49b9689d2911d1ea925db9cfce33e9b69d05f6d605e6fce75f65940136f5f55dfe7a8983a9edbc086937ec9f4100bb3e874c075f3d6caeaf46780bcc104dd83825ae45fd5a423d743d817b95e432ba28d994d65883c0532d208f6e90d951de4780b741b4810feee7d3dbd75267666b98510792533ad80bc57d3d6970d2e38504e76c6cc2cf4fb6e1358d49a1a0a30c0bc0d07d29845d9cb2371861fb9f01eb064a18f9e61a5682ef07c31ff8fb1050211fa22f01ef57f042a95756796d4c853360915e5e9c408bc09874d9bcf300c47d74a16c7b85842e22b5734bb84fb4de5dc241708408cb2b379d55be7dc8085f32fd1726a7e6c2fd58041e695596e0c2806c81906d33029c120d7c7e7f145680668fee3e5f010798364713d8c87832a51a934dcd448ac6cd35856ccc3e27c21ff9e25f1cb710d2b1796f637479fa32b003f110b0e2ac9c153941dad387a9edc7c16f50823bcd98a8618cc8735cbaa521a3d6484fc842b9185c740337838e12cf13c9efde323e8bbd33965d2bc435dcdb0cc7c26bf407063ca7a254c33800dd06b191b871fe6b2aae140d1cc1d6f22c1e5c4bc025375b77d3c4edc4cfb9dc558a9ae4814ed5dc83ad963fb590af7c109d2d35df528fa898ac5ea4db299c563fcc7d722a97d68a8e3f7771e5fff804f623ff0b2f25231bbd50ba1bc3a4d4ed857aaef212601bfdb0e183fd85f607e5cccbd4c8452b9b1e4c8376a687a59d34ac1c2dc20645a59efbc022bbd0f30999aafd2796ab3deaf29d0ce9bad1d1eda5f34dfd24cf05c8f3298566d255f75ec91919248c99abe29d5c9879758f68808f2a24dfeb386328dae00d06286a0d46b6b7ea117ad7fdbb5d9f833abf36984190a45bbeb9cd2e45af3f9077b208147e798370bd9e5373881ffa94267b82fc7cc4f11b5258cf219950a5a5732fbe10d385e9053c6fd7b5cc3098aedba588a2b619bc54e7f12228b907aea4f4544c65990baaad1b522635dfe5bb6b71721707f815d7a8ee24c8328d67b46e199c0e5c0c7fdb44b3e9defd5726317f74f4cb87909b00f1f4df8858a980a86f87d27dcf33d6d89bc4c7ec088a7270aff9470d7ef12835eddb86f7471af31e8f2cde0cf102d9c9df7cbf1064d1f61acc5897959df60a6e2861c90316c36f20cfb25d069a21a28441003ea5530e842e6112bc90d3cf67184c063bb33182b59aa49c97eee50f6141ba81518b95963b66f20a7296e911ad472e79ffa926feb2e5c5da5e97ff007445beff0c8711a90c7c7525d48e463c30997d530cab0a845ac173f399effcf6af84f50c6319a1ce3565eef74df335cab14daa748ce2037364d90a2ba428d56d5b3b602b2030ea6b721ffb19078bcfe3bbcace66fb3058745b92ff01de9ddb4dd4e0e460b090bc3983946c007e5f465cd9869cd67c5bcd5881c4557c81c69289bca96d4dc4f4cfa421547d5d5c92279b996173704616c1d50e2016efaee7acfb01c56323bad976ffb39f7d3407f7995742a63751a746e6ef6035923e4e879d92ec3e5d2390fe363270cfdadb75f1db87a71d2343229ec140cf75a25e98a298c98c22fd144b675e5fcf39115b243d8c29ab8d6f7c87a7313481fb99bdeb759072cc9a6ec5153d94298bbfdf80bc3075a503c232e3be025004d281d3478bcbdd0f5549be09fca89da7d0e34af97302607c20c464e034c6428cbe326c07615b39fc72ab6f254c7aad6102f813b9623c6a7601b6ea29f84e86999b1287bd111bfa49672c886cca6eb8786eefc96a84cb0aa04ee0334d3fe23a0cef39078bce8f22cc35eeb2fcbe22280df1209ffb05347cbc3611915e7fedbdc752c658c199b23b3346367cc5a68be6a79069a188f6a6efb2d2aaa387ebed66eeb411b9094254041932876a1120a4ae1d20dfaa8709c62828a3ee332cbbe997b6eae047bd493535a25042e1fb3f2b2933c17f6ef96c1793c0ff79fe740b9282416e5e65ef58254055e38afa2e8cec89274f4e542153896baae0e50c37c83bf1034a5b722c874652182954d271991110e43333a48fd85f9b3427915ff9bd2e3b5342858fd2d86801d1cddb55b66bda6c7df3b04ceeae4a7ce74391255ede63695046d8c27241514ceebbc0a5e6a119f7830600385c3b67583ad2e48f8517c4f31349d2d3535a71b1ba2543fca666e1a06f62ce20557ef459e419e0534feec1958cd6fb5c4413eaa1c7e7a64cb19f6a592fd74def605d69a5e6fe14ad77f60ef0424a8f6b7026c1f4b493c71b6428a826fa731022276888b0dd9fcf6dd67cfdfd2fd1765c3c5d9c5fe4d2012bf8217b9dc91b583d945f70d0df13d3b3380200f02753e86f0de109129586629db95d829235e0db826de6e17c830c1aeca17573cbf95cd18c92b8e12c57e93e189d25fe6e71c32526f82e52de09355ca7f5105a61e059d5924d227119175714b5ab610b8dfa9c53d0b4105481bd5f3d47dd6d9d0eee798d7e38644ecd4971b2663a8c628cf51016597eb2c70640a0fea463f9012eca14e957b4280866ad8490fe7c3db57cd40684dc5655bafdd28e8a24217ca96e6ea1ded591b0b8f0cc9f79059fca8c22a884fab4be708e50a38ed1c0350015f3e4326f0af07c57b31d13868167e6ae776f3203f9f03b316233a4d7045b4652b506238a9be0b68b54e6bc52cc1c0894fbfe5071616170ca4895f6636f9be5df32e09f7429c7569aa42715809969b3f8a88080f57155b4c0cbe54039fa8996c4614657a9e4c4b1eafaaf0a663c0d461380ecd907688668d119c0361c6ac486cda549521ad2702d54053e4c2747e710399e235fc8defe54c64218915598c14de35cec58f24328d950ba6548595bc4b9e6c45e3ccdaed1b1dfe9ae3e7dfa2e768d75d7408242d0c504ef2fa583703d8509e5520db9692003b34c9e4ed48aabaa6908cf599667a4ce679ccbadd440900bd917522eeecd73dc2d90446db4d7d40323ec7971477d061fbd6d1c6434c8614ef7a909f46acb4657c4828601a30b993cd9c1b14215674471fceb9777917d6b3cf6c217d453d01ae5007f7ed70f92aaddae11d2f9bcb5854c1292303c3324fef63eff0a3e7ed487310c81a23bb2f89f68a44af31ffc759827b9855fbc6b9e1321bdbed45679c14d5d72b89a7e684ca8fb434352632533b622c8b5ebd162148c301496c0a18fbf31f10e2319020f5f59e81050f21bbed6b007775bc87b3f0ef643d0294dc7db502a0a45d3c68024fad13885d0212fc96067b2de27c2ec471b201cd50f38fc777a6123931e148c4d888097e6ea4f379ff69ba12cda93b2f48ffbb7286395232a4a78094014fbf8f5b1ae3d0ac780efad2721b2996711f6c3ff54468028fc8fcab62fdd160e1e0b18a8b1726dc1bdf34c2ee35ece720716f01f495eb9adc8361e6bcd0f7fdf7a21abb2ea14ab6563f6a9e580c3e5dd0ee7dcaf5d36f04696ddae6b36039cc611020c783504fa233179397f40dee4199528bd2adf4dd0037d0709fcb0c989ed2a26b0b6d475d6c3e25ef26a87d8b25974ed4a84453df731a3d3d496a4807b5ebc5f310dfa6b72f52634cb5705cca5253899ab69035290a0e1f78d148b80c35cac0275c8a5bab51670e7aca0120"}]}], "ab0924172f9c2a1d"}}}}}}, 0xfce) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f00000007c0), 0x10) pselect6(0x40, &(0x7f0000000100)={0x4a6, 0x400000, 0x5, 0x7, 0x8, 0x777, 0xe, 0x100}, &(0x7f0000000140)={0x5, 0x2, 0xfffffffffffffff7, 0x4, 0x4, 0x6, 0xd, 0x9}, &(0x7f00000001c0)={0x53, 0x302d, 0x7, 0x6, 0x4db5, 0xfff, 0x6, 0x9}, &(0x7f0000000240), &(0x7f00000002c0)={&(0x7f0000000280)={[0xd]}, 0x8}) 766.704981ms ago: executing program 4 (id=3825): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newtaction={0x9c, 0x30, 0x48b, 0x0, 0x0, {}, [{0x88, 0x1, [@m_ctinfo={0x30, 0x2, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}, @m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @multicast2, @remote}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x9c}}, 0x0) (async) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) 753.438583ms ago: executing program 0 (id=3826): socket$netlink(0x10, 0x3, 0x0) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$sock(r0, &(0x7f0000005a80)=[{{&(0x7f0000000940)=@hci={0x1f, 0x4}, 0x80, &(0x7f0000001e00)=[{&(0x7f00000009c0)="08c70534087ab26885d776c313b95a4a78cc5fd69840e13c9889bb2cc9914e45f3e93647bfb1ae3ebcc99d147f1a0eb089ade5e510989e15b11746bd56612ef157c48a734d56f53ac322890ebfa412a8658495e5dc9fa572ea6b1fb818a6f75ea85ddd19b0c56c", 0x67}, {&(0x7f0000000ac0)="a9451a6110e6509d9bbc70ba4138157b437b538e8cdb87eb0a", 0x19}], 0x2}}], 0x1, 0x4818) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000140)={0x0, @bcast, @netrom={'nr', 0x0}, 0x4, 'syz1\x00', @bcast, 0x8, 0x2, [@null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) r1 = socket$kcm(0x2, 0x7, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x1, 0x4}}, 0x10) socketpair(0x11, 0xa, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e22, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}}, [0x6d20c9de, 0x5, 0x400, 0x2, 0x1, 0x7, 0x3, 0x200, 0x3, 0x4, 0x7fff, 0x4, 0x101, 0x200, 0x2]}, &(0x7f0000000480)=0x100) syz_emit_ethernet(0x4e, &(0x7f0000002e40)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x18, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @ipv4={'\x00', '\xff\xff', @empty}}}}}}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f00000004c0)={r4, 0x9}, &(0x7f0000000500)=0x8) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000000)={0x200042, 0x0, 0x3}, 0x10) close(r2) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x3}}, 0x10, 0x0}, 0x3000c085) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r6) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0xffffff6a) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="080000000400000000000300", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f00000001c0)={'team_slave_0\x00', 0x9}) r8 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="240000004a00010000000000000000000a000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b'], 0x24}}, 0x0) sendmsg$inet(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000c40)="02", 0x1}], 0x1}, 0x408c4) 682.224413ms ago: executing program 1 (id=3827): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) socket$netlink(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) socket$inet6(0xa, 0x5, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000007c0)={r2, 0x5}, &(0x7f0000001800)=0x8) r4 = socket$alg(0x26, 0x5, 0x0) r5 = accept$alg(r4, 0x0, 0x0) sendmsg$alg(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)="f0bd4f4b0e39ce0d64a34ae01197c4a5e527f2de948629175f5f8301842b2011f52faf8782ba3e202f9a0ed4393c9f93a6b004db332e62aa3964a04c29e5651b6ac756c9904ec9c375b1d494f583de773580c357c241ec7285980570136d7b583c2fc92941a1f7d5e46598c7fc21620efd6f329d19261952", 0x78}, {&(0x7f0000000400)="be0cad977932266254e2ff36d86b691db958e65d679e28bcf99bf169876dd806e9052c81a9baaae0d234a90acd3fb41941db7de192f4c320256953a5c50d9acb19248d2e443a750e415f9adcc05c07677c1e28fa9db2fc2364a601a0c562230c7c9b22dfc209e3530f91ac2b88f09c707be228ee8e739c71105930f5ce75f73d2318e3482ed571d700871b9cd7e566d6c10049823fd3a7ccd53f27c9689fd875586d6f2c92", 0xa5}, {&(0x7f0000000580)="d44e16c50a384bd2fe0f5ff967fb0598d296832197c2df4487f135679c3d188cb46e91829ec58a0fc75520840990cd989ca209bd275cff3faa763250da5f6b775978724396352cdfa6b4a4410130a291933d383f00", 0x55}], 0x3, &(0x7f0000000640)=[@assoc={0x18, 0x117, 0x4, 0x1}, @op={0x18}], 0x30, 0x40080c5}, 0x8000) bind$alg(r4, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x58) r6 = accept4(r4, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r6) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x1c, &(0x7f00000004c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000020000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b70400", @ANYRES16=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000", @ANYRES32, @ANYBLOB="0000000000000000b7020000000000008500000008000000bf91000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r7, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r7, @ANYBLOB='\x00\x00\x00\x00'], 0x18, 0x20000000}, 0x800) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000000000000000000000080654d970008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r9 = socket$kcm(0xa, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x8918, &(0x7f0000000000)={r9}) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r10, 0x890b, &(0x7f00000001c0)={0x0, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={'nr', 0x0}, 0x3, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x40005, 0x7, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default]}) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x4c, &(0x7f000002eff0)={0x1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x2}]}, 0x10) recvmmsg(r8, &(0x7f0000007340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/61, 0x3d}, 0xfffffffe}], 0x1, 0x0, 0x0) 649.050564ms ago: executing program 3 (id=3828): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0xa0, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_SEQ_ADJ_ORIG={0x1c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x9c}, @CTA_SEQADJ_OFFSET_AFTER={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1}]}]}, 0xa0}}, 0x0) 491.474114ms ago: executing program 3 (id=3829): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000200000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x2000000, 0xfe7f, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000), 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_mpls={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8}, @TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x5}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8848}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) 382.22971ms ago: executing program 4 (id=3830): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f0000000540)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={&(0x7f0000000340)={0x188, r2, 0x400, 0x70bd27, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0x188}, 0x1, 0x0, 0x0, 0x48814}, 0x40000c4) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002e00)=@newtfilter={0x70, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xffe0}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0x40, 0x2, [@TCA_FLOW_EMATCHES={0x3c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x2c, 0x1, 0x0, 0x0, {{0x8, 0x9, 0x40}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_DATA={0x4}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x2}]}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x2008c014) 348.035587ms ago: executing program 1 (id=3831): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$rds(0x15, 0x5, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newtfilter={0x24, 0x2a, 0xd27, 0x3, 0x0, {0x0, 0x0, 0x0, r4, {0xd, 0xfff1}, {0xfff3, 0xffe0}, {0x4, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x24044801}, 0x20000080) bind$rds(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) r5 = socket(0x40000000015, 0x5, 0x0) getsockopt(r5, 0x200000000114, 0x2716, &(0x7f00000198c0)=""/102393, &(0x7f0000000240)=0x18ff9) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a40000000060a010073797a310000000014000480100001800900010079617371000000000900020073797a32000000f01b4ad70014000000110000f800000000000069b1"], 0x68}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) close(0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000040000000000000000000000000100000a48000000030a010200000000000000000a0000050900030073797a30000000000900010073797a3100000000080007006e6174001400048008000140000000030800024054dd5e54140000001100010000000000000000000100000ab4088ceed4572176c9a8dc7acdfa07d233aea950fc8c489e1351d63698f8521fc745c581657fd75f6fd06de0437c7c1a9cabd2532ff5d1d491d59f3776dbe6b37f8e67396ce8b162e2f4ffabb444efa922e12f116e5b71a2b41a7181ab298fe1ac0cbf8b19d9e467e582fff472204f7d193bba0d4e3356c77d2f943305fae34b477839db3d1293fa7a819f"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) bpf$MAP_CREATE(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB="05000000040000000400000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x1f00, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, &(0x7f00000005c0)=[{0x6, 0x1, 0xc, 0xc}, {0x0, 0x2, 0xe, 0xb}, {0x4, 0x5, 0xc, 0x5}, {0x7, 0x1, 0xf, 0xb}, {0x5, 0xb6, 0x5, 0xa}, {0x4, 0x5, 0x7, 0x8}, {0x2, 0x5, 0x2, 0x4}, {0x2, 0x5, 0xa, 0x1}, {0x3, 0x1, 0xc, 0x6}, {0x2, 0x1, 0xa, 0x6}], 0x10, 0x7}, 0x94) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000140)=ANY=[], 0x32600) r7 = socket$can_j1939(0x1d, 0x2, 0x7) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000140)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0xfffffffffffffffc}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000280)={0x1d, r8, 0x2, {0x2, 0x0, 0x6}, 0xfd}, 0x18) r9 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r9, &(0x7f0000000000)={0x1d, r8, 0x2, {0x1, 0xff, 0x1}}, 0x18) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000240)=ANY=[@ANYBLOB="85000000b400000095"], &(0x7f00000008c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0}, 0x20) close(0x4) 335.884087ms ago: executing program 0 (id=3832): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000000004000000480311802e2e"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) (async) syz_emit_ethernet(0xc2, &(0x7f0000000380)={@broadcast, @random="74eca04e0fb0", @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x9, 0xb4, 0x68, 0x0, 0x0, 0x3a, 0x0, @empty, @multicast1, {[@end, @rr={0x7, 0x3, 0xec}]}}, {0x4e24, 0x4e21, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "68a44e9390e1b96305ef26836b3c9c1f8bc4d9ac60291b70ea627f6d1ab003fc", "74e698bda2c0e37d6aa18509fb05244cfe09bb7850b8e68d829d874bcaa5ca80473dcdcedf1ed699c1829499c671ffab", "96eb7b93133209d1007ac68d9b619a8cf87b4fa609d02c370f25e196", {"d2ff302bdb9f67a0f9db7e7bac1aee6f", "225cabb19adca44b3620cdf9f3b2af33"}}}}}}}, 0x0) 270.016419ms ago: executing program 2 (id=3833): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x800) read$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40), 0x0, 0x20044894) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x54, 0x2c, 0xd3f, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x2, 0x4}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x18, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_MPLS_OPT_LSE_DEPTH={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL={0x8, 0x5, {0x20000, 0x0, 0x1}}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) 269.489967ms ago: executing program 3 (id=3834): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, 0x0, &(0x7f0000000100)) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a3000000000240007800c0002800800014000008e020c0001800800014000000000080008400000001005000500020000000500010006"], 0x70}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000040)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x24000000}, 0x4004801) 187.346857ms ago: executing program 3 (id=3835): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000b40)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x4101}, {0xffff, 0xffff}, {0x7, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x560, 0x7, 0x6c, 0x0, 0x0, 0xbfffffff}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x94, 0x8, 0x0, 0x8, 0x7}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2004c0c4}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x0, {}, [{0x54, 0x1, [@m_skbmod={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x20}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) socket(0x10, 0x3, 0x0) (async) socket$packet(0x11, 0x2, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000b40)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x4101}, {0xffff, 0xffff}, {0x7, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x560, 0x7, 0x6c, 0x0, 0x0, 0xbfffffff}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x94, 0x8, 0x0, 0x8, 0x7}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2004c0c4}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x0, {}, [{0x54, 0x1, [@m_skbmod={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x20}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) (async) 130.418021ms ago: executing program 0 (id=3836): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[], 0x0, 0x5a, 0x0, 0xffffffff, 0x1}, 0x28) socket$pppoe(0x18, 0x1, 0x0) 50.302142ms ago: executing program 1 (id=3837): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x30a) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x1f8, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b400000000000000691050000000000004000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r1}, 0x94) 49.660868ms ago: executing program 3 (id=3838): unshare(0x0) (async) unshare(0x0) r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0x0, 0x6}, {0xffff, 0xffff}, {0x6}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd25, 0x4, {0x0, 0x0, 0x0, r1, {0x4, 0x2}, {}, {0x1, 0xf}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x5}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0xba, 0x1, 0x1}, {0x5, 0x9, 0x8, 0x1, 0xf, 0x1, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x9}}]}]}}]}, 0x64}}, 0x20040054) (async) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtfilter={0x64, 0x2c, 0xd27, 0x70bd25, 0x4, {0x0, 0x0, 0x0, r1, {0x4, 0x2}, {}, {0x1, 0xf}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x34, 0x2, [@TCA_CGROUP_EMATCHES={0x30, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x5}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0xba, 0x1, 0x1}, {0x5, 0x9, 0x8, 0x1, 0xf, 0x1, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x9}}]}]}}]}, 0x64}}, 0x20040054) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCOUTQ(r3, 0x5411, &(0x7f0000005280)) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl1\x00', 0x0, 0x29, 0x9, 0x9, 0x2, 0xc, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x12}}, @empty, 0x1, 0x700, 0x3ff, 0x328}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl1\x00', 0x0, 0x29, 0x9, 0x9, 0x2, 0xc, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x12}}, @empty, 0x1, 0x700, 0x3ff, 0x328}}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1600000011000700"/17, @ANYRES32=0x1, @ANYBLOB="0400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000100"/28], 0x50) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xfc4, '\x00', r4, 0xffffffffffffffff, 0x2, 0x3, 0x2}, 0x50) (async) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xfc4, '\x00', r4, 0xffffffffffffffff, 0x2, 0x3, 0x2}, 0x50) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xd, 0x8, &(0x7f0000000040)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r7}, {}, {0x85, 0x0, 0x0, 0x7a}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000000c0)={0x0, 0x401}, &(0x7f0000000740)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000780)={r8, 0x9, 0x20}, 0xc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000580)={{0x1}, &(0x7f0000000500), &(0x7f0000000540)='%-5lx \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000580)={{0x1, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000540)='%-5lx \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x18, 0x18, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffff45d, 0x0, 0x0, 0x0, 0x7f}, [@exit, @map_val={0x18, 0x7, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0xb25}, @map_idx={0x18, 0x8, 0x5, 0x0, 0x10}, @call={0x85, 0x0, 0x0, 0x4}, @map_fd={0x18, 0x6, 0x1, 0x0, r6}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @jmp={0x5, 0x1, 0x6, 0x5, 0x3, 0x20, 0xfffffffffffffff0}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000400)='syzkaller\x00', 0x7, 0x1a, &(0x7f0000000440)=""/26, 0x40f00, 0x8, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x6, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x313, 0x8}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000005c0)=[r7, r9], &(0x7f0000000600)=[{0x0, 0x3, 0x0, 0xa}], 0x10, 0xfffffff4}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x18, 0x18, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffff45d, 0x0, 0x0, 0x0, 0x7f}, [@exit, @map_val={0x18, 0x7, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0xb25}, @map_idx={0x18, 0x8, 0x5, 0x0, 0x10}, @call={0x85, 0x0, 0x0, 0x4}, @map_fd={0x18, 0x6, 0x1, 0x0, r6}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @jmp={0x5, 0x1, 0x6, 0x5, 0x3, 0x20, 0xfffffffffffffff0}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000400)='syzkaller\x00', 0x7, 0x1a, &(0x7f0000000440)=""/26, 0x40f00, 0x8, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x6, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xd, 0x313, 0x8}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000005c0)=[r7, r9], &(0x7f0000000600)=[{0x0, 0x3, 0x0, 0xa}], 0x10, 0xfffffff4}, 0x94) 42.896526ms ago: executing program 4 (id=3839): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000300)={'gre0\x00', &(0x7f0000000240)={'gre0\x00', 0x0, 0x40, 0x700, 0xa000000, 0x101, {{0x24, 0x4, 0x3, 0x5, 0x90, 0x64, 0x0, 0x2a, 0x2f, 0x0, @rand_addr=0x64010100, @rand_addr=0x64010101, {[@lsrr={0x83, 0x7, 0x59, [@multicast2]}, @timestamp_addr={0x44, 0xc, 0xd0, 0x1, 0x1, [{@local, 0x9}]}, @lsrr={0x83, 0x7, 0xfa, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp_prespec={0x44, 0x3c, 0x92, 0x3, 0xb, [{@remote, 0xc8b1}, {@local, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80}, {@multicast2, 0x5}, {@multicast2, 0x6}, {@multicast2, 0x2}, {@dev={0xac, 0x14, 0x14, 0x10}, 0x460}]}, @lsrr={0x83, 0x1b, 0x25, [@private=0xa010102, @private=0xa010101, @local, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @rr={0x7, 0xb, 0xc8, [@broadcast, @dev={0xac, 0x14, 0x14, 0xa}]}]}}}}}) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000003c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x37, r2}) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket(0x1e, 0x4, 0x0) (async) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0xfffffffc, 0x0, 0x100000}, 0x10) (async) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x3, &(0x7f0000000080)=0x7, 0x4) setsockopt$TIPC_GROUP_LEAVE(r6, 0x10f, 0x88) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x439, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r3, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @multicast2}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}]}}}]}, 0x40}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="40000000100039040200"/20, @ANYRES32=r3, @ANYBLOB="4010000000410400200012800800af2be48b65001400028008000700ac1414aa0600030081000000"], 0x40}}, 0x4040000) 0s ago: executing program 0 (id=3840): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000012c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x2, '\x00', 0x0, 0x0, 0x0, 0x3}, 0x50) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000200)={r1, &(0x7f0000000000)='GPL\x00', 0x4540, &(0x7f0000000140)={@align=0x9, {0x400, 0x3, 0xebdc, 0x8001}}, 0x38, &(0x7f0000000180)={@_ha_fsid}, &(0x7f00000001c0)=0x7}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)=r0}, 0x20) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket(0x2c, 0x3, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r7, &(0x7f0000000140), &(0x7f0000000080)=@udp=r6}, 0x20) r8 = socket(0x2c, 0x3, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r7, &(0x7f0000000180), &(0x7f0000000280)=@tcp6=r8, 0x1}, 0x20) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000002340)=0x0, &(0x7f0000002380)=0x4) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r10) sendmsg$NFC_CMD_VENDOR(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="01052cbd7000fedbdf251d00000008001d000400000008001e00300b000008000100d3"], 0x2c}, 0x1, 0x0, 0x0, 0x4004005}, 0x8000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002440)=@bpf_tracing={0x1a, 0x2d, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x67b3fda6}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @exit, @alu={0x4, 0x1, 0x3, 0x2, 0x0, 0x8, 0x10}, @map_idx={0x18, 0x5, 0x5, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @jmp={0x5, 0x1, 0x7, 0x0, 0x8, 0xfffffffffffffff4, 0x8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}]}, &(0x7f0000000540)='GPL\x00', 0x7fff, 0x1000, &(0x7f0000001340)=""/4096, 0x0, 0xc, '\x00', r9, 0x18, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000023c0)={0x1, 0x10, 0xd737, 0x8}, 0x10, 0x17d4e, 0xffffffffffffffff, 0x0, &(0x7f0000002400)=[r0, r0], 0x0, 0x10, 0xb}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xb000000}, {{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1c}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x4, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) kernel console output (not intermixed with test programs): ][T13524] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 278.822290][T13549] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 279.197375][T13575] __nla_validate_parse: 5 callbacks suppressed [ 279.197394][T13575] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2124'. [ 279.248875][T13575] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 279.270788][T13575] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 279.283633][T13575] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 279.295302][T13575] bond0 (unregistering): Released all slaves [ 279.570662][T13599] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2132'. [ 279.589069][T13599] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 279.979520][T13622] lo speed is unknown, defaulting to 1000 [ 280.044298][T13622] wg1 speed is unknown, defaulting to 1000 [ 280.205343][T13632] netlink: 'syz.3.2144': attribute type 3 has an invalid length. [ 280.542032][T13658] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2151'. [ 280.858733][T13674] netlink: 9 bytes leftover after parsing attributes in process `syz.3.2154'. [ 280.883236][T13674] netlink: 9 bytes leftover after parsing attributes in process `syz.3.2154'. [ 281.143235][T13690] netlink: 164 bytes leftover after parsing attributes in process `syz.2.2157'. [ 281.180922][T13698] netlink: 164 bytes leftover after parsing attributes in process `syz.2.2157'. [ 281.214211][T13690] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2157'. [ 281.216955][T13702] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 281.275466][T13702] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 281.545102][T13720] netlink: 'syz.4.2166': attribute type 1 has an invalid length. [ 281.665718][T13718] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2165'. [ 281.703503][T13718] veth1_macvtap: left promiscuous mode [ 281.709724][T13718] macsec0: entered promiscuous mode [ 281.716067][T13718] macsec0: entered allmulticast mode [ 281.723976][T13730] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2168'. [ 281.726712][T13718] veth1_macvtap: entered promiscuous mode [ 281.758090][T13718] veth1_macvtap: entered allmulticast mode [ 281.765158][T13718] macsec0: left promiscuous mode [ 281.770497][T13718] macsec0: left allmulticast mode [ 281.777589][T13718] veth1_macvtap: left allmulticast mode [ 281.784688][T13734] netlink: 'syz.2.2165': attribute type 1 has an invalid length. [ 282.068053][T13750] tipc: Enabled bearer , priority 0 [ 282.237349][T13759] netlink: 'syz.1.2178': attribute type 1 has an invalid length. [ 282.271696][T13759] netlink: 'syz.1.2178': attribute type 1 has an invalid length. [ 282.650504][T13790] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 282.942843][T13774] bridge0: port 1(syz_tun) entered disabled state [ 282.961983][T13774] syz_tun: left allmulticast mode [ 282.967278][T13774] syz_tun: left promiscuous mode [ 282.973183][T13774] bridge0: port 1(syz_tun) entered disabled state [ 283.168909][T13774] bond0: (slave bridge_slave_1): Releasing backup interface [ 283.186166][T13774] bond0: (slave bond_slave_0): Releasing backup interface [ 283.205072][T13774] bond0: (slave bond_slave_1): Releasing backup interface [ 283.233076][T13774] team0: Port device team_slave_0 removed [ 283.261878][T13774] team0: Port device team_slave_1 removed [ 283.480886][T13774] bond0: (slave wlan1): Releasing backup interface [ 283.509031][T13774] bond2: (slave bridge1): Releasing backup interface [ 283.529319][T13774] team0: Port device bridge2 removed [ 283.544726][T13774] veth1_vlan: left allmulticast mode [ 283.629511][T13799] lo: Caught tx_queue_len zero misconfig [ 283.660434][T13811] netlink: 'syz.3.2193': attribute type 3 has an invalid length. [ 283.683834][ T7307] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.700342][T13811] netlink: 'syz.3.2193': attribute type 1 has an invalid length. [ 283.704678][ T5155] wg1 speed is unknown, defaulting to 1000 [ 283.712626][ T7307] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.737701][ T7307] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 283.749332][ T5155] syz2: Port: 1 Link DOWN [ 283.762641][ T7307] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.795311][ T7307] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.823904][ T7307] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 283.859180][ T7307] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.889619][ T7307] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.899473][ T7307] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 283.912092][ T7307] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.921103][ T7307] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.932211][ T7307] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 283.966883][T13824] pim6reg: entered allmulticast mode [ 284.202393][T13836] vlan3: entered promiscuous mode [ 284.218499][T13836] geneve1: entered promiscuous mode [ 284.236673][T13836] vlan3: entered allmulticast mode [ 284.257586][T13838] __nla_validate_parse: 6 callbacks suppressed [ 284.257603][T13838] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2201'. [ 284.474685][T13856] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2208'. [ 284.511759][T13855] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2208'. [ 284.595112][T13875] IPVS: sh: FWM 3 0x00000003 - no destination available [ 284.618900][T13875] netlink: 'syz.1.2210': attribute type 11 has an invalid length. [ 284.751870][T13881] mac80211_hwsim hwsim7 syzkaller0: Caught tx_queue_len zero misconfig [ 284.871305][ T5832] block nbd1: Receive control failed (result -32) [ 285.261939][T13909] netlink: 'syz.2.2221': attribute type 1 has an invalid length. [ 285.325068][T13917] xt_hashlimit: overflow, try lower: 3/0 [ 285.880943][T13951] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2235'. [ 285.895157][T13949] bridge7: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 286.071031][T13962] netlink: 'syz.4.2239': attribute type 4 has an invalid length. [ 286.092386][T13963] netlink: 'syz.4.2239': attribute type 4 has an invalid length. [ 286.632432][T13995] xt_cgroup: invalid path, errno=-2 [ 286.648742][T13999] SET target dimension over the limit! [ 286.712426][T14002] netlink: 'syz.0.2248': attribute type 2 has an invalid length. [ 286.741372][T14002] netlink: 'syz.0.2248': attribute type 2 has an invalid length. [ 286.795784][T14006] netlink: 176 bytes leftover after parsing attributes in process `syz.4.2252'. [ 286.830701][T14005] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2251'. [ 286.920084][T14008] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2253'. [ 287.273257][T14024] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2259'. [ 287.287364][T14020] Unsupported ieee802154 address type: 0 [ 287.295563][T14023] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2258'. [ 287.349588][T14020] ip6tnl1: entered allmulticast mode [ 287.393270][T14030] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2261'. [ 287.509160][T14037] Bluetooth: hci2: Opcode 0x0401 failed: -22 [ 287.752298][T14052] syzkaller0: entered promiscuous mode [ 287.765511][T14052] syzkaller0: entered allmulticast mode [ 288.253873][T14078] IPVS: set_ctl: invalid protocol: 94 224.0.0.1:20004 [ 288.265033][T14077] netlink: 'syz.4.2277': attribute type 3 has an invalid length. [ 288.320378][T14080] syzkaller1: entered promiscuous mode [ 288.329286][T14080] syzkaller1: entered allmulticast mode [ 288.417213][T14086] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 288.425788][T14086] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 288.726933][T14112] netlink: 'syz.3.2288': attribute type 1 has an invalid length. [ 288.943835][T14125] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 289.019813][T14128] veth5: entered promiscuous mode [ 289.038612][T14128] netlink: 'syz.3.2291': attribute type 2 has an invalid length. [ 289.064952][T14128] netlink: 'syz.3.2291': attribute type 2 has an invalid length. [ 289.171149][T14142] netlink: 'syz.0.2294': attribute type 4 has an invalid length. [ 289.189242][T14142] .`¹: renamed from bond0 [ 289.289322][T14143] 8021q: adding VLAN 0 to HW filter on device bond7 [ 289.719414][T14177] __nla_validate_parse: 11 callbacks suppressed [ 289.719431][T14177] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2305'. [ 289.923777][T14177] 8021q: adding VLAN 0 to HW filter on device bond0 [ 289.932040][T14194] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2309'. [ 290.027453][T14196] netlink: 248 bytes leftover after parsing attributes in process `syz.3.2310'. [ 290.565341][T14239] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2326'. [ 290.680236][T14247] mac80211_hwsim hwsim9 ÿ: renamed from wlan1 [ 290.743521][T14250] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2330'. [ 290.767698][T14252] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 291.003895][T14263] bridge6: entered promiscuous mode [ 291.009444][T14263] bridge6: entered allmulticast mode [ 291.017307][T14263] team0: Port device bridge6 added [ 291.159371][T14263] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2336'. [ 291.340547][T14271] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2339'. [ 291.375235][T14271] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2339'. [ 291.459827][T14278] validate_nla: 2 callbacks suppressed [ 291.459844][T14278] netlink: 'syz.2.2341': attribute type 1 has an invalid length. [ 291.571125][T14283] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 291.683188][T14293] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2344'. [ 291.966945][T14300] 8021q: adding VLAN 0 to HW filter on device bond8 [ 291.997158][T14300] bridge0: port 1(bond8) entered blocking state [ 292.030609][T14300] bridge0: port 1(bond8) entered disabled state [ 292.058702][T14300] bond8: entered allmulticast mode [ 292.080499][T14300] bond8: entered promiscuous mode [ 292.090303][T14321] netlink: 'syz.3.2352': attribute type 1 has an invalid length. [ 292.114008][T14321] netlink: 'syz.3.2352': attribute type 3 has an invalid length. [ 292.134337][T14308] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2349'. [ 292.227628][T14327] x_tables: unsorted underflow at hook 1 [ 292.416298][T14327] syzkaller0: entered promiscuous mode [ 292.430584][T14327] syzkaller0: entered allmulticast mode [ 292.587876][T14345] x_tables: unsorted entry at hook 3 [ 292.733161][T14348] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 293.051107][T14374] syzkaller1: entered promiscuous mode [ 293.061381][T14374] syzkaller1: entered allmulticast mode [ 293.445780][T14388] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 294.104865][T14423] openvswitch: netlink: VXLAN extension 0 has unexpected len 2 expected 0 [ 294.164075][T14421] syzkaller0: entered promiscuous mode [ 294.169592][T14421] syzkaller0: entered allmulticast mode [ 294.541245][T14440] netlink: 'syz.1.2382': attribute type 1 has an invalid length. [ 296.448793][T14439] macvtap1: entered promiscuous mode [ 296.454284][T14439] vlan0: entered promiscuous mode [ 296.463016][T14439] macvtap1: entered allmulticast mode [ 296.506023][T14449] __nla_validate_parse: 14 callbacks suppressed [ 296.506041][T14449] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2385'. [ 296.728606][T14472] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2390'. [ 296.807664][T14476] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2393'. [ 296.897335][T14481] openvswitch: netlink: IPv4 tun info is not correct [ 297.145963][T14499] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2400'. [ 297.197174][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.221490][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.223585][T14499] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 297.239485][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.304240][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.363620][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.381694][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.393896][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.402595][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.410311][T14505] openvswitch: netlink: IP tunnel dst address not specified [ 297.424056][T14515] bond0: option resend_igmp: invalid value (32767) [ 297.456283][T14515] bond0: option resend_igmp: allowed values 0 - 255 [ 297.475660][T14515] bond0 (unregistering): Released all slaves [ 298.106562][T14575] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2421'. [ 298.130017][T14575] netlink: 'syz.3.2421': attribute type 1 has an invalid length. [ 298.140258][T14575] netlink: 'syz.3.2421': attribute type 2 has an invalid length. [ 298.155759][T14580] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2421'. [ 298.166327][T14580] netlink: 'syz.3.2421': attribute type 1 has an invalid length. [ 298.174297][T14580] netlink: 'syz.3.2421': attribute type 2 has an invalid length. [ 298.443435][T14602] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2431'. [ 298.555967][T14607] vethmacvtap: renamed from veth0_vlan [ 298.588854][T14621] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2433'. [ 298.643777][T14621] netlink: 100 bytes leftover after parsing attributes in process `syz.3.2433'. [ 298.685698][T14609] syzkaller0: entered promiscuous mode [ 298.695863][T14609] syzkaller0: entered allmulticast mode [ 299.371610][T14671] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2446'. [ 299.473749][T14682] netlink: 'syz.2.2447': attribute type 1 has an invalid length. [ 299.566211][T14671] can: request_module (can-proto-0) failed. [ 300.287076][ T5487] vethmacvtap: left promiscuous mode [ 300.383740][ T5487] vethmacvtap: entered promiscuous mode [ 300.479664][T14728] tipc: Enabling of bearer rejected, already enabled [ 300.502090][T14728] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 300.513303][T14728] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 300.810224][T14739] bridge9: entered promiscuous mode [ 300.834704][T14739] bridge9: entered allmulticast mode [ 300.878249][T14739] team0: Port device bridge9 added [ 300.977421][T14765] x_tables: duplicate underflow at hook 2 [ 301.106248][T14770] netlink: 'syz.0.2469': attribute type 9 has an invalid length. [ 301.185604][T14770] netlink: 'syz.0.2469': attribute type 2 has an invalid length. [ 301.195452][T14776] netlink: 'syz.3.2470': attribute type 1 has an invalid length. [ 301.204917][T14770] netlink: 'syz.0.2469': attribute type 2 has an invalid length. [ 302.153931][T14835] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 302.176092][T14835] bond0 (unregistering): Released all slaves [ 302.249239][T14845] netlink: 'syz.0.2489': attribute type 2 has an invalid length. [ 302.279761][T14846] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 302.393351][T14853] __nla_validate_parse: 7 callbacks suppressed [ 302.393369][T14853] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2491'. [ 302.421739][T14853] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2491'. [ 302.646950][T14869] vlan4: entered allmulticast mode [ 302.661341][T14869] bond0: entered allmulticast mode [ 302.727667][T14877] xt_TCPMSS: Only works on TCP SYN packets [ 303.156268][T14903] validate_nla: 2 callbacks suppressed [ 303.156286][T14903] netlink: 'syz.4.2506': attribute type 1 has an invalid length. [ 303.158148][T14904] net_ratelimit: 25 callbacks suppressed [ 303.158164][T14904] IPv6: addrconf: prefix option has invalid lifetime [ 303.176234][T14903] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2506'. [ 303.226941][T14903] netlink: 658 bytes leftover after parsing attributes in process `syz.4.2506'. [ 303.265878][T14903] netlink: 'syz.4.2506': attribute type 1 has an invalid length. [ 303.455325][T14924] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2509'. [ 303.498845][T14926] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2511'. [ 303.543577][T14931] IPVS: length: 8 != 1152 [ 303.622273][T14938] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2513'. [ 303.650600][T14938] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2513'. [ 303.742325][T14944] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 303.829563][T14953] netlink: 'syz.0.2520': attribute type 11 has an invalid length. [ 303.840509][T14953] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.2520'. [ 303.874828][T14953] netlink: 'syz.0.2520': attribute type 8 has an invalid length. [ 303.880741][T14962] netlink: 'syz.0.2520': attribute type 8 has an invalid length. [ 303.957715][T14965] Cannot find del_set index 4 as target [ 304.509275][T14994] pim6reg1: entered promiscuous mode [ 304.530512][T14994] pim6reg1: entered allmulticast mode [ 304.556921][T14994] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2529'. [ 304.800498][T14997] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 304.894468][T15021] tipc: Enabling of bearer rejected, failed to enable media [ 304.988615][T15027] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 305.296733][T15043] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 305.420404][T15035] netlink: 'syz.0.2544': attribute type 16 has an invalid length. [ 305.438452][T15035] netlink: 'syz.0.2544': attribute type 17 has an invalid length. [ 305.453176][T15051] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 305.453926][T15035] lo: left allmulticast mode [ 305.517812][T15035] tunl0: left allmulticast mode [ 305.538510][T15035] gre0: left allmulticast mode [ 305.565195][T15035] gretap0: left allmulticast mode [ 305.600107][T15035] ip_vti0: left allmulticast mode [ 305.617039][T15035] ip6_vti0: left allmulticast mode [ 305.624550][T15035] sit0: left allmulticast mode [ 305.644807][T15035] ip6tnl0: left allmulticast mode [ 305.652929][T15035] ip6gre0: left allmulticast mode [ 305.659842][T15035] syz_tun: left allmulticast mode [ 305.672136][T15035] vcan0: left allmulticast mode [ 305.685160][T15035] .`¹: left allmulticast mode [ 305.700988][T15035] 8021q: adding VLAN 0 to HW filter on device .`¹ [ 305.721793][T15035] team0: left allmulticast mode [ 305.728973][T15035] dummy0: left allmulticast mode [ 305.737853][T15035] nlmon0: left allmulticast mode [ 305.744714][T15035] caif0: left allmulticast mode [ 305.756279][T15035] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 306.575536][T15116] netlink: 'syz.4.2565': attribute type 1 has an invalid length. [ 306.866094][T15129] netlink: 'syz.3.2568': attribute type 4 has an invalid length. [ 306.899551][T15132] syzkaller0: entered promiscuous mode [ 306.906757][T15129] netlink: 'syz.3.2568': attribute type 4 has an invalid length. [ 306.925742][T15132] syzkaller0: entered allmulticast mode [ 307.663277][T15183] __nla_validate_parse: 13 callbacks suppressed [ 307.663294][T15183] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2585'. [ 307.743500][T15187] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2585'. [ 307.776742][T15177] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 308.017073][T15197] bond9: option arp_all_targets: invalid value (18446744073709551613) [ 308.029876][T15197] bond9 (unregistering): Released all slaves [ 308.059527][T15207] x_tables: duplicate underflow at hook 3 [ 308.510883][T15233] netlink: 'syz.2.2600': attribute type 142 has an invalid length. [ 308.649589][T15239] bridge6: the hash_elasticity option has been deprecated and is always 16 [ 308.829064][T15253] netlink: 'syz.4.2605': attribute type 2 has an invalid length. [ 308.848242][T15254] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2606'. [ 308.929313][T15261] bond9: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 308.947998][T15261] bond9 (unregistering): Released all slaves [ 308.964821][T15264] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2610'. [ 309.003345][T15264] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2610'. [ 309.093863][T15270] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2611'. [ 309.123524][T15270] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2611'. [ 309.159130][T15277] netlink: 'syz.4.2612': attribute type 1 has an invalid length. [ 309.234369][T15280] bond9: option arp_all_targets: invalid value (18446744073709551613) [ 309.246700][T15280] bond9 (unregistering): Released all slaves [ 309.563025][ T5832] block nbd2: Receive control failed (result -32) [ 309.909641][T15328] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2625'. [ 309.999065][T15294] xt_connbytes: Forcing CT accounting to be enabled [ 310.218240][T15350] netlink: 'syz.2.2629': attribute type 1 has an invalid length. [ 310.243510][T15350] netlink: 'syz.2.2629': attribute type 1 has an invalid length. [ 310.551642][T15364] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2634'. [ 310.689034][T15376] netlink: 'syz.2.2637': attribute type 11 has an invalid length. [ 310.709944][T15368] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2635'. [ 312.470421][T15477] IPv6: addrconf: prefix option has invalid lifetime [ 312.501034][T15486] bond4: option mode: unable to set because the bond device has slaves [ 312.511561][T15484] openvswitch: netlink: Message has 5 unknown bytes. [ 312.520528][T15486] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 312.550002][T15486] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 312.724756][T15490] __nla_validate_parse: 6 callbacks suppressed [ 312.724774][T15490] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2664'. [ 312.750155][T15490] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2664'. [ 312.973854][T15506] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2669'. [ 313.126297][T15517] team0: Port device bridge6 removed [ 313.455263][T15540] netlink: 'syz.3.2675': attribute type 22 has an invalid length. [ 313.476567][T15544] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2677'. [ 313.497357][T15540] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2675'. [ 313.523365][T15544] bond0: Caught tx_queue_len zero misconfig [ 313.542259][T15544] netlink: 6 bytes leftover after parsing attributes in process `syz.2.2677'. [ 313.565260][T15553] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2678'. [ 313.585618][T15540] netlink: 'syz.3.2675': attribute type 22 has an invalid length. [ 313.613461][T15540] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2675'. [ 313.616402][T15550] netlink: 'syz.4.2678': attribute type 51 has an invalid length. [ 313.645081][T15552] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2679'. [ 313.805263][T15561] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2680'. [ 314.059423][T15567] lo speed is unknown, defaulting to 1000 [ 314.085145][T15567] wg1 speed is unknown, defaulting to 1000 [ 314.212970][ T5155] IPVS: starting estimator thread 0... [ 314.341770][T15596] IPVS: using max 30 ests per chain, 72000 per kthread [ 314.589335][T15624] vlan0: entered promiscuous mode [ 314.660949][T15631] netlink: 'syz.0.2697': attribute type 1 has an invalid length. [ 314.675376][ T5155] wg1 speed is unknown, defaulting to 1000 [ 314.676224][T15629] netlink: 'syz.0.2697': attribute type 1 has an invalid length. [ 314.695306][ T5155] syz2: Port: 1 Link ACTIVE [ 314.868815][T15636] bond0: (slave ip6tnl3): The slave device specified does not support setting the MAC address [ 314.915727][T15636] bond0: (slave ip6tnl3): Error -95 calling set_mac_address [ 315.148340][T15655] Cannot find set identified by id 65534 to match [ 315.877223][T15715] nbd: must specify a size in bytes for the device [ 316.095387][T15724] netlink: 'syz.1.2719': attribute type 2 has an invalid length. [ 316.436232][T15746] IPv6: NLM_F_CREATE should be specified when creating new route [ 316.487300][T15746] IPv6: NLM_F_REPLACE set, but no existing node found! [ 316.543776][T15748] netlink: 'syz.0.2723': attribute type 22 has an invalid length. [ 316.574745][T15748] netlink: 'syz.0.2723': attribute type 22 has an invalid length. [ 316.796807][T15764] netlink: get zone limit has 4 unknown bytes [ 317.117167][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.123842][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.135462][ T1299] aoe: packet could not be sent on ipvlan0. consider increasing tx_queue_len [ 317.285751][T15794] netlink: 'syz.4.2734': attribute type 1 has an invalid length. [ 317.607734][T15812] netlink: 'syz.1.2741': attribute type 1 has an invalid length. [ 317.620879][T15818] netlink: 'syz.2.2743': attribute type 1 has an invalid length. [ 317.733383][T15812] 8021q: adding VLAN 0 to HW filter on device bond8 [ 317.742807][T15822] __nla_validate_parse: 21 callbacks suppressed [ 317.742826][T15822] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2745'. [ 317.762349][T15812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 317.771479][T15812] bond8: (slave batadv0): making interface the new active one [ 317.780039][T15812] bond8: (slave batadv0): Enslaving as an active interface with an up link [ 317.800359][T15822] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2745'. [ 317.849956][ T7304] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 317.860231][ T7304] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 317.884150][ T7304] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 317.901655][ T7306] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 318.184310][T15854] veth7: entered promiscuous mode [ 318.191335][T15854] veth7: entered allmulticast mode [ 318.440282][T15869] syzkaller1: entered promiscuous mode [ 318.453023][T15869] syzkaller1: entered allmulticast mode [ 318.529588][T15877] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.550467][T15877] netlink: 59 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.562271][T15877] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.572297][T15877] netlink: 59 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.587761][T15877] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.599899][T15877] netlink: 59 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.610072][T15877] validate_nla: 10 callbacks suppressed [ 318.610086][T15877] netlink: 'syz.4.2764': attribute type 12 has an invalid length. [ 318.661122][T15877] netlink: 'syz.4.2764': attribute type 29 has an invalid length. [ 318.696479][T15877] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.706484][T15877] netlink: 59 bytes leftover after parsing attributes in process `syz.4.2764'. [ 318.717989][T15877] netlink: 'syz.4.2764': attribute type 12 has an invalid length. [ 318.726622][T15877] netlink: 'syz.4.2764': attribute type 29 has an invalid length. [ 318.750496][T15877] netlink: 'syz.4.2764': attribute type 12 has an invalid length. [ 318.773341][T15877] netlink: 'syz.4.2764': attribute type 29 has an invalid length. [ 318.815341][T15877] netlink: 'syz.4.2764': attribute type 12 has an invalid length. [ 318.844477][T15877] netlink: 'syz.4.2764': attribute type 29 has an invalid length. [ 318.865628][T15877] netlink: 'syz.4.2764': attribute type 12 has an invalid length. [ 318.897501][T15877] netlink: 'syz.4.2764': attribute type 29 has an invalid length. [ 319.154624][T15907] tc_dump_action: action bad kind [ 319.279680][T15908] xt_CT: No such helper "syz1" [ 319.573016][T15933] SET target dimension over the limit! [ 320.041917][T15961] syzkaller1: entered promiscuous mode [ 320.054496][T15961] syzkaller1: entered allmulticast mode [ 320.490200][T15993] ip6tnl0: Caught tx_queue_len zero misconfig [ 320.504641][T15988] syzkaller0: entered promiscuous mode [ 320.523583][T15988] syzkaller0: entered allmulticast mode [ 320.649994][T15999] xt_limit: Overflow, try lower: 604147548/4200216962 [ 320.675292][T15999] openvswitch: netlink: Unknown key attributes 2 [ 320.689025][T16002] veth0: entered promiscuous mode [ 320.714254][T15999] xfrm3: entered promiscuous mode [ 320.719339][T15999] xfrm3: entered allmulticast mode [ 320.745647][T15998] veth0: left promiscuous mode [ 320.765135][T16003] bond0: entered promiscuous mode [ 320.774418][T16003] gretap0: entered promiscuous mode [ 320.781035][T16003] bond0: left promiscuous mode [ 320.787647][T16003] gretap0: left promiscuous mode [ 321.043036][T16021] : entered promiscuous mode [ 321.146515][T16028] IPVS: Error joining to the multicast group [ 321.174099][T16032] tipc: Enabling of bearer rejected, failed to enable media [ 321.247474][T16034] openvswitch: netlink: nsh attr 13535 is out of range max 3 [ 321.303146][T16040] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 321.402034][T16047] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 321.468840][T16053] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 321.637437][T16060] xt_CT: You must specify a L4 protocol and not use inversions on it [ 321.845296][T16059] bond9: (slave sit0): Device is not bonding slave [ 321.859391][T16059] bond9: option active_slave: invalid value (sit0) [ 321.870897][T16059] bond9 (unregistering): Released all slaves [ 321.921045][T16075] ±ÿÿÿÿa–ïD: renamed from lo (while UP) [ 321.951058][T16078] bond9: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 321.978377][T16078] bond9 (unregistering): Released all slaves [ 322.078349][T16073] bond7: option mode: invalid value (133) [ 322.086183][T16073] bond7 (unregistering): Released all slaves [ 322.464918][T16096] ¾x9ÿ: left allmulticast mode [ 322.542807][T16096] vethmacvtap: left promiscuous mode [ 322.656521][T16096] bond2: left promiscuous mode [ 322.682621][T16096] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode [ 322.699084][T16096] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode [ 322.724311][T16096] vlan3: left allmulticast mode [ 322.729471][T16096] gretap0: left allmulticast mode [ 322.743136][T16096] bond3: left promiscuous mode [ 322.748086][T16096] bond3: left allmulticast mode [ 322.760826][T16096] bond5: left promiscuous mode [ 322.768628][T16096] ip6gre1: left promiscuous mode [ 322.777643][T16096] vcan1: left promiscuous mode [ 322.783108][T16096] vcan1: left allmulticast mode [ 322.799325][T16096] xfrm3: left promiscuous mode [ 322.805253][T16096] xfrm3: left allmulticast mode [ 322.873825][T16123] tipc: Enabled bearer , priority 0 [ 322.905200][ T149] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 322.950566][ T149] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.031526][T16131] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 323.059286][T16146] __nla_validate_parse: 140 callbacks suppressed [ 323.059304][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.072615][T16131] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 323.124682][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.161083][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.200100][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.239343][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.264583][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.298552][T16127] syzkaller0: entered promiscuous mode [ 323.306856][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.318176][T16127] syzkaller0: entered allmulticast mode [ 323.336451][T16127] tipc: Resetting bearer [ 323.354278][ T149] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 323.359456][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.381869][ T149] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.404691][ T149] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 323.422174][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.423244][ T149] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.456389][T16146] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2835'. [ 323.466011][T16100] tipc: Resetting bearer [ 323.965671][T16180] IPv6: NLM_F_CREATE should be specified when creating new route [ 324.028598][T16182] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 325.286137][T16199] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 326.019123][T16100] tipc: Disabling bearer [ 326.028897][ T149] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 326.039154][ T149] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.342834][T16208] validate_nla: 119 callbacks suppressed [ 326.342854][T16208] netlink: 'syz.2.2846': attribute type 2 has an invalid length. [ 326.654240][T16239] macvlan0: entered allmulticast mode [ 326.666213][T16239] dummy0: entered allmulticast mode [ 326.697974][T16235] netlink: 'syz.0.2854': attribute type 1 has an invalid length. [ 326.876806][T16235] 8021q: adding VLAN 0 to HW filter on device bond9 [ 327.001068][T16251] tipc: Enabled bearer , priority 0 [ 327.027173][T16251] syzkaller0: entered promiscuous mode [ 327.060472][T16251] syzkaller0: entered allmulticast mode [ 327.122767][T16255] tipc: Resetting bearer [ 327.282196][T16250] tipc: Resetting bearer [ 327.364018][T16250] tipc: Disabling bearer [ 327.395240][T16280] netlink: 'syz.2.2867': attribute type 21 has an invalid length. [ 327.654859][T16292] netlink: 'syz.4.2869': attribute type 64 has an invalid length. [ 327.665224][T16296] netlink: 'syz.0.2871': attribute type 1 has an invalid length. [ 327.703214][T16291] gretap0: entered promiscuous mode [ 327.730599][T16291] gretap0: left promiscuous mode [ 328.071098][T16296] __nla_validate_parse: 45 callbacks suppressed [ 328.071119][T16296] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2871'. [ 328.316359][T16326] nbd: nbd1 already in use [ 328.446015][T16337] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2877'. [ 328.473482][T16337] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2877'. [ 328.517481][T16339] tipc: Enabled bearer , priority 10 [ 328.945546][T16371] bond0: entered promiscuous mode [ 328.972294][T16371] batadv0: entered promiscuous mode [ 328.988988][T16371] debugfs: 'hsr0' already exists in 'hsr' [ 329.004473][T16373] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2886'. [ 329.020459][T16371] Cannot create hsr debugfs directory [ 329.028286][T16371] hsr0: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 329.042407][T16371] hsr0: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 329.058265][T16371] batadv0: port 1(hsr0) entered blocking state [ 329.066916][T16371] batadv0: port 1(hsr0) entered disabled state [ 329.084149][T16371] hsr0: entered allmulticast mode [ 329.096054][T16371] bond0: entered allmulticast mode [ 329.107825][T16371] batadv0: entered allmulticast mode [ 329.133763][T16371] hsr0: left allmulticast mode [ 329.144462][T16371] bond0: left allmulticast mode [ 329.155815][T16371] batadv0: left allmulticast mode [ 329.170781][T16371] bond0: left promiscuous mode [ 329.196120][T16371] batadv0: left promiscuous mode [ 329.608688][T16402] delete_channel: no stack [ 329.657377][T16399] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 329.717874][T16406] team_slave_1: Caught tx_queue_len zero misconfig [ 329.916687][T16417] xt_hashlimit: size too large, truncated to 1048576 [ 330.102739][T16439] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 330.127185][T16439] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 330.733525][T16466] openvswitch: netlink: Invalid VLAN frame [ 330.743633][T16467] syz_tun: left allmulticast mode [ 330.763023][T16467] syz_tun: left promiscuous mode [ 330.785648][T16467] bridge0: port 4(syz_tun) entered disabled state [ 330.827943][T16467] batman_adv: batadv0: Removing interface: dummy0 [ 330.863839][T16467] bridge_slave_0: left allmulticast mode [ 330.882391][T16467] bridge_slave_0: left promiscuous mode [ 330.900297][T16467] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.933742][T16467] bridge_slave_1: left allmulticast mode [ 330.951347][T16467] bridge_slave_1: left promiscuous mode [ 330.973180][T16467] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.010634][T16467] bond6: (slave veth0_to_bond): Releasing active interface [ 331.063092][T16467] team0: Port device team_slave_0 removed [ 331.093768][T16467] team0: Port device team_slave_1 removed [ 331.104413][ T5830] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 331.120911][ T5830] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 331.122462][T16467] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 331.138553][ T5830] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 331.154931][ T5830] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 331.162712][T16485] netlink: 16215 bytes leftover after parsing attributes in process `syz.2.2905'. [ 331.174749][ T5830] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 331.204003][T16467] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 331.271087][T16467] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 331.310079][ T5832] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 331.320076][ T5832] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 331.330204][ T5832] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 331.345695][ T5832] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 331.354359][ T5832] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 331.475724][T16476] tipc: Enabling of bearer rejected, already enabled [ 331.513356][T16480] syzkaller0: mtu less than device minimum [ 331.673250][T16478] lo speed is unknown, defaulting to 1000 [ 331.697133][T16478] wg1 speed is unknown, defaulting to 1000 [ 331.820547][T16509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2910'. [ 331.865262][T16509] netlink: 'syz.2.2910': attribute type 1 has an invalid length. [ 331.898217][T16509] netlink: 'syz.2.2910': attribute type 2 has an invalid length. [ 331.964148][T16514] netlink: 'syz.0.2912': attribute type 2 has an invalid length. [ 332.128826][T16532] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2915'. [ 332.397355][T16478] chnl_net:caif_netlink_parms(): no params data found [ 332.717160][T16566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2918'. [ 332.779221][T16573] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2923'. [ 332.968286][T16478] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.992549][T16478] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.004929][T16478] bridge_slave_0: entered allmulticast mode [ 333.022856][T16478] bridge_slave_0: entered promiscuous mode [ 333.064934][T16478] bridge0: port 2(bridge_slave_1) entered blocking state [ 333.082460][T16478] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.098096][T16478] bridge_slave_1: entered allmulticast mode [ 333.133111][T16478] bridge_slave_1: entered promiscuous mode [ 333.208773][T16478] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 333.248103][T16478] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 333.268371][T16588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2928'. [ 333.305107][T16585] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2927'. [ 333.343783][T16478] team0: Port device team_slave_0 added [ 333.389032][T16478] team0: Port device team_slave_1 added [ 333.431250][ T5830] Bluetooth: hci5: command tx timeout [ 333.499336][T16597] Bluetooth: hci0: Opcode 0x0c20 failed: -22 [ 333.522894][T16478] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 333.536972][T16478] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 333.547339][T16597] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 333.563946][T16478] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 333.588917][T16478] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 333.605661][T16478] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 333.641305][T16478] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 333.726751][T16478] hsr_slave_0: entered promiscuous mode [ 333.733865][T16478] hsr_slave_1: entered promiscuous mode [ 333.744367][T16478] debugfs: 'hsr0' already exists in 'hsr' [ 333.769686][T16478] Cannot create hsr debugfs directory [ 333.785726][T16602] ieee802154 phy0 wpan0: encryption failed: -22 [ 333.978857][T16610] netlink: 'syz.1.2936': attribute type 13 has an invalid length. [ 334.224004][T16629] mac80211_hwsim hwsim11 ÿ: renamed from wlan1 [ 334.559321][T16648] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2944'. [ 334.902830][T16671] netlink: 'syz.2.2948': attribute type 6 has an invalid length. [ 335.138961][T16686] sctp: [Deprecated]: syz.2.2951 (pid 16686) Use of struct sctp_assoc_value in delayed_ack socket option. [ 335.138961][T16686] Use struct sctp_sack_info instead [ 335.454306][T16478] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 335.486059][T16478] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 335.510764][T16478] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 335.520938][ T5830] Bluetooth: hci5: command tx timeout [ 335.545484][T16478] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 335.559789][T16478] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 335.590566][T16478] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 335.598970][T16478] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 335.618002][T16478] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 335.625624][T16707] netlink: 'syz.4.2958': attribute type 1 has an invalid length. [ 335.885438][T16478] 8021q: adding VLAN 0 to HW filter on device bond0 [ 335.917153][T16478] 8021q: adding VLAN 0 to HW filter on device team0 [ 335.935281][ T7304] bridge0: port 1(bridge_slave_0) entered blocking state [ 335.942471][ T7304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 335.952402][T16730] netlink: 'syz.1.2965': attribute type 4 has an invalid length. [ 335.960822][T16730] netlink: 'syz.1.2965': attribute type 1 has an invalid length. [ 335.974196][T16730] netlink: 228 bytes leftover after parsing attributes in process `syz.1.2965'. [ 336.015809][ T7304] bridge0: port 2(bridge_slave_1) entered blocking state [ 336.023040][ T7304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 336.145933][T16697] syz.2.2953 (16697) used greatest stack depth: 17560 bytes left [ 336.315588][T16747] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2968'. [ 336.361040][T16747] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2968'. [ 336.421916][T16755] tipc: Enabled bearer , priority 0 [ 336.446127][T16758] syzkaller0: entered promiscuous mode [ 336.462300][T16758] syzkaller0: entered allmulticast mode [ 336.487233][T16753] tipc: Resetting bearer [ 336.497996][T16767] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2973'. [ 336.536391][T16753] tipc: Disabling bearer [ 336.578463][ T57] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20002 - 0 [ 336.589938][T16764] netlink: 16215 bytes leftover after parsing attributes in process `syz.2.2972'. [ 336.607546][ T57] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20002 - 0 [ 336.623943][ T57] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20002 - 0 [ 336.634030][ T57] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20002 - 0 [ 336.670458][T16478] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 336.704137][ T5830] block nbd3: Receive control failed (result -32) [ 336.727563][T16764] netlink: 'syz.2.2972': attribute type 1 has an invalid length. [ 336.769757][T16478] veth0_vlan: entered promiscuous mode [ 336.813744][T16478] veth1_vlan: entered promiscuous mode [ 336.940344][T16478] veth0_macvtap: entered promiscuous mode [ 336.953356][T16478] veth1_macvtap: entered promiscuous mode [ 336.974463][T16478] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 337.008109][T16478] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 337.049257][ T7306] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.074642][ T7306] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.102834][ T7306] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.112210][T16798] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2982'. [ 337.137871][ T7306] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 337.295188][T16801] netlink: 536 bytes leftover after parsing attributes in process `syz.0.2983'. [ 337.322160][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.354625][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.419712][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.443207][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.592304][ T5830] Bluetooth: hci5: command tx timeout [ 337.612576][T16816] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 337.674260][T16821] pim6reg527: entered allmulticast mode [ 337.816699][T16829] sctp: [Deprecated]: syz.2.2990 (pid 16829) Use of struct sctp_assoc_value in delayed_ack socket option. [ 337.816699][T16829] Use struct sctp_sack_info instead [ 337.912296][T16817] nbd4: detected capacity change from 0 to 63 [ 337.926966][ T5830] block nbd4: Receive control failed (result -104) [ 337.927466][ T5832] block nbd4: Receive control failed (result -32) [ 337.943711][T13395] block nbd4: Send control failed (result -32) [ 337.956711][T13395] block nbd4: Request send failed, requeueing [ 337.979623][ T1689] block nbd4: Dead connection, failed to find a fallback [ 337.992561][ T1689] block nbd4: shutting down sockets [ 337.999163][ T1689] blk_print_req_error: 138 callbacks suppressed [ 337.999181][ T1689] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 338.015872][ T1689] buffer_io_error: 138 callbacks suppressed [ 338.015889][ T1689] Buffer I/O error on dev nbd4, logical block 2, async page read [ 338.031800][T13395] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 338.040944][T13395] Buffer I/O error on dev nbd4, logical block 3, async page read [ 338.100858][T16835] netlink: 'syz.1.2994': attribute type 1 has an invalid length. [ 338.368426][T16845] __nla_validate_parse: 1 callbacks suppressed [ 338.368444][T16845] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2998'. [ 338.473085][ T5830] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 338.486673][ T5830] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 338.495966][ T5830] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 338.518988][ T5830] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 338.532715][ T5830] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 338.882388][T16850] lo speed is unknown, defaulting to 1000 [ 338.924455][T16850] wg1 speed is unknown, defaulting to 1000 [ 339.127176][T16879] netlink: 596 bytes leftover after parsing attributes in process `syz.2.3008'. [ 339.161924][T16879] netlink: 'syz.2.3008': attribute type 1 has an invalid length. [ 339.297345][T16879] 8021q: adding VLAN 0 to HW filter on device bond8 [ 339.325985][T16897] netlink: 'syz.1.3011': attribute type 1 has an invalid length. [ 339.334309][T16897] netlink: 'syz.1.3011': attribute type 2 has an invalid length. [ 339.345416][T16890] vlan5: entered promiscuous mode [ 339.365388][T16890] bond8: entered promiscuous mode [ 339.384651][T16890] vlan5: entered allmulticast mode [ 339.395517][T16890] bond8: entered allmulticast mode [ 339.420103][T16900] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 339.451699][T16879] lo speed is unknown, defaulting to 1000 [ 339.567680][T16890] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 339.593706][T16890] bond8: (slave batadv2): making interface the new active one [ 339.602635][T16890] batadv2: entered promiscuous mode [ 339.608140][T16890] batadv2: entered allmulticast mode [ 339.615524][T16890] bond8: (slave batadv2): Enslaving as an active interface with an up link [ 339.658817][T16911] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3014'. [ 339.672357][ T5830] Bluetooth: hci5: command tx timeout [ 339.677630][T16911] netlink: 'syz.4.3014': attribute type 1 has an invalid length. [ 339.685889][T16911] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3014'. [ 339.714618][T16899] syzkaller1: entered promiscuous mode [ 339.725719][T16899] syzkaller1: entered allmulticast mode [ 339.927310][T16929] x_tables: (null)_tables: NFQUEUE.1 target: invalid size 8 (kernel) != (user) 16 [ 339.954009][T16928] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3017'. [ 339.966362][T16850] chnl_net:caif_netlink_parms(): no params data found [ 340.104813][T16943] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3019'. [ 340.355888][T16952] netlink: 'syz.1.3019': attribute type 29 has an invalid length. [ 340.369829][T16959] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3025'. [ 340.380541][T16943] netlink: 'syz.1.3019': attribute type 29 has an invalid length. [ 340.400659][T16958] netlink: 'syz.2.3024': attribute type 29 has an invalid length. [ 340.474188][T16850] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.481845][T16850] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.525687][T16850] bridge_slave_0: entered allmulticast mode [ 340.534479][T16850] bridge_slave_0: entered promiscuous mode [ 340.543356][T16965] tipc: Enabled bearer , priority 0 [ 340.552811][ T5830] Bluetooth: hci3: command tx timeout [ 340.552951][T16850] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.566790][T16850] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.575004][T16965] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3026'. [ 340.593310][T16850] bridge_slave_1: entered allmulticast mode [ 340.603297][T16850] bridge_slave_1: entered promiscuous mode [ 340.699849][T16965] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3026'. [ 340.779744][T16965] syzkaller0: MTU too low for tipc bearer [ 340.797715][T16965] tipc: Disabling bearer [ 340.814094][T16850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 340.886647][T16850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.008110][T16988] ip6gre2: entered allmulticast mode [ 341.088343][T16850] team0: Port device team_slave_0 added [ 341.110360][T16850] team0: Port device team_slave_1 added [ 341.140558][T16997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3034'. [ 341.196827][T17000] x_tables: duplicate underflow at hook 2 [ 341.435321][T17009] openvswitch: netlink: Actions may not be safe on all matching packets [ 342.633669][ T5830] Bluetooth: hci3: command tx timeout [ 343.854308][T16850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 343.861779][T16850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 343.888715][T16850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 343.920711][T16850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 343.929663][T16850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 343.986315][T16850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 344.049696][T17018] netlink: 'syz.1.3038': attribute type 83 has an invalid length. [ 344.141075][T16850] hsr_slave_0: entered promiscuous mode [ 344.158930][T16850] hsr_slave_1: entered promiscuous mode [ 344.190671][T16850] debugfs: 'hsr0' already exists in 'hsr' [ 344.216100][T16850] Cannot create hsr debugfs directory [ 344.548260][T17045] ip6t_srh: unknown srh match flags 4000 [ 344.598308][T17045] netlink: 'syz.3.3045': attribute type 6 has an invalid length. [ 344.712310][ T5830] Bluetooth: hci3: command tx timeout [ 344.750757][T16850] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 344.940899][T16850] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.067431][T17057] lo speed is unknown, defaulting to 1000 [ 345.087141][T17066] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3051'. [ 345.139992][T16850] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.161720][T17057] wg1 speed is unknown, defaulting to 1000 [ 345.193198][T17068] netlink: 112 bytes leftover after parsing attributes in process `syz.3.3052'. [ 345.233628][T17072] netlink: 'syz.1.3054': attribute type 1 has an invalid length. [ 345.279139][T16850] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.289358][T17076] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3054'. [ 345.310178][T17073] netem: change failed [ 345.709660][T17100] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3061'. [ 345.735088][T17100] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3061'. [ 345.984261][T17111] openvswitch: netlink: IP tunnel TTL not specified. [ 346.299215][T16850] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 346.326818][T16850] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 346.339752][T17124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3068'. [ 346.358994][T17123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3068'. [ 346.386932][T16850] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 346.417316][T16850] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 346.440738][T17126] IPVS: Unknown mcast interface: team_slave_0 [ 346.459565][T16850] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 346.469046][T17126] netlink: 'syz.2.3069': attribute type 1 has an invalid length. [ 346.472558][T17132] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3071'. [ 346.492853][T16850] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 346.547479][T17126] bond9: entered promiscuous mode [ 346.553876][T17126] 8021q: adding VLAN 0 to HW filter on device bond9 [ 346.564039][T16850] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 346.586017][T16850] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 346.597379][T17143] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3071'. [ 346.649006][T17148] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3074'. [ 346.791360][ T5830] Bluetooth: hci3: command tx timeout [ 346.858758][T17167] set match dimension is over the limit! [ 346.859110][T17166] set match dimension is over the limit! [ 346.969010][T16850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 347.054158][T16850] 8021q: adding VLAN 0 to HW filter on device team0 [ 347.079462][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.086747][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 347.130982][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.138228][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 347.289038][T17183] syzkaller0: entered promiscuous mode [ 347.294669][T17183] syzkaller0: entered allmulticast mode [ 347.575667][T16850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 347.640135][T16850] veth0_vlan: entered promiscuous mode [ 347.670220][T16850] veth1_vlan: entered promiscuous mode [ 347.718721][T16850] veth0_macvtap: entered promiscuous mode [ 347.730364][T16850] veth1_macvtap: entered promiscuous mode [ 347.757882][T16850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 347.780771][T16850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 347.798561][ T7306] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.815396][ T7306] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.827978][ T7306] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.840390][ T7306] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.311826][T17188] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 350.437858][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.459863][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.511724][ T149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.534328][T17249] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 350.547705][ T149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.628863][T17255] __nla_validate_parse: 4 callbacks suppressed [ 350.628881][T17255] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3100'. [ 350.645182][T17255] netlink: 'syz.3.3100': attribute type 7 has an invalid length. [ 350.653129][T17255] netlink: 'syz.3.3100': attribute type 8 has an invalid length. [ 350.663444][T17255] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3100'. [ 350.787801][T17263] openvswitch: netlink: IPv6 tunnel dst address is zero [ 350.903289][T17267] netlink: 'syz.3.3103': attribute type 1 has an invalid length. [ 350.932274][T17267] nbd: nbd3 already in use [ 350.942893][T17267] block nbd3: NBD_DISCONNECT [ 350.957315][T17267] block nbd3: Send disconnect failed -32 [ 350.978316][T17267] block nbd3: shutting down sockets [ 351.217455][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 351.237842][ T5832] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 351.247784][ T5832] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 351.262085][ T5832] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 351.276424][ T5832] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 351.437214][T17280] lo speed is unknown, defaulting to 1000 [ 351.455425][T17280] wg1 speed is unknown, defaulting to 1000 [ 351.594461][T17293] IPv6: Can't replace route, no match found [ 351.614955][T17293] IPv6: Can't replace route, no match found [ 351.766118][T17307] netlink: 'syz.4.3111': attribute type 8 has an invalid length. [ 351.777897][T17307] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3111'. [ 351.906811][T17280] chnl_net:caif_netlink_parms(): no params data found [ 351.988446][T17318] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3113'. [ 352.025275][T17280] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.032584][T17280] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.042753][T17280] bridge_slave_0: entered allmulticast mode [ 352.049848][T17280] bridge_slave_0: entered promiscuous mode [ 352.057981][T17280] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.065581][T17280] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.073900][T17280] bridge_slave_1: entered allmulticast mode [ 352.085723][T17280] bridge_slave_1: entered promiscuous mode [ 352.194781][T17280] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 352.209812][T10814] batadv1: left allmulticast mode [ 352.217257][T10814] batadv1: left promiscuous mode [ 352.225084][T10814] bridge0: port 3(batadv1) entered disabled state [ 352.315556][T10814] bond5 (unregistering): (slave ip6gre1): Releasing backup interface [ 352.374657][T10814] bond4 (unregistering): (slave xfrm1): Releasing backup interface [ 352.785203][T10814] bond0 (unregistering): Released all slaves [ 352.796315][T10814] bond1 (unregistering): Released all slaves [ 352.813584][T10814] bond2 (unregistering): Released all slaves [ 352.827993][T10814] bond3 (unregistering): Released all slaves [ 352.842754][T10814] bond4 (unregistering): Released all slaves [ 352.859154][T10814] bond5 (unregistering): Released all slaves [ 352.881093][T10814] bond6 (unregistering): Released all slaves [ 352.901020][T10814] bond7 (unregistering): Released all slaves [ 352.922571][T10814] bond8 (unregistering): (slave batadv2): Releasing active interface [ 352.930770][T10814] batadv2: left promiscuous mode [ 352.937275][T10814] batadv2: left allmulticast mode [ 352.944908][T10814] bond8 (unregistering): Released all slaves [ 352.965727][T10814] bond9 (unregistering): Released all slaves [ 352.981915][T17280] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 353.023050][T17280] team0: Port device team_slave_0 added [ 353.036753][T17280] team0: Port device team_slave_1 added [ 353.073845][T17280] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 353.081322][T17280] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 353.112755][T17280] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 353.130288][T10814] : left promiscuous mode [ 353.230086][T17280] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 353.237427][T17280] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 353.265227][T17280] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 353.312887][T10814] tipc: Disabling bearer [ 353.322094][T10814] tipc: Disabling bearer [ 353.328878][T10814] tipc: Disabling bearer [ 353.336880][T10814] tipc: Left network mode [ 353.346039][T17280] hsr_slave_0: entered promiscuous mode [ 353.360350][ T5830] Bluetooth: hci0: command tx timeout [ 353.368372][T17280] hsr_slave_1: entered promiscuous mode [ 353.375639][T17280] debugfs: 'hsr0' already exists in 'hsr' [ 353.383810][T17280] Cannot create hsr debugfs directory [ 353.440280][T10814] IPVS: stopping master sync thread 6845 ... [ 353.453421][T10814] IPVS: stopping backup sync thread 7152 ... [ 353.896058][T17267] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 354.093808][T17323] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3114'. [ 354.597449][T17358] netlink: 'syz.4.3122': attribute type 1 has an invalid length. [ 354.609384][T17358] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3122'. [ 354.786960][T17375] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3125'. [ 354.790411][T17280] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 354.843923][T17280] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 354.910583][T17380] netlink: 168 bytes leftover after parsing attributes in process `syz.4.3127'. [ 354.912952][T17280] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 354.939501][T17280] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 355.138112][T17280] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 355.153727][T17280] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 355.168359][T17280] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 355.184917][T17280] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 355.434492][ T5830] Bluetooth: hci0: command tx timeout [ 357.514674][ T5830] Bluetooth: hci0: command tx timeout [ 357.709000][T10814] hsr_slave_1: left promiscuous mode [ 357.767121][T10814] pim6reg (unregistering): left allmulticast mode [ 358.079442][T10814] vcan0 (unregistering): left allmulticast mode [ 358.142173][T17416] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3135'. [ 358.375473][T17427] openvswitch: netlink: Flow actions attr not present in new flow. [ 358.529039][T17280] 8021q: adding VLAN 0 to HW filter on device bond0 [ 358.600509][T17433] pimreg: entered allmulticast mode [ 358.649347][T17439] GUP no longer grows the stack in syz.4.3142 (17439): 200000003000-20000000a000 (200000001000) [ 358.693052][T17439] CPU: 1 UID: 0 PID: 17439 Comm: syz.4.3142 Not tainted syzkaller #0 PREEMPT(full) [ 358.693078][T17439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 358.693101][T17439] Call Trace: [ 358.693108][T17439] [ 358.693116][T17439] dump_stack_lvl+0xe8/0x150 [ 358.693230][T17439] __get_user_pages+0x2453/0x29d0 [ 358.693301][T17439] ? __gup_longterm_locked+0xc4e/0x1630 [ 358.693321][T17439] ? down_read_killable+0x1bb/0x340 [ 358.693476][T17439] ? try_get_folio+0xec/0x650 [ 358.693501][T17439] __gup_longterm_locked+0xdcf/0x1630 [ 358.693544][T17439] gup_fast_fallback+0x1d82/0x22e0 [ 358.693592][T17439] ? __pfx_gup_fast_fallback+0x10/0x10 [ 358.693614][T17439] ? is_valid_gup_args+0x11f/0x200 [ 358.693635][T17439] ? get_user_pages_fast+0x4d/0xb0 [ 358.693658][T17439] __iov_iter_get_pages_alloc+0x3b6/0xb10 [ 358.693749][T17439] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 358.693786][T17439] iov_iter_get_pages2+0x5e/0xa0 [ 358.693806][T17439] __se_sys_vmsplice+0x7b3/0x1490 [ 358.693845][T17439] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 358.693867][T17439] ? __pfx_futex_wait+0x10/0x10 [ 358.693957][T17439] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.693990][T17439] do_syscall_64+0x15f/0xf80 [ 358.694039][T17439] ? trace_irq_disable+0x3b/0x140 [ 358.694064][T17439] ? clear_bhb_loop+0x40/0x90 [ 358.694085][T17439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.694103][T17439] RIP: 0033:0x7fa91b99c819 [ 358.694120][T17439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 358.694134][T17439] RSP: 002b:00007fa91c8ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 358.694151][T17439] RAX: ffffffffffffffda RBX: 00007fa91bc15fa0 RCX: 00007fa91b99c819 [ 358.694161][T17439] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000010 [ 358.694171][T17439] RBP: 00007fa91ba32c91 R08: 0000000000000000 R09: 0000000000000000 [ 358.694180][T17439] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 358.694188][T17439] R13: 00007fa91bc16038 R14: 00007fa91bc15fa0 R15: 00007ffd5791d068 [ 358.694211][T17439] [ 358.700496][T17280] 8021q: adding VLAN 0 to HW filter on device team0 [ 358.790853][T17441] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 358.885994][ T7304] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.886145][ T7304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 358.904497][ T7304] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.956547][ T7304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 359.202920][T17463] netlink: 'syz.0.3146': attribute type 2 has an invalid length. [ 359.230057][T17463] netlink: 244 bytes leftover after parsing attributes in process `syz.0.3146'. [ 359.304446][T17471] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 359.420370][T17480] nbd: must specify at least one socket [ 359.469272][T10814] IPVS: stop unused estimator thread 0... [ 359.591401][ T5830] Bluetooth: hci0: command tx timeout [ 359.670562][T17496] bond0: Caught tx_queue_len zero misconfig [ 359.716288][T17496] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3152'. [ 359.788531][T17280] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 359.809717][T17502] netlink: 'syz.4.3156': attribute type 1 has an invalid length. [ 359.953480][T17280] veth0_vlan: entered promiscuous mode [ 359.985529][T17280] veth1_vlan: entered promiscuous mode [ 360.087290][T17280] veth0_macvtap: entered promiscuous mode [ 360.131843][T17280] veth1_macvtap: entered promiscuous mode [ 360.209275][T17280] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 360.247012][T17280] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 360.280141][ T7306] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.318152][ T7306] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.409960][ T7306] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.440371][T17537] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3164'. [ 360.442030][ T7306] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.491729][T17531] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3164'. [ 360.518335][T17539] netlink: 'syz.4.3165': attribute type 58 has an invalid length. [ 360.554128][T17531] netlink: 16215 bytes leftover after parsing attributes in process `syz.0.3164'. [ 360.574014][T17539] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3165'. [ 360.674109][T17545] netlink: 'syz.1.3168': attribute type 10 has an invalid length. [ 360.698432][ T7306] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 360.707925][T17545] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3168'. [ 360.727087][ T7306] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 360.749349][T17546] netlink: 'syz.1.3168': attribute type 10 has an invalid length. [ 360.793411][T17546] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3168'. [ 360.860998][T17561] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3170'. [ 360.919160][ T149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 360.958623][ T149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 360.996122][T17553] can: request_module (can-proto-0) failed. [ 361.299651][T17581] syzkaller0: entered promiscuous mode [ 361.323299][T17581] syzkaller0: entered allmulticast mode [ 361.747320][ T5832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 361.762658][ T5832] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 361.773460][ T5832] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 361.785979][ T5832] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 361.798899][ T5832] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 361.896662][T17600] wg1 speed is unknown, defaulting to 1000 [ 362.024688][T17609] unsupported nlmsg_type 40 [ 362.424933][T17623] syzkaller0: entered promiscuous mode [ 362.431086][T17623] syzkaller0: entered allmulticast mode [ 363.061068][ T149] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 363.092426][ T149] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.445541][ T149] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 363.467444][ T149] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.548713][T17685] __nla_validate_parse: 1 callbacks suppressed [ 363.548731][T17685] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3195'. [ 363.564643][T17600] chnl_net:caif_netlink_parms(): no params data found [ 363.784373][ T149] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 363.820170][ T149] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.822451][T17710] Cannot find add_set index 4 as target [ 363.864693][T17708] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3199'. [ 363.917303][ T5830] Bluetooth: hci1: command tx timeout [ 364.026050][T17678] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.230198][ T149] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 364.254445][ T149] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.539662][T17678] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.680177][T17747] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 364.742648][T17678] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.785323][T17752] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3204'. [ 364.803150][T17600] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.811447][T17752] netlink: 'syz.3.3204': attribute type 30 has an invalid length. [ 364.811749][T17600] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.827165][T17600] bridge_slave_0: entered allmulticast mode [ 364.834675][T17600] bridge_slave_0: entered promiscuous mode [ 364.840755][T17757] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3204'. [ 364.860561][T17600] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.868084][T17600] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.876326][T17600] bridge_slave_1: entered allmulticast mode [ 364.882618][T17757] netlink: 'syz.3.3204': attribute type 30 has an invalid length. [ 364.893692][T17600] bridge_slave_1: entered promiscuous mode [ 365.000486][T17678] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.047768][ T48] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.137080][ T48] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.163999][ T48] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.277607][T17771] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3207'. [ 365.341156][ T48] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 365.378987][T17600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.448144][T17600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.633406][T17600] team0: Port device team_slave_0 added [ 365.780268][T17800] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.3214'. [ 365.804356][T17800] openvswitch: netlink: Flow actions attr not present in new flow. [ 365.825529][T17793] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.3212'. [ 365.886912][ T149] veth1_to_bridge: left allmulticast mode [ 366.001420][ T5830] Bluetooth: hci1: command tx timeout [ 366.452861][ T149] bond1 (unregistering): (slave vti0): Releasing backup interface [ 366.460787][ T149] vti0 (unregistering): left promiscuous mode [ 366.604947][ T149] bond2 (unregistering): (slave geneve2): Releasing active interface [ 366.943643][ T149] bond5 (unregistering): (slave bridge5): Releasing backup interface [ 366.953476][ T149] bridge5 (unregistering): left promiscuous mode [ 367.155817][ T149] bond1 (unregistering): Released all slaves [ 367.177453][ T149] bond2 (unregistering): Released all slaves [ 367.208809][ T149] bond3 (unregistering): Released all slaves [ 367.228115][ T149] bond4 (unregistering): Released all slaves [ 367.245090][ T149] bond5 (unregistering): Released all slaves [ 367.258609][ T149] bond6 (unregistering): Released all slaves [ 367.276434][ T149] bond0 (unregistering): Released all slaves [ 367.297016][ T149] bond7 (unregistering): Released all slaves [ 367.310706][ T149] bond8 (unregistering): (slave batadv0): Releasing active interface [ 367.320412][ T149] bond8 (unregistering): Released all slaves [ 367.335267][T17600] team0: Port device team_slave_1 added [ 367.344966][ T57] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.701851][T17600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 367.714600][T17600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 367.743149][T17600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 367.756096][T17600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 367.779636][T17600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 367.808005][T17600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 367.819624][T17871] openvswitch: netlink: Flow actions attr not present in new flow. [ 367.843185][ T149] tipc: Disabling bearer [ 367.848876][ T149] tipc: Left network mode [ 367.848931][ T35] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.873518][T17869] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3220'. [ 367.966516][ T35] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 367.999290][ T35] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.030279][ T149] IPVS: stopping backup sync thread 6210 ... [ 368.071427][ T5830] Bluetooth: hci1: command tx timeout [ 368.097594][T17600] hsr_slave_0: entered promiscuous mode [ 368.119598][T17885] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3224'. [ 368.130000][T17600] hsr_slave_1: entered promiscuous mode [ 368.156023][T17600] debugfs: 'hsr0' already exists in 'hsr' [ 368.166029][T17600] Cannot create hsr debugfs directory [ 368.235780][T17887] netlink: 164 bytes leftover after parsing attributes in process `syz.0.3225'. [ 368.326815][ T1660] block nbd4: Connection timed out, retrying (0/2 alive) [ 368.335378][ T1660] block nbd4: Connection timed out, retrying (0/2 alive) [ 368.345908][ T1660] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.355143][ T1660] Buffer I/O error on dev nbd4, logical block 1, async page read [ 368.363050][ T1660] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.373516][ T1660] Buffer I/O error on dev nbd4, logical block 0, async page read [ 368.383246][T13395] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.401390][T13395] Buffer I/O error on dev nbd4, logical block 0, async page read [ 368.410899][T13395] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.421997][T13395] Buffer I/O error on dev nbd4, logical block 1, async page read [ 368.429946][T13395] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.439469][T13395] Buffer I/O error on dev nbd4, logical block 2, async page read [ 368.447716][T13395] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.457005][T13395] Buffer I/O error on dev nbd4, logical block 3, async page read [ 368.465357][T13395] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.475307][T13395] Buffer I/O error on dev nbd4, logical block 0, async page read [ 368.483529][T13395] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.492881][T13395] Buffer I/O error on dev nbd4, logical block 1, async page read [ 368.501867][T13395] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.510957][T13395] Buffer I/O error on dev nbd4, logical block 2, async page read [ 368.524260][T13395] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 368.533684][T13395] Buffer I/O error on dev nbd4, logical block 3, async page read [ 368.553858][T13395] ldm_validate_partition_table(): Disk read failed. [ 368.576541][T13395] Dev nbd4: unable to read RDB block 0 [ 368.595543][T13395] nbd4: unable to read partition table [ 368.630143][T13395] ldm_validate_partition_table(): Disk read failed. [ 368.674942][T13395] Dev nbd4: unable to read RDB block 0 [ 368.708693][T13395] nbd4: unable to read partition table [ 368.876371][T17910] __nla_validate_parse: 1 callbacks suppressed [ 368.876387][T17910] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3231'. [ 368.898537][T17910] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3231'. [ 369.003333][ T149] hsr_slave_0: left promiscuous mode [ 369.009665][ T149] hsr_slave_1: left promiscuous mode [ 369.029655][ T149] veth1_vlan: left allmulticast mode [ 369.039452][ T149] veth1_macvtap: left promiscuous mode [ 369.041467][T17916] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3232'. [ 369.047599][ T149] veth0_macvtap: left promiscuous mode [ 369.062269][ T149] veth1_vlan: left promiscuous mode [ 369.067667][ T149] veth0_vlan: left promiscuous mode [ 369.338585][T17925] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3233'. [ 369.784964][ T149] IPVS: stop unused estimator thread 0... [ 370.151404][ T5830] Bluetooth: hci1: command tx timeout [ 370.917438][T17875] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 370.961356][T17600] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 371.003650][T17600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 371.036308][T17600] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 371.109784][T17600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 371.120897][T17600] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 371.158080][T17600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 371.176647][T17935] xt_TPROXY: Can be used only with -p tcp or -p udp [ 371.180313][T17600] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 371.217789][T17933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 371.220224][T17600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 371.327100][T17941] nbd: must specify a size in bytes for the device [ 371.443782][T17935] syzkaller0: entered promiscuous mode [ 371.466919][T17935] syzkaller0: entered allmulticast mode [ 371.867565][T17970] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3243'. [ 371.895476][T17969] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3243'. [ 372.119268][T17982] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3244'. [ 374.457914][T17971] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3242'. [ 374.716444][T17600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 374.767432][T17600] 8021q: adding VLAN 0 to HW filter on device team0 [ 374.787397][ T7304] bridge0: port 1(bridge_slave_0) entered blocking state [ 374.794696][ T7304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 374.829308][ T7304] bridge0: port 2(bridge_slave_1) entered blocking state [ 374.836744][ T7304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 374.939451][T18008] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 374.967485][T18008] netlink: 'syz.2.3249': attribute type 29 has an invalid length. [ 374.977845][T18008] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 374.988968][T18008] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 375.013996][T18008] netlink: 'syz.2.3249': attribute type 29 has an invalid length. [ 375.037114][T18008] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3249'. [ 375.217124][T17600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 375.348766][T17600] veth0_vlan: entered promiscuous mode [ 375.367794][T17600] veth1_vlan: entered promiscuous mode [ 375.409283][T17600] veth0_macvtap: entered promiscuous mode [ 375.420448][T17600] veth1_macvtap: entered promiscuous mode [ 375.446138][T17600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 375.467546][T17600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 375.486819][ T149] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 375.511063][ T149] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 375.537374][ T149] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 375.565650][ T149] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.627822][T17993] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 377.637691][T17998] netlink: 'syz.3.3247': attribute type 11 has an invalid length. [ 377.655807][T17998] netlink: 'syz.3.3247': attribute type 11 has an invalid length. [ 377.664054][T17998] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3247'. [ 377.959060][T18049] netlink: 'syz.2.3253': attribute type 1 has an invalid length. [ 377.966932][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 378.011598][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 378.033553][T18051] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 378.231420][T18049] veth3: entered promiscuous mode [ 378.241564][T18049] veth3: entered allmulticast mode [ 378.341243][ T7306] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 378.368924][ T7306] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 378.426981][T18059] syzkaller0: entered promiscuous mode [ 378.446093][T18059] syzkaller0: entered allmulticast mode [ 378.449554][T18069] netlink: 'syz.4.3258': attribute type 1 has an invalid length. [ 378.566340][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.573817][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.278502][T18086] netlink: 207952 bytes leftover after parsing attributes in process `syz.2.3262'. [ 381.314672][T18086] netlink: 207952 bytes leftover after parsing attributes in process `syz.2.3262'. [ 381.403816][T18092] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 381.449497][T18100] netlink: 'syz.4.3263': attribute type 1 has an invalid length. [ 381.558679][T18106] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 381.657211][T18079] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 381.897492][T18123] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 382.089485][ T5832] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 382.103230][ T5832] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 382.112742][ T5832] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 382.125708][ T5832] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 382.133488][ T5832] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 382.250742][T18133] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3271'. [ 382.415546][T18127] wg1 speed is unknown, defaulting to 1000 [ 382.604442][T18139] tc_dump_action: action bad kind [ 382.830726][T18148] ip6t_srh: unknown srh match flags 4000 [ 383.060347][T18163] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3279'. [ 383.079958][T18127] chnl_net:caif_netlink_parms(): no params data found [ 383.146410][T18127] bridge0: port 1(bridge_slave_0) entered blocking state [ 383.153880][T18127] bridge0: port 1(bridge_slave_0) entered disabled state [ 383.161492][T18127] bridge_slave_0: entered allmulticast mode [ 383.168860][T18127] bridge_slave_0: entered promiscuous mode [ 383.177561][T18127] bridge0: port 2(bridge_slave_1) entered blocking state [ 383.186340][T18127] bridge0: port 2(bridge_slave_1) entered disabled state [ 383.194189][T18127] bridge_slave_1: entered allmulticast mode [ 383.201816][T18127] bridge_slave_1: entered promiscuous mode [ 383.228101][T18127] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 383.240021][T18127] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 383.268024][T18127] team0: Port device team_slave_0 added [ 383.277718][T18127] team0: Port device team_slave_1 added [ 383.303243][T18127] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 383.310218][T18127] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 383.336762][T18127] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 383.349936][T18127] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 383.357963][T18127] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 383.384292][T18127] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 383.430504][T18127] hsr_slave_0: entered promiscuous mode [ 383.439145][T18127] hsr_slave_1: entered promiscuous mode [ 383.445802][T18127] debugfs: 'hsr0' already exists in 'hsr' [ 383.452346][T18127] Cannot create hsr debugfs directory [ 383.575129][T18127] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 383.665925][T18127] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 383.717592][T18127] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 383.781578][T18127] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 384.231980][ T5832] Bluetooth: hci2: command tx timeout [ 385.812836][T18151] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 385.924666][T18127] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 385.975879][T18127] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 386.015255][T18127] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 386.059473][T18127] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 386.083099][T18127] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 386.124513][T18127] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 386.150586][T18184] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.3283'. [ 386.158887][T18127] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 386.168921][T18184] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 386.192193][T18127] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 386.312810][ T5832] Bluetooth: hci2: command tx timeout [ 386.420966][T18127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 386.445059][T18127] 8021q: adding VLAN 0 to HW filter on device team0 [ 386.458760][T10814] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.465956][T10814] bridge0: port 1(bridge_slave_0) entered forwarding state [ 386.486661][ T7306] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.493873][ T7306] bridge0: port 2(bridge_slave_1) entered forwarding state [ 386.729749][T18127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 386.904373][T18127] veth0_vlan: entered promiscuous mode [ 386.917124][T18127] veth1_vlan: entered promiscuous mode [ 386.946449][T18127] veth0_macvtap: entered promiscuous mode [ 386.956407][T18127] veth1_macvtap: entered promiscuous mode [ 386.973503][T18127] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 386.987430][T18127] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 387.001028][ T35] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.012140][ T35] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.022965][ T35] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.033102][ T35] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.122432][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.130567][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.163600][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.172186][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.247243][T18214] syzkaller0: entered promiscuous mode [ 387.254633][T18214] syzkaller0: entered allmulticast mode [ 388.391760][ T5832] Bluetooth: hci2: command tx timeout [ 390.471438][ T5832] Bluetooth: hci2: command tx timeout [ 406.745927][T18235] xt_CT: You must specify a L4 protocol and not use inversions on it [ 406.751401][T18242] xt_TPROXY: Can be used only with -p tcp or -p udp [ 406.916423][T18251] netlink: 'syz.0.3292': attribute type 26 has an invalid length. [ 406.958615][T18248] xt_l2tp: v2 tid > 0xffff: 1114244 [ 407.059855][T18268] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3298'. [ 407.069148][T18268] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 407.245622][T18279] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3299'. [ 407.315705][T18279] netlink: 'syz.2.3299': attribute type 11 has an invalid length. [ 407.324434][T18279] netlink: 'syz.2.3299': attribute type 21 has an invalid length. [ 407.346131][T18279] bond1: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 407.363130][T18279] bond1 (unregistering): Released all slaves [ 409.887064][T18254] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 410.292438][T18299] ieee802154 phy0 wpan0: encryption failed: -22 [ 410.360504][T18315] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3306'. [ 413.123221][T18295] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 413.322964][T18347] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3316'. [ 413.351930][T18347] openvswitch: netlink: Flow actions attr not present in new flow. [ 413.792555][T13367] IPVS: starting estimator thread 0... [ 413.878828][T18393] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3332'. [ 413.891326][T18383] IPVS: using max 33 ests per chain, 79200 per kthread [ 413.955291][T18401] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3332'. [ 414.028289][T18404] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3333'. [ 414.051765][T18405] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3334'. [ 414.062594][T18405] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3334'. [ 416.625351][T18371] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 416.801792][T18411] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3336'. [ 416.824205][T18414] sctp: [Deprecated]: syz.4.3338 (pid 18414) Use of int in max_burst socket option. [ 416.824205][T18414] Use struct sctp_assoc_value instead [ 417.070229][T18427] bridge1: entered promiscuous mode [ 417.076276][T18427] bridge1: entered allmulticast mode [ 417.086522][T18427] team0: Port device bridge1 added [ 417.618692][T18452] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3348'. [ 420.377849][T18441] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 420.606058][T18470] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3353'. [ 420.619723][T18477] netlink: 'syz.2.3354': attribute type 1 has an invalid length. [ 420.636085][T18470] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3353'. [ 420.654314][T18475] netlink: 248 bytes leftover after parsing attributes in process `syz.3.3355'. [ 420.679054][T18475] netlink: 'syz.3.3355': attribute type 1 has an invalid length. [ 420.804159][T18489] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 420.812954][T18489] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 420.813553][T18490] xt_hashlimit: size too large, truncated to 1048576 [ 420.833757][T18491] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3358'. [ 421.192019][T18501] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 421.212806][T18501] netlink: 'syz.1.3362': attribute type 12 has an invalid length. [ 421.241515][T18501] netlink: 'syz.1.3362': attribute type 29 has an invalid length. [ 421.256703][T18501] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3362'. [ 421.329600][T18501] netlink: 'syz.1.3362': attribute type 1 has an invalid length. [ 421.350708][T18501] netlink: 212 bytes leftover after parsing attributes in process `syz.1.3362'. [ 421.619646][T18527] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3369'. [ 421.765650][T18529] xt_HMARK: spi-set and port-set can't be combined [ 421.820796][T18532] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3370'. [ 421.832994][T18533] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3370'. [ 422.745158][T18562] netlink: 'syz.4.3380': attribute type 2 has an invalid length. [ 424.332938][T18512] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 424.530965][T18580] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3387'. [ 424.549769][T18578] tipc: Started in network mode [ 424.562764][T18578] tipc: Node identity ac14140f, cluster identity 4711 [ 424.570389][T18578] tipc: New replicast peer: 255.255.255.255 [ 424.581836][T18578] tipc: Enabled bearer , priority 10 [ 424.807577][T18594] vlan2: entered allmulticast mode [ 424.822366][T18594] bond0: entered allmulticast mode [ 424.851740][T18594] bond_slave_0: entered allmulticast mode [ 424.871860][T18594] bond_slave_1: entered allmulticast mode [ 425.366402][T18628] xt_SECMARK: invalid mode: 9 [ 425.411809][T18630] netlink: 'syz.1.3395': attribute type 1 has an invalid length. [ 425.622224][ T7305] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.625248][T18643] netlink: 'syz.1.3400': attribute type 1 has an invalid length. [ 425.645166][T11196] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.655507][ T7305] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.692479][T11196] tipc: Node number set to 2886997007 [ 425.765863][T18649] x_tables: unsorted underflow at hook 3 [ 425.772599][T18646] veth3: entered allmulticast mode [ 425.874424][T18655] __nla_validate_parse: 4 callbacks suppressed [ 425.874444][T18655] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3405'. [ 425.969728][T18662] ip6gre1: entered allmulticast mode [ 426.083988][T11196] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 426.129515][T18679] netlink: 830 bytes leftover after parsing attributes in process `syz.0.3411'. [ 426.140359][T18679] Bluetooth: MGMT ver 1.23 [ 426.148728][T18679] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3411'. [ 426.197996][T18686] bond_slave_1: entered promiscuous mode [ 426.251469][T11196] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 426.278735][T18689] xt_hashlimit: size too large, truncated to 1048576 [ 428.748606][T18650] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 428.941416][T18715] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3422'. [ 428.959763][T18714] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 428.962052][T18715] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3422'. [ 429.019062][T18714] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 429.028247][T18713] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3423'. [ 429.042129][T18714] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 429.108913][T18708] 0: reclassify loop, rule prio 0, protocol 700 [ 429.356460][T18738] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3427'. [ 429.563665][T18747] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3430'. [ 429.750700][T18746] bond1: Unable to set up delay as MII monitoring is disabled [ 429.767096][T18746] bond1 (unregistering): Released all slaves [ 429.922157][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 430.063756][T18776] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3439'. [ 432.670323][T18755] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 432.868939][T18784] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 433.054932][T18795] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3447'. [ 433.078282][T18796] netlink: 3648 bytes leftover after parsing attributes in process `syz.4.3445'. [ 433.092136][T18796] netlink: 3648 bytes leftover after parsing attributes in process `syz.4.3445'. [ 433.156391][T18804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3449'. [ 433.181562][T18804] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3449'. [ 433.233291][T18807] siw: device registration error -23 [ 433.250404][T18807] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3450'. [ 433.372958][T18812] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3452'. [ 433.403332][T18812] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3452'. [ 433.526847][T18829] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3457'. [ 433.556497][T18834] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3456'. [ 433.739231][T18846] Cannot find map_set index 135 as target [ 433.763281][T18851] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 433.962206][T18861] can: request_module (can-proto-0) failed. [ 434.142157][T18875] sctp: [Deprecated]: syz.1.3468 (pid 18875) Use of int in max_burst socket option. [ 434.142157][T18875] Use struct sctp_assoc_value instead [ 434.255876][T18878] sctp: [Deprecated]: syz.1.3468 (pid 18878) Use of struct sctp_assoc_value in delayed_ack socket option. [ 434.255876][T18878] Use struct sctp_sack_info instead [ 434.984410][T18883] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 436.358118][T18813] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 436.635739][T18902] IPVS: set_ctl: invalid protocol: 103 172.20.20.187:20001 [ 437.137191][T18946] netlink: 'syz.4.3490': attribute type 2 has an invalid length. [ 437.204591][T18950] netlink: 'syz.4.3491': attribute type 17 has an invalid length. [ 437.656856][T18959] netdevsim netdevsim2 netdevsim0: Unsupported IPsec algorithm - please use rfc4106(gcm(aes)) [ 437.661545][T18962] syzkaller0: entered promiscuous mode [ 437.708308][T18962] syzkaller0: entered allmulticast mode [ 437.978636][T18986] sit0: entered promiscuous mode [ 438.016694][T18986] netlink: 'syz.4.3501': attribute type 1 has an invalid length. [ 438.180023][T19003] tipc: Started in network mode [ 438.185143][T19003] tipc: Node identity ac141441, cluster identity 4711 [ 438.194008][T19003] tipc: Enabling of bearer rejected, failed to enable media [ 438.248662][T19003] bond1 (unregistering): Released all slaves [ 438.447399][T19019] veth1_macvtap: left promiscuous mode [ 438.576894][T19024] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 438.646330][T19027] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 438.721295][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 438.799198][T19038] : entered promiscuous mode [ 438.965624][T19047] __nla_validate_parse: 12 callbacks suppressed [ 438.965642][T19047] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3519'. [ 439.458614][ T149] nci: nci_ntf_packet: unknown ntf opcode 0x107 [ 439.477399][T19074] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.998739][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.006357][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.028885][T19098] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3536'. [ 440.399256][T19121] netlink: 124 bytes leftover after parsing attributes in process `syz.0.3542'. [ 442.358691][T19069] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 442.535202][T19147] netlink: 'syz.1.3551': attribute type 3 has an invalid length. [ 442.553384][T19147] netlink: 216 bytes leftover after parsing attributes in process `syz.1.3551'. [ 442.719673][T19161] FAULT_INJECTION: forcing a failure. [ 442.719673][T19161] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 442.753063][T19161] CPU: 0 UID: 0 PID: 19161 Comm: syz.1.3554 Not tainted syzkaller #0 PREEMPT(full) [ 442.753089][T19161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 442.753104][T19161] Call Trace: [ 442.753111][T19161] [ 442.753119][T19161] dump_stack_lvl+0xe8/0x150 [ 442.753152][T19161] should_fail_ex+0x412/0x560 [ 442.753275][T19161] _copy_from_user+0x2d/0xb0 [ 442.753322][T19161] ___sys_sendmsg+0x1c6/0x360 [ 442.753436][T19161] ? __lock_acquire+0x6b5/0x2cf0 [ 442.753484][T19161] ? __pfx____sys_sendmsg+0x10/0x10 [ 442.753548][T19161] ? __fget_files+0x2a/0x420 [ 442.753571][T19161] ? __fget_files+0x3a0/0x420 [ 442.753600][T19161] __x64_sys_sendmsg+0x1bd/0x2a0 [ 442.753626][T19161] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 442.753658][T19161] ? __pfx_ksys_write+0x10/0x10 [ 442.753697][T19161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.753716][T19161] do_syscall_64+0x15f/0xf80 [ 442.753739][T19161] ? trace_irq_disable+0x3b/0x140 [ 442.753760][T19161] ? clear_bhb_loop+0x40/0x90 [ 442.753781][T19161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.753803][T19161] RIP: 0033:0x7fbe8759c819 [ 442.753821][T19161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 442.753836][T19161] RSP: 002b:00007fbe8839c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 442.753854][T19161] RAX: ffffffffffffffda RBX: 00007fbe87815fa0 RCX: 00007fbe8759c819 [ 442.753867][T19161] RDX: 0000000004008054 RSI: 0000200000000200 RDI: 0000000000000005 [ 442.753878][T19161] RBP: 00007fbe8839c090 R08: 0000000000000000 R09: 0000000000000000 [ 442.753889][T19161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.753899][T19161] R13: 00007fbe87816038 R14: 00007fbe87815fa0 R15: 00007ffdf7ac0a98 [ 442.753935][T19161] [ 445.625475][T19151] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 445.829581][T19199] sctp: [Deprecated]: syz.3.3565 (pid 19199) Use of int in maxseg socket option. [ 445.829581][T19199] Use struct sctp_assoc_value instead [ 445.888118][T19203] FAULT_INJECTION: forcing a failure. [ 445.888118][T19203] name failslab, interval 1, probability 0, space 0, times 1 [ 445.935170][T19203] CPU: 0 UID: 0 PID: 19203 Comm: syz.2.3569 Not tainted syzkaller #0 PREEMPT(full) [ 445.935196][T19203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 445.935206][T19203] Call Trace: [ 445.935213][T19203] [ 445.935220][T19203] dump_stack_lvl+0xe8/0x150 [ 445.935250][T19203] should_fail_ex+0x412/0x560 [ 445.935278][T19203] should_failslab+0xa8/0x100 [ 445.935342][T19203] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 445.935368][T19203] ? __alloc_skb+0x186/0x7d0 [ 445.935455][T19203] ? __alloc_skb+0x1d0/0x7d0 [ 445.935564][T19203] ? __local_bh_enable_ip+0xd0/0x130 [ 445.935635][T19203] __alloc_skb+0x1d0/0x7d0 [ 445.935656][T19203] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 445.935705][T19203] netlink_sendmsg+0x5d4/0xb40 [ 445.935795][T19203] ? __pfx_netlink_sendmsg+0x10/0x10 [ 445.935818][T19203] ? aa_sock_msg_perm+0xf1/0x1b0 [ 445.936066][T19203] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 445.936096][T19203] ____sys_sendmsg+0x972/0x9f0 [ 445.936120][T19203] ? __might_fault+0xaf/0x130 [ 445.936165][T19203] ? __pfx_____sys_sendmsg+0x10/0x10 [ 445.936197][T19203] ? import_iovec+0x73/0xa0 [ 445.936218][T19203] ___sys_sendmsg+0x2a5/0x360 [ 445.936241][T19203] ? __lock_acquire+0x6b5/0x2cf0 [ 445.936267][T19203] ? __pfx____sys_sendmsg+0x10/0x10 [ 445.936316][T19203] ? __fget_files+0x2a/0x420 [ 445.936336][T19203] ? __fget_files+0x3a0/0x420 [ 445.936364][T19203] __x64_sys_sendmsg+0x1bd/0x2a0 [ 445.936391][T19203] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 445.936424][T19203] ? __pfx_ksys_write+0x10/0x10 [ 445.936455][T19203] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.936472][T19203] do_syscall_64+0x15f/0xf80 [ 445.936495][T19203] ? trace_irq_disable+0x3b/0x140 [ 445.936514][T19203] ? clear_bhb_loop+0x40/0x90 [ 445.936534][T19203] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.936551][T19203] RIP: 0033:0x7f893bd9c819 [ 445.936567][T19203] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.936582][T19203] RSP: 002b:00007f893cc85028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 445.936600][T19203] RAX: ffffffffffffffda RBX: 00007f893c015fa0 RCX: 00007f893bd9c819 [ 445.936613][T19203] RDX: 0000000004008054 RSI: 0000200000000200 RDI: 0000000000000005 [ 445.936624][T19203] RBP: 00007f893cc85090 R08: 0000000000000000 R09: 0000000000000000 [ 445.936633][T19203] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 445.936641][T19203] R13: 00007f893c016038 R14: 00007f893c015fa0 R15: 00007ffd1d6bb258 [ 445.936662][T19203] [ 446.409455][T19225] netlink: 'syz.2.3573': attribute type 29 has an invalid length. [ 446.596367][T19240] netlink: 'syz.2.3577': attribute type 24 has an invalid length. [ 449.485789][T19231] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 449.747038][T19279] netlink: 'syz.2.3587': attribute type 2 has an invalid length. [ 449.813830][T19282] xt_CT: You must specify a L4 protocol and not use inversions on it [ 449.823070][T19282] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3589'. [ 450.047142][T19303] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3594'. [ 450.066138][T19303] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 450.104880][T19302] openvswitch: netlink: Flow actions attr not present in new flow. [ 450.115236][T19293] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 450.253562][T19310] syzkaller1: entered promiscuous mode [ 450.270227][T19310] syzkaller1: entered allmulticast mode [ 450.332739][T19319] netlink: 'syz.4.3597': attribute type 1 has an invalid length. [ 450.340995][T19319] netlink: 'syz.4.3597': attribute type 11 has an invalid length. [ 450.350832][T19319] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3597'. [ 450.424766][T19323] xt_hashlimit: size too large, truncated to 1048576 [ 450.536906][T19325] xt_hashlimit: size too large, truncated to 1048576 [ 450.589156][T19330] netlink: 13 bytes leftover after parsing attributes in process `syz.4.3601'. [ 450.765263][T19338] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 450.809686][T19338] bond0: (slave lo): Error: Device can not be enslaved while up [ 451.064695][T19355] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3609'. [ 451.223252][T19367] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3613'. [ 451.400112][T19380] netlink: 'syz.4.3616': attribute type 1 has an invalid length. [ 451.741742][T19406] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3625'. [ 452.169059][T19430] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3633'. [ 452.234110][T19432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3634'. [ 452.249945][T19432] netlink: 'syz.1.3634': attribute type 1 has an invalid length. [ 452.261247][T19432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3634'. [ 452.270539][T19432] netlink: 'syz.1.3634': attribute type 1 has an invalid length. [ 452.382155][T19440] netlink: 'syz.0.3635': attribute type 11 has an invalid length. [ 452.829277][T19460] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 452.876445][T19460] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 452.880172][T19468] netlink: 'syz.4.3644': attribute type 3 has an invalid length. [ 452.908493][T19470] Bluetooth: MGMT ver 1.23 [ 452.914118][T19470] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0x2 [ 453.102061][T19473] netlink: 'syz.3.3648': attribute type 11 has an invalid length. [ 454.373139][T19553] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 454.417758][T19553] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 454.429660][T19553] bond0 (unregistering): Released all slaves [ 454.537900][T19559] netlink: 'syz.1.3673': attribute type 21 has an invalid length. [ 454.554604][T19561] netlink: 'syz.4.3674': attribute type 1 has an invalid length. [ 454.579341][T19559] IPv6: NLM_F_CREATE should be specified when creating new route [ 454.696980][T19567] netlink: 'syz.2.3675': attribute type 1 has an invalid length. [ 454.859906][T19583] erspan0: entered promiscuous mode [ 454.867357][T19582] __nla_validate_parse: 16 callbacks suppressed [ 454.867375][T19582] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3679'. [ 454.888584][T19583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3677'. [ 455.173155][T19601] xt_hashlimit: size too large, truncated to 1048576 [ 455.289520][T19611] netlink: 'syz.4.3686': attribute type 10 has an invalid length. [ 455.337574][T19616] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3688'. [ 455.352350][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 455.380756][T19616] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3688'. [ 455.559895][T19625] team0: Port device bridge3 added [ 455.577246][T19628] bridge0: port 3(team0) entered blocking state [ 455.602164][T19628] bridge0: port 3(team0) entered disabled state [ 455.616337][T19628] team0: entered allmulticast mode [ 455.627523][T19628] team_slave_0: entered allmulticast mode [ 455.641237][T19628] team_slave_1: entered allmulticast mode [ 455.647950][T19628] bridge3: entered allmulticast mode [ 455.664530][T19628] team0: entered promiscuous mode [ 455.669799][T19628] team_slave_0: entered promiscuous mode [ 455.676893][T19628] team_slave_1: entered promiscuous mode [ 455.683671][T19628] bridge3: entered promiscuous mode [ 455.689812][T19632] netlink: 192 bytes leftover after parsing attributes in process `syz.3.3692'. [ 455.700741][T19628] bridge0: port 3(team0) entered blocking state [ 455.707229][T19628] bridge0: port 3(team0) entered forwarding state [ 456.052802][T19650] netlink: 'syz.4.3699': attribute type 16 has an invalid length. [ 456.062704][T19650] netlink: 'syz.4.3699': attribute type 17 has an invalid length. [ 456.129216][T19650] sit0: left promiscuous mode [ 456.143035][T19658] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3698'. [ 456.213292][T19661] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3701'. [ 456.295142][T19666] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3700'. [ 456.349779][T19650] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.370495][T19650] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.449106][T19650] vlan2: left allmulticast mode [ 456.459240][T19650] bond0: left allmulticast mode [ 456.464802][T19650] bond_slave_0: left allmulticast mode [ 456.470628][T19650] bond_slave_1: left allmulticast mode [ 456.716553][T19684] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3704'. [ 456.985672][T19706] xt_TPROXY: Can be used only with -p tcp or -p udp [ 457.021876][T19699] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 457.324961][T19727] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3717'. [ 457.433082][T19620] Bluetooth: hci5: command 0x0406 tx timeout [ 457.528523][T19734] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 457.610421][T19741] netlink: 'syz.4.3723': attribute type 21 has an invalid length. [ 457.965285][T19770] netlink: 'syz.3.3733': attribute type 28 has an invalid length. [ 457.976438][T19770] netlink: 'syz.3.3733': attribute type 3 has an invalid length. [ 458.640923][T19794] netlink: 'syz.1.3741': attribute type 29 has an invalid length. [ 458.649542][T19794] netlink: 'syz.1.3741': attribute type 29 has an invalid length. [ 459.404981][T19821] netlink: 'syz.4.3748': attribute type 64 has an invalid length. [ 459.474876][T19825] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 459.482210][ T5937] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 460.735227][T19751] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 461.043892][T19849] __nla_validate_parse: 76 callbacks suppressed [ 461.043914][T19849] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3756'. [ 461.072749][T19849] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3756'. [ 461.094900][T19853] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3758'. [ 461.101174][T19849] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3756'. [ 461.259121][T19860] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3759'. [ 461.288821][T19865] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3761'. [ 461.476917][T19868] syzkaller0: entered promiscuous mode [ 461.482631][T19868] syzkaller0: entered allmulticast mode [ 461.584790][T19884] netlink: 'syz.4.3765': attribute type 1 has an invalid length. [ 461.825072][T19898] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 461.878954][T19898] syzkaller0: entered promiscuous mode [ 461.898169][T19898] syzkaller0: entered allmulticast mode [ 462.009534][T19912] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3774'. [ 462.022222][T19910] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3774'. [ 462.551573][T19620] Bluetooth: hci3: command 0x0406 tx timeout [ 462.741760][T19950] set match dimension is over the limit! [ 462.752165][T19951] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3783'. [ 462.788780][T19951] hsr_slave_1 (unregistering): left promiscuous mode [ 464.309344][T19871] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 464.784041][T19986] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3789'. [ 464.900158][T19995] netlink: 'syz.1.3791': attribute type 51 has an invalid length. [ 465.095359][T20007] xt_TPROXY: Can be used only with -p tcp or -p udp [ 465.599620][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 467.608352][T19995] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 467.617099][T19995] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 467.634382][T19995] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 467.654628][T19995] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 467.712602][T20002] __nla_validate_parse: 1 callbacks suppressed [ 467.712621][T20002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3790'. [ 467.751925][T20002] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3790'. [ 467.767691][T20011] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 467.788288][ T7306] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.797999][T20002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3790'. [ 467.810373][ T7306] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.822368][T20002] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3790'. [ 467.838745][ T7306] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.852076][T20011] wireguard: wg0: Could not create IPv4 socket [ 467.872882][ T7306] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 468.072205][T20030] x_tables: duplicate underflow at hook 1 [ 468.073732][T20027] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3799'. [ 468.089603][T20028] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3800'. [ 468.274780][T20037] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 468.570818][T20045] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3808'. [ 468.808697][T20035] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3804'. [ 468.945332][T20066] netlink: 'syz.4.3812': attribute type 3 has an invalid length. [ 469.061638][T20074] syzkaller0: entered promiscuous mode [ 469.079649][T20074] syzkaller0: entered allmulticast mode [ 469.166467][T20076] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 469.305051][T20084] SET target dimension over the limit! [ 469.319182][T20088] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3816'. [ 469.432075][ T5872] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.593855][ T5904] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.633710][T13367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.230554][T20035] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 471.353263][T13367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.672343][ T5904] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.734581][T20121] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3826'. [ 471.799170][ T5832] block nbd3: Receive control failed (result -107) [ 472.026599][T20136] policy can only be matched on NF_INET_PRE_ROUTING [ 472.026620][T20136] unable to load match [ 472.279166][T20151] [ 472.281546][T20151] ====================================================== [ 472.288584][T20151] WARNING: possible circular locking dependency detected [ 472.295622][T20151] syzkaller #0 Not tainted [ 472.300108][T20151] ------------------------------------------------------ [ 472.307133][T20151] syz.3.3838/20151 is trying to acquire lock: [ 472.313211][T20151] ffffffff8ea84780 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x152/0x650 [ 472.322369][T20151] [ 472.322369][T20151] but task is already holding lock: [ 472.329753][T20151] ffff8880371c8f78 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 472.339351][T20151] [ 472.339351][T20151] which lock already depends on the new lock. [ 472.339351][T20151] [ 472.349760][T20151] [ 472.349760][T20151] the existing dependency chain (in reverse order) is: [ 472.358771][T20151] [ 472.358771][T20151] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 472.366436][T20151] __might_fault+0xcb/0x130 [ 472.371470][T20151] _copy_from_user+0x28/0xb0 [ 472.376596][T20151] csum_and_copy_from_iter_full+0x1e7/0x1f00 [ 472.383184][T20151] ip_generic_getfrag+0x149/0x2d0 [ 472.388869][T20151] __ip6_append_data+0x39e4/0x3f70 [ 472.394627][T20151] ip6_append_data+0x10f/0x280 [ 472.399936][T20151] rawv6_sendmsg+0x12d3/0x18e0 [ 472.405293][T20151] ____sys_sendmsg+0x80a/0x9f0 [ 472.410671][T20151] ___sys_sendmsg+0x2a5/0x360 [ 472.415864][T20151] __x64_sys_sendmsg+0x1bd/0x2a0 [ 472.421317][T20151] do_syscall_64+0x15f/0xf80 [ 472.426428][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.432829][T20151] [ 472.432829][T20151] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 472.440554][T20151] lock_sock_nested+0x41/0x100 [ 472.445847][T20151] inet_shutdown+0x6a/0x390 [ 472.450966][T20151] nbd_mark_nsock_dead+0x2e9/0x560 [ 472.456690][T20151] recv_work+0x1c2e/0x1d40 [ 472.461615][T20151] process_scheduled_works+0xb5d/0x1860 [ 472.467694][T20151] worker_thread+0xa53/0xfc0 [ 472.472794][T20151] kthread+0x388/0x470 [ 472.477398][T20151] ret_from_fork+0x514/0xb70 [ 472.482539][T20151] ret_from_fork_asm+0x1a/0x30 [ 472.488003][T20151] [ 472.488003][T20151] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 472.495671][T20151] __mutex_lock+0x1a3/0x1550 [ 472.500803][T20151] nbd_queue_rq+0x37b/0x1100 [ 472.505920][T20151] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 472.512051][T20151] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 472.519036][T20151] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 472.525523][T20151] blk_mq_run_hw_queue+0x348/0x4f0 [ 472.531195][T20151] blk_mq_dispatch_list+0xd16/0xe10 [ 472.536902][T20151] blk_mq_flush_plug_list+0x48d/0x570 [ 472.542790][T20151] __blk_flush_plug+0x3ed/0x4d0 [ 472.548247][T20151] __submit_bio+0x28d/0x580 [ 472.553279][T20151] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 472.559444][T20151] block_read_full_folio+0x599/0x830 [ 472.565275][T20151] filemap_read_folio+0x137/0x3b0 [ 472.570849][T20151] do_read_cache_folio+0x358/0x590 [ 472.576467][T20151] read_part_sector+0xb6/0x2b0 [ 472.581808][T20151] adfspart_check_ICS+0xb1/0x960 [ 472.587285][T20151] bdev_disk_changed+0x817/0x1770 [ 472.592838][T20151] blkdev_get_whole+0x380/0x510 [ 472.598282][T20151] bdev_open+0x31e/0xd30 [ 472.603031][T20151] blkdev_open+0x470/0x610 [ 472.607954][T20151] do_dentry_open+0x785/0x14e0 [ 472.613229][T20151] vfs_open+0x3b/0x340 [ 472.617829][T20151] path_openat+0x2e08/0x3860 [ 472.622972][T20151] do_file_open+0x23e/0x4a0 [ 472.627988][T20151] do_sys_openat2+0x113/0x200 [ 472.633177][T20151] __x64_sys_openat+0x138/0x170 [ 472.638547][T20151] do_syscall_64+0x15f/0xf80 [ 472.643656][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.650083][T20151] [ 472.650083][T20151] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 472.657304][T20151] __mutex_lock+0x1a3/0x1550 [ 472.662411][T20151] nbd_queue_rq+0xc6/0x1100 [ 472.667425][T20151] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 472.673482][T20151] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 472.680320][T20151] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 472.686805][T20151] blk_mq_run_hw_queue+0x348/0x4f0 [ 472.692465][T20151] blk_mq_dispatch_list+0xd16/0xe10 [ 472.698173][T20151] blk_mq_flush_plug_list+0x48d/0x570 [ 472.704067][T20151] __blk_flush_plug+0x3ed/0x4d0 [ 472.709442][T20151] __submit_bio+0x28d/0x580 [ 472.714661][T20151] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 472.720825][T20151] block_read_full_folio+0x599/0x830 [ 472.726734][T20151] filemap_read_folio+0x137/0x3b0 [ 472.732532][T20151] do_read_cache_folio+0x358/0x590 [ 472.738150][T20151] read_part_sector+0xb6/0x2b0 [ 472.743431][T20151] adfspart_check_ICS+0xb1/0x960 [ 472.748917][T20151] bdev_disk_changed+0x817/0x1770 [ 472.754456][T20151] blkdev_get_whole+0x380/0x510 [ 472.759814][T20151] bdev_open+0x31e/0xd30 [ 472.764591][T20151] blkdev_open+0x470/0x610 [ 472.769515][T20151] do_dentry_open+0x785/0x14e0 [ 472.774785][T20151] vfs_open+0x3b/0x340 [ 472.779359][T20151] path_openat+0x2e08/0x3860 [ 472.784470][T20151] do_file_open+0x23e/0x4a0 [ 472.789481][T20151] do_sys_openat2+0x113/0x200 [ 472.794670][T20151] __x64_sys_openat+0x138/0x170 [ 472.800026][T20151] do_syscall_64+0x15f/0xf80 [ 472.805156][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.811649][T20151] [ 472.811649][T20151] -> #3 (set->srcu){.+.+}-{0:0}: [ 472.818759][T20151] __synchronize_srcu+0xca/0x300 [ 472.824322][T20151] elevator_switch+0x1e8/0x7a0 [ 472.829680][T20151] elevator_change+0x2cc/0x450 [ 472.835033][T20151] elevator_set_default+0x36c/0x430 [ 472.840734][T20151] blk_register_queue+0x3e9/0x4e0 [ 472.846261][T20151] __add_disk+0x677/0xd50 [ 472.851104][T20151] add_disk_fwnode+0xfb/0x480 [ 472.856310][T20151] nbd_dev_add+0x72c/0xb50 [ 472.861241][T20151] nbd_init+0x168/0x1f0 [ 472.866034][T20151] do_one_initcall+0x250/0x870 [ 472.871329][T20151] do_initcall_level+0x104/0x190 [ 472.876976][T20151] do_initcalls+0x59/0xa0 [ 472.881969][T20151] kernel_init_freeable+0x2a6/0x3e0 [ 472.887873][T20151] kernel_init+0x1d/0x1d0 [ 472.892758][T20151] ret_from_fork+0x514/0xb70 [ 472.897890][T20151] ret_from_fork_asm+0x1a/0x30 [ 472.903171][T20151] [ 472.903171][T20151] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 472.910990][T20151] __mutex_lock+0x1a3/0x1550 [ 472.916100][T20151] elevator_change+0x1b3/0x450 [ 472.921366][T20151] elevator_set_none+0xb5/0x140 [ 472.926758][T20151] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 472.933342][T20151] nbd_start_device+0x17f/0xb10 [ 472.938744][T20151] nbd_genl_connect+0x165b/0x1cf0 [ 472.944382][T20151] genl_family_rcv_msg_doit+0x22a/0x330 [ 472.950528][T20151] genl_rcv_msg+0x61c/0x7a0 [ 472.955542][T20151] netlink_rcv_skb+0x232/0x4b0 [ 472.960842][T20151] genl_rcv+0x28/0x40 [ 472.965337][T20151] netlink_unicast+0x75c/0x8e0 [ 472.970613][T20151] netlink_sendmsg+0x813/0xb40 [ 472.975889][T20151] ____sys_sendmsg+0x972/0x9f0 [ 472.981161][T20151] ___sys_sendmsg+0x2a5/0x360 [ 472.986345][T20151] __x64_sys_sendmsg+0x1bd/0x2a0 [ 472.991792][T20151] do_syscall_64+0x15f/0xf80 [ 472.996899][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.003346][T20151] [ 473.003346][T20151] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 473.011938][T20151] blk_alloc_queue+0x546/0x680 [ 473.017305][T20151] __blk_mq_alloc_disk+0x197/0x390 [ 473.022924][T20151] nbd_dev_add+0x499/0xb50 [ 473.027848][T20151] nbd_init+0x168/0x1f0 [ 473.032514][T20151] do_one_initcall+0x250/0x870 [ 473.037806][T20151] do_initcall_level+0x104/0x190 [ 473.043253][T20151] do_initcalls+0x59/0xa0 [ 473.048094][T20151] kernel_init_freeable+0x2a6/0x3e0 [ 473.053810][T20151] kernel_init+0x1d/0x1d0 [ 473.058650][T20151] ret_from_fork+0x514/0xb70 [ 473.063751][T20151] ret_from_fork_asm+0x1a/0x30 [ 473.069116][T20151] [ 473.069116][T20151] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 473.076315][T20151] __lock_acquire+0x15a5/0x2cf0 [ 473.081687][T20151] lock_acquire+0x106/0x350 [ 473.086744][T20151] fs_reclaim_acquire+0x71/0x100 [ 473.092195][T20151] prepare_alloc_pages+0x152/0x650 [ 473.097817][T20151] __alloc_frozen_pages_noprof+0x12f/0x380 [ 473.104138][T20151] alloc_pages_mpol+0x232/0x4a0 [ 473.109524][T20151] vma_alloc_folio_noprof+0xea/0x210 [ 473.115321][T20151] do_pte_missing+0x1656/0x3490 [ 473.120697][T20151] handle_mm_fault+0x1bec/0x3310 [ 473.126148][T20151] do_user_addr_fault+0x75b/0x1340 [ 473.131806][T20151] exc_page_fault+0x6a/0xc0 [ 473.136833][T20151] asm_exc_page_fault+0x26/0x30 [ 473.142304][T20151] __put_user_4+0xd/0x20 [ 473.147074][T20151] qrtr_ioctl+0x24e/0x460 [ 473.152029][T20151] sock_do_ioctl+0x101/0x320 [ 473.157138][T20151] sock_ioctl+0x5c6/0x7f0 [ 473.161989][T20151] __se_sys_ioctl+0xfc/0x170 [ 473.167131][T20151] do_syscall_64+0x15f/0xf80 [ 473.172267][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.178681][T20151] [ 473.178681][T20151] other info that might help us debug this: [ 473.178681][T20151] [ 473.188915][T20151] Chain exists of: [ 473.188915][T20151] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 473.188915][T20151] [ 473.201546][T20151] Possible unsafe locking scenario: [ 473.201546][T20151] [ 473.208991][T20151] CPU0 CPU1 [ 473.214348][T20151] ---- ---- [ 473.219715][T20151] rlock(&mm->mmap_lock); [ 473.224132][T20151] lock(sk_lock-AF_INET6); [ 473.231146][T20151] lock(&mm->mmap_lock); [ 473.238001][T20151] lock(fs_reclaim); [ 473.241980][T20151] [ 473.241980][T20151] *** DEADLOCK *** [ 473.241980][T20151] [ 473.250111][T20151] 2 locks held by syz.3.3838/20151: [ 473.255317][T20151] #0: ffff8880206959e0 (sk_lock-AF_QIPCRTR){+.+.}-{0:0}, at: qrtr_ioctl+0xd1/0x460 [ 473.264717][T20151] #1: ffff8880371c8f78 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 473.274644][T20151] [ 473.274644][T20151] stack backtrace: [ 473.280527][T20151] CPU: 1 UID: 0 PID: 20151 Comm: syz.3.3838 Not tainted syzkaller #0 PREEMPT(full) [ 473.280545][T20151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 473.280553][T20151] Call Trace: [ 473.280560][T20151] [ 473.280567][T20151] dump_stack_lvl+0xe8/0x150 [ 473.280589][T20151] print_circular_bug+0x2e1/0x300 [ 473.280611][T20151] check_noncircular+0x12e/0x150 [ 473.280632][T20151] __lock_acquire+0x15a5/0x2cf0 [ 473.280651][T20151] ? is_bpf_text_address+0x26/0x2b0 [ 473.280701][T20151] ? is_bpf_text_address+0x292/0x2b0 [ 473.280716][T20151] ? is_bpf_text_address+0x26/0x2b0 [ 473.280731][T20151] ? prepare_alloc_pages+0x152/0x650 [ 473.280744][T20151] lock_acquire+0x106/0x350 [ 473.280759][T20151] ? prepare_alloc_pages+0x152/0x650 [ 473.280775][T20151] fs_reclaim_acquire+0x71/0x100 [ 473.280786][T20151] ? prepare_alloc_pages+0x152/0x650 [ 473.280797][T20151] prepare_alloc_pages+0x152/0x650 [ 473.280819][T20151] __alloc_frozen_pages_noprof+0x12f/0x380 [ 473.280834][T20151] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 473.280848][T20151] ? __pfx_policy_nodemask+0x10/0x10 [ 473.280862][T20151] ? __lock_acquire+0x6b5/0x2cf0 [ 473.280879][T20151] alloc_pages_mpol+0x232/0x4a0 [ 473.280894][T20151] vma_alloc_folio_noprof+0xea/0x210 [ 473.280908][T20151] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 473.280921][T20151] ? __pte_offset_map+0x29/0x240 [ 473.280938][T20151] ? __pte_offset_map+0x29/0x240 [ 473.280955][T20151] do_pte_missing+0x1656/0x3490 [ 473.280979][T20151] handle_mm_fault+0x1bec/0x3310 [ 473.280999][T20151] ? handle_mm_fault+0xee/0x3310 [ 473.281016][T20151] ? __pfx_handle_mm_fault+0x10/0x10 [ 473.281035][T20151] ? __lock_acquire+0x6b5/0x2cf0 [ 473.281057][T20151] ? lock_mm_and_find_vma+0xa7/0x340 [ 473.281076][T20151] do_user_addr_fault+0x75b/0x1340 [ 473.281100][T20151] exc_page_fault+0x6a/0xc0 [ 473.281119][T20151] asm_exc_page_fault+0x26/0x30 [ 473.281134][T20151] RIP: 0010:__put_user_4+0xd/0x20 [ 473.281151][T20151] Code: 66 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 473.281163][T20151] RSP: 0018:ffffc90005a87bb8 EFLAGS: 00050202 [ 473.281176][T20151] RAX: 0000000000034000 RBX: 0000000000000000 RCX: 0000200000005280 [ 473.281185][T20151] RDX: 0000000000000001 RSI: ffffffff8e22a959 RDI: ffffffff8c27f000 [ 473.281194][T20151] RBP: ffffc90005a87cb0 R08: ffffffff8217a23f R09: ffff8880371c8f78 [ 473.281203][T20151] R10: dffffc0000000000 R11: ffffed10040d2b45 R12: 1ffff92000b50f7c [ 473.281212][T20151] R13: dffffc0000000000 R14: ffff888020695780 R15: 0000000000034000 [ 473.281224][T20151] ? __might_fault+0xaf/0x130 [ 473.281243][T20151] qrtr_ioctl+0x24e/0x460 [ 473.281262][T20151] ? __pfx_qrtr_ioctl+0x10/0x10 [ 473.281280][T20151] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 473.281294][T20151] sock_do_ioctl+0x101/0x320 [ 473.281311][T20151] ? __pfx_sock_do_ioctl+0x10/0x10 [ 473.281324][T20151] ? do_futex+0x395/0x420 [ 473.281347][T20151] sock_ioctl+0x5c6/0x7f0 [ 473.281360][T20151] ? __pfx_sock_ioctl+0x10/0x10 [ 473.281373][T20151] ? __fget_files+0x2a/0x420 [ 473.281388][T20151] ? __fget_files+0x3a0/0x420 [ 473.281403][T20151] ? __fget_files+0x2a/0x420 [ 473.281418][T20151] ? bpf_lsm_file_ioctl+0x9/0x20 [ 473.281433][T20151] ? __pfx_sock_ioctl+0x10/0x10 [ 473.281445][T20151] __se_sys_ioctl+0xfc/0x170 [ 473.281457][T20151] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.281469][T20151] do_syscall_64+0x15f/0xf80 [ 473.281485][T20151] ? trace_irq_disable+0x3b/0x140 [ 473.281498][T20151] ? clear_bhb_loop+0x40/0x90 [ 473.281512][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.281524][T20151] RIP: 0033:0x7fab46f9c819 [ 473.281536][T20151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.281548][T20151] RSP: 002b:00007fab47e2f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 473.281560][T20151] RAX: ffffffffffffffda RBX: 00007fab47216090 RCX: 00007fab46f9c819 [ 473.281570][T20151] RDX: 0000200000005280 RSI: 0000000000005411 RDI: 0000000000000006 [ 473.281578][T20151] RBP: 00007fab47032c91 R08: 0000000000000000 R09: 0000000000000000 [ 473.281586][T20151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 473.281594][T20151] R13: 00007fab47216128 R14: 00007fab47216090 R15: 00007ffcdf45c1b8 [ 473.281608][T20151] SYZFAIL: failed to send rpc fd=3 want=48 sent=0 n=-1 (errno 32: Broken pipe) [ 473.806306][ T5904] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.199729][T10814] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.223299][T10814] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.340416][T10814] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.351418][T10814] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.391561][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.444539][T10814] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.455282][T10814] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.507725][T10814] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 474.518460][T10814] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 474.585594][T10814] bridge_slave_1: left allmulticast mode [ 474.591838][T10814] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.599855][T10814] bridge_slave_0: left allmulticast mode [ 474.606324][T10814] bridge_slave_0: left promiscuous mode [ 474.612149][T10814] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.748948][T10814] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 474.759100][T10814] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 474.768781][T10814] bond0 (unregistering): Released all slaves [ 474.944348][T10814] hsr_slave_0: left promiscuous mode [ 474.950264][T10814] hsr_slave_1: left promiscuous mode [ 474.956523][T10814] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 474.964741][T10814] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 474.976029][T10814] veth1_macvtap: left promiscuous mode [ 474.982798][T10814] veth0_macvtap: left promiscuous mode [ 474.988364][T10814] veth1_vlan: left promiscuous mode [ 474.997242][T10814] veth0_vlan: left promiscuous mode [ 475.131681][T10814] team0 (unregistering): Port device team_slave_1 removed [ 475.142238][T10814] team0 (unregistering): Port device team_slave_0 removed [ 475.201496][ T5487] 8021q: adding VLAN 0 to HW filter on device eth1 [ 475.496957][ T5487] 8021q: adding VLAN 0 to HW filter on device eth2 [ 475.519045][T10814] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.529510][T10814] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.591820][T10814] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.602227][T10814] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.668641][T10814] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.686250][T10814] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.716471][T10814] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.727127][T10814] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.759541][ T5487] 8021q: adding VLAN 0 to HW filter on device eth3 [ 475.842639][T10814] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.910200][T10814] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 475.985309][T10814] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.018089][ T5487] 8021q: adding VLAN 0 to HW filter on device eth4 [ 476.036886][T10814] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.135399][T10814] bridge_slave_1: left allmulticast mode [ 476.143436][T10814] bridge_slave_1: left promiscuous mode [ 476.149204][T10814] bridge0: port 2(bridge_slave_1) entered disabled state [ 476.159811][T10814] bridge_slave_0: left allmulticast mode [ 476.165728][T10814] bridge_slave_0: left promiscuous mode [ 476.171865][T10814] bridge0: port 1(bridge_slave_0) entered disabled state [ 476.184940][T10814] bridge_slave_1: left allmulticast mode [ 476.190643][T10814] bridge_slave_1: left promiscuous mode [ 476.198082][T10814] bridge0: port 2(bridge_slave_1) entered disabled state [ 476.206813][T10814] bridge_slave_0: left allmulticast mode [ 476.213016][T10814] bridge_slave_0: left promiscuous mode [ 476.218770][T10814] bridge0: port 1(bridge_slave_0) entered disabled state [ 476.404748][T10814] team0: Port device bridge1 removed [ 476.513898][T10814] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.524269][T10814] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.534721][T10814] bond0 (unregistering): Released all slaves [ 476.664192][T10814] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 476.674388][T10814] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 476.683879][T10814] bond0 (unregistering): Released all slaves [ 476.692689][T10814] bond1 (unregistering): Released all slaves [ 476.703767][ T5487] 8021q: adding VLAN 0 to HW filter on device eth5 [ 476.772161][T10814] tipc: Disabling bearer [ 476.778057][T10814] tipc: Left network mode [ 476.823926][T10814] IPVS: stopping backup sync thread 16900 ... [ 477.000709][ T5487] 8021q: adding VLAN 0 to HW filter on device eth6 [ 477.160896][T10814] hsr_slave_0: left promiscuous mode [ 477.166786][T10814] hsr_slave_1: left promiscuous mode [ 477.172756][T10814] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.180179][T10814] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 477.188599][T10814] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.196226][T10814] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 477.207860][T10814] hsr_slave_0: left promiscuous mode [ 477.214297][T10814] hsr_slave_1: left promiscuous mode [ 477.226364][T10814] veth1_macvtap: left promiscuous mode [ 477.232104][T10814] veth0_macvtap: left promiscuous mode [ 477.237656][T10814] veth1_vlan: left promiscuous mode [ 477.247465][T10814] veth0_vlan: left promiscuous mode [ 477.253856][T10814] veth1_macvtap: left promiscuous mode [ 477.259391][T10814] veth0_macvtap: left promiscuous mode [ 477.265620][T10814] veth1_vlan: left promiscuous mode [ 477.270904][T10814] veth0_vlan: left promiscuous mode [ 477.407412][T10814] team0 (unregistering): Port device team_slave_1 removed [ 477.420002][T10814] team0 (unregistering): Port device team_slave_0 removed [ 477.529428][T10814] team0 (unregistering): Port device team_slave_1 removed [ 477.540092][T10814] team0 (unregistering): Port device team_slave_0 removed [ 477.580522][ T5487] 8021q: adding VLAN 0 to HW filter on device eth7 [ 477.922125][ T5487] 8021q: adding VLAN 0 to HW filter on device eth8 [ 477.982680][T10814] IPVS: stop unused estimator thread 0... [ 478.172945][ T5487] 8021q: adding VLAN 0 to HW filter on device eth9 [ 478.368482][ T5487] 8021q: adding VLAN 0 to HW filter on device eth10 [ 478.565202][ T5487] 8021q: adding VLAN 0 to HW filter on device eth11 [ 478.771752][ T5487] 8021q: adding VLAN 0 to HW filter on device eth12