last executing test programs: 5.298382943s ago: executing program 1 (id=7445): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0x20, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}}, 0x0, 0x0, 0x39, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4f5d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) 5.226987932s ago: executing program 1 (id=7447): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x228, 0x0, 0x0, 0x148, 0xb0, 0x148, 0x190, 0x240, 0x240, 0x190, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x9, 0x7, {0x7}}}}, {{@uncond, 0x0, 0xc0, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x288) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x228, 0x0, 0x0, 0x148, 0xb0, 0x148, 0x190, 0x240, 0x240, 0x190, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x9, 0x7, {0x7}}}}, {{@uncond, 0x0, 0xc0, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x288) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000340)={0x4, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_group_source_req(r2, 0x0, 0x2e, &(0x7f00000004c0)={0x5, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x108) setsockopt$inet_group_source_req(r2, 0x0, 0x2e, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e24, @multicast2}}}, 0x108) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010800000000000075a003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000000000d0001009364703a73"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) (async) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010800000000000075a003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000000000d0001009364703a73"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) (async) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c00"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c00"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="8c00000010001fff28bd70000000800000000000", @ANYRES32=0x0, @ANYBLOB="efb00000800000006c0012800b00010062726964676500005c00028008000500010000000c002e"], 0x8c}, 0x1, 0x0, 0x0, 0x4000084}, 0x14) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f00000002c0)=0x1ff, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r7) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r8, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x80) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r9, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) (async) setsockopt$inet_int(r9, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000140)={'veth0_macvtap\x00', 0x0}) sendmmsg$inet(r9, &(0x7f0000000000)=[{{&(0x7f0000000040)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @local, @loopback}}}, @ip_retopts={{0x10}}], 0x30}}], 0x1, 0x0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010023010000340200001c00000008000100", @ANYRESHEX=r1, @ANYBLOB="0800040000000010080003"], 0x2c}}, 0x0) (async) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010023010000340200001c00000008000100", @ANYRESHEX=r1, @ANYBLOB="0800040000000010080003"], 0x2c}}, 0x0) 4.857852181s ago: executing program 2 (id=7451): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0x4, 0x0, &(0x7f0000000040)='GPL\x00'}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @loopback}, 0x1}, 0x1c) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) (async) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000240)=0xe0, 0x4) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) (async, rerun: 32) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000310081044e81f782db44b904021d080005000000e8fe55a1180015000600142603600e120900210000000401a8001600a40001", 0xfffffe8b}], 0x1}, 0x4) (async, rerun: 32) r1 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="33fe00004a00530c8e5eb88edc5a9c0e0a9b80"], 0xfe33) (async, rerun: 64) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0xfe33) (rerun: 64) 4.777188961s ago: executing program 1 (id=7453): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f000000040000000400000008"], 0x50) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async, rerun: 64) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x14, 0x0, &(0x7f0000000000)) (async, rerun: 64) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000008c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000}, 0x94) 4.702663717s ago: executing program 2 (id=7455): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c1c6be7d728d100ebff0f000304253d7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000500000080000008002300f9ffffff21002200b688a4e6b2920bb4c8774b665cf059609100168b00f6cafbea768a8ae2000000"], 0x4c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) 4.601312972s ago: executing program 1 (id=7458): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x400100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r3, {0x0, 0xc}, {0x0, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x405c071}, 0x4008000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000200)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4000) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$F2FS_IOC_GARBAGE_COLLECT(r7, 0x4004f506, &(0x7f0000000540)=0x1) r8 = socket(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendto$packet(r8, &(0x7f0000000500)="4af2adb743ebbc46ba", 0xffffffffffffffe0, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@newtaction={0x70, 0x1c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x5c, 0x1, [@m_skbedit={0x58, 0xb, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0xd}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x5}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0x1, 0x6, 0x2042, 0x4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x70}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r11) sendmsg$NLBL_MGMT_C_ADDDEF(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xf, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NLBL_MGMT_C_ADDDEF(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008000}, 0x4040000) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="0a00000016000000000800007f00000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00B\x00'/20, @ANYRES32=0x0, @ANYBLOB="c88d840b28665cb273cf291ef992b4cd711cea74a2a860", @ANYBLOB='\x00'/28], 0x50) 4.503391874s ago: executing program 2 (id=7459): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001cd000071187c0000000000c3640000f10000007b0a00fe00000000850000002e00000079a00000000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x45}, 0x48) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg(r0, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000340)=""/82, 0x52}], 0x1}, 0x81}], 0x1, 0x2000, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={0x0}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$tun(r1, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0xfd5e, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07}, @generic={0x0, 0x2, "d588380003c1"}]}}}}}}, 0xfd6c) 4.440230231s ago: executing program 1 (id=7460): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newlink={0x38, 0x10, 0x801, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x3feff, 0x40e00}, [@IFLA_CARRIER={0x5, 0x21, 0x1}, @IFLA_AF_SPEC={0x10, 0x1a, 0x0, 0x1, [@AF_INET6={0xc, 0xa, 0x0, 0x1, [@IFLA_INET6_ADDR_GEN_MODE={0x5, 0x8, 0x8}]}]}]}, 0x38}}, 0x0) 4.151277962s ago: executing program 1 (id=7462): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000a0000000900010073797a3000000000400000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a30000000004c000022060a010400000000000000000100000008000b40000000000900010073797a300000000024000480200001800700010072740000140002800800014000000003080002400000ae60140000001100010000000000000000000000000a"], 0xd4}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000a0000000900010073797a3000000000400000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a30000000004c000022060a010400000000000000000100000008000b40000000000900010073797a300000000024000480200001800700010072740000140002800800014000000003080002400000ae60140000001100010000000000000000000000000a"], 0xd4}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x1c}}, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r5) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYRES32=r1, @ANYBLOB="291e37cc977d5d2aff8096e4705efdd73471aa0b915f8602e8d7c037dc03b0e74616a626b000fa442b367f5388f0c70745761c4cedd195ff2daf0afa3399f99f834c583a6d595833d8d6fb7786ca2f6c0fcb1cea6fa267dc2255d1e824404b9666826f220f83d13667f62f5ca99cab2ef290fe8e50bef2b6fe43007d15ed9375bf5035eea73ac30c4f5ff7a9ad7b3c3b4a28f9f8f498f5cd91396b3ee0fa8fe2237884cf82a627301600ca43a3dd317a8adbbe160b3ee7f26a3027d6577c98475869f49b", @ANYRES32=r6, @ANYRES64=0x0, @ANYRESOCT=r1, @ANYRESDEC=r2], 0x184}, 0x1, 0x0, 0x0, 0x4040040}, 0x0) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f0000000040)=0x2, 0x4) socket$inet_icmp(0x2, 0x2, 0x1) (async) r7 = socket$inet_icmp(0x2, 0x2, 0x1) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000100000000000000000000000000000a08001a400000000814001980080001004102000008000200080c000008000840000000010800074000000001"], 0x40}, 0x1, 0x0, 0x0, 0x340bb1d040eda419}, 0x84) (async) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000100000000000000000000000000000a08001a400000000814001980080001004102000008000200080c000008000840000000010800074000000001"], 0x40}, 0x1, 0x0, 0x0, 0x340bb1d040eda419}, 0x84) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c0000001400010000000000fcdbdf25021f49cb", @ANYRESHEX=r2, @ANYBLOB="08000200e00000011400030000000900000000000000008000e9ffff"], 0x3c}, 0x1, 0x0, 0x0, 0x4004800}, 0x8001) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f00000000c0)=@req={0x8000, 0xb4b, 0x300, 0x1daf6}, 0x10) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000040)=@req3={0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x100}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x8, 0x3, 0x2b8, 0x0, 0x1000000, 0xffffffff, 0x168, 0xffffffff, 0x220, 0xffffffff, 0xffffffff, 0x220, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x108, 0x168, 0x0, {0x0, 0x1c8}, [@common=@set={{0x40}, {{0x0, [0x7, 0x1, 0x3, 0x0, 0x3], 0x3, 0xc}}}, @common=@inet=@hashlimit1={{0x58}, {'veth0_to_batadv\x00', {0xf, 0x0, 0x5, 0x0, 0x0, 0x5, 0x23}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x0, 0x8, 0x7, 0x4, 0xb], 0x3, 0xdab9f66e79d89cfe}, {0x1, [0x0, 0x4, 0x0, 0x0, 0x5, 0x2], 0x1}}}}, {{@ip={@remote, @rand_addr=0x64010101, 0xff, 0xffffff, 'veth0_vlan\x00', 'vcan0\x00', {}, {0xff}}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x4, 0x6d12, 0x3ff, 0x6, 'netbios-ns\x00', {0xffffffffffffffff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x64}}}}, 0x318) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x44000) r10 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x460080, 0x0) pwritev(r10, &(0x7f0000000040)=[{&(0x7f0000000180)="80fd06000040", 0x27}], 0x2, 0x0, 0x4) (async) pwritev(r10, &(0x7f0000000040)=[{&(0x7f0000000180)="80fd06000040", 0x27}], 0x2, 0x0, 0x4) 4.144834645s ago: executing program 2 (id=7463): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'gretap0\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x7800, 0x10, 0x2, 0x8000, {{0x21, 0x4, 0x3, 0x2, 0x84, 0x68, 0x0, 0x6, 0x29, 0x0, @local, @multicast1, {[@cipso={0x86, 0x32, 0xffffffffffffffff, [{0x2, 0x9, "ebb994adc05920"}, {0x7, 0x11, "7ef5f7d9f0826ba59e9c6f3f6f5b22"}, {0x6, 0xf, "2f038ff746fcff7d2ea83a7813"}, {0x5, 0x3, "de"}]}, @end, @cipso={0x86, 0x11, 0x3, [{0x1, 0x5, "a01872"}, {0x7, 0x6, "e88ccbfa"}]}, @timestamp_prespec={0x44, 0xc, 0x98, 0x3, 0x9, [{@dev={0xac, 0x14, 0x14, 0x26}, 0x400}]}, @timestamp={0x44, 0x20, 0xdd, 0x0, 0xc, [0x12ae, 0x10, 0x1527, 0x5ab0400, 0x8, 0x5000, 0xf764]}]}}}}}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@getnexthop={0x20, 0x76, 0xb0d, 0x4000, 0x25dfdbfb, {0x3}, [@NHA_OIF={0x8, 0x5, r1}]}, 0x20}, 0x1, 0x0, 0x0, 0x8084}, 0x0) 3.993614774s ago: executing program 2 (id=7464): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000008c0)={0x84, @multicast2, 0x4e22, 0x1, 'lc\x00', 0x0, 0x10005, 0x204e}, 0x2c) setsockopt$IP_VS_SO_SET_DEL(r3, 0x0, 0x483, &(0x7f0000000000)={0x20000000000084, @private=0xa010102, 0x1ffc, 0x200000001, 'fo\x00', 0x15, 0x821, 0x1}, 0x2c) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00J\x00', @ANYRES16=r2, @ANYBLOB="010000000000fbdbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x20, 0x8e7b0, @ipv4={'\x00', '\xff\xff', @remote}, 0x40000}, 0x1c) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x99bcb88de02507f2, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) setsockopt(r5, 0x84, 0x7d, &(0x7f0000000440)='\a\x00\x00\x00\x00\x00\x00\x00', 0x8) getsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0x24, &(0x7f0000000180), &(0x7f00000001c0)=0xe) mmap(&(0x7f00009c5000/0x4000)=nil, 0x4000, 0x3, 0x28012, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r7, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x4001, @empty}, 0x10, 0x0}, 0x30006041) r8 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r8, &(0x7f0000000240)={0x28, 0x0, 0x2710, @hyper}, 0x10) listen(r3, 0x0) clock_gettime(0x0, &(0x7f0000000100)) ppoll(&(0x7f00000000c0)=[{r8, 0x404}, {r0, 0x48}, {r7, 0x808}, {r1, 0x10}, {0xffffffffffffffff, 0x20}, {r1, 0x224}], 0x6, 0x0, 0x0, 0x0) close(r7) 3.660179539s ago: executing program 3 (id=7466): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000780)=@newlink={0x74, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x54, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x44, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_LIMIT={0x5, 0x6, 0x8}, @IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e22}, @IFLA_IPTUN_REMOTE={0x14, 0x3, @private2}, @IFLA_IPTUN_FLOWINFO={0x8, 0x7, 0x7}, @IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x1}, @IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e20}]}}}]}, 0x74}, 0x1, 0xba01, 0x0, 0x4004001}, 0x4000000) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000080)={0x209d, 0x0, 0x4, 0x6}, 0x10) write(r1, &(0x7f00000000c0)="1800000016005f0214fffffffffffff80700000023000000", 0x18) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e23, @rand_addr=0x64010102}, {0x1, @multicast}, 0x2, {0x2, 0x4e21, @broadcast}, 'ip6gre0\x00'}) 3.455693315s ago: executing program 3 (id=7467): r0 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x4, 0x5, &(0x7f0000000240)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x4f}, @call={0x85, 0x0, 0x0, 0x23}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x28, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x1ff001, 0x401, 0x7b, 0x1}, 0x50) socket$kcm(0x2b, 0x1, 0x0) r4 = openat$cgroup_int(r1, &(0x7f00000000c0)='notify_on_release\x00', 0x2, 0x0) close(r4) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f00000007c0)={r3, 0x0, 0x0}, 0x20) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd2c, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) 2.982525815s ago: executing program 2 (id=7469): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="2f00000000000004"], 0x20) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') (async) unshare(0x6a040000) (async) r1 = socket$netlink(0x10, 0x3, 0xb) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) 1.763422402s ago: executing program 4 (id=7478): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={0x3c, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r2, 0x300, 0x170bd2b, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @mcast2, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x5, @mcast1, 0x3}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x48000) (async) sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)={0x6c, r2, 0x300, 0x170bd2b, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @mcast2, 0xf8}}, {0x20, 0x2, @in6={0xa, 0x0, 0x5, @mcast1, 0x3}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}]}, 0x6c}}, 0x48000) 1.701580376s ago: executing program 4 (id=7480): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) getpeername(r0, 0x0, &(0x7f00000000c0)) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000002e80), r1) sendmsg$NLBL_CIPSOV4_C_REMOVE(r1, &(0x7f0000003080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x14, r2, 0x1, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x20000840) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_DEV(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x2c, r4, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_DEVICE={0x4}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan3\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$ax25(0x3, 0x2, 0x3) getsockopt$ax25_int(r8, 0x101, 0x6, &(0x7f0000000000), &(0x7f0000000280)=0x4) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010700000000040000001600000008000300", @ANYRES32=r10], 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x7c, r4, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_SEC_DEVKEY={0x10, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x81) sendmsg$NL80211_CMD_GET_WIPHY(r0, 0x0, 0x4) 1.541041253s ago: executing program 0 (id=7482): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x1d, 0x2, 0x6) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000002c0)="6092fd2ab660eb7d72f9124688cbd42b1340d8886551a77a049cd4731f1201750aa3ce23f8503b43eac6b849f52998fd28e078d2888ccc64d5fdb2fab5b4b3277320958ca1199b5ef3587a48267fb088455088224991869d33174c0fe2e610cd9b4d3ff43130ee0768ced26aeab142982cd870e3be7d1ea91e44d16fbcadd302e235d605f546e5f4ba3bf6a97cb691a53238a6c1e47f0845a63039a5771d12eb44d5", 0xa2}], 0x1, 0x0, 0x0, 0x4080}, 0x4040004) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r4 = accept$alg(r3, 0x0, 0x0) recvmmsg(r4, &(0x7f0000003540)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000012c0)=""/4096, 0xfffffffffffffc8e}], 0x1}, 0xffffff0b}], 0x2, 0x2001, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r2, &(0x7f00000001c0)="a6e2976b", 0x4, 0x840, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/4079, 0xfef, 0x0, 0x0}, &(0x7f0000000000)=0x40) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c010000100007000000000000000000ff020000000000000000000000000001e00000020000000000000000000000004e200000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000100000000010000000000000000000000000000000000000000000000000000000000000000000000000000020000000000007000000ff070000000000000000000000000400fdffffffe80a0000003c9b9bb852e43c9b00020070000000000000004c001200726663343130362d67636d2d6165736e69000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200004ea3230553375f3a9cbabf095200f706ecaff1887375d312412eada180f5673428e94ec50c600b42c270cf039f96fb79a31a43e20a5e1d5a8dfcfed99b6cd606682df6fc1484e58b"], 0x13c}}, 0x0) 1.526818015s ago: executing program 0 (id=7483): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b70300000000000085"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x6, 0x104}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r0}, &(0x7f0000000840), &(0x7f0000000880)=r1}, 0x20) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r5, 0x25, 0x2}, 0x14) syz_emit_ethernet(0x66, &(0x7f0000000280)={@multicast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "02adf7", 0x30, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "fd9063", 0x0, 0x6, 0x0, @mcast1, @loopback={0x0, 0xffffac1414aa}}}}}}}}, 0x0) 1.458548906s ago: executing program 0 (id=7484): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001cd000071187c0000000000c3640000f10000007b0a00fe00000000850000002e00000079a00000000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x45}, 0x48) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg(r0, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000340)=""/82, 0x52}], 0x1}, 0x81}], 0x1, 0x2000, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={0x0}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$tun(r1, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0xfd5e, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07}, @generic={0x0, 0x2, "d588380003c1"}]}}}}}}, 0xfd6c) 1.270409518s ago: executing program 3 (id=7485): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="08001d00040000000400000009000000000000004e1edb81ade1ea38e26979f23670e7aab8dc123ce655fb3e2ed79ca6838936e81855d74a38dbda3e115c9f77d677f13b84ed6a75ef1c845a07990c8f142f7288d45a7e4e09586bc5d7d410d7b98fd3cfba5bcf39a06d63abed37e3abd0a0", @ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="180900", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000120095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca3", 0x4}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538", 0x58}], 0x2}], 0x1, 0x40800) recvmsg(r3, 0x0, 0x10100) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000ac4010000060a0b040000000000000000020000004c000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c5920800024000000002140001800b0001006c6f6f6b75700000040002800900010073797a30000000000900020073797a3200000000f70007404884b24b02a8a7758a688958ed60ecfd057e10926ba77e5596b13e43cd4488e4aa68af5f7236ec205b6e4cac2a0d86c336bf07dbe861f4f57bcef92dcf818d532d4475b5daa4dadc1690f228e860bba5a0b5d9bde86862e8f7fc08f0debd4974c6fae7d737a0007ec948ac4d8714ebff6b25648fb910e0d6d07f023cf5fa4051627b9c5b69e265538f9ba683bf172a5ff815afa543c12e550a1bcc9287080c7c12cc89d216c56febb0b06134672ea6b0077c846396169475f271319988f49ec94f2996e5d0e1cb151fb223e556f10fb681"], 0x1ec}}, 0x0) 1.05883558s ago: executing program 3 (id=7486): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000bc0)={0x130, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_NAT={0xa4, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x80, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x60, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x4}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x48, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'sip-20000\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x130}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) socket(0x10, 0x803, 0x0) (async) r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000500)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000500)={'team0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x8c, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r2, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x6], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x100, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x4ed]}}]}}]}, 0x8c}}, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 819.534022ms ago: executing program 3 (id=7487): unshare(0x6020400) (async) unshare(0x6020400) poll(0x0, 0x0, 0x9) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r2, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES64=r1], 0x68}}, 0x0) unshare(0x2020400) (async) unshare(0x2020400) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r3, &(0x7f0000000040)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) (async) bind$x25(r3, &(0x7f0000000040)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r5, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r6, r4, 0x0, r0}, 0x10) 735.321999ms ago: executing program 4 (id=7488): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f0000000100)=[{&(0x7f0000000000)="8e", 0x1}], 0x1, 0x8001, 0x80) close(r1) (async) r2 = socket$inet6(0xa, 0x80002, 0x88) sendmmsg$inet6(r2, &(0x7f0000003a80)=[{{&(0x7f00000001c0)={0xa, 0x4e23, 0x2, @mcast1, 0x7}, 0x1c, 0x0}}], 0x1, 0xc004) (async) sendfile(r1, r0, 0x0, 0xf03a0005) (async) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) r3 = socket$inet_udplite(0x2, 0x2, 0x88) (rerun: 64) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x8000, 0x0, 0xcf, 0x408, {{0x5, 0x4, 0x0, 0x38, 0x14, 0x65, 0x0, 0x3, 0x4, 0x0, @loopback, @remote}}}}) (async) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r5, 0x1, 0x9, &(0x7f0000000480)=0xfffffffc, 0x4) (async) bind$inet(r5, &(0x7f0000000040)={0x2, 0xfffd, @local}, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000340)=0xc) sendmsg$nl_xfrm(r7, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7c0100001600000327bd7000fbdbdf25e0000001000000000000000000000000fe8000000000000000000000000000aa4e2000074e090b211c4a0a00a0801d00", @ANYRES32=r4, @ANYRES32=r8, @ANYBLOB="00000000000000000000000000000000000004d56c000000ac141423000000000000000000000000faffffffffffffff0300000000000000ff0f00000000000040000000000000000004000000000000c100000000000000040000000000000002000000000000000100000000000000bff80000000000005a000000000000008600000000000000060000000e0000005300000028bd7000000000000a0006022100000000000000c3ec00000700000081000100686d616328736861312d6e656f6e2900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8010000da223268d9dbb777a4c4f1d9092fa08be8e136ac51ac5ee1c25c237e8afa944e520a702277e889ec1d793b4e75d568f6e8d2cfc85d0a6aa295000000"], 0x17c}}, 0x8004) (async) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$BATADV_CMD_GET_NEIGHBORS(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c400000bb9fb6fa17c9b11a20edc99b016f5615320b3ad75e0a7de6bc5c44e9a197a1511114293695a3d712344c24ff9934be71e5610dac77e2ed1ae6f894d57505e17819bcf18067f20dc06a823e220967ae17ee0597fe89bb2f468a5610f18dd41998d1c769392e666e3a148cf9cd8a837018fb408924fb834ecaba7ab86d02a2eae600b3bb7fa19163385a14f9c7", @ANYRES16=r9, @ANYBLOB="310301000000fcdbdf250900000008000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x20000095}, 0x200480c4) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000002100040026bd7000fedbdf2502142000030000081400000008000200ac141400000000000400000005001300000000000c000c400000000000000b84"], 0x40}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x100, 0x70bc25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x8, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) (async, rerun: 64) r10 = socket$kcm(0x10, 0x2, 0x10) (async, rerun: 64) r11 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="2309fefffffffcffffff0100000005000700000000000800090000000000060002000100000008000a000400010008001700", @ANYRES32], 0x3c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) (async, rerun: 32) sendmsg$kcm(r10, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) (rerun: 32) 718.991811ms ago: executing program 0 (id=7489): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x22483, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x103000, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0xfff3, 0xfff1}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3d1, 0x3, 0xffffffffffffffff, 0x6, 0x6}, 0x2d}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0xc804}, 0x2) close(r2) socket$unix(0x1, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r1, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="27030200000314000e00003c031500000000ff8800000000000000000000000000000000000085dc9d9839dc1336", 0x2e}], 0x1}, 0x4005) 591.231937ms ago: executing program 4 (id=7490): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r1) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000004e000100000000000000000000030000080001"], 0x1c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x49801, 0x9a4d}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x2}]}}}]}, 0x40}}, 0x4004050) sendto$packet(r0, &(0x7f0000000400)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53bcc", 0x28, 0x40880, &(0x7f0000000200)={0x11, 0x86dd, r2, 0x1, 0x4, 0x6, @local}, 0x14) 310.07802ms ago: executing program 3 (id=7491): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x884}, 0x20000080) socket(0x10, 0x803, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x24000840) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="7800000000000013c8a2c8c0b99f8d5d3aa95ab6", @ANYBLOB="00000000000000005800128008000100677265004c00028008000600ac1414aa050017000000000005000800020000000800150090650900060003000100000005000a0001000000080007007f000001080007007f000001060010004e220000"], 0x78}}, 0x800) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4001, 0xb, @loopback, 0x9}, 0x1c) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, 0x0, 0x0) listen(r3, 0xfffffffc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1]}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000540)=ANY=[@ANYBLOB="34010000100003053a0070000c0000000000000031862de866c6701a710ae73d88f05355173676eec3ea926fb377fe48f67980f658c760e2d660816107a63da86b37601e14cb818586cbf626d1b53908b01daa59c9c5de3785f2fb3015f4d73baf104765a66e5dae30d2092bbe4c8fed31cb3d1e520a923cfe42a733782dc6786ba6ccddd9ee20cfda8e7c8e0d829c2d7d6dbc3b444f9ef508912166e51eefae3e3de1f2e76c01245489c17024967fc305", @ANYRES32=0x0, @ANYBLOB="3a000000a0010200f800128009000100766c616e00000000e8000280580003800c00010009000000070000000c00010000000000000800000c000100fcffffff050000000c00010050000000020000000c00010002000000030000000c000100ff070000050000000c0001002b440000040000001c0003800c00010001000000050000000c000100834c0000ca080000640004800c00010005000000800000000c0001000a000000040000000c00010008000000070000000c00010006000000810000000c00010003000000010000800c00010002000000070000000c000100f7ffffff0d0000000c000100a05500000100000006000100020000000400038008000500", @ANYRES32=r10, @ANYBLOB="08002900496200000a0002000000000000000000"], 0x134}}, 0x800) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20000000) 281.455781ms ago: executing program 4 (id=7492): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x4, @local}, 0x10, 0x0, 0x0, &(0x7f0000000240)=[@rdma_args={0x48, 0x114, 0x1, {{0x5, 0x1a2}, {0x0}, &(0x7f0000000400)=[{&(0x7f0000000880)=""/4096, 0x1000}], 0x1, 0x0, 0xc}}], 0x48}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000001b00)=ANY=[@ANYBLOB="140000001000010000000000000006000000000a3c000000120a09000000000000000000020008030900020073797a310000000008000440000000000900010073797a30000000000800034000000007", @ANYRESDEC=r1], 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x4040000) 173.659691ms ago: executing program 0 (id=7493): bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000f00)={0x28, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000400000000000900020073797a320000000014000780050015001300000008001200000000000500050002000000050001000600000012000300686173683a6e65742c706f7274"], 0x60}}, 0x40000010) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x40, r1, 0x1, 0x1070bd0c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x79}]}, 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x20) socket$kcm(0x29, 0x5, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r1, 0x400, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x1c}}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xe, &(0x7f0000000b00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff6a0af0fff8ffff1971a400fe00000000b7060000080000002d6400000000000045040300010000001704000001000a00b7040000ff010000720af2fe000000008500000049000000b700000070b2000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d761ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a8321e056acf27c34bed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb93ce1c0983cdcb48477b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e44c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6bc7c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c460880000000000000000000000000000007a4604baa70bda5d5f18f54e9638350a6dd81a55ab5528efd1ef5a564908db7cce99e5c569c2947763b90e03b6d1a53b590e4ff4867f0d86b9af58244866b9df33634c8d85ce1b3bfa3e5bec6989c907c2f46b9a837676e07d87bb7dba3f34694ceb5b9faf10eece00bcfd503ed3f3048782665a848d79e443de4ba97db3a9bde69be7612cb1441c61eadd5bb4494ff2eb189c2ab3a241c12f764c0719650c1b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x9}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x20000000}, 0x10}, 0x94) 38.253835ms ago: executing program 4 (id=7494): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) r1 = socket$inet_udplite(0x2, 0x2, 0x88) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x8942, &(0x7f0000000640)={'tunl0\x00', 0x0}) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000010101010000000000000000000340000200008c6f91d1265a1616874123762973bf85444296a8655de4d945dbcf49f50f"], 0x24}}, 0x0) 0s ago: executing program 0 (id=7495): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000280)={{r0, &(0x7f0000000080)='\')-\")\\^u\'#\x00', 0x800, &(0x7f00000000c0)={@_ha_fsid={[0x9, 0xc00]}, {0x7, 0xfffe, 0x38d, 0x81}}, 0x9, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x8}, {[0xf3b, 0x4, 0x9, 0x219]}, 0xf2bd, 0x55, &(0x7f0000000200)=""/85}) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff00000000017c0000040042800c000180062106a990390000100002"], 0x34}, 0x1, 0x0, 0x0, 0x4004095}, 0xc000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff0000000002"], 0x34}, 0x1, 0x0, 0x0, 0x4000895}, 0xc000) kernel console output (not intermixed with test programs): syzkaller0: entered allmulticast mode [ 830.404344][T29323] sctp: [Deprecated]: syz.1.5963 (pid 29323) Use of struct sctp_assoc_value in delayed_ack socket option. [ 830.404344][T29323] Use struct sctp_sack_info instead [ 830.423233][T29323] sctp: [Deprecated]: syz.1.5963 (pid 29323) Use of struct sctp_assoc_value in delayed_ack socket option. [ 830.423233][T29323] Use struct sctp_sack_info instead [ 830.450546][T29298] lo speed is unknown, defaulting to 1000 [ 830.473178][T29298] batadv0 speed is unknown, defaulting to 1000 [ 830.601389][T29326] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 830.694190][T29326] veth3: entered promiscuous mode [ 830.955017][T29336] lo speed is unknown, defaulting to 1000 [ 831.531546][T29336] lo speed is unknown, defaulting to 1000 [ 831.757489][T29342] bond15: Unable to set peer notification delay as MII monitoring is disabled [ 831.783576][T29342] bond15 (unregistering): Released all slaves [ 831.933329][T29336] lo speed is unknown, defaulting to 1000 [ 831.954071][T29336] batadv0 speed is unknown, defaulting to 1000 [ 832.018700][T29352] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 832.187688][T29360] lo speed is unknown, defaulting to 1000 [ 832.411926][T29364] netlink: 'syz.1.5976': attribute type 1 has an invalid length. [ 832.738051][T17462] IPVS: starting estimator thread 0... [ 832.745774][T29375] IPVS: fo: FWM 3 0x00000003 - no destination available [ 832.765557][ C0] IPVS: fo: FWM 3 0x00000003 - no destination available [ 832.862926][T29376] IPVS: using max 25 ests per chain, 60000 per kthread [ 833.048860][T29379] netlink: 'syz.0.5978': attribute type 2 has an invalid length. [ 833.198117][T29360] lo speed is unknown, defaulting to 1000 [ 833.713189][T29360] lo speed is unknown, defaulting to 1000 [ 833.723724][T29360] batadv0 speed is unknown, defaulting to 1000 [ 833.890427][T29397] netlink: 'syz.1.5983': attribute type 30 has an invalid length. [ 833.963844][T29394] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 834.123617][T29397] bond1: option arp_missed_max: invalid value (0) [ 834.132784][T29397] bond1: option arp_missed_max: allowed values 1 - 255 [ 834.172467][T29397] bond1 (unregistering): Released all slaves [ 834.615261][T29410] syzkaller0: entered promiscuous mode [ 834.622603][T29410] syzkaller0: entered allmulticast mode [ 834.790269][T29431] __nla_validate_parse: 3 callbacks suppressed [ 834.790290][T29431] netlink: 240 bytes leftover after parsing attributes in process `syz.3.5988'. [ 834.919223][T29433] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5990'. [ 834.983452][T29434] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5990'. [ 836.819889][T29433] bond0: entered promiscuous mode [ 836.826195][T29433] bond_slave_0: entered promiscuous mode [ 836.846950][T29433] bond_slave_1: entered promiscuous mode [ 836.861446][T29433] macvlan2: entered promiscuous mode [ 836.866935][T29433] dummy0: entered promiscuous mode [ 836.877947][T29433] bond0: left promiscuous mode [ 836.884462][T29433] bond_slave_0: left promiscuous mode [ 836.890390][T29433] bond_slave_1: left promiscuous mode [ 836.896784][T29433] macvlan2: left promiscuous mode [ 836.911907][T29433] dummy0: left promiscuous mode [ 836.933442][T29434] bond0: entered promiscuous mode [ 836.938731][T29434] bond_slave_0: entered promiscuous mode [ 836.952348][T29434] bond_slave_1: entered promiscuous mode [ 836.958239][T29434] macvlan2: entered promiscuous mode [ 836.967545][T29434] dummy0: entered promiscuous mode [ 836.974286][T29434] bond0: left promiscuous mode [ 836.979087][T29434] bond_slave_0: left promiscuous mode [ 836.996943][T29434] bond_slave_1: left promiscuous mode [ 837.003925][T29434] macvlan2: left promiscuous mode [ 837.012010][T29434] dummy0: left promiscuous mode [ 837.071583][T29438] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5991'. [ 837.084020][T29446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5993'. [ 837.252870][T29456] netlink: 'syz.0.5995': attribute type 1 has an invalid length. [ 837.262591][T29456] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5995'. [ 837.273352][T29456] netlink: 1 bytes leftover after parsing attributes in process `syz.0.5995'. [ 837.283506][T29456] netlink: 'syz.0.5995': attribute type 1 has an invalid length. [ 837.328347][T29452] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5994'. [ 837.472272][T29462] pim6reg1: entered promiscuous mode [ 837.489475][T29462] pim6reg1: entered allmulticast mode [ 838.287749][T29482] bond4: invalid ARP target 0.0.0.0 specified for addition [ 838.331104][T29482] bond4: option arp_ip_target: invalid value (0) [ 838.340559][T29482] bond4 (unregistering): Released all slaves [ 838.644010][T29499] netlink: 'syz.3.6008': attribute type 15 has an invalid length. [ 838.875926][T29513] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.6012'. [ 839.233532][T29503] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 839.243955][T29503] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 839.379349][T29532] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6017'. [ 839.423200][T29533] netlink: 'syz.0.6016': attribute type 1 has an invalid length. [ 839.724894][T29536] bond15: (slave vxcan1): The slave device specified does not support setting the MAC address [ 839.739849][T29536] bond15: (slave vxcan1): Error -95 calling set_mac_address [ 839.865797][T29553] __nla_validate_parse: 2 callbacks suppressed [ 839.865818][T29553] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6019'. [ 840.188886][T29564] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6024'. [ 840.959230][T29599] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6033'. [ 841.046085][T29599] bond16: entered promiscuous mode [ 841.085623][T29599] 8021q: adding VLAN 0 to HW filter on device bond16 [ 841.110102][T29603] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6033'. [ 841.185411][T29602] 8021q: adding VLAN 0 to HW filter on device bond16 [ 841.225332][T29602] bond16: (slave ip6tnl2): The slave device specified does not support setting the MAC address [ 841.244362][T29602] bond16: (slave ip6tnl2): Error -95 calling set_mac_address [ 841.376287][T29614] netlink: 'syz.3.6036': attribute type 1 has an invalid length. [ 841.422376][T29617] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6037'. [ 841.533888][T29599] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 841.564579][T29622] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6036'. [ 841.715330][T29614] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6036'. [ 841.812169][T29618] 8021q: adding VLAN 0 to HW filter on device bond5 [ 841.822016][T29618] bond4: (slave bond5): making interface the new active one [ 841.830330][T29618] bond4: (slave bond5): Enslaving as an active interface with an up link [ 841.882430][T29632] netlink: 4224 bytes leftover after parsing attributes in process `syz.0.6039'. [ 841.984636][T29635] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6040'. [ 842.026556][T29621] bond4: (slave gretap2): Enslaving as a backup interface with an up link [ 842.070090][T29640] netlink: 'syz.4.6042': attribute type 1 has an invalid length. [ 842.081637][T29622] 8021q: adding VLAN 0 to HW filter on device bond4 [ 842.108636][T29626] vlan3: entered promiscuous mode [ 842.117317][T29626] bond4: entered promiscuous mode [ 842.126145][T29626] bond5: entered promiscuous mode [ 842.205822][T29650] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 842.207738][T29649] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6044'. [ 842.213156][T29650] IPv6: NLM_F_CREATE should be set when creating new route [ 842.213283][T29650] IPv6: NLM_F_CREATE should be set when creating new route [ 842.229426][T29640] bond1: entered promiscuous mode [ 842.240932][T29650] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 842.247311][T29651] netlink: 'syz.1.6043': attribute type 16 has an invalid length. [ 842.268751][T29640] 8021q: adding VLAN 0 to HW filter on device bond1 [ 842.292006][T29646] 8021q: adding VLAN 0 to HW filter on device bond1 [ 842.299522][T29646] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 842.312840][T29646] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 842.328256][T29646] bond1: (slave wireguard0): making interface the new active one [ 842.337223][T29646] wireguard0: entered promiscuous mode [ 842.352799][T29646] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 842.412337][T29650] bond1: (slave wireguard1): The slave device specified does not support setting the MAC address [ 842.443401][T29650] bond1: (slave wireguard1): Enslaving as a backup interface with an up link [ 842.874517][T29693] netlink: 'syz.2.6053': attribute type 15 has an invalid length. [ 845.535419][T29661] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 845.747368][T29702] tipc: Enabling of bearer rejected, failed to enable media [ 845.806693][T29713] netlink: 'syz.0.6057': attribute type 2 has an invalid length. [ 845.838848][T29713] netlink: 'syz.0.6057': attribute type 1 has an invalid length. [ 845.866408][T29713] netlink: 'syz.0.6057': attribute type 1 has an invalid length. [ 845.970860][T29720] __nla_validate_parse: 2 callbacks suppressed [ 845.970882][T29720] netlink: 120 bytes leftover after parsing attributes in process `syz.2.6059'. [ 846.016898][T29720] netlink: 'syz.2.6059': attribute type 1 has an invalid length. [ 846.026547][T29718] lo speed is unknown, defaulting to 1000 [ 846.027407][T29720] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6059'. [ 846.214769][T29726] gtp0: entered promiscuous mode [ 846.240358][T29734] IPVS: Error connecting to the multicast addr [ 846.249505][T29726] IPv6: NLM_F_CREATE should be specified when creating new route [ 846.315419][T29718] lo speed is unknown, defaulting to 1000 [ 846.557430][T29744] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6065'. [ 846.652387][T29718] lo speed is unknown, defaulting to 1000 [ 846.690722][T29718] batadv0 speed is unknown, defaulting to 1000 [ 846.768215][T29755] block nbd4: not configured, cannot reconfigure [ 846.982293][T29768] sctp: [Deprecated]: syz.2.6071 (pid 29768) Use of int in max_burst socket option. [ 846.982293][T29768] Use struct sctp_assoc_value instead [ 847.218547][T29774] netlink: 'syz.3.6075': attribute type 11 has an invalid length. [ 847.228270][T29774] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6075'. [ 847.238635][T29774] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 847.270455][T29774] netlink: 'syz.3.6075': attribute type 1 has an invalid length. [ 847.928661][T29792] xt_TCPMSS: Only works on TCP SYN packets [ 848.034040][T29794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6081'. [ 848.336893][T29807] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6084'. [ 848.431847][T29814] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6086'. [ 848.483968][T29817] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6087'. [ 848.685484][T29826] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6089'. [ 848.992268][ T5830] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 849.003317][ T5830] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 849.012696][ T5830] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 849.032155][ T5830] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 849.039942][ T5830] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 849.105839][T29828] lo speed is unknown, defaulting to 1000 [ 849.298846][T29828] lo speed is unknown, defaulting to 1000 [ 849.536355][T29828] lo speed is unknown, defaulting to 1000 [ 849.544397][T29828] batadv0 speed is unknown, defaulting to 1000 [ 849.777667][T29837] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6092'. [ 849.843300][T29757] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 849.848591][T29828] chnl_net:caif_netlink_parms(): no params data found [ 850.026937][T29844] netlink: 'syz.1.6093': attribute type 1 has an invalid length. [ 850.111836][T29828] bridge0: port 1(bridge_slave_0) entered blocking state [ 850.119043][T29828] bridge0: port 1(bridge_slave_0) entered disabled state [ 850.145513][T29828] bridge_slave_0: entered allmulticast mode [ 850.168760][T29828] bridge_slave_0: entered promiscuous mode [ 850.182702][T29854] x_tables: duplicate entry at hook 2 [ 850.201070][T29828] bridge0: port 2(bridge_slave_1) entered blocking state [ 850.208407][T29828] bridge0: port 2(bridge_slave_1) entered disabled state [ 850.236665][T29828] bridge_slave_1: entered allmulticast mode [ 850.258846][T29828] bridge_slave_1: entered promiscuous mode [ 850.303749][T29857] lo speed is unknown, defaulting to 1000 [ 850.362534][T29828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 850.388361][T29828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 850.523361][T29828] team0: Port device team_slave_0 added [ 850.567305][T29828] team0: Port device team_slave_1 added [ 850.735645][T29828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 850.748789][T29828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 850.800966][T29828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 850.815106][T29828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 850.825807][T29828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 850.933577][T29828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 851.021443][T29886] "syz.2.6103" (29886) uses obsolete ecb(arc4) skcipher [ 851.141966][ T5830] Bluetooth: hci4: command tx timeout [ 851.189072][T29857] lo speed is unknown, defaulting to 1000 [ 851.266529][T29828] hsr_slave_0: entered promiscuous mode [ 851.297607][T29828] hsr_slave_1: entered promiscuous mode [ 851.307699][T29828] debugfs: 'hsr0' already exists in 'hsr' [ 851.337037][T29828] Cannot create hsr debugfs directory [ 851.389797][T29895] __nla_validate_parse: 6 callbacks suppressed [ 851.389819][T29895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6105'. [ 851.412333][T29897] netlink: 'syz.3.6106': attribute type 1 has an invalid length. [ 851.420512][T29897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6106'. [ 851.697550][T29857] lo speed is unknown, defaulting to 1000 [ 851.715363][T29905] netlink: 'syz.1.6108': attribute type 1 has an invalid length. [ 851.736485][T29857] batadv0 speed is unknown, defaulting to 1000 [ 851.803939][T29910] bond2: (slave gretap1): making interface the new active one [ 851.813499][T29910] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 851.843480][T29828] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 851.905264][T29910] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6108'. [ 852.013380][T29828] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.062451][T29917] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6111'. [ 852.125738][T29828] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.268638][T29828] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.576769][T29940] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 852.659801][T29941] xfrm0: entered promiscuous mode [ 852.753267][T29944] netlink: 'syz.1.6118': attribute type 1 has an invalid length. [ 852.783377][T29944] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.6118'. [ 852.798617][T29944] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 852.860789][T29828] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 852.876978][T29828] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 852.914847][T29828] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 852.962167][T29828] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 853.222317][ T5830] Bluetooth: hci4: command tx timeout [ 853.258343][T29828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 853.283565][T29828] 8021q: adding VLAN 0 to HW filter on device team0 [ 853.309979][T20022] bridge0: port 1(bridge_slave_0) entered blocking state [ 853.317315][T20022] bridge0: port 1(bridge_slave_0) entered forwarding state [ 853.360482][T25764] bridge0: port 2(bridge_slave_1) entered blocking state [ 853.367727][T25764] bridge0: port 2(bridge_slave_1) entered forwarding state [ 854.017125][T29975] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6123'. [ 854.028802][T29828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 854.038167][T29975] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6123'. [ 854.038362][T29972] syzkaller0: entered promiscuous mode [ 854.048046][T29975] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6123'. [ 854.072633][T29975] netlink: 540 bytes leftover after parsing attributes in process `syz.1.6123'. [ 854.081984][T29972] syzkaller0: entered allmulticast mode [ 854.114428][T29977] IPVS: Unknown mcast interface: macvlan0 [ 854.189675][T29972] netlink: 'syz.3.6122': attribute type 13 has an invalid length. [ 854.264720][T29828] veth0_vlan: entered promiscuous mode [ 854.285838][T29978] tipc: Enabled bearer , priority 0 [ 854.326723][T29971] tipc: Resetting bearer [ 854.355287][T29971] tipc: Disabling bearer [ 854.400499][T29828] veth1_vlan: entered promiscuous mode [ 854.532003][T29828] veth0_macvtap: entered promiscuous mode [ 854.546636][T29828] veth1_macvtap: entered promiscuous mode [ 854.577390][T29828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 854.616170][T29828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 854.645635][T20022] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.669866][T30002] erspan1: entered allmulticast mode [ 854.686137][T20022] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.696430][T20022] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.708228][T20022] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.939459][T30006] tipc: Enabled bearer , priority 0 [ 854.961679][T30006] syzkaller0: entered promiscuous mode [ 854.975907][T30006] syzkaller0: entered allmulticast mode [ 855.007785][T25756] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 855.034106][T25756] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 855.119305][T30006] tipc: Resetting bearer [ 855.137615][T30005] tipc: Resetting bearer [ 855.166781][T30005] tipc: Disabling bearer [ 855.194151][T25764] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 855.207744][T25764] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 855.311643][ T5830] Bluetooth: hci4: command tx timeout [ 855.906063][T30035] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6147'. [ 855.937418][T30039] lo speed is unknown, defaulting to 1000 [ 856.437929][T30039] lo speed is unknown, defaulting to 1000 [ 856.714603][T30065] openvswitch: netlink: Key type 234 is out of range max 32 [ 856.926042][T30039] lo speed is unknown, defaulting to 1000 [ 856.942987][T30039] batadv0 speed is unknown, defaulting to 1000 [ 857.404861][ T5830] Bluetooth: hci4: command tx timeout [ 857.682458][T30084] lo speed is unknown, defaulting to 1000 [ 857.998227][T30096] __nla_validate_parse: 2 callbacks suppressed [ 857.998249][T30096] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6163'. [ 858.166634][T30094] lo speed is unknown, defaulting to 1000 [ 858.626218][T30094] lo speed is unknown, defaulting to 1000 [ 858.900077][T30084] lo speed is unknown, defaulting to 1000 [ 859.015731][T30094] lo speed is unknown, defaulting to 1000 [ 859.025820][T30094] batadv0 speed is unknown, defaulting to 1000 [ 859.095915][T30101] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6165'. [ 859.340870][T30103] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6166'. [ 859.524265][T30106] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6167'. [ 859.600365][T30106] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6167'. [ 859.629902][T30084] lo speed is unknown, defaulting to 1000 [ 859.891952][T30084] batadv0 speed is unknown, defaulting to 1000 [ 860.215486][T30113] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6170'. [ 860.716985][T30127] ip6t_srh: unknown srh invflags 4000 [ 862.196187][T30152] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 862.283347][T30156] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6181'. [ 862.311654][T30152] bond1 (unregistering): Released all slaves [ 862.560039][T30150] lo speed is unknown, defaulting to 1000 [ 863.070041][T30177] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6188'. [ 863.406122][T30150] lo speed is unknown, defaulting to 1000 [ 863.694780][T30199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6195'. [ 864.262073][T30203] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6196'. [ 864.301703][T30150] lo speed is unknown, defaulting to 1000 [ 864.354863][T30150] batadv0 speed is unknown, defaulting to 1000 [ 864.413450][T30203] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6196'. [ 864.423755][T30203] openvswitch: netlink: Flow key attr not present in new flow. [ 864.461857][T30206] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6197'. [ 864.579301][T30207] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6197'. [ 864.709716][T30209] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6198'. [ 864.983591][T30223] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6201'. [ 865.084203][T30223] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6201'. [ 865.359198][T30245] netlink: 260 bytes leftover after parsing attributes in process `syz.4.6207'. [ 865.373221][T30246] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 865.386364][T30246] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 865.521260][T30254] netlink: 'syz.3.6211': attribute type 10 has an invalid length. [ 865.563871][T30246] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 865.611191][T30246] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 865.657153][T30254] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 865.729354][T30246] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 865.760273][T30246] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 865.892265][T30246] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 865.916960][T30268] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 865.945198][T30246] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 866.039508][T30260] lo speed is unknown, defaulting to 1000 [ 866.077215][T30271] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 866.127544][T30267] lo speed is unknown, defaulting to 1000 [ 866.290109][T25764] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 866.299556][T25764] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 866.348278][T25764] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 866.366082][T25764] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 866.590280][T30275] tipc: Enabled bearer , priority 0 [ 866.605563][T25764] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 866.616384][T25764] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 866.629220][T30277] syzkaller0: entered promiscuous mode [ 866.640887][T30277] syzkaller0: entered allmulticast mode [ 866.672746][T30274] tipc: Resetting bearer [ 866.682142][T25764] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 866.711677][T25764] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 866.721872][T30273] tipc: Resetting bearer [ 866.786845][T30273] tipc: Disabling bearer [ 867.033061][T30260] lo speed is unknown, defaulting to 1000 [ 867.072665][T30291] netlink: 'syz.4.6219': attribute type 1 has an invalid length. [ 867.081712][T30293] netlink: 'syz.4.6219': attribute type 1 has an invalid length. [ 867.702451][T30314] x_tables: duplicate underflow at hook 1 [ 867.722194][T30260] lo speed is unknown, defaulting to 1000 [ 867.722193][T30267] lo speed is unknown, defaulting to 1000 [ 867.773019][T30260] batadv0 speed is unknown, defaulting to 1000 [ 867.773043][T30316] netlink: 'syz.4.6225': attribute type 2 has an invalid length. [ 867.792945][T30314] lo speed is unknown, defaulting to 1000 [ 868.158794][T30327] lo speed is unknown, defaulting to 1000 [ 868.548804][T30343] __nla_validate_parse: 6 callbacks suppressed [ 868.548825][T30343] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6230'. [ 868.562643][T30267] lo speed is unknown, defaulting to 1000 [ 868.625157][T30267] batadv0 speed is unknown, defaulting to 1000 [ 868.654121][T30343] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6230'. [ 868.665625][T30343] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6230'. [ 868.807168][T30314] lo speed is unknown, defaulting to 1000 [ 868.999160][T30348] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6232'. [ 869.468252][T30327] lo speed is unknown, defaulting to 1000 [ 869.468284][T30314] lo speed is unknown, defaulting to 1000 [ 869.486303][T30314] batadv0 speed is unknown, defaulting to 1000 [ 870.057381][T30370] netdevsim netdevsim4: Direct firmware load for - [ 870.057381][T30370] failed with error -2 [ 870.075248][T30370] netdevsim netdevsim4: Falling back to sysfs fallback for: - [ 870.075248][T30370] [ 870.270959][T30327] lo speed is unknown, defaulting to 1000 [ 870.330225][T30327] batadv0 speed is unknown, defaulting to 1000 [ 871.469252][T30379] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.6240'. [ 871.764498][T30385] tipc: Enabled bearer , priority 0 [ 871.784422][T30385] syzkaller0: entered promiscuous mode [ 871.790141][T30385] syzkaller0: entered allmulticast mode [ 871.842533][T30385] tipc: Resetting bearer [ 871.853160][T30384] tipc: Resetting bearer [ 871.934626][T30384] tipc: Disabling bearer [ 872.476584][T30411] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6249'. [ 872.794008][T30421] veth0: entered promiscuous mode [ 872.833057][T30421] netlink: 'syz.4.6250': attribute type 1 has an invalid length. [ 872.855538][T30422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6251'. [ 872.865619][T30421] netlink: 248 bytes leftover after parsing attributes in process `syz.4.6250'. [ 872.953711][T30425] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6252'. [ 873.087080][T30425] ip6gretap0: entered promiscuous mode [ 873.124610][T30425] syz_tun: entered promiscuous mode [ 873.169679][T30430] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6250'. [ 873.963427][T29091] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 873.976473][T29091] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 873.987609][T29091] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 873.999704][T29091] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 874.013467][T29091] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 874.184788][T30451] lo speed is unknown, defaulting to 1000 [ 874.275162][T30457] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6261'. [ 874.438015][T30466] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6263'. [ 874.587349][T30451] lo speed is unknown, defaulting to 1000 [ 875.320467][T30486] tipc: Failed to obtain node identity [ 875.349296][T30486] tipc: Enabling of bearer rejected, failed to enable media [ 875.473545][T30483] xt_CT: No such helper "snmp_trap" [ 875.490021][T30451] lo speed is unknown, defaulting to 1000 [ 875.531436][T30451] batadv0 speed is unknown, defaulting to 1000 [ 875.851741][T30500] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6273'. [ 876.063738][T30496] 8021q: VLANs not supported on vxcan1 [ 876.103440][ T5830] Bluetooth: hci3: command tx timeout [ 876.136466][T30506] nbd0: detected capacity change from 0 to 63 [ 876.153354][T30162] block nbd0: Dead connection, failed to find a fallback [ 876.487261][T30451] chnl_net:caif_netlink_parms(): no params data found [ 877.053307][T30556] FAULT_INJECTION: forcing a failure. [ 877.053307][T30556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 877.097365][T30451] bridge0: port 1(bridge_slave_0) entered blocking state [ 877.110893][T30563] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6290'. [ 877.116305][T30451] bridge0: port 1(bridge_slave_0) entered disabled state [ 877.120165][T30556] CPU: 0 UID: 0 PID: 30556 Comm: syz.4.6288 Not tainted syzkaller #0 PREEMPT(full) [ 877.120188][T30556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 877.120261][T30556] Call Trace: [ 877.120274][T30556] [ 877.120285][T30556] dump_stack_lvl+0xe8/0x150 [ 877.120317][T30556] should_fail_ex+0x412/0x560 [ 877.120348][T30556] _copy_to_user+0x31/0xb0 [ 877.120371][T30556] simple_read_from_buffer+0xe1/0x170 [ 877.120403][T30556] proc_fail_nth_read+0x1bb/0x230 [ 877.120431][T30556] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 877.120458][T30556] ? rw_verify_area+0x2a6/0x4d0 [ 877.120479][T30556] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 877.120504][T30556] vfs_read+0x20c/0xa70 [ 877.120524][T30556] ? fdget_pos+0x246/0x320 [ 877.120548][T30556] ? __pfx___mutex_lock+0x10/0x10 [ 877.120573][T30556] ? __pfx_vfs_read+0x10/0x10 [ 877.120602][T30556] ? __fget_files+0x2a/0x420 [ 877.120626][T30556] ? __fget_files+0x3a0/0x420 [ 877.120652][T30556] ? __fget_files+0x2a/0x420 [ 877.120680][T30556] ksys_read+0x150/0x270 [ 877.120703][T30556] ? __pfx_ksys_read+0x10/0x10 [ 877.120737][T30556] do_syscall_64+0x14d/0xf80 [ 877.120759][T30556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 877.120784][T30556] ? trace_irq_disable+0x37/0x100 [ 877.120805][T30556] ? clear_bhb_loop+0x40/0x90 [ 877.120827][T30556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 877.120853][T30556] RIP: 0033:0x7fcfd3f5cece [ 877.120872][T30556] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 877.120887][T30556] RSP: 002b:00007fcfd4d8efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 877.120908][T30556] RAX: ffffffffffffffda RBX: 00007fcfd4d8f6c0 RCX: 00007fcfd3f5cece [ 877.120922][T30556] RDX: 000000000000000f RSI: 00007fcfd4d8f0a0 RDI: 0000000000000004 [ 877.120933][T30556] RBP: 00007fcfd4d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 877.120944][T30556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 877.120955][T30556] R13: 00007fcfd4216038 R14: 00007fcfd4215fa0 R15: 00007ffe16e3a688 [ 877.120986][T30556] [ 877.402114][T30451] bridge_slave_0: entered allmulticast mode [ 877.410372][T30451] bridge_slave_0: entered promiscuous mode [ 877.540209][T30566] syzkaller0: entered promiscuous mode [ 877.546602][T30566] syzkaller0: entered allmulticast mode [ 877.564669][T30451] bridge0: port 2(bridge_slave_1) entered blocking state [ 877.574422][T30451] bridge0: port 2(bridge_slave_1) entered disabled state [ 877.582908][T30451] bridge_slave_1: entered allmulticast mode [ 877.592108][T30451] bridge_slave_1: entered promiscuous mode [ 878.142289][T30599] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6298'. [ 878.183389][ T5830] Bluetooth: hci3: command tx timeout [ 879.738197][T30451] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 879.755414][T30451] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 879.901109][T30451] team0: Port device team_slave_0 added [ 879.922009][T30451] team0: Port device team_slave_1 added [ 879.971865][T30613] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6299'. [ 880.063683][T30451] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 880.076575][T30451] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 880.134311][T30451] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 880.152326][T30608] lo speed is unknown, defaulting to 1000 [ 880.165997][T30451] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 880.176950][T30451] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 880.207227][T30451] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 880.261240][ T5830] Bluetooth: hci3: command tx timeout [ 880.303332][T30622] syzkaller1: entered promiscuous mode [ 880.308854][T30622] syzkaller1: entered allmulticast mode [ 880.720473][T30608] lo speed is unknown, defaulting to 1000 [ 880.737701][T30451] hsr_slave_0: entered promiscuous mode [ 880.760033][T30451] hsr_slave_1: entered promiscuous mode [ 880.780952][T30451] debugfs: 'hsr0' already exists in 'hsr' [ 880.796991][T30451] Cannot create hsr debugfs directory [ 881.217625][T30608] lo speed is unknown, defaulting to 1000 [ 881.218046][T30630] bridge0: port 3(netdevsim0) entered blocking state [ 881.262120][T30630] bridge0: port 3(netdevsim0) entered disabled state [ 881.272683][T30630] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 881.281657][T30630] bridge0: port 3(netdevsim0) entered blocking state [ 881.288647][T30630] bridge0: port 3(netdevsim0) entered forwarding state [ 881.341651][T30608] batadv0 speed is unknown, defaulting to 1000 [ 881.430034][T30638] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 881.523117][T30638] veth0_macvtap: left promiscuous mode [ 881.535711][T30641] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6310'. [ 881.683389][T30643] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6313'. [ 881.814284][T30451] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 881.844067][T30451] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 882.007596][T30451] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 882.037003][T30451] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 882.255528][T30662] netlink: 'syz.3.6317': attribute type 21 has an invalid length. [ 882.264848][T30662] netlink: 'syz.3.6317': attribute type 1 has an invalid length. [ 882.290844][T30662] netlink: 15998 bytes leftover after parsing attributes in process `syz.3.6317'. [ 882.337458][T30451] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 882.352411][ T5830] Bluetooth: hci3: command tx timeout [ 882.393308][T30451] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 882.514620][T30451] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 882.537679][T30451] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 882.680255][T30672] macvtap1: entered promiscuous mode [ 882.706410][T30672] veth1_to_hsr: entered promiscuous mode [ 882.721603][T30672] macvtap1: entered allmulticast mode [ 882.748583][T30672] veth1_to_hsr: entered allmulticast mode [ 883.244114][T30694] netlink: 212916 bytes leftover after parsing attributes in process `syz.3.6320'. [ 883.293815][T30694] lo: Caught tx_queue_len zero misconfig [ 883.314719][T30694] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6320'. [ 883.497913][T30451] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 883.525982][T30451] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 883.546862][T30702] 8021q: VLANs not supported on syzkaller0 [ 883.554318][T30451] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 883.617437][T30451] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 886.091369][T30451] 8021q: adding VLAN 0 to HW filter on device bond0 [ 886.224515][T30733] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 886.301531][T30451] 8021q: adding VLAN 0 to HW filter on device team0 [ 886.355590][T25764] bridge0: port 1(bridge_slave_0) entered blocking state [ 886.362820][T25764] bridge0: port 1(bridge_slave_0) entered forwarding state [ 886.466723][T30733] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 886.488245][T30745] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6333'. [ 886.508692][T25756] bridge0: port 2(bridge_slave_1) entered blocking state [ 886.515876][T25756] bridge0: port 2(bridge_slave_1) entered forwarding state [ 886.533048][T30746] netlink: 'syz.0.6332': attribute type 11 has an invalid length. [ 886.586260][T30733] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 886.604705][T30745] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6333'. [ 886.726819][T30733] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 886.934786][T25755] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 887.079607][T25755] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 887.098647][T25755] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 887.108699][T30757] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6337'. [ 887.158864][T30762] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6338'. [ 887.172206][T30761] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6338'. [ 887.204443][T25755] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 887.279613][T30451] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 887.719262][T30451] veth0_vlan: entered promiscuous mode [ 887.776493][T30451] veth1_vlan: entered promiscuous mode [ 887.932894][T30451] veth0_macvtap: entered promiscuous mode [ 887.950135][T30800] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6346'. [ 887.980041][T30800] nbd: must specify a size in bytes for the device [ 887.993949][T30451] veth1_macvtap: entered promiscuous mode [ 888.031481][T30800] netlink: 'syz.4.6346': attribute type 8 has an invalid length. [ 888.070229][T30451] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 888.079306][T30800] netlink: 209840 bytes leftover after parsing attributes in process `syz.4.6346'. [ 888.120220][T30451] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 888.183251][T25758] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.194404][T25758] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.321996][T30810] bridge0: port 2(bridge_slave_1) entered disabled state [ 888.330104][T30810] bridge0: port 1(bridge_slave_0) entered disabled state [ 888.375220][T30821] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6351'. [ 888.500012][T30810] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 888.522608][T30810] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 888.702424][T30811] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6349'. [ 888.707007][T30804] lo speed is unknown, defaulting to 1000 [ 888.714150][T30812] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6349'. [ 888.733317][T25758] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.834291][T25758] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.864714][T25758] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.954408][T25758] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.997353][T25758] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 889.021522][T25758] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 889.241141][T25764] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 889.264436][T25764] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 889.344817][T25764] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 889.372770][T25764] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 889.450172][T30804] lo speed is unknown, defaulting to 1000 [ 890.003789][T30804] lo speed is unknown, defaulting to 1000 [ 890.082091][T30882] bond3: entered promiscuous mode [ 890.095298][T30804] batadv0 speed is unknown, defaulting to 1000 [ 890.947069][T30915] netlink: 'syz.2.6378': attribute type 21 has an invalid length. [ 891.009398][T30915] netlink: 'syz.2.6378': attribute type 3 has an invalid length. [ 891.135181][T30922] netlink: zone id is out of range [ 891.140425][T30922] netlink: zone id is out of range [ 891.197325][T30922] netlink: zone id is out of range [ 891.223037][T30922] netlink: zone id is out of range [ 891.235342][T30922] netlink: zone id is out of range [ 891.240518][T30922] netlink: zone id is out of range [ 891.325313][T30922] netlink: zone id is out of range [ 891.330494][T30922] netlink: zone id is out of range [ 891.420872][T30922] netlink: zone id is out of range [ 891.426055][T30922] netlink: zone id is out of range [ 891.434339][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 891.459039][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 891.477331][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 891.491108][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 891.499023][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 891.773600][T30932] siw: device registration error -23 [ 892.054422][T17824] syz_tun (unregistering): left promiscuous mode [ 892.226821][T30927] lo speed is unknown, defaulting to 1000 [ 892.360294][T30943] lo speed is unknown, defaulting to 1000 [ 892.734260][T30952] __nla_validate_parse: 3 callbacks suppressed [ 892.734282][T30952] netlink: 84 bytes leftover after parsing attributes in process `syz.1.6386'. [ 892.758781][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 892.776998][T30952] tipc: Started in network mode [ 892.783503][T30952] tipc: Node identity 6eb3b2e2c27c, cluster identity 4711 [ 892.790952][T30952] tipc: Enabled bearer , priority 0 [ 892.938069][T30963] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6389'. [ 892.977522][T30964] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan0, syncid = 4, id = 0 [ 893.218228][T30973] bond1: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 893.278311][T30973] bond1 (unregistering): Released all slaves [ 893.313413][T30927] lo speed is unknown, defaulting to 1000 [ 893.380221][T30969] lo speed is unknown, defaulting to 1000 [ 893.621637][ T5830] Bluetooth: hci0: command tx timeout [ 893.859309][T30975] 8021q: adding VLAN 0 to HW filter on device bond0 [ 893.899532][T30975] 8021q: adding VLAN 0 to HW filter on device team0 [ 893.922894][T30927] lo speed is unknown, defaulting to 1000 [ 893.942419][T17461] tipc: Node number set to 2899292898 [ 893.949143][T30943] lo speed is unknown, defaulting to 1000 [ 893.956487][T30927] batadv0 speed is unknown, defaulting to 1000 [ 894.512249][T30969] lo speed is unknown, defaulting to 1000 [ 894.555473][T30943] lo speed is unknown, defaulting to 1000 [ 894.571386][T30996] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6397'. [ 894.586009][T30943] batadv0 speed is unknown, defaulting to 1000 [ 894.983558][T31005] erspan1: entered promiscuous mode [ 894.989062][T31005] erspan1: entered allmulticast mode [ 895.007742][T30927] chnl_net:caif_netlink_parms(): no params data found [ 895.016980][T30969] lo speed is unknown, defaulting to 1000 [ 895.048655][T30969] batadv0 speed is unknown, defaulting to 1000 [ 895.146031][T31009] veth0: entered promiscuous mode [ 895.195571][T31009] veth0: left promiscuous mode [ 895.355587][T31018] sctp: [Deprecated]: syz.1.6402 (pid 31018) Use of struct sctp_assoc_value in delayed_ack socket option. [ 895.355587][T31018] Use struct sctp_sack_info instead [ 895.373995][T30927] bridge0: port 1(bridge_slave_0) entered blocking state [ 895.396854][T30927] bridge0: port 1(bridge_slave_0) entered disabled state [ 895.405060][T30927] bridge_slave_0: entered allmulticast mode [ 895.413980][T30927] bridge_slave_0: entered promiscuous mode [ 895.467019][T30927] bridge0: port 2(bridge_slave_1) entered blocking state [ 895.486355][T30927] bridge0: port 2(bridge_slave_1) entered disabled state [ 895.513339][T30927] bridge_slave_1: entered allmulticast mode [ 895.538816][T30927] bridge_slave_1: entered promiscuous mode [ 895.702918][ T5830] Bluetooth: hci0: command tx timeout [ 895.790196][T30927] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 895.816340][T30927] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 896.074307][T30927] team0: Port device team_slave_0 added [ 896.085344][T30927] team0: Port device team_slave_1 added [ 896.222431][T30927] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 896.230045][T30927] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 896.258927][T30927] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 896.293081][T30927] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 896.311377][T30927] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 896.364441][T30927] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 896.474910][T31024] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6404'. [ 896.666695][T30927] hsr_slave_0: entered promiscuous mode [ 896.674829][T30927] hsr_slave_1: entered promiscuous mode [ 896.686738][T30927] debugfs: 'hsr0' already exists in 'hsr' [ 896.693604][T30927] Cannot create hsr debugfs directory [ 897.000463][T30927] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 897.059936][T31034] syzkaller0: entered promiscuous mode [ 897.076941][T31034] syzkaller0: entered allmulticast mode [ 897.098672][T30927] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 897.168304][T30927] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 897.248036][T30927] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 897.540210][T30927] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 897.562919][T30927] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 897.593475][T31048] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6412'. [ 897.593614][T30927] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 897.622995][T31048] netlink: 'syz.4.6412': attribute type 12 has an invalid length. [ 897.668567][T30927] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 897.668691][T31048] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6412'. [ 897.684774][T31048] netlink: 'syz.4.6412': attribute type 12 has an invalid length. [ 897.696309][T25756] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 897.727156][T25756] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 897.737536][T25756] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 897.769736][T25756] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 897.784000][ T5830] Bluetooth: hci0: command tx timeout [ 897.926928][T31071] sctp: [Deprecated]: syz.1.6418 (pid 31071) Use of int in max_burst socket option deprecated. [ 897.926928][T31071] Use struct sctp_assoc_value instead [ 897.937862][T30927] 8021q: adding VLAN 0 to HW filter on device bond0 [ 897.989475][T31072] lo speed is unknown, defaulting to 1000 [ 897.993834][T30927] 8021q: adding VLAN 0 to HW filter on device team0 [ 898.016759][T25756] bridge0: port 1(bridge_slave_0) entered blocking state [ 898.024040][T25756] bridge0: port 1(bridge_slave_0) entered forwarding state [ 898.047207][T25762] bridge0: port 2(bridge_slave_1) entered blocking state [ 898.054425][T25762] bridge0: port 2(bridge_slave_1) entered forwarding state [ 898.407609][T30927] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 898.417788][T31072] lo speed is unknown, defaulting to 1000 [ 898.432150][T31079] sctp: [Deprecated]: syz.4.6420 (pid 31079) Use of struct sctp_assoc_value in delayed_ack socket option. [ 898.432150][T31079] Use struct sctp_sack_info instead [ 898.497153][T30927] veth0_vlan: entered promiscuous mode [ 898.528387][T30927] veth1_vlan: entered promiscuous mode [ 898.592972][T30927] veth0_macvtap: entered promiscuous mode [ 898.616557][T30927] veth1_macvtap: entered promiscuous mode [ 898.669825][T30927] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 898.685211][T30927] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 898.760333][T25758] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.779723][T25758] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.821675][T25758] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.851465][T25758] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 899.010561][T31072] lo speed is unknown, defaulting to 1000 [ 899.019158][T31072] batadv0 speed is unknown, defaulting to 1000 [ 899.119722][T25758] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 899.147536][T25758] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 899.256810][T25764] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 899.276919][T25764] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 899.296470][T31095] net_ratelimit: 769 callbacks suppressed [ 899.296493][T31095] netlink: zone id is out of range [ 899.322729][T31095] netlink: zone id is out of range [ 899.334110][T31095] netlink: zone id is out of range [ 899.348457][T31095] netlink: zone id is out of range [ 899.388436][T31095] netlink: zone id is out of range [ 899.408494][T31095] netlink: zone id is out of range [ 899.423252][T31095] netlink: zone id is out of range [ 899.434738][T31095] netlink: zone id is out of range [ 899.447252][T31095] netlink: zone id is out of range [ 899.465267][T31095] netlink: zone id is out of range [ 899.863095][ T5830] Bluetooth: hci0: command tx timeout [ 900.006836][T31119] bridge1: entered allmulticast mode [ 901.097604][T31133] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6430'. [ 901.112779][T31133] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6430'. [ 901.242288][T31146] Bluetooth: MGMT ver 1.23 [ 901.540425][T31161] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6440'. [ 901.651996][T31168] netlink: 84 bytes leftover after parsing attributes in process `syz.4.6443'. [ 901.667957][T31168] netlink: 84 bytes leftover after parsing attributes in process `syz.4.6443'. [ 901.786654][ T51] block nbd3: Receive control failed (result -32) [ 901.845815][T31172] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 902.367179][T31198] tipc: Started in network mode [ 902.373711][T31198] tipc: Node identity 7a8e53038098, cluster identity 4711 [ 902.385866][T31198] tipc: Enabled bearer , priority 0 [ 902.447971][T31198] tipc: Disabling bearer [ 902.875641][T31219] lo speed is unknown, defaulting to 1000 [ 902.998656][T31227] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6461'. [ 903.015997][T31227] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6461'. [ 903.331095][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 903.337280][ T5830] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 903.436042][T31219] lo speed is unknown, defaulting to 1000 [ 903.754250][T31253] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6468'. [ 903.781444][T31253] netlink: 5 bytes leftover after parsing attributes in process `syz.0.6468'. [ 903.790443][T31253] nbd: socks must be embedded in a SOCK_ITEM attr [ 903.843501][T31219] lo speed is unknown, defaulting to 1000 [ 903.879951][T31219] batadv0 speed is unknown, defaulting to 1000 [ 904.339948][T31275] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6472'. [ 904.408830][T31277] syzkaller0: entered promiscuous mode [ 904.415738][T31277] syzkaller0: entered allmulticast mode [ 905.067599][T31303] syzkaller0: entered promiscuous mode [ 905.073695][T31303] syzkaller0: entered allmulticast mode [ 905.774056][T31317] bridge0: port 2(bridge_slave_1) entered disabled state [ 906.241784][T25759] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 906.273127][T25759] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.310311][T25759] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 906.338218][T25759] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.350321][T25759] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 906.376270][T31352] netlink: 'syz.4.6493': attribute type 1 has an invalid length. [ 906.384130][T25759] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.407051][T31323] lo speed is unknown, defaulting to 1000 [ 906.418416][T25759] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 906.430801][T25759] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 906.448036][T31356] : entered promiscuous mode [ 906.475541][T31349] __nla_validate_parse: 2 callbacks suppressed [ 906.475561][T31349] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6494'. [ 906.636104][T31363] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.6497'. [ 906.656546][T31363] net_ratelimit: 20 callbacks suppressed [ 906.656567][T31363] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 906.874341][T31370] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 906.988661][T31373] lo speed is unknown, defaulting to 1000 [ 907.148624][T31323] lo speed is unknown, defaulting to 1000 [ 907.359348][T31382] xt_CT: You must specify a L4 protocol and not use inversions on it [ 907.500379][T31384] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 907.897992][T31373] lo speed is unknown, defaulting to 1000 [ 907.905099][T31323] lo speed is unknown, defaulting to 1000 [ 907.980235][T31323] batadv0 speed is unknown, defaulting to 1000 [ 908.488878][T31373] lo speed is unknown, defaulting to 1000 [ 908.596970][T31373] batadv0 speed is unknown, defaulting to 1000 [ 908.674477][T31416] netlink: 'syz.1.6510': attribute type 1 has an invalid length. [ 908.682526][T31416] netlink: 'syz.1.6510': attribute type 2 has an invalid length. [ 908.700746][T31416] netlink: 'syz.1.6510': attribute type 1 has an invalid length. [ 908.718771][T31416] netlink: 'syz.1.6510': attribute type 3 has an invalid length. [ 908.732638][T31416] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6510'. [ 908.953646][T31425] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6513'. [ 909.023192][T31422] lo speed is unknown, defaulting to 1000 [ 909.241954][T31431] netlink: 'syz.3.6515': attribute type 1 has an invalid length. [ 909.682927][T31422] lo speed is unknown, defaulting to 1000 [ 909.826588][T31457] netlink: 'syz.3.6520': attribute type 15 has an invalid length. [ 909.843595][T31457] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6520'. [ 910.113894][T31422] lo speed is unknown, defaulting to 1000 [ 910.126918][T31422] batadv0 speed is unknown, defaulting to 1000 [ 911.097695][T31467] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6524'. [ 911.107648][T31467] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6524'. [ 912.295243][T31492] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 912.418993][T31495] syzkaller0: entered promiscuous mode [ 912.443915][T31495] syzkaller0: entered allmulticast mode [ 912.482922][T31495] netlink: 'syz.0.6532': attribute type 1 has an invalid length. [ 912.532525][T31499] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6534'. [ 913.082054][T31518] netlink: 'syz.2.6539': attribute type 10 has an invalid length. [ 913.100137][T31518] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6539'. [ 913.120828][T31518] bond0: entered promiscuous mode [ 913.127072][T31518] bond_slave_0: entered promiscuous mode [ 913.135615][T31518] bond_slave_1: entered promiscuous mode [ 913.146816][T31519] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6539'. [ 913.188770][T31518] bridge0: port 3(bond0) entered blocking state [ 913.204347][T31518] bridge0: port 3(bond0) entered disabled state [ 913.229852][T31518] bond0: entered allmulticast mode [ 913.237976][T31518] bond_slave_0: entered allmulticast mode [ 913.245520][T31518] bond_slave_1: entered allmulticast mode [ 913.285429][T31518] bridge0: port 3(bond0) entered blocking state [ 913.291951][T31518] bridge0: port 3(bond0) entered forwarding state [ 913.305554][T31533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6543'. [ 913.347499][T31533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6543'. [ 913.357251][T31519] netlink: 'syz.2.6539': attribute type 10 has an invalid length. [ 913.368574][T31519] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6539'. [ 913.406996][T31533] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6543'. [ 913.516663][T31540] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6544'. [ 913.517396][T31539] tipc: Enabled bearer , priority 0 [ 913.642221][T31544] syzkaller0: entered promiscuous mode [ 913.648536][T31544] syzkaller0: entered allmulticast mode [ 913.663724][T31544] tipc: Resetting bearer [ 913.684231][T31548] netlink: 'syz.3.6547': attribute type 1 has an invalid length. [ 913.724473][T31547] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6546'. [ 913.750062][T31543] syzkaller0: entered promiscuous mode [ 913.756646][T31543] syzkaller0: entered allmulticast mode [ 913.774613][T31551] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6548'. [ 913.792601][ C1] TC_ACT_REPEAT abuse ? [ 913.820391][T31537] tipc: Resetting bearer [ 914.006064][ C1] TC_ACT_REPEAT abuse ? [ 915.785444][T31537] tipc: Disabling bearer [ 915.796108][T31548] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 915.807231][T31551] ip6gre1: entered promiscuous mode [ 915.822154][T31551] ip6gre1: entered allmulticast mode [ 915.869564][T31559] : entered promiscuous mode [ 915.883181][T17461] tipc: Node number set to 4195767043 [ 916.112823][T31583] netlink: 'syz.0.6553': attribute type 1 has an invalid length. [ 916.308940][T31585] ieee80211 Ï€ã,ÄûÔxµ…üb©)%ë ]ô‚3DûLÌ¥”!!bíÓÙ.˜>„nS‡#^‘§: Failed to add default virtual iface [ 916.400092][T31594] netlink: 'syz.1.6558': attribute type 13 has an invalid length. [ 916.784282][T31617] netlink: 'syz.2.6562': attribute type 1 has an invalid length. [ 916.793926][T31616] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 916.885080][T31583] tipc: Enabling of bearer rejected, failed to enable media [ 916.914961][T31618] lo speed is unknown, defaulting to 1000 [ 917.295127][T31618] lo speed is unknown, defaulting to 1000 [ 917.480001][T31636] xt_hashlimit: max too large, truncated to 1048576 [ 917.503017][T31636] netlink: 'syz.0.6570': attribute type 4 has an invalid length. [ 917.710341][T31618] lo speed is unknown, defaulting to 1000 [ 917.859621][T31652] __nla_validate_parse: 4 callbacks suppressed [ 917.859642][T31652] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6573'. [ 917.904033][T31618] batadv0 speed is unknown, defaulting to 1000 [ 918.038092][T31662] tipc: Started in network mode [ 918.046942][T31662] tipc: Node identity 3a5a0cb7df45, cluster identity 4711 [ 918.062717][T31662] tipc: Enabled bearer , priority 0 [ 918.102334][T31662] syzkaller0: entered promiscuous mode [ 918.108060][T31662] syzkaller0: entered allmulticast mode [ 918.148214][T31662] tipc: Resetting bearer [ 918.157709][T31661] tipc: Resetting bearer [ 918.198156][T31661] tipc: Disabling bearer [ 918.383642][T31676] netlink: 'syz.4.6581': attribute type 3 has an invalid length. [ 918.393748][T31676] netlink: 'syz.4.6581': attribute type 1 has an invalid length. [ 918.410811][T31676] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6581'. [ 918.742807][T31698] openvswitch: netlink: Message has 8 unknown bytes. [ 918.786118][T31698] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 919.027815][T31711] netlink: 'syz.3.6589': attribute type 21 has an invalid length. [ 919.045156][T31711] IPv6: NLM_F_CREATE should be specified when creating new route [ 919.059172][T31711] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 919.066500][T31711] IPv6: NLM_F_CREATE should be set when creating new route [ 919.073830][T31711] IPv6: NLM_F_CREATE should be set when creating new route [ 919.081215][T31711] IPv6: NLM_F_CREATE should be set when creating new route [ 919.431418][T31715] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6592'. [ 919.628786][T31730] netlink: 207952 bytes leftover after parsing attributes in process `syz.0.6597'. [ 920.238020][T31752] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6603'. [ 920.538368][T31757] bridge2: entered promiscuous mode [ 921.028440][T31772] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6608'. [ 921.082394][T31786] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6608'. [ 921.249655][T31772] bond3: option lacp_rate: invalid value (192) [ 921.270195][T31772] bond3 (unregistering): Released all slaves [ 921.347757][T31794] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6612'. [ 921.413122][T31796] netlink: 'syz.3.6613': attribute type 3 has an invalid length. [ 921.422362][T31796] netlink: 666 bytes leftover after parsing attributes in process `syz.3.6613'. [ 921.731597][T31817] ip6tnl1: entered promiscuous mode [ 921.749445][T31817] ip6tnl1: entered allmulticast mode [ 921.795715][T31818] batman_adv: batadv0: Adding interface: geneve0 [ 921.829522][T31818] batman_adv: batadv0: The MTU of interface geneve0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 921.911503][T31818] batman_adv: batadv0: Interface activated: geneve0 [ 922.061182][T31842] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6624'. [ 922.709534][T31879] lo speed is unknown, defaulting to 1000 [ 922.750235][T31884] bridge_slave_0: left allmulticast mode [ 922.759230][T31884] bridge_slave_0: left promiscuous mode [ 922.768041][T31884] bridge0: port 1(bridge_slave_0) entered disabled state [ 922.782006][T31884] bridge_slave_1: left allmulticast mode [ 922.787861][T31884] bridge_slave_1: left promiscuous mode [ 922.798879][T31884] bridge0: port 2(bridge_slave_1) entered disabled state [ 922.815883][T31884] bond0: (slave bond_slave_0): Releasing backup interface [ 922.833093][T31884] bond0: (slave bond_slave_1): Releasing backup interface [ 922.856751][T31884] team0: Port device team_slave_0 removed [ 922.869589][T31884] team0: Port device team_slave_1 removed [ 922.880406][T31884] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 922.888308][T31884] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 922.901635][T31884] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 922.909347][T31884] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 922.926985][T31884] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 922.943986][T31876] lo speed is unknown, defaulting to 1000 [ 923.276175][T31901] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6640'. [ 923.332768][T31904] netlink: 'syz.4.6642': attribute type 2 has an invalid length. [ 923.508049][T31919] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.6644'. [ 923.528104][T31919] ksmbd: Unknown IPC event: 1, ignore. [ 923.740506][T31904] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6642'. [ 923.938284][T31879] lo speed is unknown, defaulting to 1000 [ 924.669991][T31958] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6649'. [ 924.694710][T31879] lo speed is unknown, defaulting to 1000 [ 924.694729][T31876] lo speed is unknown, defaulting to 1000 [ 924.702884][T31879] batadv0 speed is unknown, defaulting to 1000 [ 924.757555][T31959] tipc: Resetting bearer [ 925.028364][T31971] tipc: New replicast peer: 255.255.255.255 [ 925.070740][T31971] tipc: Enabled bearer , priority 26 [ 925.637102][T31987] netlink: 'syz.4.6656': attribute type 12 has an invalid length. [ 925.667938][T31876] lo speed is unknown, defaulting to 1000 [ 925.745931][T31876] batadv0 speed is unknown, defaulting to 1000 [ 925.852978][T31996] pimreg: entered allmulticast mode [ 925.859949][T31996] pimreg: left allmulticast mode [ 927.212062][T32039] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6664'. [ 927.440389][T32044] syzkaller0: Caught tx_queue_len zero misconfig [ 928.241075][T32064] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6670'. [ 928.332313][T32066] mac80211_hwsim hwsim92 ªªªªª;: renamed from wlan0 [ 928.572057][T32076] tc_dump_action: action bad kind [ 928.951468][T32094] netlink: 192 bytes leftover after parsing attributes in process `syz.4.6677'. [ 931.465459][T32108] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6680'. [ 931.527864][T32098] lo speed is unknown, defaulting to 1000 [ 931.653369][T32112] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6682'. [ 931.715624][T32112] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 931.722953][T32112] IPv6: NLM_F_CREATE should be set when creating new route [ 931.737667][T32112] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 931.745086][T32112] IPv6: NLM_F_CREATE should be set when creating new route [ 932.088323][T32098] lo speed is unknown, defaulting to 1000 [ 932.252897][T32134] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6690'. [ 932.352094][T32134] bond1: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 932.402128][T32134] bond1 (unregistering): Released all slaves [ 932.775178][T32098] lo speed is unknown, defaulting to 1000 [ 932.793824][T32098] batadv0 speed is unknown, defaulting to 1000 [ 932.826851][T32152] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6694'. [ 932.854124][T32152] macvtap1: entered promiscuous mode [ 932.859669][T32152] mac80211_hwsim hwsim87 wlan1: entered promiscuous mode [ 933.013868][T32157] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 933.050282][T32157] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6695'. [ 933.837781][T32182] openvswitch: netlink: Duplicate or invalid key (type 0). [ 933.858251][T32182] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 933.869209][T32176] netlink: 260 bytes leftover after parsing attributes in process `syz.1.6701'. [ 933.928509][T32187] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6701'. [ 933.985341][T32176] netlink: 'syz.1.6701': attribute type 6 has an invalid length. [ 935.131736][T32198] syzkaller0: entered promiscuous mode [ 935.153379][T32198] syzkaller0: entered allmulticast mode [ 935.347308][T32237] netlink: 'syz.4.6717': attribute type 13 has an invalid length. [ 935.363951][T32236] netlink: 'syz.4.6717': attribute type 13 has an invalid length. [ 935.395179][T32237] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6717'. [ 935.421598][T32236] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6717'. [ 935.581579][T32249] FAULT_INJECTION: forcing a failure. [ 935.581579][T32249] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 935.610810][T32249] CPU: 0 UID: 0 PID: 32249 Comm: syz.2.6720 Not tainted syzkaller #0 PREEMPT(full) [ 935.610841][T32249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 935.610853][T32249] Call Trace: [ 935.610861][T32249] [ 935.610870][T32249] dump_stack_lvl+0xe8/0x150 [ 935.610903][T32249] should_fail_ex+0x412/0x560 [ 935.610938][T32249] _copy_from_user+0x2d/0xb0 [ 935.610959][T32249] ___sys_recvmsg+0x175/0x590 [ 935.610992][T32249] ? __pfx____sys_recvmsg+0x10/0x10 [ 935.611022][T32249] ? __fget_files+0x2a/0x420 [ 935.611060][T32249] ? __fget_files+0x3a0/0x420 [ 935.611090][T32249] do_recvmmsg+0x334/0x800 [ 935.611125][T32249] ? __pfx_do_recvmmsg+0x10/0x10 [ 935.611162][T32249] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 935.611207][T32249] __x64_sys_recvmmsg+0x198/0x250 [ 935.611236][T32249] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 935.611274][T32249] do_syscall_64+0x14d/0xf80 [ 935.611303][T32249] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.611322][T32249] ? trace_irq_disable+0x37/0x100 [ 935.611344][T32249] ? clear_bhb_loop+0x40/0x90 [ 935.611367][T32249] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 935.611386][T32249] RIP: 0033:0x7f0a8819c629 [ 935.611404][T32249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 935.611421][T32249] RSP: 002b:00007f0a89028028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 935.611443][T32249] RAX: ffffffffffffffda RBX: 00007f0a88415fa0 RCX: 00007f0a8819c629 [ 935.611457][T32249] RDX: 0000000000000001 RSI: 0000200000000480 RDI: 0000000000000003 [ 935.611469][T32249] RBP: 00007f0a89028090 R08: 0000000000000000 R09: 0000000000000000 [ 935.611480][T32249] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 935.611492][T32249] R13: 00007f0a88416038 R14: 00007f0a88415fa0 R15: 00007ffc1f78d928 [ 935.611523][T32249] [ 936.327236][T32276] xt_CT: No such helper "snmp_trap" [ 936.518834][T32297] netlink: 112 bytes leftover after parsing attributes in process `syz.1.6733'. [ 936.563126][T32297] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6733'. [ 936.676312][T32297] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6733'. [ 936.850252][T32314] netlink: 'syz.4.6740': attribute type 1 has an invalid length. [ 936.938669][T32314] 8021q: adding VLAN 0 to HW filter on device bond3 [ 936.993579][T32323] netlink: 'syz.1.6742': attribute type 1 has an invalid length. [ 937.009221][T32318] bond3: (slave veth1): Enslaving as an active interface with a down link [ 937.058945][T32321] bond3: (slave dummy0): making interface the new active one [ 937.062321][T32325] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6742'. [ 937.068964][T32321] dummy0: entered promiscuous mode [ 937.082193][T32321] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 937.186698][T32328] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6744'. [ 937.198403][T32328] block nbd4: Unsupported socket: should be TCP or UNIX. [ 937.267636][T32337] netlink: 'syz.4.6746': attribute type 3 has an invalid length. [ 937.298364][T32337] syz_tun: entered allmulticast mode [ 937.306981][T32337] siw: device registration error -23 [ 937.314780][T32336] syz_tun: left allmulticast mode [ 937.393031][T32340] Bluetooth: MGMT ver 1.23 [ 937.426980][T32303] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 937.532760][T32349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6751'. [ 937.554073][T32349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6751'. [ 937.564973][T32349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6751'. [ 937.583231][T32347] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 937.788689][T32364] Can't find ip_set type NLBL_UNLBL [ 938.283263][T32392] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 938.381615][T32394] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 938.949775][T32426] veth0_to_bridge: entered promiscuous mode [ 939.052383][T32425] veth0_to_bridge: left promiscuous mode [ 939.353031][T32438] lo speed is unknown, defaulting to 1000 [ 940.032194][T32438] lo speed is unknown, defaulting to 1000 [ 940.308944][T32483] sctp: [Deprecated]: syz.3.6789 (pid 32483) Use of int in maxseg socket option. [ 940.308944][T32483] Use struct sctp_assoc_value instead [ 940.469941][T32438] lo speed is unknown, defaulting to 1000 [ 940.492010][T32438] batadv0 speed is unknown, defaulting to 1000 [ 940.642754][T32491] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 940.656886][T32491] bond5 (unregistering): Released all slaves [ 940.783553][T32499] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 940.808809][T32499] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 940.842340][T32499] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 941.012932][T32513] __nla_validate_parse: 8 callbacks suppressed [ 941.012953][T32513] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6798'. [ 941.209425][T32524] netlink: 'syz.3.6801': attribute type 9 has an invalid length. [ 941.257093][T32526] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6802'. [ 941.268560][T32528] netlink: 'syz.3.6801': attribute type 9 has an invalid length. [ 941.305634][T32526] netlink: 124 bytes leftover after parsing attributes in process `syz.1.6802'. [ 941.399953][T32530] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6803'. [ 941.442727][T32530] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6803'. [ 941.479328][T32536] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6805'. [ 941.549211][T32532] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6804'. [ 941.657175][T32532] bridge0: port 2(bridge_slave_1) entered disabled state [ 941.705808][T32532] bridge_slave_1 (unregistering): left allmulticast mode [ 941.736871][T32532] bridge_slave_1 (unregistering): left promiscuous mode [ 941.760763][T32532] bridge0: port 2(bridge_slave_1) entered disabled state [ 941.864311][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 942.002688][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 942.015332][ C1] IPv6: bridge0: IPv6 duplicate address fe80::a8aa:aaff:feaa:aa1b used by aa:aa:aa:aa:aa:1b detected! [ 942.571756][ T5189] udevd[5189]: worker [30162] /devices/virtual/block/nbd0 is taking a long time [ 942.996102][T32566] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6812'. [ 943.051917][T32566] syzkaller1: entered promiscuous mode [ 943.080721][T32566] syzkaller1: entered allmulticast mode [ 943.169856][T32580] netlink: 'syz.0.6815': attribute type 1 has an invalid length. [ 943.240823][T32580] bond1: entered promiscuous mode [ 943.246405][T32580] 8021q: adding VLAN 0 to HW filter on device bond1 [ 943.269110][T32578] bridge1: entered promiscuous mode [ 943.367492][T32580] bond1: (slave bridge3): making interface the new active one [ 943.381807][T32561] netlink: 'syz.1.6810': attribute type 1 has an invalid length. [ 943.389599][T32561] netlink: 'syz.1.6810': attribute type 4 has an invalid length. [ 943.399448][T32580] bridge3: entered promiscuous mode [ 943.429615][T32580] bond1: (slave bridge3): Enslaving as an active interface with an up link [ 943.449264][T32584] netlink: 'syz.1.6810': attribute type 1 has an invalid length. [ 943.452453][T32561] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.6810'. [ 943.474675][T32584] netlink: 4070 bytes leftover after parsing attributes in process `syz.1.6810'. [ 943.707976][T32598] lo speed is unknown, defaulting to 1000 [ 943.954829][ T5830] Bluetooth: hci5: command 0x0406 tx timeout [ 944.017998][T32602] netlink: 'syz.0.6822': attribute type 6 has an invalid length. [ 944.029652][T32609] lo speed is unknown, defaulting to 1000 [ 944.057338][T32602] netlink: 'syz.0.6822': attribute type 6 has an invalid length. [ 944.347961][T32598] lo speed is unknown, defaulting to 1000 [ 944.569879][T32628] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 944.577321][T32628] IPv6: NLM_F_CREATE should be set when creating new route [ 944.862886][T32635] batman_adv: batadv0: Adding interface: ipvlan2 [ 944.869543][T32635] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 944.904660][T32635] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 944.978482][T32637] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 3 [ 945.028446][T32598] lo speed is unknown, defaulting to 1000 [ 945.034386][T32609] lo speed is unknown, defaulting to 1000 [ 945.043602][T32598] batadv0 speed is unknown, defaulting to 1000 [ 945.095341][T32639] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 945.239712][T32646] netlink: 'syz.4.6833': attribute type 3 has an invalid length. [ 945.286144][T32646] syz_tun: entered allmulticast mode [ 945.368988][T32646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 945.378897][T32646] 8021q: adding VLAN 0 to HW filter on device team0 [ 945.396979][T32646] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 945.471837][T32645] syz_tun: left allmulticast mode [ 945.496913][T32652] bridge4: entered promiscuous mode [ 945.533997][T32652] bridge4: entered allmulticast mode [ 945.576588][T32652] team0: Port device bridge4 added [ 945.803340][T32609] lo speed is unknown, defaulting to 1000 [ 945.871142][T32609] batadv0 speed is unknown, defaulting to 1000 [ 946.176091][T32680] __nla_validate_parse: 8 callbacks suppressed [ 946.176112][T32680] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6842'. [ 946.317157][T32680] bond1: option broadcast_neighbor: invalid value (30) [ 946.357563][T32680] bond1 (unregistering): Released all slaves [ 946.425563][T32694] netlink: 'syz.4.6845': attribute type 13 has an invalid length. [ 946.705159][T32703] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6848'. [ 946.747188][T32704] RDS: rds_bind could not find a transport for ::ffff:172.30.1.2, load rds_tcp or rds_rdma? [ 946.972689][T32706] veth0_to_¡jL: entered promiscuous mode [ 946.978476][T32706] bridge0: entered promiscuous mode [ 947.210852][T32712] openvswitch: netlink: VXLAN extension message has 3 unknown bytes. [ 947.405320][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 947.548232][T32722] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6854'. [ 947.644867][T32726] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6855'. [ 947.884144][T32726] bridge0: entered promiscuous mode [ 947.922488][T32726] macvtap2: entered promiscuous mode [ 947.928195][T32726] macvtap2: entered allmulticast mode [ 947.949063][T32726] bridge0: entered allmulticast mode [ 947.956178][T32726] bridge0: port 1(macvtap2) entered blocking state [ 947.963911][T32726] bridge0: port 1(macvtap2) entered disabled state [ 948.038339][T32726] bridge0: left allmulticast mode [ 948.044635][T32726] bridge0: left promiscuous mode [ 948.376020][T32745] netlink: 'syz.4.6860': attribute type 8 has an invalid length. [ 948.393392][T32745] netlink: 'syz.4.6860': attribute type 9 has an invalid length. [ 948.402757][T32745] netlink: 'syz.4.6860': attribute type 10 has an invalid length. [ 948.432876][T32745] netlink: 'syz.4.6860': attribute type 11 has an invalid length. [ 948.448794][T32745] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6860'. [ 948.934277][T32763] netlink: 212320 bytes leftover after parsing attributes in process `syz.2.6868'. [ 949.048986][ T301] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6870'. [ 949.176601][ T301] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 949.188753][ T301] syzkaller1: linktype set to 768 [ 949.219413][ T301] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6870'. [ 949.290501][ T310] lo speed is unknown, defaulting to 1000 [ 949.494503][ T326] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6876'. [ 949.642328][ T310] lo speed is unknown, defaulting to 1000 [ 949.904261][ T310] lo speed is unknown, defaulting to 1000 [ 949.913477][ T310] batadv0 speed is unknown, defaulting to 1000 [ 950.085184][ T344] xt_CT: You must specify a L4 protocol and not use inversions on it [ 950.370420][ T356] lo speed is unknown, defaulting to 1000 [ 950.415275][ T362] netlink: 65173 bytes leftover after parsing attributes in process `syz.0.6886'. [ 950.424847][ T363] netlink: 'syz.3.6885': attribute type 4 has an invalid length. [ 950.998874][ T356] lo speed is unknown, defaulting to 1000 [ 951.074818][ T384] lo speed is unknown, defaulting to 1000 [ 951.724819][ T393] syzkaller1: entered promiscuous mode [ 951.733631][ T393] syzkaller1: entered allmulticast mode [ 951.775065][ T396] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 952.044780][ T356] lo speed is unknown, defaulting to 1000 [ 952.078616][ T356] batadv0 speed is unknown, defaulting to 1000 [ 952.088599][ T384] lo speed is unknown, defaulting to 1000 [ 952.092891][ T404] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6898'. [ 952.370789][ T411] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6900'. [ 952.897217][ T428] syzkaller0: entered promiscuous mode [ 952.904881][ T428] syzkaller0: entered allmulticast mode [ 952.935888][ T384] lo speed is unknown, defaulting to 1000 [ 952.997868][ T384] batadv0 speed is unknown, defaulting to 1000 [ 954.154050][ T441] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6911'. [ 955.497620][ T448] rdma_op ffff8880558689f0 conn xmit_rdma 0000000000000000 [ 955.535906][ T448] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 955.721503][ T455] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6916'. [ 956.404374][ T480] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6922'. [ 956.428850][ T480] block nbd4: Unsupported socket: should be TCP or UNIX. [ 956.511239][ T485] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6925'. [ 956.765120][ T497] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6929'. [ 957.283979][ T517] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6933'. [ 957.343280][ T517] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6933'. [ 957.417414][ T523] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6933'. [ 957.471466][ T523] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6933'. [ 957.481977][ T523] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6933'. [ 957.505613][ T523] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6933'. [ 957.528238][ T526] netlink: 236 bytes leftover after parsing attributes in process `syz.3.6934'. [ 957.796626][ T540] C: renamed from team_slave_0 [ 957.848795][ T545] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6941'. [ 957.883385][ T540] netlink: 164 bytes leftover after parsing attributes in process `syz.0.6938'. [ 957.981698][ T548] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan0, syncid = 4, id = 0 [ 958.028124][ T550] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6943'. [ 958.610860][ T586] netlink: 'syz.2.6953': attribute type 3 has an invalid length. [ 958.687806][ T591] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan0, syncid = 4, id = 0 [ 959.343783][ T636] tipc: Enabled bearer , priority 0 [ 959.351767][ T636] syzkaller0: entered promiscuous mode [ 959.357302][ T636] syzkaller0: entered allmulticast mode [ 959.405607][ T636] tipc: Resetting bearer [ 959.417782][ T638] netlink: 'syz.4.6972': attribute type 3 has an invalid length. [ 959.420809][ T635] tipc: Resetting bearer [ 959.446718][ T635] tipc: Disabling bearer [ 959.582948][ T646] netlink: 'syz.2.6975': attribute type 4 has an invalid length. [ 959.599920][ T648] syzkaller0: entered promiscuous mode [ 959.606479][ T648] syzkaller0: entered allmulticast mode [ 959.637057][ T648] tipc: Enabled bearer , priority 0 [ 959.653964][ T647] tipc: Resetting bearer [ 959.680327][ T647] tipc: Disabling bearer [ 959.852688][ T659] tipc: Enabled bearer , priority 0 [ 959.871618][ T659] syzkaller0: entered promiscuous mode [ 959.877152][ T659] syzkaller0: entered allmulticast mode [ 959.957021][ T659] tipc: Resetting bearer [ 960.321703][ T670] tipc: Resetting bearer [ 960.468751][ T670] tipc: Disabling bearer [ 961.332958][ T733] netlink: 'syz.2.6999': attribute type 1 has an invalid length. [ 961.419175][ T733] 8021q: adding VLAN 0 to HW filter on device bond2 [ 961.482825][ T744] bond2: Unable to set up delay as MII monitoring is disabled [ 961.494483][ T744] bond2 (unregistering): Released all slaves [ 961.535877][ T739] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 961.546994][ T739] bond2: (slave batadv1): making interface the new active one [ 961.562108][ T739] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 961.590051][ T733] bond2 (unregistering): (slave batadv1): Releasing active interface [ 961.602414][ T733] bond2 (unregistering): Released all slaves [ 961.779785][ T757] geneve2: entered promiscuous mode [ 961.928680][ T762] vlan2: entered allmulticast mode [ 961.940070][ T762] bridge0: port 3(bond0) entered disabled state [ 961.955865][ T762] bridge0: port 3(bond0) entered disabled state [ 961.977800][ T762] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 961.993549][ T762] bond_slave_0: left promiscuous mode [ 962.003559][ T762] bond_slave_0: left allmulticast mode [ 962.014022][ T762] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 962.025986][ T762] bond_slave_1: left promiscuous mode [ 962.031948][ T762] bond_slave_1: left allmulticast mode [ 962.039124][ T762] bond0 (unregistering): Released all slaves [ 962.086364][ T773] siw: device registration error -23 [ 962.319127][ T785] __nla_validate_parse: 82 callbacks suppressed [ 962.319148][ T785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7012'. [ 962.543218][ T788] syzkaller0: entered promiscuous mode [ 962.551416][ T788] syzkaller0: entered allmulticast mode [ 962.595386][ T797] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7017'. [ 964.613449][ T795] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7016'. [ 964.622789][ T795] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7016'. [ 964.632053][ T795] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7016'. [ 964.641794][ T795] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7016'. [ 964.707605][ T809] lo speed is unknown, defaulting to 1000 [ 964.789963][ T819] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7020'. [ 965.024811][ T832] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7024'. [ 965.349140][ T844] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 965.373017][ T809] lo speed is unknown, defaulting to 1000 [ 965.708713][ T855] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7031'. [ 965.738210][ T855] macvtap2: entered promiscuous mode [ 965.748263][ T809] lo speed is unknown, defaulting to 1000 [ 965.764273][ T809] batadv0 speed is unknown, defaulting to 1000 [ 966.237763][ T876] geneve2: entered promiscuous mode [ 966.250794][T25756] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 966.295640][T25756] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 966.321829][T25756] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 966.346147][T25756] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 966.443187][ T892] netlink: 'syz.3.7039': attribute type 1 has an invalid length. [ 966.463549][ T892] netlink: 96 bytes leftover after parsing attributes in process `syz.3.7039'. [ 967.478124][ T920] syzkaller0: entered promiscuous mode [ 967.488320][ T920] syzkaller0: entered allmulticast mode [ 967.605900][ T925] bond2: option fail_over_mac: invalid value (127) [ 967.620291][ T925] bond2 (unregistering): Released all slaves [ 967.807868][ T937] __nla_validate_parse: 3 callbacks suppressed [ 967.807889][ T937] netlink: 220 bytes leftover after parsing attributes in process `syz.0.7049'. [ 967.952483][ T951] netlink: 'syz.2.7052': attribute type 8 has an invalid length. [ 967.962937][ T951] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7052'. [ 970.032224][ T972] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7053'. [ 970.115678][ T974] batadv0: entered promiscuous mode [ 970.128329][ T974] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 970.146438][ T979] lo: Caught tx_queue_len zero misconfig [ 970.154853][ T979] netlink: 'syz.1.7056': attribute type 5 has an invalid length. [ 970.243286][ T977] syzkaller0: entered promiscuous mode [ 970.248929][ T977] syzkaller0: entered allmulticast mode [ 970.259890][ T982] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7058'. [ 970.294049][ T982] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7058'. [ 970.392821][ T989] netlink: 'syz.4.7060': attribute type 4 has an invalid length. [ 970.432978][ T989] netlink: 'syz.4.7060': attribute type 4 has an invalid length. [ 970.442680][ T996] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7062'. [ 970.456812][ T989] netlink: 'syz.4.7060': attribute type 4 has an invalid length. [ 970.482068][ T989] netlink: 'syz.4.7060': attribute type 4 has an invalid length. [ 970.553070][ T989] netlink: 'syz.4.7060': attribute type 4 has an invalid length. [ 970.562719][ T989] netlink: 'syz.4.7060': attribute type 4 has an invalid length. [ 970.571790][ T989] netlink: 'syz.4.7060': attribute type 4 has an invalid length. [ 970.732870][ T1007] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 970.736097][ T1010] openvswitch: netlink: Message has 572 unknown bytes. [ 970.750350][ T1010] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 970.765055][ T1010] Bluetooth: MGMT ver 1.23 [ 970.826910][ T1000] syzkaller0: entered promiscuous mode [ 970.843407][ T1000] syzkaller0: entered allmulticast mode [ 970.844389][ T1012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7068'. [ 972.994283][ T1038] netlink: 244 bytes leftover after parsing attributes in process `syz.0.7071'. [ 973.039294][ T1038] pimreg: entered allmulticast mode [ 973.057932][ T1038] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7071'. [ 973.078831][ T1043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7072'. [ 973.169667][ T1038] bond2: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 973.183380][ T1038] bond2 (unregistering): Released all slaves [ 973.207822][ T1036] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.7070'. [ 973.901369][ T1094] siw: device registration error -23 [ 974.136867][ T1100] IPVS: length: 146 != 8 [ 974.547987][ T1122] validate_nla: 59 callbacks suppressed [ 974.548012][ T1122] netlink: 'syz.0.7088': attribute type 1 has an invalid length. [ 974.632851][ T1122] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7088'. [ 974.658173][ T1122] bond2: (slave bridge5): making interface the new active one [ 974.667779][ T1122] bond2: (slave bridge5): Enslaving as an active interface with an up link [ 974.679015][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 974.700465][ T1122] bond2: (slave bridge6): Enslaving as an active interface with a down link [ 974.747523][ T1122] macvlan2: entered promiscuous mode [ 974.753796][ T1122] macvlan2: entered allmulticast mode [ 974.764103][ T1122] bond2: entered promiscuous mode [ 974.769425][ T1122] bridge5: entered promiscuous mode [ 974.777963][ T1122] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 974.801000][ T1122] bond2: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 974.817500][ T1122] bond2: left promiscuous mode [ 974.824985][ T1122] bridge5: left promiscuous mode [ 975.014670][ T1130] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7091'. [ 975.095552][ T1127] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7090'. [ 975.648170][ T1140] lo speed is unknown, defaulting to 1000 [ 975.866669][ T1147] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 976.539035][ T1162] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 976.605895][ T1162] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 976.667744][ T1140] lo speed is unknown, defaulting to 1000 [ 976.928869][ T1161] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 977.275366][ T1140] lo speed is unknown, defaulting to 1000 [ 977.323687][ T1140] batadv0 speed is unknown, defaulting to 1000 [ 977.339549][ T1179] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 977.649358][ T1183] netlink: 5 bytes leftover after parsing attributes in process `syz.3.7103'. [ 977.659682][ T1183] 0ªî{X¹¦: renamed from gretap0 (while UP) [ 977.687084][ T1183] 0ªî{X¹¦: entered allmulticast mode [ 977.695061][ T1183] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 978.283007][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 978.303863][ T1191] tipc: Resetting bearer [ 978.361780][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 978.809899][ T1212] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7110'. [ 979.047169][ T1053] Set syz1 is full, maxelem 65536 reached [ 979.083097][ T1220] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7112'. [ 979.204752][ T1220] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7112'. [ 979.255718][ T1225] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7112'. [ 979.394780][ T1232] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7114'. [ 979.788045][ T1241] xt_TPROXY: Can be used only with -p tcp or -p udp [ 980.015861][ T1245] netlink: 7060 bytes leftover after parsing attributes in process `syz.2.7120'. [ 980.292091][ T1258] netlink: 'syz.1.7122': attribute type 1 has an invalid length. [ 980.479567][ T1269] netlink: 'syz.2.7126': attribute type 1 has an invalid length. [ 980.667738][ T1278] can: request_module (can-proto-0) failed. [ 980.716458][ T1284] syzkaller0: entered allmulticast mode [ 980.723227][ T1284] syzkaller0: entered promiscuous mode [ 980.788914][ T1287] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7129'. [ 980.833494][ T1284] syzkaller0 (unregistering): left promiscuous mode [ 980.879812][ T1284] syzkaller0 (unregistering): left allmulticast mode [ 980.979913][T25758] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 980.992276][T25758] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 981.025720][ T1292] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7132'. [ 981.055030][T25758] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 981.076338][T25758] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 981.115481][ T1301] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7133'. [ 981.279210][ T1309] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7137'. [ 981.347721][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.357681][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.402409][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.410189][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.441335][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.458492][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.551996][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.559142][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.612728][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.619896][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.661753][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.702884][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.709906][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.717896][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.729785][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.736893][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.745198][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.769866][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.806511][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.809025][ T1328] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 981.819752][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.852044][ T1327] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 981.858140][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.888712][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.902744][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.910281][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.932175][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.947050][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.954796][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.962989][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.970373][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.979232][ T1308] bond0: option arp_validate: invalid value (55553) [ 981.987748][ T1308] bond0: option arp_validate: invalid value (55553) [ 982.085604][ T1308] bond0: option arp_validate: invalid value (55553) [ 982.617322][ T1368] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 983.012680][ T1394] netlink: 'syz.3.7159': attribute type 1 has an invalid length. [ 983.051363][ T1372] bridge0: port 2(bridge_slave_1) entered disabled state [ 983.059151][ T1372] bridge0: port 1(bridge_slave_0) entered disabled state [ 983.188505][ T1372] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 983.205328][ T1372] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 983.618606][T25755] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.647028][T25755] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.676704][T25755] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.706627][T25755] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.202373][ T1437] netlink: 'syz.1.7170': attribute type 1 has an invalid length. [ 984.253108][ T1437] bond6: entered promiscuous mode [ 984.258582][ T1437] 8021q: adding VLAN 0 to HW filter on device bond6 [ 984.375837][ T1449] bond6: (slave bridge5): making interface the new active one [ 984.389116][ T1449] bridge5: entered promiscuous mode [ 984.396797][ T1449] bond6: (slave bridge5): Enslaving as an active interface with an up link [ 984.467338][T20022] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 984.497571][T20022] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.540678][T20022] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 984.556544][T20022] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.581362][ T1443] lo speed is unknown, defaulting to 1000 [ 984.582420][ T1449] bridge0: Device is already in use. [ 984.621674][T20022] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 984.660521][T20022] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.690527][T20022] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 984.737345][T20022] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.806223][ T1464] lo speed is unknown, defaulting to 1000 [ 984.841277][ T1476] vlan3: entered allmulticast mode [ 984.850690][ T1476] veth0_to_bond: entered allmulticast mode [ 984.886358][ T1479] pimreg: entered allmulticast mode [ 984.904700][ T1476] __nla_validate_parse: 71 callbacks suppressed [ 984.904721][ T1476] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.7180'. [ 984.982921][ T1450] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7172'. [ 985.092433][ T1490] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7182'. [ 985.123337][ T1490] nbd: must specify a device to reconfigure [ 985.180726][ T1489] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7182'. [ 985.194613][ T1489] nbd: must specify a device to reconfigure [ 985.212706][ T1490] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7182'. [ 985.226472][ T1496] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7185'. [ 985.257656][ T1495] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7185'. [ 985.272144][ T1495] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7185'. [ 985.281227][ T1496] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7185'. [ 985.306978][ T1443] lo speed is unknown, defaulting to 1000 [ 985.355982][ T1495] netlink: 'syz.1.7185': attribute type 10 has an invalid length. [ 985.377786][ T1495] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 985.555327][ T1503] netlink: 'syz.1.7187': attribute type 10 has an invalid length. [ 985.637125][ T1503] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 985.658827][ T1506] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.7188'. [ 985.669339][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 985.876792][ T1464] lo speed is unknown, defaulting to 1000 [ 985.877969][ T1443] lo speed is unknown, defaulting to 1000 [ 985.900889][ T1443] batadv0 speed is unknown, defaulting to 1000 [ 986.161191][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 986.193385][ T1517] lo speed is unknown, defaulting to 1000 [ 986.407319][ T1529] bridge0: port 3(netdevsim0) entered disabled state [ 986.414349][ T1529] bridge0: port 1(bridge_slave_0) entered disabled state [ 986.797560][ T29] audit: type=1804 audit(1771375972.752:22): pid=1531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.7195" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=783 res=1 errno=0 [ 986.881961][ T29] audit: type=1800 audit(1771375972.792:23): pid=1531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7195" name="x000000000000000300000000000000000000003" dev="tmpfs" ino=783 res=0 errno=0 [ 986.984535][ T1533] netlink: 'syz.2.7196': attribute type 8 has an invalid length. [ 987.024292][ T1464] lo speed is unknown, defaulting to 1000 [ 987.126597][ T1464] batadv0 speed is unknown, defaulting to 1000 [ 987.856422][ T1553] netlink: 'syz.1.7201': attribute type 2 has an invalid length. [ 987.871001][ T1553] netlink: 'syz.1.7201': attribute type 1 has an invalid length. [ 987.974949][ T1517] lo speed is unknown, defaulting to 1000 [ 988.053408][ T1557] tipc: Enabling of bearer rejected, already enabled [ 988.086666][ T1557] tipc: Resetting bearer [ 988.263265][ T1563] netlink: 'syz.1.7206': attribute type 1 has an invalid length. [ 988.343144][ T1563] bond7: entered promiscuous mode [ 988.348760][ T1563] 8021q: adding VLAN 0 to HW filter on device bond7 [ 988.417150][ T1517] lo speed is unknown, defaulting to 1000 [ 988.456300][ T1517] batadv0 speed is unknown, defaulting to 1000 [ 988.626759][ T1570] bond7: (slave bridge6): making interface the new active one [ 988.635852][ T1570] bridge6: entered promiscuous mode [ 988.643890][ T1570] bond7: (slave bridge6): Enslaving as an active interface with an up link [ 990.006547][ T1595] syzkaller0: entered promiscuous mode [ 990.021107][ T1595] syzkaller0: entered allmulticast mode [ 990.041091][ T1595] 0: reclassify loop, rule prio 0, protocol 800 [ 990.098716][ T1595] macsec0: entered promiscuous mode [ 990.118502][ T1595] macsec0: entered allmulticast mode [ 990.137274][ T1596] __nla_validate_parse: 9 callbacks suppressed [ 990.137295][ T1596] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7215'. [ 990.395209][ T1599] syzkaller0: entered promiscuous mode [ 990.413385][ T1599] syzkaller0: entered allmulticast mode [ 990.633336][ T1618] netlink: 'syz.3.7216': attribute type 1 has an invalid length. [ 990.658813][ T1616] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7220'. [ 990.683673][ T1616] netlink: 48 bytes leftover after parsing attributes in process `syz.0.7220'. [ 990.695005][ T1616] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7220'. [ 990.845008][ T1616] vlan2: entered allmulticast mode [ 990.852402][ T1616] dummy0: entered allmulticast mode [ 991.087051][ T1630] IPVS: set_ctl: invalid protocol: 1 172.30.0.1:20004 [ 991.268789][ T1649] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 991.292961][ T1649] syzkaller1: linktype set to 768 [ 991.491334][ T1664] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7230'. [ 991.550041][ T1665] netlink: 'syz.0.7227': attribute type 12 has an invalid length. [ 991.673361][ T1677] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7235'. [ 991.692640][ T1678] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7231'. [ 992.141699][ T1700] netlink: 56 bytes leftover after parsing attributes in process `syz.2.7243'. [ 992.153291][ T1700] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7243'. [ 992.355587][T16081] IPVS: starting estimator thread 0... [ 992.362405][ T1708] IPVS: sed: FWM 3 0x00000003 - no destination available [ 992.451461][ T1709] IPVS: using max 51 ests per chain, 122400 per kthread [ 992.896404][ T1717] bridge7: entered promiscuous mode [ 992.902135][ T1717] bridge7: entered allmulticast mode [ 994.352972][ T1652] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 994.562067][ T1725] tipc: Enabling of bearer rejected, failed to enable media [ 995.144211][ T1758] netlink: 105 bytes leftover after parsing attributes in process `syz.1.7255'. [ 995.200305][ T1762] netlink: 'syz.0.7257': attribute type 1 has an invalid length. [ 995.219837][ T1767] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7259'. [ 995.229817][ T1762] netlink: 'syz.0.7257': attribute type 2 has an invalid length. [ 995.255471][ T1767] erspan0: entered promiscuous mode [ 995.275278][ T1767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7259'. [ 996.130068][ T1783] gretap0: entered promiscuous mode [ 996.155481][ T1786] tipc: Enabled bearer , priority 0 [ 996.189519][ T1791] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7263'. [ 996.202946][ T1789] syzkaller0: entered promiscuous mode [ 996.208586][ T1789] syzkaller0: entered allmulticast mode [ 996.217188][ T1797] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7263'. [ 996.362605][ T1793] tipc: Resetting bearer [ 996.389635][ T1777] tipc: Resetting bearer [ 996.487591][ T1777] tipc: Disabling bearer [ 996.646302][ T1817] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7270'. [ 996.967958][ T1825] lo speed is unknown, defaulting to 1000 [ 997.156644][ T1834] netlink: 'syz.0.7272': attribute type 11 has an invalid length. [ 997.231477][ T1831] netlink: 'syz.1.7271': attribute type 1 has an invalid length. [ 997.428328][ T1831] bond8: entered promiscuous mode [ 997.434161][ T1831] bond8: entered allmulticast mode [ 997.440167][ T1831] 8021q: adding VLAN 0 to HW filter on device bond8 [ 997.464895][ T1837] erspan2: entered allmulticast mode [ 997.476264][ T1837] bond8: (slave erspan2): making interface the new active one [ 997.485047][ T1837] erspan2: entered promiscuous mode [ 997.492964][ T1837] bond8: (slave erspan2): Enslaving as an active interface with an up link [ 997.504603][ T1825] lo speed is unknown, defaulting to 1000 [ 997.631906][ T1845] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7276'. [ 998.071814][ T1825] lo speed is unknown, defaulting to 1000 [ 998.082336][ T1825] batadv0 speed is unknown, defaulting to 1000 [ 998.785006][ T1861] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 999.046604][ T1900] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7291'. [ 1000.262388][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 1000.338527][ T1950] lo speed is unknown, defaulting to 1000 [ 1000.388933][ T1958] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.7305'. [ 1000.401235][ T1959] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.7305'. [ 1000.868491][ T1977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7310'. [ 1000.958848][ T1950] lo speed is unknown, defaulting to 1000 [ 1001.042003][ T1982] IPVS: set_ctl: invalid protocol: 59 172.20.20.12:21 [ 1001.339415][ T1988] netlink: 'syz.3.7313': attribute type 3 has an invalid length. [ 1001.434918][ T1950] lo speed is unknown, defaulting to 1000 [ 1001.449069][ T1950] batadv0 speed is unknown, defaulting to 1000 [ 1001.474982][ T1993] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.7315'. [ 1001.595418][ T2000] netlink: 'syz.1.7317': attribute type 1 has an invalid length. [ 1001.648818][ T2006] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7317'. [ 1001.662324][ T2007] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7319'. [ 1001.699534][ T2000] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7317'. [ 1001.736363][ T2007] bridge2: port 1(veth11) entered blocking state [ 1001.743778][ T2007] bridge2: port 1(veth11) entered disabled state [ 1001.752070][ T2007] veth11: entered allmulticast mode [ 1001.754468][ T2012] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7317'. [ 1001.759631][ T2007] veth11: entered promiscuous mode [ 1001.791494][ T2012] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1001.829591][ T2006] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7317'. [ 1001.861347][ T2006] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7317'. [ 1002.182128][ T2034] netlink: 'syz.3.7327': attribute type 1 has an invalid length. [ 1002.192175][ T2034] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1002.234518][ T2034] netlink: 'syz.3.7327': attribute type 13 has an invalid length. [ 1002.249235][ T2034] netlink: 'syz.3.7327': attribute type 17 has an invalid length. [ 1002.370100][ T2043] siw: device registration error -23 [ 1002.384815][ T2034] 0ªî{X¹¦: left allmulticast mode [ 1002.462921][ T2034] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1002.673204][ T2056] xt_TCPMSS: Only works on TCP SYN packets [ 1002.680394][ T2050] openvswitch: netlink: IP tunnel TTL not specified. [ 1002.891604][ T2060] tun0: tun_chr_ioctl cmd 1074025675 [ 1002.897053][ T2060] tun0: persist enabled [ 1002.940475][ T2060] tun0: tun_chr_ioctl cmd 1074025675 [ 1002.953215][ T2060] tun0: persist enabled [ 1002.984828][ T2060] tun0: tun_chr_ioctl cmd 1074025673 [ 1003.990145][ T2110] lo speed is unknown, defaulting to 1000 [ 1004.011849][ T2121] batadv_slave_0: entered promiscuous mode [ 1004.034753][ T2120] xt_hashlimit: size too large, truncated to 1048576 [ 1004.045988][ T2119] batadv_slave_0: left promiscuous mode [ 1004.050611][ T2120] xt_hashlimit: max too large, truncated to 1048576 [ 1004.176267][ T2120] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1004.745346][ T2148] macvlan2: entered allmulticast mode [ 1004.752532][ T2148] hsr0: entered allmulticast mode [ 1004.784645][ T2148] hsr_slave_0: entered allmulticast mode [ 1004.831522][ T2148] hsr_slave_1: entered allmulticast mode [ 1004.839406][ T2110] lo speed is unknown, defaulting to 1000 [ 1004.865551][ T2146] gtp0: entered promiscuous mode [ 1004.876874][ T2146] gtp0: entered allmulticast mode [ 1005.511491][ T2110] lo speed is unknown, defaulting to 1000 [ 1005.533986][ T2183] __nla_validate_parse: 11 callbacks suppressed [ 1005.534008][ T2183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7362'. [ 1005.573350][ T2184] netdevsim netdevsim1 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 1005.616879][ T2110] batadv0 speed is unknown, defaulting to 1000 [ 1005.633786][ T2183] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7362'. [ 1005.644021][ T2183] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7362'. [ 1005.671829][ T2183] syzkaller0: entered promiscuous mode [ 1005.677362][ T2183] syzkaller0: entered allmulticast mode [ 1005.869286][ T2192] netlink: 'syz.1.7364': attribute type 1 has an invalid length. [ 1005.880042][ T2192] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 1005.999273][ T2196] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7366'. [ 1006.021504][ T2196] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7366'. [ 1006.065565][ T2196] batadv2: entered promiscuous mode [ 1006.071041][ T2196] batadv2: entered allmulticast mode [ 1006.088645][ T2196] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 1006.428921][ T2224] netlink: 'syz.2.7373': attribute type 1 has an invalid length. [ 1006.437856][ T2224] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7373'. [ 1006.449906][ T2224] netlink: 658 bytes leftover after parsing attributes in process `syz.2.7373'. [ 1006.460417][ T2224] netlink: 1 bytes leftover after parsing attributes in process `syz.2.7373'. [ 1006.622399][ T2232] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7374'. [ 1006.639534][ T2233] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7375'. [ 1006.874979][ T2241] netlink: 'syz.2.7377': attribute type 23 has an invalid length. [ 1006.945356][ T2242] netlink: 'syz.2.7377': attribute type 23 has an invalid length. [ 1007.296716][ T2252] netem: change failed [ 1007.394703][ T2259] openvswitch: netlink: IP tunnel TTL not specified. [ 1008.106793][ T2110] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1008.143277][ T2290] netlink: 'syz.1.7391': attribute type 4 has an invalid length. [ 1008.144309][ T2294] netlink: 'syz.1.7391': attribute type 4 has an invalid length. [ 1008.286505][ T2300] lo speed is unknown, defaulting to 1000 [ 1008.347971][ T2304] netlink: 'syz.2.7393': attribute type 10 has an invalid length. [ 1008.363082][ T2307] netlink: 'syz.1.7394': attribute type 4 has an invalid length. [ 1008.374615][ T2304] dummy0: entered promiscuous mode [ 1008.385463][ T2304] bridge0: port 3(dummy0) entered blocking state [ 1008.433083][ T2304] bridge0: port 3(dummy0) entered disabled state [ 1008.456601][ T2304] dummy0: entered allmulticast mode [ 1008.732095][ T2315] openvswitch: netlink: Tunnel attr 77 out of range max 16 [ 1008.988498][ T2300] lo speed is unknown, defaulting to 1000 [ 1009.476092][ T2300] lo speed is unknown, defaulting to 1000 [ 1009.512682][ T2300] batadv0 speed is unknown, defaulting to 1000 [ 1009.656582][ T2348] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 1010.344280][ T2379] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 1010.387031][ T2379] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 1010.419684][ T2379] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 1010.519777][ T2377] syzkaller0: entered promiscuous mode [ 1010.543292][ T2377] syzkaller0: entered allmulticast mode [ 1010.623397][ T2390] __nla_validate_parse: 13 callbacks suppressed [ 1010.623417][ T2390] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7417'. [ 1010.629074][ T2392] lo speed is unknown, defaulting to 1000 [ 1011.561483][ T2417] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7420'. [ 1011.872642][T31565] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1012.905982][T16080] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1013.517844][ T2392] lo speed is unknown, defaulting to 1000 [ 1013.627697][ T2421] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7422'. [ 1013.884465][ T2440] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7425'. [ 1013.895531][ T2440] nbd: couldn't find a device at index 65546 [ 1014.012822][T31565] IPVS: starting estimator thread 0... [ 1014.023420][ T2392] lo speed is unknown, defaulting to 1000 [ 1014.051423][ T2392] batadv0 speed is unknown, defaulting to 1000 [ 1014.105886][ T2455] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7427'. [ 1014.124369][ T2451] IPVS: using max 30 ests per chain, 72000 per kthread [ 1014.833630][T25757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1014.946206][T31565] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1014.953674][ T2480] netlink: 64 bytes leftover after parsing attributes in process `syz.2.7431'. [ 1015.216885][ T2493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7435'. [ 1015.428175][ T2499] vlan0: entered promiscuous mode [ 1015.455325][ T2502] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7436'. [ 1015.473262][T25759] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1015.564171][ T2500] scsi_nl_rcv_msg: discarding partial skb [ 1015.613946][ T2503] lo speed is unknown, defaulting to 1000 [ 1015.964973][ T2520] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7441'. [ 1015.987085][ T2519] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7441'. [ 1016.199597][ T2527] mac80211_hwsim hwsim81 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1016.223030][ T2503] lo speed is unknown, defaulting to 1000 [ 1016.397146][ T2534] netlink: 'syz.4.7444': attribute type 1 has an invalid length. [ 1016.412123][ T2534] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7444'. [ 1016.464766][ T2537] xt_CT: No such helper "netbios-ns" [ 1016.533804][ T2547] sctp: [Deprecated]: syz.4.7444 (pid 2547) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1016.533804][ T2547] Use struct sctp_sack_info instead [ 1016.565684][ T2548] tipc: Enabling of bearer <“dp:s> rejected, media not registered [ 1016.592736][ T2546] tipc: Enabling of bearer <“dp:s> rejected, media not registered [ 1016.603643][ T2547] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7444'. [ 1016.637752][ T2551] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7448'. [ 1016.649738][ T2546] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7447'. [ 1016.650112][ T2547] netlink: 'syz.4.7444': attribute type 1 has an invalid length. [ 1016.877065][ T2503] lo speed is unknown, defaulting to 1000 [ 1016.885874][ T2503] batadv0 speed is unknown, defaulting to 1000 [ 1017.709916][ T2598] siw: device registration error -23 [ 1017.819950][ T2633] lo speed is unknown, defaulting to 1000 [ 1018.021394][T31565] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1018.338527][ T2633] lo speed is unknown, defaulting to 1000 [ 1018.658282][ T2633] lo speed is unknown, defaulting to 1000 [ 1018.693681][ T2633] batadv0 speed is unknown, defaulting to 1000 [ 1018.972390][ T2678] netlink: 'syz.0.7471': attribute type 3 has an invalid length. [ 1018.980290][ T2678] netlink: 'syz.0.7471': attribute type 1 has an invalid length. [ 1018.989578][ T2678] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7471'. [ 1019.003373][ T2678] NCSI netlink: No device for ifindex 808464432 [ 1019.172579][ T2660] siw: device registration error -23 [ 1019.192424][ T2671] lo speed is unknown, defaulting to 1000 [ 1019.679760][ T2671] lo speed is unknown, defaulting to 1000 [ 1019.696571][ T2694] netlink: 112 bytes leftover after parsing attributes in process `syz.4.7475'. [ 1020.083079][ T2671] lo speed is unknown, defaulting to 1000 [ 1020.091628][ T2671] batadv0 speed is unknown, defaulting to 1000 [ 1020.496173][ T2726] netlink: 64 bytes leftover after parsing attributes in process `syz.3.7485'. [ 1020.581124][T25759] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.000921][ T2740] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7487'. [ 1021.073490][T21715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.222986][T25755] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.473387][ T2760] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7492'. [ 1021.581971][ T2767] netlink: 276 bytes leftover after parsing attributes in process `syz.3.7491'. [ 1021.680351][ T2769] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7494'. [ 1021.690443][ T2770] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7494'. [ 1021.828267][ T2774] netlink: 'syz.0.7495': attribute type 2 has an invalid length. [ 1021.862320][ T30] INFO: task udevd:30162 blocked for more than 143 seconds. [ 1021.953182][ T30] Not tainted syzkaller #0 [ 1021.958178][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1021.969384][ T30] task:udevd state:D stack:23464 pid:30162 tgid:30162 ppid:5189 task_flags:0x400140 flags:0x00080000 [ 1022.013055][ T30] Call Trace: [ 1022.027888][ T30] [ 1022.051508][ T30] __schedule+0x1568/0x5290 [ 1022.068927][ T30] ? blk_mq_flush_plug_list+0x443/0x570 [ 1022.088623][ T30] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 1022.108917][ T30] ? __blk_flush_plug+0x416/0x4d0 [ 1022.117934][ T30] ? __pfx___schedule+0x10/0x10 [ 1022.123561][ T30] ? schedule+0x90/0x360 [ 1022.128040][ T30] schedule+0x164/0x360 [ 1022.132784][ T30] schedule_timeout+0x158/0x2c0 [ 1022.137845][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 1022.143916][ T30] ? __pfx_process_timeout+0x10/0x10 [ 1022.149432][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1022.157244][ T30] ? prepare_to_wait_event+0x436/0x480 [ 1022.165908][ T30] nbd_queue_rq+0x857/0x1100 [ 1022.171029][ T30] ? __pfx_nbd_queue_rq+0x10/0x10 [ 1022.176266][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1022.184849][ T30] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1022.192692][ T30] ? sbitmap_get+0x229/0x390 [ 1022.197471][ T30] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 1022.204228][ T30] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 1022.210251][ T30] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1022.227739][ T30] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 1022.246286][ T30] ? blk_mq_hw_queue_need_run+0x13c/0x680 [ 1022.252621][ T30] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 1022.258342][ T30] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1022.266539][ T30] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 1022.272509][ T30] blk_mq_run_hw_queue+0x348/0x4f0 [ 1022.277731][ T30] blk_mq_dispatch_list+0xd16/0xe10 [ 1022.285970][ T30] ? bdev_count_inflight+0x1cf/0x210 [ 1022.291905][ T30] ? blk_mq_dispatch_list+0x1d0/0xe10 [ 1022.297625][ T30] ? __pfx_blk_mq_dispatch_list+0x10/0x10 [ 1022.305458][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 1022.311184][ T30] ? rcu_is_watching+0x15/0xb0 [ 1022.316057][ T30] blk_mq_flush_plug_list+0x48d/0x570 [ 1022.321995][ T30] ? blk_add_rq_to_plug+0x300/0x450 [ 1022.327302][ T30] ? blk_mq_submit_bio+0xef8/0x27c0 [ 1022.333652][ T30] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 1022.339915][ T30] __blk_flush_plug+0x3ed/0x4d0 [ 1022.348823][ T30] ? __pfx___blk_flush_plug+0x10/0x10 [ 1022.355169][ T30] ? blkg_get+0x20/0x1d0 [ 1022.359636][ T30] __submit_bio+0x28d/0x580 [ 1022.366020][ T30] ? __pfx___submit_bio+0x10/0x10 [ 1022.372450][ T30] ? bio_associate_blkg+0x6d/0x230 [ 1022.377664][ T30] submit_bio_noacct_nocheck+0x2f4/0xa20 [ 1022.385226][ T30] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10 [ 1022.392447][ T30] ? bio_alloc_bioset+0xbe2/0x11b0 [ 1022.397674][ T30] block_read_full_folio+0x599/0x830 [ 1022.406374][ T30] ? __pfx_blkdev_get_block+0x10/0x10 [ 1022.414754][ T30] filemap_read_folio+0x137/0x3b0 [ 1022.419987][ T30] ? __pfx_blkdev_read_folio+0x10/0x10 [ 1022.431843][ T30] ? __pfx_filemap_read_folio+0x10/0x10 [ 1022.437513][ T30] ? filemap_add_folio+0x356/0x530 [ 1022.444163][ T30] do_read_cache_folio+0x358/0x590 [ 1022.449357][ T30] ? __pfx_blkdev_read_folio+0x10/0x10 [ 1022.455459][ T30] read_part_sector+0xb6/0x2b0 [ 1022.460328][ T30] adfspart_check_ICS+0xa5/0xa40 [ 1022.465980][ T30] ? snprintf+0xe8/0x140 [ 1022.470282][ T30] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1022.477225][ T30] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 1022.485186][ T30] bdev_disk_changed+0x7ba/0x1550 [ 1022.490336][ T30] ? bdev_open+0xe0/0xd30 [ 1022.496279][ T30] ? __pfx_bdev_disk_changed+0x10/0x10 [ 1022.505869][ T30] blkdev_get_whole+0x380/0x510 [ 1022.513492][ T30] bdev_open+0x31e/0xd30 [ 1022.518402][ T30] blkdev_open+0x470/0x610 [ 1022.524548][ T30] ? __pfx_blkdev_open+0x10/0x10 [ 1022.529858][ T30] do_dentry_open+0x785/0x14e0 [ 1022.535772][ T30] vfs_open+0x3b/0x340 [ 1022.539955][ T30] ? path_openat+0x2df0/0x3860 [ 1022.545911][ T30] path_openat+0x2e08/0x3860 [ 1022.552098][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 1022.557652][ T30] ? stack_depot_save_flags+0x33/0x810 [ 1022.563800][ T30] ? __pfx_path_openat+0x10/0x10 [ 1022.568888][ T30] ? __x64_sys_openat+0x138/0x170 [ 1022.574957][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 1022.580224][ T30] do_file_open+0x23e/0x4a0 [ 1022.586020][ T30] ? __pfx_do_file_open+0x10/0x10 [ 1022.591618][ T30] ? _raw_spin_unlock+0x28/0x50 [ 1022.596508][ T30] ? alloc_fd+0x64b/0x6c0 [ 1022.601363][ T30] do_sys_openat2+0x113/0x200 [ 1022.606080][ T30] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1022.611814][ T30] ? __pfx_do_sys_openat2+0x10/0x10 [ 1022.617037][ T30] ? rcu_is_watching+0x15/0xb0 [ 1022.622015][ T30] __x64_sys_openat+0x138/0x170 [ 1022.626899][ T30] do_syscall_64+0x14d/0xf80 [ 1022.631781][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.637973][ T30] ? trace_irq_disable+0x37/0x100 [ 1022.643224][ T30] ? clear_bhb_loop+0x40/0x90 [ 1022.648049][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.654360][ T30] RIP: 0033:0x7fb6848a7407 [ 1022.658897][ T30] RSP: 002b:00007ffe5990c4d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1022.668219][ T30] RAX: ffffffffffffffda RBX: 00007fb6850ac880 RCX: 00007fb6848a7407 [ 1022.676505][ T30] RDX: 00000000000a0800 RSI: 0000559cd05b82d0 RDI: ffffffffffffff9c [ 1022.684606][ T30] RBP: 0000559cd05b7910 R08: 0000000000000000 R09: 0000000000000000 [ 1022.692787][ T30] R10: 0000000000000000 R11: 0000000000000202 R12: 0000559cd05cc830 [ 1022.701214][ T30] R13: 0000559cd05c5190 R14: 0000000000000000 R15: 0000559cd05cc830 [ 1022.709331][ T30] [ 1022.712931][ T30] [ 1022.712931][ T30] Showing all locks held in the system: [ 1022.741461][ T30] 1 lock held by khungtaskd/30: [ 1022.746388][ T30] #0: ffffffff8e75e0a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1022.845838][ T30] 2 locks held by getty/5574: [ 1022.851132][ T30] #0: ffff8880323080a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1022.861228][ T30] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 1022.871969][ T30] 3 locks held by kworker/1:8/16080: [ 1022.877402][ T30] #0: ffff88813fe03548 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1022.888899][ T30] #1: ffffc90002ee7c40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1022.900732][ T30] #2: ffffffff8e764200 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 1022.911706][ T30] 3 locks held by kworker/u8:10/20022: [ 1022.917497][ T30] #0: ffff88813fe44148 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1022.932679][ T30] #1: ffffc9000eadfc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1022.946470][ T30] #2: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 1022.956614][ T30] 4 locks held by kworker/u8:23/25756: [ 1022.962534][ T30] #0: ffff88801b6ce948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1022.973637][ T30] #1: ffffc9000cfd7c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1022.985610][ T30] #2: ffffffff8fbaffb0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 1022.995598][ T30] #3: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: ipmr_net_exit_batch+0x20/0x90 [ 1023.005243][ T30] 3 locks held by udevd/30162: [ 1023.010207][ T30] #0: ffff888026292358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 1023.019682][ T30] #1: ffff888025b5c098 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x31f/0x4f0 [ 1023.029356][ T30] #2: ffff888026380180 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc6/0x1100 [ 1023.038580][ T30] 2 locks held by syz.1.7462/2633: [ 1023.043921][ T30] #0: ffffffff8fbaffb0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 1023.053993][ T30] #1: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: cfg802154_pernet_exit+0x19/0xe0 [ 1023.063866][ T30] 2 locks held by syz.2.7469/2671: [ 1023.069000][ T30] #0: ffffffff8fbaffb0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 1023.079609][ T30] #1: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: cfg802154_pernet_exit+0x19/0xe0 [ 1023.090399][ T30] 2 locks held by syz.3.7491/2758: [ 1023.096532][ T30] #0: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 1023.106794][ T30] #1: ffffffff8e764338 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 1023.118207][ T30] 1 lock held by syz.3.7491/2761: [ 1023.123403][ T30] #0: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: dev_ethtool+0x1e1/0x1ae0 [ 1023.132836][ T30] 1 lock held by syz.3.7491/2767: [ 1023.137876][ T30] #0: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 1023.147487][ T30] [ 1023.149839][ T30] ============================================= [ 1023.149839][ T30] [ 1023.158792][ T30] NMI backtrace for cpu 0 [ 1023.158815][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1023.158836][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1023.158848][ T30] Call Trace: [ 1023.158857][ T30] [ 1023.158866][ T30] dump_stack_lvl+0xe8/0x150 [ 1023.158898][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 1023.158920][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1023.158946][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1023.158966][ T30] sys_info+0x135/0x170 [ 1023.158991][ T30] watchdog+0xf90/0xfe0 [ 1023.159020][ T30] ? watchdog+0x209/0xfe0 [ 1023.159050][ T30] kthread+0x388/0x470 [ 1023.159076][ T30] ? __pfx_watchdog+0x10/0x10 [ 1023.159096][ T30] ? __pfx_kthread+0x10/0x10 [ 1023.159134][ T30] ret_from_fork+0x51e/0xb90 [ 1023.159160][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1023.159180][ T30] ? __switch_to+0xc7d/0x1400 [ 1023.159204][ T30] ? __pfx_kthread+0x10/0x10 [ 1023.159231][ T30] ret_from_fork_asm+0x1a/0x30 [ 1023.159272][ T30] [ 1023.159286][ T30] Sending NMI from CPU 0 to CPUs 1: [ 1023.270749][ C1] NMI backtrace for cpu 1 [ 1023.270770][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 1023.270787][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1023.270797][ C1] RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x2e/0x90 [ 1023.270823][ C1] Code: 48 8b 04 24 65 48 8b 15 28 c2 52 11 65 8b 0d 49 c2 52 11 81 e1 00 01 ff 00 74 11 81 f9 00 01 00 00 75 5b 83 ba 44 16 00 00 00 <74> 52 8b 8a 20 16 00 00 83 f9 03 75 47 48 8b 8a 28 16 00 00 44 8b [ 1023.270836][ C1] RSP: 0018:ffffc90000a08b80 EFLAGS: 00000246 [ 1023.270852][ C1] RAX: ffffffff89a7d5b5 RBX: 0000000000000000 RCX: 0000000000000100 [ 1023.270864][ C1] RDX: ffff88801dac8000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1023.270875][ C1] RBP: ffff88805da11ec8 R08: 0000000000000003 R09: 0000000000000004 [ 1023.270885][ C1] R10: dffffc0000000000 R11: fffff52000141174 R12: dffffc0000000000 [ 1023.270897][ C1] R13: ffff888053182ada R14: 1ffff1100a63055b R15: 0000000000000000 [ 1023.270908][ C1] FS: 0000000000000000(0000) GS:ffff8881255b0000(0000) knlGS:0000000000000000 [ 1023.270921][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1023.270933][ C1] CR2: 00007fcfd41e89b8 CR3: 0000000075f20000 CR4: 00000000003526f0 [ 1023.270949][ C1] Call Trace: [ 1023.270957][ C1] [ 1023.270963][ C1] pie_calculate_probability+0x6a5/0x7e0 [ 1023.270996][ C1] fq_pie_timer+0x288/0x5b0 [ 1023.271017][ C1] ? fq_pie_timer+0x4d/0x5b0 [ 1023.271040][ C1] call_timer_fn+0x192/0x5a0 [ 1023.271057][ C1] ? __pfx_fq_pie_timer+0x10/0x10 [ 1023.271077][ C1] ? call_timer_fn+0xd4/0x5a0 [ 1023.271092][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1023.271113][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1023.271131][ C1] ? __pfx_fq_pie_timer+0x10/0x10 [ 1023.271152][ C1] __run_timer_base+0x652/0x8b0 [ 1023.271167][ C1] ? ktime_get+0x45/0x200 [ 1023.271192][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 1023.271211][ C1] ? sched_clock_cpu+0x74/0x440 [ 1023.271231][ C1] run_timer_softirq+0xb7/0x170 [ 1023.271247][ C1] handle_softirqs+0x22a/0x7c0 [ 1023.271266][ C1] ? __irq_exit_rcu+0x5f/0x150 [ 1023.271287][ C1] __irq_exit_rcu+0x5f/0x150 [ 1023.271304][ C1] irq_exit_rcu+0x9/0x30 [ 1023.271319][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1023.271340][ C1] [ 1023.271345][ C1] [ 1023.271352][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1023.271369][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1023.271388][ C1] Code: 44 7b 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 38 2b 00 fb f4 7c e8 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 1023.271400][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000242 [ 1023.271413][ C1] RAX: 000000000022e283 RBX: ffffffff8199661d RCX: 0000000080000001 [ 1023.271424][ C1] RDX: 0000000000000001 RSI: ffffffff8dee2508 RDI: ffffffff8c276500 [ 1023.271435][ C1] RBP: ffffc90000197f10 R08: ffff8880b873375b R09: 1ffff110170e66eb [ 1023.271446][ C1] R10: dffffc0000000000 R11: ffffed10170e66ec R12: ffffffff90109070 [ 1023.271457][ C1] R13: 1ffff11003b59000 R14: 0000000000000001 R15: 0000000000000001 [ 1023.271470][ C1] ? do_idle+0x1bd/0x500 [ 1023.271498][ C1] default_idle+0x9/0x20 [ 1023.271519][ C1] default_idle_call+0x72/0xb0 [ 1023.271539][ C1] do_idle+0x1bd/0x500 [ 1023.271556][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 1023.271577][ C1] ? __pfx_do_idle+0x10/0x10 [ 1023.271598][ C1] cpu_startup_entry+0x43/0x60 [ 1023.271616][ C1] start_secondary+0x101/0x110 [ 1023.271632][ C1] common_startup_64+0x13e/0x147 [ 1023.271660][ C1] [ 1023.621751][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 1023.628805][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1023.637934][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1023.648077][ T30] Call Trace: [ 1023.651368][ T30] [ 1023.654298][ T30] vpanic+0x1e0/0x670 [ 1023.658289][ T30] panic+0xc5/0xd0 [ 1023.662031][ T30] ? __pfx_panic+0x10/0x10 [ 1023.666454][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 1023.671915][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1023.678101][ T30] watchdog+0xfda/0xfe0 [ 1023.682260][ T30] ? watchdog+0x209/0xfe0 [ 1023.686606][ T30] kthread+0x388/0x470 [ 1023.690871][ T30] ? __pfx_watchdog+0x10/0x10 [ 1023.695747][ T30] ? __pfx_kthread+0x10/0x10 [ 1023.700349][ T30] ret_from_fork+0x51e/0xb90 [ 1023.704962][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1023.710078][ T30] ? __switch_to+0xc7d/0x1400 [ 1023.714770][ T30] ? __pfx_kthread+0x10/0x10 [ 1023.719369][ T30] ret_from_fork_asm+0x1a/0x30 [ 1023.724154][ T30] [ 1023.727326][ T30] Kernel Offset: disabled [ 1023.731766][ T30] Rebooting in 86400 seconds..