last executing test programs: 4.338275005s ago: executing program 3 (id=6113): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000300)="a0", 0x1, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) (async) listen(r0, 0x21) (async) r1 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x6, @remote, 0xbef}}}, &(0x7f00000000c0)=0x84) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0800000004000000040000000600000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000130000000000000000400000000020"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="1809000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffff88) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000006e00)={&(0x7f0000006c40)={0x14, 0x27, 0x1, 0x70bd27, 0x25dfdbfd, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x2000c810}, 0x8000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f0800", 0x0, 0xe8a2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x280, 0x0) ioctl$TUNSETFILTEREBPF(r5, 0x800454e1, &(0x7f0000000040)=r3) 3.288967737s ago: executing program 3 (id=6128): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x158c, 0x36, 0x107, 0xfffffffc, 0x810000, {0x3, 0x7c}}, 0x158c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) socket$key(0xf, 0x3, 0x2) (async) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000400000000000337f5701a491df00"/35], 0x48) (async) r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)={0xffffffffffffffff}, 0x4) (async) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163300c", 0x8) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$inet(r4, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)='K', 0x1}], 0x1}}], 0x1, 0x8000) (async) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r5, &(0x7f0000000980), 0xe) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000380)={'ip6gre0\x00', &(0x7f0000000300)={'ip6gre0\x00', 0x0, 0x2f, 0x2, 0x3, 0x40, 0x4, @mcast1, @ipv4={'\x00', '\xff\xff', @empty}, 0x1, 0x8000, 0x400, 0x81}}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r4, &(0x7f0000000640)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000400)={0x60, 0x0, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x4884}, 0x4000005) (async) listen(r5, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000680)={0x0, 0x5}, &(0x7f00000006c0)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000700)={0x3, 0x7, 0x0, 0x4, 0xfffffffb, 0x5, 0x1, 0x9, r8}, &(0x7f0000000740)=0x20) (async) ioctl$sock_SIOCINQ(r5, 0x5411, 0x0) r9 = accept$unix(r4, 0x0, 0x0) recvmmsg$unix(r9, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x62, 0x0) r10 = bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r9}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x18, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="7aa5da8681222b11df4cd249dbe7c277accd7380c84ecaa55598fbd882aaa52389ddfab554b50c0488e6ca8245398f7f904f4ba504cacf7a68df02"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa577be8e7f03c498, '\x00', 0x0, @fallback=0x5cce7bf011d7a714, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, @value=r10}, 0x94) r11 = accept4(r5, 0x0, &(0x7f0000000780), 0x0) bind$bt_l2cap(r11, &(0x7f00000007c0)={0x1f, 0x7, @any, 0xfffd, 0x1}, 0xe) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000001a0001000000000000000000020000000000000000000003934ac781fbb2f5824f7a661a70459372", @ANYRES32=0x0, @ANYBLOB], 0x24}}, 0x0) 2.333590512s ago: executing program 3 (id=6144): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000190001002cbd700000c8c3532d"], 0x24}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x2d}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) 2.220046346s ago: executing program 2 (id=6147): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040}, 0x8000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket(0x8, 0x0, 0x8000) ioctl$sock_netrom_SIOCADDRT(r1, 0x6180, 0x0) sendmsg$802154_dgram(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x7, 0x0, 0x0, 0x8005}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) 2.174780812s ago: executing program 3 (id=6148): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x40}}, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0xffffff5d}, 0x1c) listen(r1, 0x50) sendmsg$inet(r1, &(0x7f00000019c0)={&(0x7f0000000340)={0x2, 0x4e20, @local}, 0x10, &(0x7f00000017c0)=[{&(0x7f0000000380)="8cef", 0x2}], 0x1, 0x0, 0x4000}, 0x4000) socket$unix(0x1, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 2.163160072s ago: executing program 4 (id=6149): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) r0 = socket$kcm(0x1e, 0x1, 0x0) sendmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000300)="80", 0xfdef}], 0x1}, 0x0) (async) syz_emit_ethernet(0x66, &(0x7f0000001640)={@local, @broadcast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x30, 0x0, 0x0, @local, @remote, {[@dstopts={0x0, 0x5, '\x00', [@calipso={0x7, 0x20, {0x1, 0x6, 0x7, 0x5e4, [0x9, 0x6, 0xad1000]}}, @padn, @ra={0x5, 0x2, 0x2}]}]}}}}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000002c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000000)=0x7, &(0x7f0000000040)=0x1) (async) close(r1) 2.041456264s ago: executing program 3 (id=6152): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448d4, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000001400791048000000000069001a000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0xa3}, 0x21) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x20, 0x2c, 0x107, 0x0, 0x8, {0xb, 0x7c}, [@nested={0x4, 0x1}, @typed={0x6, 0x84, 0x0, 0x0, @str='-\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0x851) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000004c00000095"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x90) sendmsg$NL80211_CMD_GET_SURVEY(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x6, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x891) 2.012574963s ago: executing program 4 (id=6153): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x6, 0x4, 0x800008, 0x6, 0x2880}, 0x50) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$isdn_base(0x22, 0x3, 0x0) getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f0000000180)=""/107, &(0x7f0000000040)=0x6b) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000700)={r0, 0x58, &(0x7f0000002600)}, 0x10) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f00000000c0), &(0x7f00000002c0)=0x30) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000800)=ANY=[@ANYBLOB="0213000002"], 0x10}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r5}, 0x10) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r6, &(0x7f00000001c0)='g', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}, 0x2}, 0x1c) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="14010000350001000000000000000000020100800c0001"], 0x114}], 0x1}, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f00000000c0)={0xb, 0x4, 0xfe, 0x2, 0x3, 0x0, 0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x5}, 0xe) setsockopt$sock_int(r6, 0x1, 0x2e, &(0x7f0000000000)=0x8000, 0x4) shutdown(r6, 0x1) recvmmsg(r6, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) r8 = accept$unix(r4, &(0x7f0000000580), &(0x7f0000000600)=0x6e) setsockopt(r8, 0x8, 0x5, &(0x7f0000000880)="872573d27d7b441e40e5881deffe663d349f2cad6b90b80bd7a8d07f5769a47b9d192ff59854a1294ab68c86b1af2ea5247c609c388427beeaab0bd90155e28534d05fb0f8d40bb0f481f43cb0973dad6934b0f6258e41df7d5a6781151d68f0cd6ddc009f49b210dac7666b9bdc5c9417221b17fde3f4d85ee92c650495c530cd81e0c91654b4244439b0068c12224228a9a289eee145d583aebe74fbcd90d5bb1a1a76020be83dc64e9ab4f92c82bb3780fef040efc8f4827e42658b7d2e7e89fed46cc27c770e5686effe11af4ad272ceba9a5d55eda44a98d870718818155cba1b9c9367e2322718c4a11bce6f6d", 0xf0) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r9, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@bridge_getvlan={0x60, 0x72, 0x20, 0x70bd26, 0x25dfdbfd, {0x7, 0x0, 0x0, r9}, [@BRIDGE_VLANDB_DUMP_FLAGS={0xf52dd1dba2d26817}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040094}, 0x0) 1.877594673s ago: executing program 3 (id=6154): socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/uts\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/uts\x00') unshare(0x6a040000) (async) unshare(0x6a040000) socket(0x8, 0x3, 0x0) (async) r0 = socket(0x8, 0x3, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0) (async) setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x63, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x10, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xfff2}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x1a}]}}]}, 0x3c}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000180)={'wg1\x00'}) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x101140, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x101140, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(r3, &(0x7f0000000480)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x3, 0xfd, 0xfffff028}, {0x6, 0x0, 0x9, 0x1}]}) (async) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x3, 0xfd, 0xfffff028}, {0x6, 0x0, 0x9, 0x1}]}) 1.593384093s ago: executing program 0 (id=6157): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c00)={&(0x7f0000000b80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@fwd={0x1}, @ptr={0x0, 0x0, 0x0, 0x2, 0x1}]}, {0x0, [0x2e, 0x2e]}}, 0x0, 0x34}, 0x20) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x70, r5, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x5c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x54e4, @empty, 0x4}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x80, @mcast2, 0x80}}}}]}]}, 0x70}}, 0x0) (async) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x70, r5, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x5c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x54e4, @empty, 0x4}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x80, @mcast2, 0x80}}}}]}]}, 0x70}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, 0xffffffffffffffff, 0x4000) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, 0xffffffffffffffff, 0x4000) r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCDELRT(r6, 0x890c, &(0x7f0000000500)={0x0, @default, @netrom={'nr', 0x0}, 0x0, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x0, 0x0, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default]}) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r3) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r3) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r4, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000000c40)={0x260, r7, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x19c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x198, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'batadv\x00'}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, ':}\x00'}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'syz0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'mqprio\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, 'nr'}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'mqprio\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '\xff\xff\xff\xff\xff\xff'}]}, {0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '*%)}./\\\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xf}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'mqprio\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '#\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2a}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '[^:Y\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ',\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, 'batadv\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '-@-@_&@\\\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x56}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '^}-\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, ']{\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, 'syz0\x00'}]}, {0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '\xff\xff\xff\xff\xff\xff'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'udp:syz2\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '-\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '/\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}]}, 0x260}, 0x1, 0x0, 0x0, 0x20000005}, 0x880) mmap(&(0x7f0000724000/0x1000)=nil, 0x1000, 0x0, 0x4000932, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r1, 0xf501, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bind(r1, &(0x7f0000000080)=@ethernet={0x1, @broadcast}, 0x80) (async) bind(r1, &(0x7f0000000080)=@ethernet={0x1, @broadcast}, 0x80) r9 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="953a04"], 0x24}}, 0x0) recvmmsg$unix(r9, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000640)=""/249, 0xf9}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000007c0)=""/97, 0x61}, {&(0x7f00000001c0)=""/104, 0x68}, {&(0x7f0000000300)=""/25, 0x19}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/133, 0x85}], 0x8}}], 0x1, 0x2080, 0x0) (async) recvmmsg$unix(r9, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000640)=""/249, 0xf9}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000007c0)=""/97, 0x61}, {&(0x7f00000001c0)=""/104, 0x68}, {&(0x7f0000000300)=""/25, 0x19}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/133, 0x85}], 0x8}}], 0x1, 0x2080, 0x0) write(r9, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) (async) write(r9, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) setsockopt$TIPC_CONN_TIMEOUT(r3, 0x10f, 0x82, &(0x7f0000000140)=0xffffff51, 0x4) (async) setsockopt$TIPC_CONN_TIMEOUT(r3, 0x10f, 0x82, &(0x7f0000000140)=0xffffff51, 0x4) close(r8) 1.421541513s ago: executing program 4 (id=6158): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000040000000000000000001400711221000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r2 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000013c0)={'erspan0\x00', &(0x7f0000001380)=@ethtool_cmd={0xa, 0x8, 0x57f959ea, 0x8, 0x6, 0x3, 0xc0, 0x4, 0xca, 0x2, 0x0, 0x4, 0x3, 0x3, 0x7, 0x8, [0x8, 0x34]}}) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)={0x2c, r1, 0x1, 0x0, 0x0, {{0x2}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8fe}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0xd}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r3], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x8000) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000000104010100000000e1000000000000070500010001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000040000000000000000001400711221000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async) syz_init_net_socket$llc(0x1a, 0x2, 0x0) (async) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000013c0)={'erspan0\x00', &(0x7f0000001380)=@ethtool_cmd={0xa, 0x8, 0x57f959ea, 0x8, 0x6, 0x3, 0xc0, 0x4, 0xca, 0x2, 0x0, 0x4, 0x3, 0x3, 0x7, 0x8, [0x8, 0x34]}}) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)={0x2c, r1, 0x1, 0x0, 0x0, {{0x2}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8fe}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0xd}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r3], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x8000) (async) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000000104010100000000e1000000000000070500010001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) (async) 1.292920807s ago: executing program 2 (id=6159): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)="b204ee", 0x3}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)='\b', 0x1}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f0000002b40)='-', 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000000200)=[{0x0}, {&(0x7f0000000540)="f2", 0x1}, {&(0x7f0000002e40)="d4", 0x1}, {&(0x7f0000000480)='\a', 0x1}, {&(0x7f00000004c0)='a', 0x1}, {&(0x7f0000000680)="a6", 0x1}, {&(0x7f0000000100)="3cc3", 0x2}], 0x7}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2", 0x1}, {&(0x7f0000001340)="b8", 0x1}], 0x5}}], 0x3, 0x4000000) sendmsg$inet(r0, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000280)="18624cad2c4c063fa461143f48", 0xd}, {&(0x7f00000002c0)}], 0x2, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @multicast1}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2}}}, @ip_retopts={{0x14, 0x0, 0x7, {[@noop]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010100, @rand_addr=0x64010100}}}], 0xa8}, 0x840) 1.241544933s ago: executing program 1 (id=6160): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x0, 0xca, 0x3, 0x0, 0x1}, 0x50) socket$kcm(0x29, 0x2, 0x0) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0x2}, {}, {0x85, 0x0, 0x0, 0x31}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x6c}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1}, 0x94) 1.186374019s ago: executing program 4 (id=6161): listen(0xffffffffffffffff, 0x7) r0 = socket$inet(0xa, 0x801, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) listen(r0, 0x1) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r2, 0x7) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r3, 0x100) r4 = socket$inet(0xa, 0x4, 0x84) listen(r4, 0x8) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000200)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00feff00000000", 0x48}], 0x1) 1.139127488s ago: executing program 1 (id=6162): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) syz_emit_ethernet(0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="ffffff7fffff0180c200000100f725aeb6e0f2e5196fc354ed90460d914ecf693877e450d19f90694f597a45f7aeca169087b522a63934f1d008ecf616c7f040bab38d13577e3dff2c945a949674a583e614a32fc8b832cbcca175679907fb68d923a9a92997c9e08907a76feecbabd236d03be21e614af7546395c31a598b"], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$caif_stream(0x25, 0x1, 0x4) ppoll(&(0x7f0000000740)=[{r1, 0x26}, {r2, 0x8434}], 0x2, 0x0, 0x0, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r4, &(0x7f0000000140), 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000010204700"/20, @ANYRES32=0x0, @ANYBLOB="63a6000000000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB], 0x44}}, 0x20008004) 1.123021157s ago: executing program 0 (id=6163): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060086dd0000100002"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000000)={'gre0\x00', &(0x7f00000000c0)={'gre0\x00', 0x0, 0x700, 0x700, 0x8, 0xffffff89, {{0x8, 0x4, 0x3, 0x18, 0x20, 0x65, 0x0, 0x2, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0xb}, @local, {[@timestamp_prespec={0x44, 0xc, 0xa3, 0x3, 0xd, [{@loopback, 0x100000}]}]}}}}}) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f00000000c0)=@abs={0x1}, 0x6e) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'veth1_to_team\x00'}) r3 = socket$netlink(0x10, 0x3, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a800008100000086dd6076cd8a0018000020010000000000000000000000000000fe8000000000000000000000000000000002000000000000070800000000000000d600010001010075dbf4"], 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01001800000000000000500000005000000002000000090000000000000e03000000010000000a0000000000001203000000000000000500000d0000000006000000010000000000000000000000000000000000000009000000000000000100000003"], 0x0, 0x6a, 0x0, 0x0, 0x7fffffff}, 0x28) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r7, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x8, 0x3, 0x480, 0x0, 0xffffffff, 0xffffffff, 0x3b0, 0xffffffff, 0x3b0, 0xffffffff, 0xffffffff, 0x3b0, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x1a0, 0x1c8, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0xffff0000, 0x24, 0x0, 'syz1\x00'}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1a, 0x1, 0x5}}}, {{@ipv6={@remote, @private2, [0xffffff00, 0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'erspan0\x00', 'bridge_slave_1\x00', {}, {0xff}, 0x2b, 0x2, 0x5, 0x5}, 0x0, 0x1c8, 0x1e8, 0x0, {}, [@common=@ipv6header={{0x28}, {0x2c, 0x10, 0x1}}, @common=@inet=@recent0={{0xf8}, {0x0, 0x6, 0x4, 0x0, 'syz0\x00'}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4e0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0xffff}, {0xffff, 0xffff}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) r11 = socket(0x2d, 0x2, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) 1.094909319s ago: executing program 2 (id=6164): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000340)=@mangle={'mangle\x00', 0x2, 0x6, 0x510, 0x370, 0x0, 0x280, 0xd0, 0xd0, 0x440, 0x440, 0x440, 0x440, 0x440, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0xff, 0xff000000], [0x0, 0xff000000], 'syzkaller0\x00', 'bridge0\x00', {0xff}, {}, 0x0, 0x2}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff}, {0xffffffffffffffff, 0x0, 0x7}, {}, 0x2}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x3ff}}}, {{@ipv6={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xff], [], 'bond_slave_1\x00', 'pim6reg1\x00', {0xff}, {}, 0x0, 0x9}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4, 0x0, 0x2b}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, [0xffffff00, 0xffffffff, 0xff000000], [0xffffffff, 0xffffffff, 0x0, 0xffffffff], 'xfrm0\x00', 'team_slave_1\x00', {0xff}, {}, 0x11, 0x9, 0x1, 0x40}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x3, 0x4}, {0x2, 0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x20}}}}, 0x570) 917.36146ms ago: executing program 1 (id=6165): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x4, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xad}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d4", 0x5) accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000280)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000140)="4dd89749e22ac8725b22ead8a542bca5f08c0b5f01f90bb213176aadc8a4a031d5f463e655849e503e30de2a5dda539311f9608c2994ad9fcda3433369a9c2952b137e71eda3753b7516d49a7fec55501252c47ebd0df19d174d888b1c81ec825804c925e11af39a32b1aacbf292864bbd", 0x71}], 0x1, 0x0, 0x0, 0x40841}], 0x1, 0x40) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1]}}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0x3c, r2, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xfc}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x64}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4044851}, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) 916.691512ms ago: executing program 2 (id=6166): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="020086dd0300000000003000000060ec970012302c00fe8000000000ffffff880000000000aaff0200000000000000000000000000013a"], 0xfdef) 785.135776ms ago: executing program 1 (id=6167): r0 = socket$inet6(0xa, 0x80803, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@private0, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0xa0}, {}, {0x0, 0x0, 0x0, 0x3}, 0x0, 0x1, 0x1}, {{@in=@empty}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x6}}, 0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x6, &(0x7f00000002c0)=ANY=[@ANYBLOB="05000000000000006b113600000000008510000002000000850000000500000095000000000000009500a50500000000719837a62ecba6b4aca926e6c8a1e509afe04e27090b613f59968cc4b88b4ecb8c4f46ebe3d5e393478f148c05cb001274b4a292d599"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) 776.15772ms ago: executing program 0 (id=6168): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), r1) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000ecffffffffff2000000005002000000000000c001f0070687930"], 0x28}}, 0x0) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r2, 0x300, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_LBT_ENABLED={0x5}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0xd}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x7}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x6}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x1}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0xb1}]}, 0xfffffffffffffe29}, 0x1, 0x0, 0x0, 0x80}, 0x4000040) (async) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_int(r3, 0x0, 0x13, &(0x7f0000000140)=0x1, 0x4) sendto$inet(r3, 0x0, 0x0, 0x563de1c6eba3ad61, &(0x7f00000001c0)={0x2, 0x0, @multicast2}, 0x10) 585.537719ms ago: executing program 1 (id=6169): r0 = socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x3e, &(0x7f0000000280)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x88, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x0, 0x5, 0x0, {0x5, 0x4, 0x0, 0x25, 0x9b0d, 0x67, 0x3, 0x80, 0x0, 0x5, @multicast1, @multicast2}}}}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f0000000080)=""/51, &(0x7f0000000140)=0x33) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x30, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000e80)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26765ba5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbdf8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d9447c4df6e21ee0e54f8be072e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7303f01e5cdb5682ddf73d65c3de1d88dd7496d6345d5b9de0223988056a53e19a8b96b9640bc6c09d3c2ff894d626b57c776ed53f94d5e22ff148061b37f72bd92924cb1d0a725e19b264346b7cae0251a850de78316503f3c3d395c7e3f04fc8d52583327cd2341ce4b2d092815376299686f41353b2823814563011a2223b9dd"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0xfeffff, 0xe80, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1, 0x1000000000000}}], 0x48}, 0x0) 584.576403ms ago: executing program 0 (id=6170): r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0x13, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) 506.089688ms ago: executing program 2 (id=6171): r0 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRESDEC], 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) recvmmsg$unix(r0, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000004740)=""/191, 0xbf}, {&(0x7f0000004840)=""/215, 0xd7}, {&(0x7f0000004940)=""/255, 0xff}, {&(0x7f00000008c0)=""/161, 0xa1}, {&(0x7f00000002c0)=""/211, 0xd3}, {&(0x7f0000004c00)=""/4096, 0x1000}, {&(0x7f0000000540)=""/241, 0xf1}, {&(0x7f0000005d00)=""/215, 0xd7}], 0x8}}], 0x1, 0x100, 0x0) recvmmsg$unix(r0, &(0x7f0000002f00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2000, 0x0) write(r0, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000000c0)=@bpf_lsm={0xe, 0x2000000000000028, &(0x7f0000000000)=ANY=[@ANYBLOB="660a00000000000061114c0000000000850000005500000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 398.279723ms ago: executing program 0 (id=6172): sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000100)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000a40)="118db76e8efb27d530b26a8302bad647e35540226c4052b6d573165d39ad8ead67632e8fe108cf55473bc22914286359c3bb3decf99ed04d34d1a73ae48dae0e69ee69fe", 0x44}], 0x4}}], 0x1, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000080), 0x4) r1 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000055002f03000000000000000007000000", @ANYRES16=r2, @ANYBLOB="2002015eeb34c016f61d5f13ea7eb8bc4dfdd2a004ada0f8941a42df16f636c259623431e8093d3be7e742147dba7c83c1c1d973e7fa0d00e020a63c28a5d846a5be0f3b0273baebb780ad2ad740c36943", @ANYBLOB="00000000000000000000000000000000000000000010"], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000000000000079109000000000007b0ae8ff0000000095000000feff0000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3f}, 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001e000100fdffffff00000000020000000100000700000000080006000200000008000100"], 0x2c}, 0x1, 0x0, 0x0, 0x42816}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000000)=0x3dc4, 0x4) sendmmsg$inet(r4, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000200)='GPL\x00', 0xe}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=r5, @ANYRES32=r5, @ANYRES64=r5], 0x20) recvfrom(r4, 0x0, 0x0, 0x2101, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) syz_init_net_socket$ax25(0x3, 0x3, 0xece6a7d857d8d0a7) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r6}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='contention_begin\x00'}, 0x18) r8 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000200af5010000000000"], 0x84}, 0x1, 0x0, 0x0, 0x844}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="5800000055003d09000000f9b718810007000000", @ANYRES32, @ANYBLOB="20000280", @ANYRES32, @ANYBLOB="0000000000000000000000000a000000000000000000001420000100", @ANYRES8], 0x58}, 0x1, 0x0, 0x0, 0x840}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r9, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x14, r10, 0x331, 0x2000, 0x40000000, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[], 0x50}}, 0x0) sendmmsg(r8, &(0x7f0000000000), 0x4000000000001f2, 0x0) setsockopt$ax25_int(r7, 0x101, 0x1, &(0x7f0000000040)=0x4000000, 0x4) sendto$ax25(r1, &(0x7f0000000140)="c03bac82f5e674522edf86f84c44d4c012bee8e1483d21f35aaab87b207c4ce725f158be7cb57562ea9b07714dae1baed620232921fa68e525dfb779d0a4363db664913a38465c7cd539063c3f59fa8d5fccf944bd3bfeb0142e52d02ef75dc509a3604131c44de72d32e16eee1ad2349ebd832f32cf57083c0ec3dacf9a7ea8542f7f529a2bb2c3e45d8f7c38a6c32d022fb2d823791a0f3bbab10071498cab87965dd6c39151fd", 0xa8, 0x4040000, &(0x7f0000000240)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) 182.144303ms ago: executing program 2 (id=6173): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xf, 0xf}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8}]}}]}, 0x3c}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0x2}, {0xffe0, 0xa}}, [@TCA_CHAIN={0x8, 0xb, 0xb463}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200000214000e00052fb96dffff1144ee163cddcb0000fff100"/38, 0x26}, {&(0x7f00000004c0)="f058fe7dad777f8f", 0x300}], 0x2}, 0x5) r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r12 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r13 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r13, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r12, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0xfffd, 'syz0\x00', @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x800, 0x2, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @bcast]}) ioctl$sock_netrom_SIOCADDRT(r12, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x2, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000c80)=ANY=[@ANYBLOB="30060000", @ANYRES16=0x0, @ANYBLOB="00022abd7000fcdbdf00d2b9e435e04d2eceae1efc63a033c101cc92c132", @ANYRES32=0x0, @ANYBLOB="c0005a801c00018005000400020000000500070001000000050004000200000014000080050004000000000005000700000000003400028014000300060004e80900000007000600970007001400050008000900090005000700080002000200050006000000000040000080050006000000000005000400010000001200020034084011471c2756072e0c1a491000001000010048481660120124053002184805000600020000001800028014000300030002000600060040000000e900e7ff44025a80900001801d00020053291b374e5123413b2923293c233c211f371d134b2c38284000000005000600000000001400030002000b000500ff0700100f00730006001400030000000600770e0500ffff06000400001014000500ffff00000010010006008000810008001400030008000200f6ff04000100ff7fff0706001400030000000300dc00bb0001000a000004020018000280140003000600ff00040007000400070006000900200001800500040000000000140003000800a10e05000300f69b0500018003008000028023000200160d0950521bb31408061729270d414d054d4f1c37201a4010194d2a27540100140005000900070080000600020009000e000100050006000100000014000500080065000200810000040500f50003001400050000020600090004000900060002000a00110001000b0400020c1a16306c1230130b0000000c00028005000400020000001800038014000500ffff0900c5e7010043000900050006007800008005000600020000003b00020005215429050e19294c311742081810473108491e48464008182e4618240c093931422f163337032551203a2300490743502147251a4f2b001400030000040300010002000100060003007f0014000500ff01040006000300000002006efd080005000400020000000c0003800500060000000000500002800500070001000000140005009b00020006000600f20108000800050014000500000010000400fdff0300fcffff0308001400050006000900040007000800bf0703000300050006000200000010035a800c00008005000600000000003000038005000600000000000500040000000000050007000200000014000300000802000210ffff08000400070006005c0002801d00010016166c0624240b4800000b0960191b241202012018026c033c000000050007000200000005000400010000001e0001004860120b306036021602050218360c09064809090903060c1616000005000700020000002000018014000500030004007f00100003000b000000090f050004000300000054000180050006000200000005000400000000000500040000000000050006000000000005000700020000002800020026091c2b14532b1e1c1b531933205250321750382f1f3f2346220b404e3a2d01481a3819ac00028005000400000000000500040002000000140003000400ff030400920a030000000900ffff36000200100d21464a5404182c1e1e43280b05443854040a3c272001180f4820241e1d3b4d1c5546442e052836102410000741101f4d00000500070001000000140003007c80001006fc06000400040007000180060002000931000005000700010000001e000100020b06016c24360b16f306066c0002010b06040003046e022436000018000380140005000800ffff0001650009003f0406000100880001803b0002004f0e08133127300756210a3002541054014019502d4c412d413a2425214c16191c33242f1c311f0923483d204e4d224c4b5135273c03560025000200322912171841480f141c3b30003a071405355717161318392f4609370d00180a110000001d0001000b24600b043606020c0b3012480c0202060b361648160112090000009400018014000300000081000f00a40604000800010404001400030006000300630502001e04040001000f0014000300050080000500080005000700400002000500070002000000140005000101b700040000007f0002000c000f0024000100361636606c0b600606011218240c603030601b0b096c0c046c0c180403062400140005001000020009000e00070058000008090020000080140005000100080000105b0606000100010001010500070001000000"], 0x630}, 0x1, 0x0, 0x0, 0x4011}, 0x200040c0) ioctl$sock_netrom_SIOCADDRT(r10, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x10000, 'syz0\x00', @default, 0xfffffdb6, 0x2, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_netrom_SIOCADDRT(r10, 0x890b, &(0x7f0000000000)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x10001, 'syz1\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) 180.826717ms ago: executing program 4 (id=6174): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)="b204ee", 0x3}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)='\b', 0x1}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f0000002b40)='-', 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000001580)}, {&(0x7f0000000540)="f2", 0x1}, {&(0x7f0000002e40)="d4", 0x1}, {&(0x7f0000000480)='\a', 0x1}, {&(0x7f00000004c0)='a', 0x1}, {&(0x7f0000000680)="a6", 0x1}, {&(0x7f0000000100)="3cc3", 0x2}], 0x7}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2", 0x1}, {&(0x7f0000001340)="b8", 0x1}], 0x5}}], 0x3, 0x4000000) sendmsg$inet(r0, &(0x7f0000000780)={&(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000280)="18624cad2c4c063fa461143f48", 0xd}, {&(0x7f00000002c0)}], 0x2, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @multicast1}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2}}}, @ip_retopts={{0x14, 0x0, 0x7, {[@noop]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010100, @rand_addr=0x64010100}}}], 0xa8}, 0x840) 139.330544ms ago: executing program 1 (id=6175): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x1, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000300)={{{@in6=@ipv4={'\x00', '\xff\xff', @multicast1}, @in6=@loopback, 0x4e20, 0x0, 0x4, 0x0, 0x2}, {0xc, 0x7ff, 0x9141, 0x0, 0x6, 0xf42, 0x7}, {0x0, 0x0, 0x0, 0xfffefffffffffffe}, 0x80000000, 0x0, 0x1, 0x0, 0x4, 0x2}, {{@in6=@private2, 0x0, 0x33}, 0x0, @in6=@empty, 0xfffffffd, 0x0, 0x2, 0x4, 0xffffefff, 0x0, 0x1}}, 0xe8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MPATH(0xffffffffffffffff, 0x0, 0x41) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000a40)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002040)={&(0x7f0000001e00)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r4, @ANYBLOB="01002cbd7000fddbdf252100000008000300", @ANYRES32=r5, @ANYBLOB="0a000600080211000000000034002d800a00000001010101010100000a00000001010101010100000a000001010101010100000a0000000202020202020000"], 0xb0}, 0x1, 0x0, 0x0, 0x20008004}, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) ppoll(&(0x7f0000000100)=[{r0, 0x240}, {0xffffffffffffffff, 0x1020}], 0x2, &(0x7f0000000280)={r7, r8+60000000}, &(0x7f00000002c0)={[0xffffffff80000000]}, 0x8) 107.68545ms ago: executing program 0 (id=6176): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x40}}, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0xffffff5d}, 0x1c) listen(r1, 0x50) sendmsg$inet(r1, &(0x7f00000019c0)={&(0x7f0000000340)={0x2, 0x4e20, @local}, 0x10, &(0x7f00000017c0)=[{&(0x7f0000000380)="8cef", 0x2}], 0x1}, 0x4000) (fail_nth: 19) socket$unix(0x1, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 0s ago: executing program 4 (id=6177): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x3, 0xb, 0x6, 0x8}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000300)={r1, 0x4, 0xffff, 0x5, 0x5, 0x10c1, 0x3, 0x4, {r1, @in={{0x2, 0x4e24, @empty}}, 0x9, 0x9, 0x12, 0x7, 0x206}}, &(0x7f00000001c0)=0xb0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r1, @ANYRESDEC=r2, @ANYBLOB="000000001400010000000000000000000000000000800000080002"], 0x38}}, 0x0) kernel console output (not intermixed with test programs): ocess `syz.1.4215'. [ 450.428725][T20765] tipc: Disabling bearer [ 450.492616][T12817] tipc: Node number set to 1135938 [ 450.655981][T20806] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4220'. [ 450.691093][T20807] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4220'. [ 450.945794][T20824] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4225'. [ 450.958904][T20827] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4227'. [ 450.968791][T20824] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4225'. [ 450.985922][T20822] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4224'. [ 451.206119][T20842] sock: sock_set_timeout: `syz.0.4232' (pid 20842) tries to set negative timeout [ 451.242302][T20845] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4233'. [ 451.264483][T20848] veth0: entered promiscuous mode [ 451.271249][T20845] bridge_slave_1: left allmulticast mode [ 451.287169][T20845] bridge_slave_1: left promiscuous mode [ 451.293152][T20845] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.314729][T20845] bridge_slave_0: left allmulticast mode [ 451.325309][T20845] bridge_slave_0: left promiscuous mode [ 451.340290][T20845] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.474547][T20849] veth0: left promiscuous mode [ 452.118298][T20888] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20001 [ 453.220180][T20915] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_hsr, syncid = 0, id = 0 [ 453.340359][T20931] IPv6: NLM_F_CREATE should be specified when creating new route [ 453.388509][T20933] syzkaller1: entered promiscuous mode [ 453.394068][T20933] syzkaller1: entered allmulticast mode [ 453.482919][T20938] __nla_validate_parse: 3 callbacks suppressed [ 453.482938][T20938] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4256'. [ 453.535436][T20939] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4256'. [ 453.743238][T20941] tipc: Enabling of bearer rejected, failed to enable media [ 454.061457][T20964] nbd: socks must be embedded in a SOCK_ITEM attr [ 454.210843][T20968] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4264'. [ 454.321808][T20967] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4263'. [ 454.331445][T20968] gre0: left promiscuous mode [ 454.336310][T20968] gre0: left allmulticast mode [ 454.402158][T20973] bond1: (slave lo): Releasing backup interface [ 454.411037][T20973] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 454.445970][T20973] bridge_slave_0: left allmulticast mode [ 454.453057][T20973] bridge_slave_0: left promiscuous mode [ 454.461076][T20973] bridge0: port 1(bridge_slave_0) entered disabled state [ 454.485396][T20973] bridge_slave_1: left allmulticast mode [ 454.495934][T20973] bridge_slave_1: left promiscuous mode [ 454.505108][T20973] bridge0: port 2(bridge_slave_1) entered disabled state [ 454.516110][T20979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4266'. [ 454.527504][T20979] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4266'. [ 454.539327][T20980] netlink: 'syz.0.4265': attribute type 2 has an invalid length. [ 454.549260][T20980] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4265'. [ 454.560510][T20973] bond0: (slave bond_slave_0): Releasing backup interface [ 454.595492][T20973] bond0: (slave bond_slave_1): Releasing backup interface [ 454.633415][T20973] team0: Port device team_slave_0 removed [ 454.680222][T20973] team0: Port device team_slave_1 removed [ 454.698480][T20973] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 454.719388][T20973] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 454.734197][T20973] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 454.741936][T20973] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 454.775206][T20973] team0: Port device geneve0 removed [ 454.964514][T20999] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4272'. [ 455.051834][T20999] bond2: entered promiscuous mode [ 455.059186][T20999] bond2: entered allmulticast mode [ 455.065041][T20999] 8021q: adding VLAN 0 to HW filter on device bond2 [ 455.082384][T21004] macvlan2: entered promiscuous mode [ 455.088281][T21004] macvlan2: entered allmulticast mode [ 455.096041][T21004] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 455.323741][T21016] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4276'. [ 455.337481][T21015] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4276'. [ 455.412447][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.421583][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.429011][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.449627][T21020] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 455.485064][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.495411][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.504368][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.513813][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.536410][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.545118][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.554079][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.563500][T21020] wlan0 speed is unknown, defaulting to 1000 [ 455.765354][T21033] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 455.867760][T21036] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 455.875094][T21036] IPv6: NLM_F_CREATE should be set when creating new route [ 455.882438][T21036] IPv6: NLM_F_CREATE should be set when creating new route [ 455.889819][T21036] IPv6: NLM_F_CREATE should be set when creating new route [ 455.889990][T21037] tipc: Enabled bearer , priority 0 [ 455.921158][T21037] syzkaller0: entered promiscuous mode [ 455.931889][T21040] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 455.940936][T21037] syzkaller0: entered allmulticast mode [ 456.082158][T21032] tipc: Resetting bearer [ 456.144603][T21032] tipc: Disabling bearer [ 456.534896][T21070] dvmrp6: entered allmulticast mode [ 456.541275][T21068] openvswitch: netlink: Message has 592 unknown bytes. [ 456.567560][T21068] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 456.641416][T21074] bond5: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 456.655249][T21074] bond5 (unregistering): Released all slaves [ 456.921194][T21093] netlink: 'syz.4.4297': attribute type 4 has an invalid length. [ 456.935989][T21092] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 456.970423][T21083] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 457.234725][T21104] netlink: 'syz.2.4300': attribute type 33 has an invalid length. [ 457.249924][T21108] block nbd0: Unsupported socket: should be TCP or UNIX. [ 458.124379][T21158] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 458.694582][T21174] pim6reg: entered allmulticast mode [ 458.711358][T21176] netlink: 'syz.1.4322': attribute type 1 has an invalid length. [ 459.036583][T21198] netlink: 'syz.4.4330': attribute type 1 has an invalid length. [ 459.044731][T21198] __nla_validate_parse: 9 callbacks suppressed [ 459.044750][T21198] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4330'. [ 459.074008][T21198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4330'. [ 459.096867][T21198] netlink: 'syz.4.4330': attribute type 2 has an invalid length. [ 459.124010][T21198] netlink: 'syz.4.4330': attribute type 2 has an invalid length. [ 459.161336][T21198] netlink: 'syz.4.4330': attribute type 2 has an invalid length. [ 459.722725][T21235] syzkaller0: entered promiscuous mode [ 459.728649][T21235] syzkaller0: entered allmulticast mode [ 460.072993][T21254] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4347'. [ 460.106590][T21256] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4347'. [ 460.129956][T21247] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4345'. [ 460.192214][T21260] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4348'. [ 460.317780][T21264] tipc: Enabled bearer , priority 0 [ 460.336700][T21264] syzkaller0: entered promiscuous mode [ 460.342653][T21264] syzkaller0: entered allmulticast mode [ 460.406113][T21264] tipc: Resetting bearer [ 460.493376][T21263] tipc: Resetting bearer [ 460.586271][T21263] tipc: Disabling bearer [ 460.681408][T21286] syzkaller1: entered promiscuous mode [ 460.691141][T21286] syzkaller1: entered allmulticast mode [ 460.712345][T21286] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 460.720817][T21289] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 460.843381][ T3658] veth0_to_bond: left allmulticast mode [ 460.865333][ T3658] veth0_to_bond: left promiscuous mode [ 460.879686][ T3658] bridge8: port 2(veth0_to_bond) entered disabled state [ 460.923784][ T3658] veth3: left allmulticast mode [ 460.934649][ T3658] veth3: left promiscuous mode [ 460.942615][ T3658] bridge8: port 1(veth3) entered disabled state [ 461.189887][ T3658] bond4 (unregistering): (slave ip6gretap1): Releasing active interface [ 461.575825][T21316] xt_hashlimit: invalid rate [ 461.683976][T21323] netlink: 'syz.1.4367': attribute type 16 has an invalid length. [ 461.692455][T21323] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4367'. [ 461.728353][ T3658] team0: Port device bridge0 removed [ 462.226266][ T3658] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 462.252000][ T3658] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 462.267265][ T3658] bond0 (unregistering): Released all slaves [ 462.421890][ T3658] bond1 (unregistering): Released all slaves [ 462.442444][ T3658] bond2 (unregistering): Released all slaves [ 462.457970][ T3658] bond3 (unregistering): Released all slaves [ 462.482836][ T3658] bond4 (unregistering): Released all slaves [ 462.499883][ T3658] bond5 (unregistering): Released all slaves [ 462.612869][ T3658] bond6 (unregistering): Released all slaves [ 462.627965][ T3658] bond7 (unregistering): Released all slaves [ 462.643825][ T3658] bond8 (unregistering): Released all slaves [ 462.862521][ T3658] tipc: Disabling bearer [ 462.914494][ T3658] tipc: Left network mode [ 462.920108][T21361] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4374'. [ 462.932212][T21360] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4375'. [ 462.990923][T21364] bond0: (slave macvlan6): Error -98 calling set_mac_address [ 463.075800][T21360] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4375'. [ 463.228696][T21381] xt_ecn: cannot match TCP bits for non-tcp packets [ 463.516042][T21394] Bluetooth: MGMT ver 1.23 [ 464.299766][T21416] bond3: option lp_interval: invalid value (0) [ 464.306098][T21416] bond3: option lp_interval: allowed values 1 - 2147483647 [ 464.344183][T21416] bond3 (unregistering): Released all slaves [ 464.363330][T21423] netlink: 'syz.4.4393': attribute type 21 has an invalid length. [ 464.372546][T21423] netlink: 'syz.4.4393': attribute type 22 has an invalid length. [ 464.407125][T21423] netlink: 'syz.4.4393': attribute type 23 has an invalid length. [ 464.415116][T21423] netlink: 'syz.4.4393': attribute type 25 has an invalid length. [ 464.434260][T21423] netlink: 'syz.4.4393': attribute type 26 has an invalid length. [ 464.451573][ T3658] hsr_slave_1: left promiscuous mode [ 464.499142][ T3658] team_slave_0: left promiscuous mode [ 464.506198][ T3658] team_slave_1: left promiscuous mode [ 464.519544][ T3658] veth1_macvtap: left promiscuous mode [ 464.525657][T21423] __nla_validate_parse: 2 callbacks suppressed [ 464.534080][ T3658] veth0_macvtap: left promiscuous mode [ 464.544568][T21423] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4393'. [ 464.546437][ T3658] veth1_vlan: left promiscuous mode [ 464.563227][ T3658] veth0_vlan: left promiscuous mode [ 464.626174][T21434] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4395'. [ 464.636193][T21434] openvswitch: netlink: Flow key attr not present in new flow. [ 464.742255][ T3658] pimreg (unregistering): left allmulticast mode [ 464.774715][ T3658] pimreg3 (unregistering): left allmulticast mode [ 465.043319][ T3658] team0 (unregistering): Port device team_slave_1 removed [ 465.085994][ T3658] team0 (unregistering): Port device team_slave_0 removed [ 465.094824][ T1138] smc: removing ib device syz2 [ 465.244008][T21439] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 465.250853][T21439] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 465.699960][T21455] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4401'. [ 465.721089][T21455] netlink: 'syz.1.4401': attribute type 9 has an invalid length. [ 466.253012][T21468] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4407'. [ 466.331945][T21474] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 466.492563][T21481] netlink: 'syz.0.4414': attribute type 7 has an invalid length. [ 466.606941][T21481] netlink: 'syz.0.4414': attribute type 8 has an invalid length. [ 467.282219][T21528] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4423'. [ 467.427094][T21524] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4421'. [ 468.045044][T21551] sctp: [Deprecated]: syz.2.4428 (pid 21551) Use of int in max_burst socket option deprecated. [ 468.045044][T21551] Use struct sctp_assoc_value instead [ 468.123280][T21552] IPVS: set_ctl: invalid protocol: 135 224.0.0.2:20004 [ 468.394089][T21564] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4434'. [ 468.431969][T21568] netlink: 'syz.1.4435': attribute type 30 has an invalid length. [ 468.517415][T21573] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.4437'. [ 468.664973][T21577] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.4436'. [ 468.749592][T21580] tipc: Enabled bearer , priority 0 [ 468.979948][T21583] syzkaller0: entered promiscuous mode [ 469.004857][T21583] syzkaller0: entered allmulticast mode [ 469.156257][T21563] tipc: Resetting bearer [ 469.319054][T21563] tipc: Disabling bearer [ 469.486137][T21595] netlink: 'syz.1.4442': attribute type 1 has an invalid length. [ 469.511593][ T3658] IPVS: stop unused estimator thread 0... [ 469.540579][T21595] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 469.590295][T21600] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4443'. [ 469.648105][T21600] openvswitch: netlink: nsh attr 12336 is out of range max 3 [ 469.661818][T21605] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 469.884878][T21621] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4449'. [ 469.895630][T21617] netlink: 'syz.2.4448': attribute type 1 has an invalid length. [ 469.916411][T21617] netlink: 136 bytes leftover after parsing attributes in process `syz.2.4448'. [ 469.945756][T21617] netlink: 'syz.2.4448': attribute type 1 has an invalid length. [ 470.360808][T21645] tipc: Enabled bearer , priority 0 [ 470.368660][T21645] syzkaller0: entered promiscuous mode [ 470.374271][T21645] syzkaller0: entered allmulticast mode [ 470.381376][T21647] xt_l2tp: v2 doesn't support IP mode [ 470.441524][T21649] bond5: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 470.491284][T21649] bond5 (unregistering): Released all slaves [ 470.555897][T21663] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.4464'. [ 470.603326][T21658] delete_channel: no stack [ 470.687154][T21644] tipc: Resetting bearer [ 470.765566][T21644] tipc: Disabling bearer [ 470.786528][T21670] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 470.795012][T21670] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 470.814590][T21670] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 470.843950][T21670] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 470.928565][T21683] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4469'. [ 471.170541][T21696] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4473'. [ 471.267315][T21698] netlink: 96 bytes leftover after parsing attributes in process `syz.0.4474'. [ 471.363022][T21706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4477'. [ 471.370089][T21702] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 471.374129][T21706] netlink: 'syz.2.4477': attribute type 5 has an invalid length. [ 471.388689][T21706] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4477'. [ 471.414872][T21706] geneve3: entered promiscuous mode [ 471.420858][T21706] geneve3: entered allmulticast mode [ 471.512119][T21709] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4478'. [ 471.523649][T21709] ip6t_rpfilter: unknown options [ 471.554198][T12880] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 471.585195][T12880] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 471.603453][T12880] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 471.614201][T12880] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 472.007951][T21739] netlink: 'syz.2.4487': attribute type 11 has an invalid length. [ 472.218151][T21758] netlink: 'syz.0.4492': attribute type 1 has an invalid length. [ 472.476197][T21772] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 472.825112][T21794] xt_CT: You must specify a L4 protocol and not use inversions on it [ 472.879672][T21794] netlink: 'syz.1.4501': attribute type 2 has an invalid length. [ 473.039459][T21816] netlink: 'syz.1.4506': attribute type 29 has an invalid length. [ 473.059639][T21816] netlink: 'syz.1.4506': attribute type 1 has an invalid length. [ 473.104134][T21816] netlink: 'syz.1.4506': attribute type 29 has an invalid length. [ 473.316630][T21831] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 473.862196][T21862] netlink: Conntrack attr has 3 unknown bytes [ 473.937133][T21864] openvswitch: netlink: IP tunnel dst address not specified [ 474.135152][T21875] SET target dimension over the limit! [ 474.327450][T21881] syzkaller0: entered allmulticast mode [ 474.338458][T21882] C: renamed from lo [ 474.351826][T21882] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 474.795797][T21907] netlink: 'syz.0.4535': attribute type 11 has an invalid length. [ 474.805829][T21907] __nla_validate_parse: 44 callbacks suppressed [ 474.805850][T21907] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4535'. [ 474.822913][T21913] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4536'. [ 474.836320][T21908] validate_nla: 33 callbacks suppressed [ 474.836340][T21908] netlink: 'syz.1.4534': attribute type 2 has an invalid length. [ 474.868365][T21908] 9: entered promiscuous mode [ 475.025783][T21924] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4539'. [ 475.052376][T21925] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4539'. [ 475.097390][T21924] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 475.137119][T21924] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 475.272856][T21933] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4543'. [ 475.314695][T21941] netlink: 388 bytes leftover after parsing attributes in process `syz.4.4545'. [ 475.350853][T21944] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4544'. [ 475.500819][T21950] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4548'. [ 475.798635][T21959] block nbd2: NBD_DISCONNECT [ 475.866232][T21968] netlink: 480 bytes leftover after parsing attributes in process `syz.2.4548'. [ 475.903393][T21968] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.4548'. [ 475.947966][T21977] netlink: 'syz.4.4556': attribute type 10 has an invalid length. [ 475.959523][T21971] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 476.058193][T21981] openvswitch: netlink: IPv4 tunnel dst address is zero [ 476.140291][T21985] tipc: Enabled bearer , priority 0 [ 476.228842][T21985] syzkaller0: entered promiscuous mode [ 476.234701][T21985] syzkaller0: entered allmulticast mode [ 476.242794][T21985] tipc: Resetting bearer [ 476.261129][T21984] tipc: Resetting bearer [ 476.408247][T21999] netlink: 'syz.2.4564': attribute type 6 has an invalid length. [ 476.610026][T22002] netlink: 'syz.1.4565': attribute type 4 has an invalid length. [ 477.944686][T21984] tipc: Disabling bearer [ 500.745616][T22015] __nla_validate_parse: 3 callbacks suppressed [ 500.745637][T22015] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4569'. [ 500.786599][T22015] x_tables: duplicate underflow at hook 1 [ 501.199975][T22047] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4575'. [ 501.448095][T22054] tipc: Enabled bearer , priority 0 [ 501.549025][T22054] syzkaller0: entered promiscuous mode [ 501.557148][T22054] syzkaller0: entered allmulticast mode [ 501.581500][T22054] tipc: Resetting bearer [ 501.608629][T22052] tipc: Resetting bearer [ 502.204016][T22086] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4586'. [ 503.519884][T22052] tipc: Disabling bearer [ 503.736973][T22094] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4589'. [ 503.775962][T22098] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4590'. [ 503.930195][T22111] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4590'. [ 504.175576][T22123] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 504.546257][T22151] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4601'. [ 504.565462][T22152] macvlan0: entered promiscuous mode [ 504.574760][T22152] SET target dimension over the limit! [ 504.638687][T22157] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4603'. [ 504.648112][T22157] openvswitch: netlink: Flow key attr not present in new flow. [ 504.684760][T22157] bond5: entered allmulticast mode [ 504.690999][T22157] 8021q: adding VLAN 0 to HW filter on device bond5 [ 504.732297][T22160] netlink: 'syz.0.4605': attribute type 39 has an invalid length. [ 505.168953][T22184] tipc: Enabled bearer , priority 10 [ 505.437011][T22203] bridge_slave_0: left allmulticast mode [ 505.454089][T22203] bridge_slave_0: left promiscuous mode [ 505.478772][T22203] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.518609][T22203] bridge_slave_1: left allmulticast mode [ 505.542738][T22203] bridge_slave_1: left promiscuous mode [ 505.552736][T22203] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.566503][T22203] `: (slave bond_slave_0): Releasing backup interface [ 505.586285][T22203] `: (slave bond_slave_1): Releasing backup interface [ 505.615970][T22203] team0: Port device team_slave_0 removed [ 505.643726][T22203] team0: Port device team_slave_1 removed [ 505.658564][T22203] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 505.852046][T22227] xt_CT: You must specify a L4 protocol and not use inversions on it [ 505.968378][T22230] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4622'. [ 505.973650][T22233] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4627'. [ 506.007134][T22233] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4627'. [ 506.047512][ T3658] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.090174][ T3658] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.114031][ T3658] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.126022][ T3658] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 506.171929][T22235] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4626'. [ 506.425193][T22256] netlink: 'syz.2.4632': attribute type 1 has an invalid length. [ 506.464656][T22258] veth0_to_bridge: entered promiscuous mode [ 506.495657][T22257] veth0_to_bridge: left promiscuous mode [ 506.690184][T22263] tipc: Enabled bearer , priority 0 [ 506.715371][T22263] syzkaller0: entered promiscuous mode [ 506.722700][T22263] syzkaller0: entered allmulticast mode [ 506.740218][T22263] netlink: 184 bytes leftover after parsing attributes in process `syz.1.4634'. [ 506.923871][T22274] batadv1: entered allmulticast mode [ 506.989981][T22277] tipc: Resetting bearer [ 507.031392][T22262] tipc: Resetting bearer [ 507.080528][T22262] tipc: Disabling bearer [ 507.094751][T22275] syzkaller1: entered promiscuous mode [ 507.101240][T22275] syzkaller1: entered allmulticast mode [ 507.113303][T22284] 8021q: VLANs not supported on gre0 [ 507.320017][T22294] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4641'. [ 507.352739][T22294] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4641'. [ 507.380001][T22294] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4641'. [ 507.416500][T22301] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4643'. [ 507.453176][T22301] lo speed is unknown, defaulting to 1000 [ 507.488480][T22301] lo speed is unknown, defaulting to 1000 [ 507.495439][T22301] lo speed is unknown, defaulting to 1000 [ 507.654783][T22308] netlink: 'syz.1.4645': attribute type 1 has an invalid length. [ 507.668449][T22308] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4645'. [ 508.109098][T22301] infiniband syz2: set down [ 508.113784][T22301] infiniband syz2: added lo [ 508.118575][ T5904] lo speed is unknown, defaulting to 1000 [ 508.186704][T22301] RDS/IB: syz2: added [ 508.233951][T22332] netlink: 'syz.1.4650': attribute type 5 has an invalid length. [ 508.253646][T22301] smc: adding ib device syz2 with port count 1 [ 508.262773][T22301] smc: ib device syz2 port 1 has no pnetid [ 508.274004][ T5904] lo speed is unknown, defaulting to 1000 [ 508.312492][T22301] lo speed is unknown, defaulting to 1000 [ 508.373603][T22339] syzkaller0: entered promiscuous mode [ 508.389094][T22339] syzkaller0: entered allmulticast mode [ 508.681193][T22353] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 508.686658][T22356] syzkaller0: entered promiscuous mode [ 508.702229][T22356] syzkaller0: entered allmulticast mode [ 508.829415][T22301] lo speed is unknown, defaulting to 1000 [ 509.241918][T22378] xt_TCPMSS: Only works on TCP SYN packets [ 509.520018][T22301] lo speed is unknown, defaulting to 1000 [ 510.124275][T22301] lo speed is unknown, defaulting to 1000 [ 510.684845][T22301] lo speed is unknown, defaulting to 1000 [ 510.999147][T22468] netlink: 'syz.4.4682': attribute type 1 has an invalid length. [ 511.013535][T22468] netlink: 'syz.4.4682': attribute type 1 has an invalid length. [ 511.021479][T22468] __nla_validate_parse: 6 callbacks suppressed [ 511.021497][T22468] netlink: 9172 bytes leftover after parsing attributes in process `syz.4.4682'. [ 511.263656][T22301] lo speed is unknown, defaulting to 1000 [ 511.392281][T22487] netlink: 596 bytes leftover after parsing attributes in process `syz.4.4687'. [ 511.623554][T22488] netlink: 'syz.4.4687': attribute type 1 has an invalid length. [ 511.705600][T22488] 8021q: adding VLAN 0 to HW filter on device bond6 [ 512.540454][T22519] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4693'. [ 513.680404][T22301] lo speed is unknown, defaulting to 1000 [ 514.103814][T22540] netlink: 'syz.0.4701': attribute type 16 has an invalid length. [ 514.126781][T22540] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4701'. [ 514.141737][T22544] netlink: 'syz.0.4701': attribute type 16 has an invalid length. [ 514.153544][T22544] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4701'. [ 514.376661][T22558] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4706'. [ 514.434087][T22558] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 514.800946][T22578] sctp: [Deprecated]: syz.2.4711 (pid 22578) Use of int in maxseg socket option. [ 514.800946][T22578] Use struct sctp_assoc_value instead [ 514.823128][T22581] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4714'. [ 514.848214][T22583] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4714'. [ 514.889917][T22587] netlink: 27 bytes leftover after parsing attributes in process `syz.0.4713'. [ 515.450507][T22621] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4724'. [ 515.530307][T22636] Bluetooth: MGMT ver 1.23 [ 515.738628][T22650] netlink: 'syz.4.4731': attribute type 20 has an invalid length. [ 515.795450][T17492] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.816447][T17492] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.836068][T17492] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.869606][T17492] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 517.040369][T22729] pim6reg1: entered promiscuous mode [ 517.069256][T22729] pim6reg1: entered allmulticast mode [ 517.192572][T22734] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 517.204033][T22738] netlink: 'syz.1.4759': attribute type 9 has an invalid length. [ 517.369833][T22734] !: renamed from dummy0 (while UP) [ 517.609771][T22749] __nla_validate_parse: 5 callbacks suppressed [ 517.609794][T22749] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4763'. [ 517.655569][T22747] netlink: 480 bytes leftover after parsing attributes in process `syz.1.4762'. [ 517.684407][T22747] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.4762'. [ 517.834394][T22756] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 517.869781][T22757] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.093190][T22772] wireguard1: entered promiscuous mode [ 518.113595][T22772] wireguard1: entered allmulticast mode [ 518.133266][T22772] team0: Device wireguard1 is of different type [ 518.241799][T22785] veth1_macvtap: left promiscuous mode [ 518.271822][T22786] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4772'. [ 518.315953][T22788] FAULT_INJECTION: forcing a failure. [ 518.315953][T22788] name failslab, interval 1, probability 0, space 0, times 0 [ 518.329714][T22788] CPU: 0 UID: 0 PID: 22788 Comm: syz.3.4774 Not tainted syzkaller #0 PREEMPT(full) [ 518.329745][T22788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 518.329760][T22788] Call Trace: [ 518.329768][T22788] [ 518.329778][T22788] dump_stack_lvl+0xe8/0x150 [ 518.329809][T22788] should_fail_ex+0x414/0x560 [ 518.329849][T22788] should_failslab+0xa8/0x100 [ 518.329877][T22788] __kmalloc_noprof+0xdf/0x800 [ 518.329898][T22788] ? sock_kmalloc+0xd6/0x160 [ 518.329929][T22788] sock_kmalloc+0xd6/0x160 [ 518.329957][T22788] ____sys_sendmsg+0x1b5/0x820 [ 518.329988][T22788] ? __pfx_____sys_sendmsg+0x10/0x10 [ 518.330024][T22788] ? import_iovec+0x74/0xa0 [ 518.330047][T22788] ___sys_sendmsg+0x21f/0x2a0 [ 518.330066][T22788] ? __pfx____sys_sendmsg+0x10/0x10 [ 518.330111][T22788] ? __fget_files+0x2a/0x420 [ 518.330130][T22788] ? __fget_files+0x3a0/0x420 [ 518.330156][T22788] __x64_sys_sendmsg+0x19b/0x260 [ 518.330177][T22788] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 518.330203][T22788] ? __pfx_ksys_write+0x10/0x10 [ 518.330226][T22788] do_syscall_64+0xec/0xf80 [ 518.330242][T22788] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.330258][T22788] ? clear_bhb_loop+0x60/0xb0 [ 518.330276][T22788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.330291][T22788] RIP: 0033:0x7f54b718f749 [ 518.330305][T22788] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 518.330319][T22788] RSP: 002b:00007f54b80e7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 518.330336][T22788] RAX: ffffffffffffffda RBX: 00007f54b73e5fa0 RCX: 00007f54b718f749 [ 518.330348][T22788] RDX: 0000000000000840 RSI: 0000200000000780 RDI: 0000000000000003 [ 518.330358][T22788] RBP: 00007f54b80e7090 R08: 0000000000000000 R09: 0000000000000000 [ 518.330367][T22788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 518.330376][T22788] R13: 00007f54b73e6038 R14: 00007f54b73e5fa0 R15: 00007ffeb11b3ee8 [ 518.330401][T22788] [ 518.547274][T22790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4772'. [ 518.556421][T22785] veth0_virt_wifi: renamed from macsec0 [ 518.733342][T22800] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4777'. [ 518.885091][T22810] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4779'. [ 518.964810][T22818] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4782'. [ 519.022062][T22818] bridge3: entered promiscuous mode [ 519.041646][T22818] bridge3: entered allmulticast mode [ 519.164365][T22830] ip6t_srh: unknown srh match flags 5F28 [ 519.170585][T22831] ip6t_srh: unknown srh match flags 5F28 [ 519.258916][T22836] veth0: entered promiscuous mode [ 519.265254][T22836] veth0: left promiscuous mode [ 519.404422][T22842] xt_CT: You must specify a L4 protocol and not use inversions on it [ 519.442196][T22842] netlink: 'syz.2.4789': attribute type 2 has an invalid length. [ 519.837485][T22873] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4800'. [ 519.864420][T22873] netlink: 'syz.1.4800': attribute type 10 has an invalid length. [ 519.956248][T22876] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4801'. [ 520.050646][T22878] bond7 (unregistering): Released all slaves [ 520.465598][T22903] bond0: (slave bond_slave_0): Releasing backup interface [ 520.484874][T22903] bond0: (slave bond_slave_1): Releasing backup interface [ 520.535850][T22903] team0: Port device team_slave_0 removed [ 520.562733][T22903] team0: Port device team_slave_1 removed [ 520.573487][T22903] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 520.589414][T22903] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 520.599309][T22909] netlink: 'syz.4.4811': attribute type 6 has an invalid length. [ 520.601781][T22903] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 520.616146][T22903] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 520.638374][T22903] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 522.019449][T22979] tipc: Enabled bearer , priority 0 [ 522.038871][T22987] syzkaller0: entered promiscuous mode [ 522.044515][T22987] syzkaller0: entered allmulticast mode [ 522.102450][T22979] tipc: Resetting bearer [ 522.134442][T22978] tipc: Resetting bearer [ 522.217833][T22978] tipc: Disabling bearer [ 522.984033][T23042] __nla_validate_parse: 18 callbacks suppressed [ 522.984057][T23042] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4852'. [ 523.334278][T23061] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4858'. [ 523.460733][T23068] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4859'. [ 523.471414][T23069] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4861'. [ 523.481199][T23069] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4861'. [ 523.491076][T23069] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4861'. [ 523.500555][T23068] netlink: 'syz.1.4859': attribute type 5 has an invalid length. [ 523.509035][T23068] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4859'. [ 523.668514][T23076] netlink: 'syz.0.4863': attribute type 17 has an invalid length. [ 523.676549][T23076] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4863'. [ 523.689118][T23076] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4863'. [ 523.705739][T23076] erspan0: entered promiscuous mode [ 523.712461][T23076] gretap0: entered promiscuous mode [ 523.866645][T23085] nbd: couldn't find device at index 0 [ 523.984812][T23091] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4865'. [ 524.012324][T23091] bridge0: port 1(ipvlan2) entered blocking state [ 524.023368][T23091] bridge0: port 1(ipvlan2) entered disabled state [ 524.046223][T23091] ipvlan2: entered allmulticast mode [ 524.062281][T23091] bridge0: entered allmulticast mode [ 524.072348][T23091] ipvlan2: left allmulticast mode [ 524.077832][T23091] bridge0: left allmulticast mode [ 524.479554][T23113] syzkaller1: entered promiscuous mode [ 524.485522][T23116] netlink: 'syz.4.4873': attribute type 28 has an invalid length. [ 524.495894][T23113] syzkaller1: entered allmulticast mode [ 524.501838][T23116] netlink: 'syz.4.4873': attribute type 3 has an invalid length. [ 528.230976][T23113] Set syz1 is full, maxelem 65536 reached [ 528.508795][T23284] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 528.666899][T23289] __nla_validate_parse: 9 callbacks suppressed [ 528.666915][T23289] netlink: 401 bytes leftover after parsing attributes in process `syz.1.4929'. [ 529.015395][T23311] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4934'. [ 529.497214][T23336] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4942'. [ 529.529876][T23338] netlink: 'syz.2.4943': attribute type 1 has an invalid length. [ 529.555783][T23340] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4944'. [ 529.640727][T23338] 8021q: adding VLAN 0 to HW filter on device bond3 [ 529.699516][T23340] bond7: option xmit_hash_policy: invalid value (64) [ 529.714665][T23340] bond7 (unregistering): Released all slaves [ 529.741652][T23355] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4943'. [ 529.761972][T23348] 8021q: adding VLAN 0 to HW filter on device bond3 [ 529.774284][T23348] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 529.785932][T23348] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 529.830107][T23338] veth3: entered promiscuous mode [ 529.838619][T23338] bond3: (slave veth3): Enslaving as an active interface with a down link [ 529.851995][T23355] 8021q: adding VLAN 0 to HW filter on device bond3 [ 529.988206][T23362] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4950'. [ 530.463996][T23381] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4955'. [ 530.484629][T23380] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 530.500118][T23380] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 530.633880][T23387] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4958'. [ 530.649167][T23384] tipc: Enabled bearer , priority 0 [ 530.802300][T23384] syzkaller0: entered promiscuous mode [ 530.815153][T23384] syzkaller0: entered allmulticast mode [ 530.837390][T23384] tipc: Resetting bearer [ 530.923899][T23383] tipc: Resetting bearer [ 531.049648][T23412] netlink: 'syz.4.4965': attribute type 9 has an invalid length. [ 532.624570][T23383] tipc: Disabling bearer [ 532.635148][T23405] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4963'. [ 532.749373][T23432] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4969'. [ 533.081893][T23457] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 533.213250][T23464] netlink: 'syz.0.4979': attribute type 83 has an invalid length. [ 533.354794][T23463] bond7: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 533.395489][T23463] bond7 (unregistering): Released all slaves [ 533.442729][T23475] netlink: 'syz.4.4984': attribute type 1 has an invalid length. [ 533.728983][T23475] bond7: entered promiscuous mode [ 533.734843][T23475] 8021q: adding VLAN 0 to HW filter on device bond7 [ 533.772405][T23502] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4987'. [ 534.637625][T23538] syzkaller1: entered promiscuous mode [ 534.648876][T23538] syzkaller1: entered allmulticast mode [ 534.892935][T23551] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 534.936513][T23555] netlink: 144 bytes leftover after parsing attributes in process `syz.0.4999'. [ 535.023243][T23557] bond2 (unregistering): Released all slaves [ 535.174596][T23568] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5005'. [ 535.205617][T23568] nbd: couldn't find a device at index 0 [ 535.410254][T23580] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5007'. [ 535.434052][T23583] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5008'. [ 535.448263][T23569] 8021q: adding VLAN 0 to HW filter on device ` [ 535.532931][T23569] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 535.573917][T23587] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5009'. [ 535.633628][T23587] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 535.642342][T23587] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 535.662502][T23587] team0: Failed to send options change via netlink (err -105) [ 535.703651][T23587] team0: Port device batadv1 added [ 535.753592][T23592] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5011'. [ 535.837936][T23595] bond4: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 535.866216][T23595] bond4 (unregistering): Released all slaves [ 536.104631][T23611] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5017'. [ 536.209502][T23617] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5019'. [ 536.232705][T23619] netlink: 165 bytes leftover after parsing attributes in process `syz.0.5021'. [ 536.428435][T23627] netlink: 'syz.1.5023': attribute type 1 has an invalid length. [ 536.541030][T23635] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 536.553881][T19839] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 536.572608][T19839] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 536.610048][T19839] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 536.650534][T19839] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 536.733925][T23644] syzkaller0: entered promiscuous mode [ 536.745404][T23644] syzkaller0: entered allmulticast mode [ 536.768105][T23644] 0: reclassify loop, rule prio 0, protocol 800 [ 536.916029][T23657] chnl_net:caif_netlink_parms(): no params data found [ 537.294624][T23685] netlink: 'syz.0.5042': attribute type 1 has an invalid length. [ 537.307809][T23685] netlink: 'syz.0.5042': attribute type 1 has an invalid length. [ 537.315865][T23685] netlink: 'syz.0.5042': attribute type 1 has an invalid length. [ 537.326424][T23685] netlink: 'syz.0.5042': attribute type 2 has an invalid length. [ 537.644553][T23705] SET target dimension over the limit! [ 537.952807][T23729] netlink: 'syz.3.5055': attribute type 11 has an invalid length. [ 537.981888][T23724] bond8: entered promiscuous mode [ 538.007813][T23724] bond8: entered allmulticast mode [ 538.018275][T23724] 8021q: adding VLAN 0 to HW filter on device bond8 [ 538.081590][T23723] bond9: entered promiscuous mode [ 538.086921][T23723] bond9: entered allmulticast mode [ 538.092444][T23723] 8021q: adding VLAN 0 to HW filter on device bond9 [ 538.126146][T23729] geneve3: entered promiscuous mode [ 538.225350][T23723] bond10: entered promiscuous mode [ 538.234865][T23723] bond10: entered allmulticast mode [ 538.240723][T23723] 8021q: adding VLAN 0 to HW filter on device bond10 [ 538.291361][T23723] bond11: entered promiscuous mode [ 538.296670][T23723] bond11: entered allmulticast mode [ 538.302665][T23723] 8021q: adding VLAN 0 to HW filter on device bond11 [ 538.347516][T23723] bond12: entered promiscuous mode [ 538.354680][T23723] bond12: entered allmulticast mode [ 538.360673][T23723] 8021q: adding VLAN 0 to HW filter on device bond12 [ 538.416407][T23723] bond13: entered promiscuous mode [ 538.442588][T23723] bond13: entered allmulticast mode [ 538.460570][T23723] 8021q: adding VLAN 0 to HW filter on device bond13 [ 538.550092][T23723] bond14: entered promiscuous mode [ 538.577756][T23723] bond14: entered allmulticast mode [ 538.584392][T23723] 8021q: adding VLAN 0 to HW filter on device bond14 [ 538.639242][T23723] bond15: entered promiscuous mode [ 538.644589][T23723] bond15: entered allmulticast mode [ 538.650756][T23723] 8021q: adding VLAN 0 to HW filter on device bond15 [ 538.659695][T23749] pim6reg1: entered promiscuous mode [ 538.665134][T23749] pim6reg1: entered allmulticast mode [ 538.685472][T23768] vcan1: entered promiscuous mode [ 538.690857][T23768] vcan1: entered allmulticast mode [ 538.755774][T23723] bond16: entered promiscuous mode [ 538.768818][T23723] bond16: entered allmulticast mode [ 538.775096][T23723] 8021q: adding VLAN 0 to HW filter on device bond16 [ 538.814602][T23773] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 538.884872][T23777] __nla_validate_parse: 15 callbacks suppressed [ 538.884892][T23777] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5068'. [ 538.946046][T23779] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5069'. [ 539.477254][T23809] netlink: 'syz.4.5078': attribute type 2 has an invalid length. [ 539.489881][T23809] syzkaller0: entered promiscuous mode [ 539.498005][T23809] syzkaller0: entered allmulticast mode [ 539.510426][T23812] syzkaller0: entered promiscuous mode [ 539.515971][T23812] syzkaller0: entered allmulticast mode [ 539.531300][T23809] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5078'. [ 539.638321][T23821] netlink: 'syz.3.5081': attribute type 11 has an invalid length. [ 539.656153][T23821] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5081'. [ 539.833920][T23823] syzkaller0: entered promiscuous mode [ 539.842221][T23827] netlink: 'syz.3.5084': attribute type 8 has an invalid length. [ 539.856957][T23823] syzkaller0: entered allmulticast mode [ 539.859286][T23837] netlink: 'syz.3.5084': attribute type 8 has an invalid length. [ 539.892664][T23827] netlink: 'syz.3.5084': attribute type 4 has an invalid length. [ 539.901302][T23827] netlink: 17 bytes leftover after parsing attributes in process `syz.3.5084'. [ 539.947384][T23837] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5084'. [ 539.974518][T23842] netlink: 'syz.4.5086': attribute type 10 has an invalid length. [ 540.062718][T23850] xt_connbytes: Forcing CT accounting to be enabled [ 540.287031][T23826] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5084'. [ 540.466469][T23866] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5093'. [ 540.580931][T23870] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5095'. [ 542.100432][T23884] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5097'. [ 542.130093][T23888] xt_CT: You must specify a L4 protocol and not use inversions on it [ 542.368353][T23903] netlink: 'syz.0.5104': attribute type 2 has an invalid length. [ 543.150751][T23945] netlink: 'syz.0.5115': attribute type 1 has an invalid length. [ 543.225715][T23953] syzkaller0: entered promiscuous mode [ 543.291148][T23953] syzkaller0: entered allmulticast mode [ 543.744445][T23991] netlink: 'syz.2.5130': attribute type 1 has an invalid length. [ 543.797917][T23991] bond4: (slave gretap1): making interface the new active one [ 543.808267][T23991] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 543.903722][T23996] __nla_validate_parse: 4 callbacks suppressed [ 543.903744][T23996] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5132'. [ 543.921394][T23996] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 544.208973][T24019] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5138'. [ 544.327373][T24019] bond4: entered promiscuous mode [ 544.332640][T24019] bond4: entered allmulticast mode [ 544.341749][T24019] 8021q: adding VLAN 0 to HW filter on device bond4 [ 544.380892][T24023] macvlan2: entered promiscuous mode [ 544.390757][T24023] macvlan2: entered allmulticast mode [ 544.404262][T24023] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 544.492716][T24029] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5140'. [ 544.665557][T24037] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5143'. [ 544.728520][T24041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5145'. [ 544.749914][T24044] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5142'. [ 544.937975][T24036] netlink: 'syz.4.5140': attribute type 7 has an invalid length. [ 544.999180][T24056] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 545.516194][T24086] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5157'. [ 545.577397][T24090] Cannot find add_set index 0 as target [ 545.600825][T24089] tipc: Enabled bearer , priority 0 [ 545.634529][T24089] syzkaller0: entered promiscuous mode [ 545.643811][T24089] syzkaller0: entered allmulticast mode [ 545.659580][T24097] syzkaller1: entered promiscuous mode [ 545.697428][T24097] syzkaller1: entered allmulticast mode [ 545.713913][T24089] tipc: Resetting bearer [ 545.772714][T24087] tipc: Resetting bearer [ 545.818741][T24087] tipc: Disabling bearer [ 546.031863][T12880] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.041302][T12880] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.250653][ T5904] IPVS: starting estimator thread 0... [ 546.276528][T24129] netlink: 'syz.4.5172': attribute type 2 has an invalid length. [ 546.316235][T24132] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5173'. [ 546.348917][T24128] IPVS: using max 27 ests per chain, 64800 per kthread [ 546.358506][T24132] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5173'. [ 546.610188][ T5904] IPVS: starting estimator thread 0... [ 546.698697][T24161] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5181'. [ 546.716884][T24154] IPVS: using max 29 ests per chain, 69600 per kthread [ 546.773135][T24161] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 547.297217][T24190] netlink: 'syz.2.5188': attribute type 1 has an invalid length. [ 547.785392][T24232] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 547.941850][T24241] openvswitch: netlink: Message has 1 unknown bytes. [ 547.979676][T24241] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 548.838596][T24259] dvmrp0: entered allmulticast mode [ 548.994803][T24287] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 549.163152][T24294] __nla_validate_parse: 12 callbacks suppressed [ 549.163173][T24294] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5217'. [ 549.290490][T24304] bond0: Error: Cannot enslave bond to itself. [ 549.299944][T24306] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5220'. [ 549.345360][T24306] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5220'. [ 549.350963][T24309] vcan0: entered promiscuous mode [ 549.360016][T24309] vcan0: entered allmulticast mode [ 550.068348][T24351] netlink: 'syz.4.5235': attribute type 2 has an invalid length. [ 550.118455][T24354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5236'. [ 550.128979][T24353] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5236'. [ 550.299652][T24365] gtp0: entered promiscuous mode [ 550.304694][T24365] gtp0: entered allmulticast mode [ 550.324978][T24357] IPVS: persistence engine module ip_vs_pe_ not found [ 550.446368][T24373] netlink: 'syz.4.5243': attribute type 11 has an invalid length. [ 550.457304][T24373] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5243'. [ 550.488395][T24375] syzkaller0: entered promiscuous mode [ 550.493941][T24375] syzkaller0: entered allmulticast mode [ 550.534112][T24380] xt_ipcomp: unknown flags 1D [ 550.730765][T24381] syzkaller0: entered promiscuous mode [ 550.736366][T24381] syzkaller0: entered allmulticast mode [ 550.747548][T24393] Unknown options in mask b7f2 [ 550.846096][T24396] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5250'. [ 550.986621][T24408] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5253'. [ 550.991100][T24406] nbd: must specify an index to disconnect [ 551.003556][T24408] netlink: 'syz.2.5253': attribute type 5 has an invalid length. [ 551.016481][T24408] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5253'. [ 551.145251][T24408] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 551.164600][T24408] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.176930][T24408] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 551.180199][T24415] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5255'. [ 551.246382][T24415] netlink: 'syz.0.5255': attribute type 4 has an invalid length. [ 551.387854][T24408] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 551.407996][T24408] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.418633][T24408] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 551.561158][T24408] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 551.581809][T24408] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.600314][T24408] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 551.630185][T24432] syzkaller1: entered promiscuous mode [ 551.635873][T24432] syzkaller1: entered allmulticast mode [ 551.645122][T24432] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 551.703480][T24408] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 551.729088][T24408] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 551.753270][T24408] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 551.872729][T24444] netlink: 'syz.3.5265': attribute type 4 has an invalid length. [ 552.032184][ T1077] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 552.040864][ T1077] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 552.053108][ T1077] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 552.072589][T24451] tipc: Enabled bearer , priority 0 [ 552.099978][ T1077] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 552.120122][ T1077] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 552.138862][ T1077] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 552.241633][T24451] syzkaller0: entered promiscuous mode [ 552.247691][T24451] syzkaller0: entered allmulticast mode [ 552.254859][T24451] tipc: Resetting bearer [ 552.286022][ T1077] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 552.305677][ T1077] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 552.325197][ T1077] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 552.334639][T24450] tipc: Resetting bearer [ 553.942810][T24450] tipc: Disabling bearer [ 554.013251][T12879] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 554.032363][T12879] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 554.050749][T12879] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 554.156402][T24478] IPVS: Error connecting to the multicast addr [ 554.419940][T24496] __nla_validate_parse: 1 callbacks suppressed [ 554.419962][T24496] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5280'. [ 554.741190][T24522] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 554.928721][T24533] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 554.993711][T24532] syz2: rxe_newlink: already configured on lo [ 555.230637][T24554] xt_nfacct: accounting object `\$9ZM#iU|^c\F9YⳈ' does not exist [ 555.283990][T24558] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 555.493909][T24566] tap0: tun_chr_ioctl cmd 1074025676 [ 555.509721][T24566] tap0: owner set to 0 [ 555.515659][T24574] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5306'. [ 555.535671][T24574] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5306'. [ 555.646553][T24572] netlink: 'syz.3.5303': attribute type 8 has an invalid length. [ 556.181569][T24594] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.5308'. [ 556.207876][T24596] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5307'. [ 556.284972][T24599] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 556.381288][T24611] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5314'. [ 556.391059][T24599] bond2: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 556.440922][T24599] bond2 (unregistering): Released all slaves [ 556.596985][T24621] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 556.634215][T24623] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5318'. [ 556.893175][T24634] vlan2: entered promiscuous mode [ 556.916374][T24634] bridge0: entered promiscuous mode [ 556.995064][T24643] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 557.065278][T24643] geneve4: entered promiscuous mode [ 557.143567][T24653] tipc: Enabled bearer , priority 0 [ 557.233724][T24660] FAULT_INJECTION: forcing a failure. [ 557.233724][T24660] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 557.267577][T24660] CPU: 0 UID: 0 PID: 24660 Comm: syz.4.5326 Not tainted syzkaller #0 PREEMPT(full) [ 557.267609][T24660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 557.267623][T24660] Call Trace: [ 557.267632][T24660] [ 557.267642][T24660] dump_stack_lvl+0xe8/0x150 [ 557.267676][T24660] should_fail_ex+0x414/0x560 [ 557.267717][T24660] _copy_from_iter+0x1cd/0x1630 [ 557.267755][T24660] ? __pfx__copy_from_iter+0x10/0x10 [ 557.267786][T24660] ? __build_skb_around+0x22d/0x3c0 [ 557.267817][T24660] ? __alloc_skb+0x27e/0x3a0 [ 557.267843][T24660] skb_copy_datagram_from_iter+0xf5/0x720 [ 557.267878][T24660] ? __local_bh_enable_ip+0xd0/0x130 [ 557.267900][T24660] ? iov_iter_single_seg_count+0xc9/0x2f0 [ 557.267930][T24660] tun_get_user+0x1683/0x3dc0 [ 557.267979][T24660] ? __pfx_tun_get_user+0x10/0x10 [ 557.268007][T24660] ? __lock_acquire+0x6b6/0x2cf0 [ 557.268043][T24660] ? ref_tracker_alloc+0x318/0x460 [ 557.268062][T24660] ? aa_file_perm+0x139/0x1530 [ 557.268091][T24660] ? aa_file_perm+0x44c/0x1530 [ 557.268120][T24660] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 557.268144][T24660] ? tun_get+0x1c/0x2f0 [ 557.268170][T24660] ? tun_get+0x1c/0x2f0 [ 557.268202][T24660] ? tun_get+0x1c/0x2f0 [ 557.268226][T24660] ? tun_get+0x1c/0x2f0 [ 557.268258][T24660] tun_chr_write_iter+0x113/0x200 [ 557.268288][T24660] do_iter_readv_writev+0x623/0x8c0 [ 557.268319][T24660] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 557.268339][T24660] ? common_file_perm+0x1b5/0x220 [ 557.268371][T24660] ? bpf_lsm_file_permission+0x9/0x20 [ 557.268403][T24660] ? security_file_permission+0x75/0x290 [ 557.268427][T24660] ? rw_verify_area+0x255/0x4d0 [ 557.268465][T24660] vfs_writev+0x31a/0x960 [ 557.268502][T24660] ? __pfx_vfs_writev+0x10/0x10 [ 557.268557][T24660] ? __fget_files+0x2a/0x420 [ 557.268596][T24660] ? __fget_files+0x3a0/0x420 [ 557.268621][T24660] ? __fget_files+0x2a/0x420 [ 557.268658][T24660] do_writev+0x14d/0x2d0 [ 557.268688][T24660] ? __pfx_do_writev+0x10/0x10 [ 557.268725][T24660] do_syscall_64+0xec/0xf80 [ 557.268746][T24660] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.268766][T24660] ? trace_irq_disable+0x37/0x100 [ 557.268799][T24660] ? clear_bhb_loop+0x60/0xb0 [ 557.268826][T24660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.268848][T24660] RIP: 0033:0x7fc19fb8f749 [ 557.268869][T24660] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 557.268889][T24660] RSP: 002b:00007fc1a09a5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 557.268912][T24660] RAX: ffffffffffffffda RBX: 00007fc19fde6090 RCX: 00007fc19fb8f749 [ 557.268928][T24660] RDX: 0000000000000001 RSI: 00002000000001c0 RDI: 0000000000000005 [ 557.268941][T24660] RBP: 00007fc1a09a5090 R08: 0000000000000000 R09: 0000000000000000 [ 557.268955][T24660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 557.268968][T24660] R13: 00007fc19fde6128 R14: 00007fc19fde6090 R15: 00007ffee4399d78 [ 557.268999][T24660] [ 557.354151][T24653] syzkaller0: entered promiscuous mode [ 557.584853][T24653] syzkaller0: entered allmulticast mode [ 557.607691][T24653] tipc: Resetting bearer [ 557.680067][T24652] tipc: Resetting bearer [ 557.764346][T24675] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 557.836332][T24679] netlink: 'syz.2.5332': attribute type 1 has an invalid length. [ 559.450516][T24652] tipc: Disabling bearer [ 559.616639][T24689] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 559.733736][T24693] netlink: 'syz.1.5338': attribute type 4 has an invalid length. [ 559.770879][T24693] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5338'. [ 559.793875][T24702] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 559.809632][T24703] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 559.857509][T24707] syzkaller0: entered promiscuous mode [ 559.866278][T24707] syzkaller0: entered allmulticast mode [ 560.029202][T24709] 8021q: adding VLAN 0 to HW filter on device bond5 [ 560.279854][T24726] tipc: Enabled bearer , priority 0 [ 560.364210][T24733] FAULT_INJECTION: forcing a failure. [ 560.364210][T24733] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 560.387978][T24733] CPU: 1 UID: 0 PID: 24733 Comm: syz.2.5347 Not tainted syzkaller #0 PREEMPT(full) [ 560.388010][T24733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 560.388024][T24733] Call Trace: [ 560.388032][T24733] [ 560.388042][T24733] dump_stack_lvl+0xe8/0x150 [ 560.388075][T24733] should_fail_ex+0x414/0x560 [ 560.388115][T24733] _copy_to_user+0x31/0xb0 [ 560.388146][T24733] simple_read_from_buffer+0xe1/0x170 [ 560.388179][T24733] proc_fail_nth_read+0x1b3/0x220 [ 560.388205][T24733] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 560.388233][T24733] ? rw_verify_area+0x2a6/0x4d0 [ 560.388267][T24733] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 560.388292][T24733] vfs_read+0x200/0xa30 [ 560.388312][T24733] ? fdget_pos+0x247/0x320 [ 560.388345][T24733] ? __pfx___mutex_lock+0x10/0x10 [ 560.388369][T24733] ? __pfx_vfs_read+0x10/0x10 [ 560.388398][T24733] ? __fget_files+0x2a/0x420 [ 560.388430][T24733] ? __fget_files+0x3a0/0x420 [ 560.388463][T24733] ? __fget_files+0x2a/0x420 [ 560.388500][T24733] ksys_read+0x145/0x250 [ 560.388541][T24733] ? __pfx_ksys_read+0x10/0x10 [ 560.388575][T24733] do_syscall_64+0xec/0xf80 [ 560.388597][T24733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.388619][T24733] ? trace_irq_disable+0x37/0x100 [ 560.388647][T24733] ? clear_bhb_loop+0x60/0xb0 [ 560.388673][T24733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.388694][T24733] RIP: 0033:0x7fc71d58e15c [ 560.388715][T24733] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 560.388734][T24733] RSP: 002b:00007fc71e4d1030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 560.388757][T24733] RAX: ffffffffffffffda RBX: 00007fc71d7e6090 RCX: 00007fc71d58e15c [ 560.388774][T24733] RDX: 000000000000000f RSI: 00007fc71e4d10a0 RDI: 0000000000000008 [ 560.388788][T24733] RBP: 00007fc71e4d1090 R08: 0000000000000000 R09: 0000000000000000 [ 560.388801][T24733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 560.388814][T24733] R13: 00007fc71d7e6128 R14: 00007fc71d7e6090 R15: 00007ffccd12d1e8 [ 560.388851][T24733] [ 560.440963][T24726] syzkaller0: entered promiscuous mode [ 560.627251][T24726] syzkaller0: entered allmulticast mode [ 560.633078][ T5904] IPVS: starting estimator thread 0... [ 560.641646][T24726] tipc: Resetting bearer [ 560.659250][T24734] vlan0: entered allmulticast mode [ 560.664449][T24734] bridge_slave_0: entered allmulticast mode [ 560.679826][T24738] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5350'. [ 560.701797][T24738] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.5350'. [ 560.740632][T24740] IPVS: using max 31 ests per chain, 74400 per kthread [ 560.822252][ T4468] tipc: Resetting bearer [ 560.832697][T24726] tipc: Resetting bearer [ 561.028721][T24751] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5352'. [ 561.120871][T24755] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 561.584319][T24766] netlink: 596 bytes leftover after parsing attributes in process `syz.1.5357'. [ 562.852737][T24726] tipc: Disabling bearer [ 563.114910][T24786] can: request_module (can-proto-0) failed. [ 563.142487][T24795] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 563.308199][T24801] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 563.391455][T24805] netlink: 'syz.1.5368': attribute type 1 has an invalid length. [ 563.629208][T24829] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 563.760516][T24833] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5376'. [ 563.861268][T24842] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 563.913244][T24846] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5381'. [ 563.964254][T24846] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5381'. [ 564.219716][T24864] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5383'. [ 564.274095][T24869] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5386'. [ 564.808044][T24902] __nla_validate_parse: 1 callbacks suppressed [ 564.808066][T24902] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5395'. [ 564.932624][T24910] netlink: 'syz.0.5398': attribute type 1 has an invalid length. [ 564.943202][T24910] netlink: 244 bytes leftover after parsing attributes in process `syz.0.5398'. [ 564.968913][T24913] netlink: 'syz.2.5400': attribute type 1 has an invalid length. [ 564.978789][T24913] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5400'. [ 564.990522][T24910] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5398'. [ 565.128081][T24919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5404'. [ 565.347514][T24929] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5405'. [ 565.378355][T24929] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5405'. [ 565.565134][T24944] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5412'. [ 565.611933][T24946] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 565.631325][T24952] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5415'. [ 565.657011][T24952] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5415'. [ 565.823148][T24965] netlink: 'syz.1.5421': attribute type 32 has an invalid length. [ 565.873036][T24962] wlan0 speed is unknown, defaulting to 1000 [ 565.881752][T24962] lo speed is unknown, defaulting to 1000 [ 565.972222][T24974] netlink: 'syz.2.5422': attribute type 25 has an invalid length. [ 566.059215][T24974] netlink: 'syz.2.5422': attribute type 25 has an invalid length. [ 566.091855][T24977] xt_TPROXY: Can be used only with -p tcp or -p udp [ 566.650064][T25004] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 567.823825][T25079] netlink: 'syz.2.5451': attribute type 1 has an invalid length. [ 567.867389][T25079] tipc: Enabling of bearer rejected, media not registered [ 568.097403][T25094] syzkaller0: entered promiscuous mode [ 568.103191][T25094] syzkaller0: entered allmulticast mode [ 568.113474][T25090] tipc: Enabled bearer , priority 0 [ 568.310436][T25106] netem: change failed [ 568.417331][T25089] tipc: Resetting bearer [ 568.483936][T25089] tipc: Disabling bearer [ 568.629242][T25123] x_tables: duplicate underflow at hook 2 [ 568.767488][T25132] openvswitch: netlink: Flow key attr not present in new flow. [ 568.783650][T25132] sctp: [Deprecated]: syz.4.5464 (pid 25132) Use of struct sctp_assoc_value in delayed_ack socket option. [ 568.783650][T25132] Use struct sctp_sack_info instead [ 568.948074][T25138] netlink: 'syz.4.5467': attribute type 6 has an invalid length. [ 569.090769][T25145] 8021q: VLANs not supported on sit0 [ 569.285939][T25162] netlink: 'syz.2.5469': attribute type 10 has an invalid length. [ 569.359863][T25162] team0: Port device geneve0 added [ 569.741252][T25187] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 569.874483][T25191] macvtap1: entered promiscuous mode [ 569.880234][T25194] netlink: 'syz.3.5483': attribute type 1 has an invalid length. [ 569.928073][T25191] macvtap1: entered allmulticast mode [ 569.944351][T25191] veth1_vlan: entered allmulticast mode [ 570.000861][T25196] macvtap2: entered promiscuous mode [ 570.011001][T25196] macvtap2: entered allmulticast mode [ 570.032013][T25207] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 570.132312][T25207] wlan0 speed is unknown, defaulting to 1000 [ 570.140478][T25207] lo speed is unknown, defaulting to 1000 [ 570.387639][T25216] __nla_validate_parse: 16 callbacks suppressed [ 570.387661][T25216] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5492'. [ 571.042761][ T2916] 0: reclassify loop, rule prio 0, protocol 700 [ 571.289360][T25261] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5503'. [ 571.318206][T25261] netlink: 80 bytes leftover after parsing attributes in process `syz.1.5503'. [ 571.358706][T25261] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5503'. [ 571.502938][T25275] netlink: 'syz.3.5508': attribute type 4 has an invalid length. [ 571.644059][T25283] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5511'. [ 571.698108][T25285] bond2 (unregistering): Released all slaves [ 571.704430][T25283] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5511'. [ 571.947579][T25297] block nbd3: server does not support multiple connections per device. [ 571.960169][T25297] block nbd3: shutting down sockets [ 572.074613][T25308] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5517'. [ 572.109382][T25311] netlink: 'syz.0.5518': attribute type 1 has an invalid length. [ 573.786963][T25311] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 573.941735][T25337] IPVS: set_ctl: invalid protocol: 0 10.1.1.5:20016 [ 574.129314][T25347] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5526'. [ 574.147340][T25347] openvswitch: netlink: Flow key attr not present in new flow. [ 574.545040][T25371] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5538'. [ 574.581482][T25378] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5540'. [ 575.199888][T25405] can: request_module (can-proto-4) failed. [ 575.478609][T25440] __nla_validate_parse: 2 callbacks suppressed [ 575.478629][T25440] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5555'. [ 575.621043][T25452] tunl0: entered promiscuous mode [ 575.638901][T25452] netlink: 'syz.1.5558': attribute type 3 has an invalid length. [ 575.679065][T25452] netlink: 9 bytes leftover after parsing attributes in process `syz.1.5558'. [ 575.693414][T25456] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5557'. [ 575.790620][T25460] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5560'. [ 575.820884][T25460] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5560'. [ 576.168430][T25482] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5566'. [ 576.194253][T25482] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5566'. [ 576.236223][T25477] bond5: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 576.342691][T25477] bond5 (unregistering): Released all slaves [ 576.423096][T25488] tipc: Enabled bearer , priority 0 [ 576.511196][T25491] syzkaller0: entered promiscuous mode [ 576.519035][T25491] syzkaller0: entered allmulticast mode [ 576.525801][T25491] tipc: Resetting bearer [ 576.691905][T25514] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5575'. [ 576.719887][T25514] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5575'. [ 576.742131][T25468] tipc: Resetting bearer [ 577.249055][T25537] netlink: 'syz.2.5580': attribute type 21 has an invalid length. [ 578.713787][T25468] tipc: Disabling bearer [ 578.813399][T25537] netlink: 'syz.2.5580': attribute type 6 has an invalid length. [ 578.848272][T25537] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5580'. [ 579.023568][T25549] netlink: 'syz.0.5584': attribute type 4 has an invalid length. [ 579.401099][T25569] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 579.703154][T25582] tipc: Enabled bearer , priority 0 [ 579.826398][T25578] syzkaller0: entered promiscuous mode [ 579.835785][T25578] syzkaller0: entered allmulticast mode [ 579.856069][T25578] tipc: Resetting bearer [ 580.125241][T25604] netlink: 'syz.1.5603': attribute type 21 has an invalid length. [ 580.146668][ T1154] tipc: Resetting bearer [ 580.165130][T25604] IPv6: NLM_F_CREATE should be specified when creating new route [ 580.174750][T25574] tipc: Resetting bearer [ 582.049773][T25574] tipc: Disabling bearer [ 582.183335][T25623] openvswitch: netlink: IP tunnel dst address not specified [ 582.335580][T25628] netlink: 'syz.2.5608': attribute type 1 has an invalid length. [ 582.417214][T25628] 8021q: adding VLAN 0 to HW filter on device bond6 [ 582.474260][T25629] bond6: (slave veth5): Enslaving as an active interface with a down link [ 582.611828][T25651] dvmrp6: entered allmulticast mode [ 582.630148][T25653] __nla_validate_parse: 5 callbacks suppressed [ 582.630167][T25653] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5616'. [ 582.653901][T25653] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5616'. [ 582.668283][T25653] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5616'. [ 582.690252][T25653] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5616'. [ 582.708926][T25654] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5616'. [ 582.730437][T25654] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5616'. [ 582.739875][T25654] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5616'. [ 582.991493][T25672] netlink: 'syz.0.5621': attribute type 1 has an invalid length. [ 582.999638][T25672] netlink: 'syz.0.5621': attribute type 3 has an invalid length. [ 583.007922][T25672] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5621'. [ 583.624303][T25698] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5630'. [ 584.036384][ T5847] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 584.047811][ T5847] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 584.061348][ T5847] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 584.073093][ T5847] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 584.081253][ T5847] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 584.179789][ T5836] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 584.203019][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 584.210688][ T5836] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 584.222883][ T5836] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 584.248030][ T5836] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 584.427285][T25711] wlan0 speed is unknown, defaulting to 1000 [ 584.462523][T25711] lo speed is unknown, defaulting to 1000 [ 584.569587][T25736] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5638'. [ 584.714185][T25737] netlink: 'syz.4.5638': attribute type 1 has an invalid length. [ 584.740899][T25737] netlink: 'syz.4.5638': attribute type 7 has an invalid length. [ 584.758771][T25737] netlink: 'syz.4.5638': attribute type 8 has an invalid length. [ 584.780811][T25737] NCSI netlink: No device for ifindex 65584 [ 584.912334][ T3549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 584.924628][ T3549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.936181][ T3549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 585.061425][ T3549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.088546][ T3549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.109285][ T3549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 585.301473][ T3549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.313467][ T3549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.325371][ T3549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 585.463758][T25711] chnl_net:caif_netlink_parms(): no params data found [ 585.553896][ T3549] bond0: (slave netdevsim0): Releasing backup interface [ 585.574836][ T3549] netdevsim netdevsim1 netdevsim0 (unregistering): left promiscuous mode [ 585.600806][ T3549] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 585.628471][ T3549] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.667832][ T3549] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 585.954302][T25711] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.974381][T25711] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.994741][T25711] bridge_slave_0: entered allmulticast mode [ 586.022455][T25711] bridge_slave_0: entered promiscuous mode [ 586.065053][T25711] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.075717][T25771] x_tables: duplicate underflow at hook 3 [ 586.102679][T25711] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.124693][T25711] bridge_slave_1: entered allmulticast mode [ 586.165332][T25711] bridge_slave_1: entered promiscuous mode [ 586.313159][ T5847] Bluetooth: hci2: command tx timeout [ 586.365443][T25711] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 586.393422][T25711] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 586.503619][T25711] team0: Port device team_slave_0 added [ 586.530011][T25711] team0: Port device team_slave_1 added [ 587.045402][ T3549] erspan0 (unregistering): left promiscuous mode [ 587.099770][ T3549] gretap0 (unregistering): left promiscuous mode [ 587.310234][ T3549] dvmrp0 (unregistering): left allmulticast mode [ 587.346358][ T3549] dvmrp6 (unregistering): left allmulticast mode [ 587.398673][ T3549] bond3 (unregistering): (slave geneve2): Releasing backup interface [ 587.565970][ T1154] tipc: Subscription rejected, illegal request [ 587.830871][ T3549] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 587.841320][ T3549] bond_slave_0: left promiscuous mode [ 587.851660][ T3549] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 587.861858][ T3549] bond_slave_1: left promiscuous mode [ 587.875801][ T3549] bond0 (unregistering): Released all slaves [ 587.896139][ T3549] bond1 (unregistering): Released all slaves [ 587.915457][ T3549] bond2 (unregistering): Released all slaves [ 587.936553][ T3549] bond3 (unregistering): Released all slaves [ 588.129988][ T3549] bond4 (unregistering): Released all slaves [ 588.345279][T25812] IPVS: length: 239 != 24 [ 588.384354][ T3549] 9: left promiscuous mode [ 588.404074][ T5847] Bluetooth: hci2: command tx timeout [ 588.420285][T25711] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 588.466836][T25711] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 588.567846][T25711] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 588.592285][ T3549] tipc: Disabling bearer [ 588.599733][ T3549] tipc: Disabling bearer [ 588.615742][T25711] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 588.622950][ T3549] tipc: Left network mode [ 588.650107][T25711] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 588.693336][T25711] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 588.819903][T25831] __nla_validate_parse: 3 callbacks suppressed [ 588.819924][T25831] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5666'. [ 588.847265][T25831] tc_dump_action: action bad kind [ 588.925808][T25711] hsr_slave_0: entered promiscuous mode [ 588.970563][T25711] hsr_slave_1: entered promiscuous mode [ 588.982259][T25711] debugfs: 'hsr0' already exists in 'hsr' [ 588.989696][T25711] Cannot create hsr debugfs directory [ 589.205347][T25849] netlink: 'syz.2.5672': attribute type 1 has an invalid length. [ 589.269943][T25849] netlink: 16179 bytes leftover after parsing attributes in process `syz.2.5672'. [ 589.323480][T25857] xt_CT: You must specify a L4 protocol and not use inversions on it [ 589.354279][T25857] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5674'. [ 589.441882][T25864] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 589.865770][T25882] x_tables: duplicate underflow at hook 3 [ 589.979403][T25880] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 590.060160][ T3549] hsr_slave_0: left promiscuous mode [ 590.074785][ T3549] hsr_slave_1: left promiscuous mode [ 590.082287][ T3549] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 590.107224][ T3549] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 590.129484][ T3549] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 590.149343][ T3549] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 590.204911][ T3549] veth1_vlan: left allmulticast mode [ 590.215393][ T3549] veth1_macvtap: left promiscuous mode [ 590.230393][ T3549] veth0_macvtap: left promiscuous mode [ 590.240205][ T3549] veth1_vlan: left promiscuous mode [ 590.247278][ T3549] veth0_vlan: left promiscuous mode [ 590.277855][T25897] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 590.357769][ T30] audit: type=1107 audit(1768396117.168:4): pid=25901 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Y;ZY[f7I0:z6Nhfto# =#딵f [ 590.357769][ T30] )/SknSsS1`Cb hw]\{eZj [ 590.357769][ T30] !s&emb2in:Ě&Z@"ܥQAiV^X' [ 590.464023][ T3549] team0 (unregistering): Port device batadv1 removed [ 590.471070][ T5847] Bluetooth: hci2: command tx timeout [ 590.503227][ T3549] pim6reg (unregistering): left allmulticast mode [ 590.902869][ T3549] team0 (unregistering): Port device team_slave_1 removed [ 590.945795][ T3549] team0 (unregistering): Port device team_slave_0 removed [ 591.400907][T25902] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5690'. [ 591.427145][T25902] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5690'. [ 591.528402][T25905] netlink: 9 bytes leftover after parsing attributes in process `syz.4.5691'. [ 591.546389][T25904] netlink: 9 bytes leftover after parsing attributes in process `syz.4.5691'. [ 591.602809][T25904] gretap0: entered promiscuous mode [ 591.610880][T25909] netlink: 'syz.2.5692': attribute type 11 has an invalid length. [ 591.634995][T25909] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5692'. [ 591.670301][T25907] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5694'. [ 591.741177][T25905] gretap0: left promiscuous mode [ 591.752479][T25907] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5694'. [ 591.785949][T25905] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 591.803230][T25920] netlink: 'syz.2.5696': attribute type 4 has an invalid length. [ 591.811952][T25921] netlink: 'syz.2.5696': attribute type 4 has an invalid length. [ 591.846930][T25904] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 592.150481][T25924] syzkaller0: entered promiscuous mode [ 592.156036][T25924] syzkaller0: entered allmulticast mode [ 592.560941][ T5847] Bluetooth: hci2: command tx timeout [ 594.018919][ T3549] IPVS: stop unused estimator thread 0... [ 594.136434][T25944] netlink: 'syz.2.5703': attribute type 12 has an invalid length. [ 594.232698][T25711] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 594.272380][T25711] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 594.320272][T25955] __nla_validate_parse: 4 callbacks suppressed [ 594.320291][T25955] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5703'. [ 594.348039][T25956] bond7: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 594.383287][T25956] bond7 (unregistering): Released all slaves [ 594.430442][T25711] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 594.455945][T25968] netlink: 'syz.4.5708': attribute type 13 has an invalid length. [ 594.487273][T25711] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 594.621118][T25981] netlink: 'syz.2.5710': attribute type 1 has an invalid length. [ 594.700509][T25985] netlink: 96 bytes leftover after parsing attributes in process `syz.3.5711'. [ 594.761380][T25981] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5710'. [ 594.771411][T25988] bond7: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 594.784157][T25988] bond7: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 594.795614][T25988] bond7: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 594.899281][T25711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 594.943234][T25994] netlink: 536 bytes leftover after parsing attributes in process `syz.0.5714'. [ 594.981000][T25996] netlink: 'syz.3.5715': attribute type 9 has an invalid length. [ 595.048828][T25711] 8021q: adding VLAN 0 to HW filter on device team0 [ 595.074019][ T3658] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.081290][ T3658] bridge0: port 1(bridge_slave_0) entered forwarding state [ 595.134163][ T3658] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.141407][ T3658] bridge0: port 2(bridge_slave_1) entered forwarding state [ 595.241203][T26007] netlink: 'syz.2.5718': attribute type 21 has an invalid length. [ 595.570252][T26029] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 595.719110][T25711] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.829184][T25711] veth0_vlan: entered promiscuous mode [ 595.872291][T25711] veth1_vlan: entered promiscuous mode [ 595.939255][T25711] veth0_macvtap: entered promiscuous mode [ 595.963360][T25711] veth1_macvtap: entered promiscuous mode [ 596.015795][T25711] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.046000][T25711] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.075041][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.099825][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.119796][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.150174][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.242334][T26052] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.5731'. [ 596.442250][ T3469] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 596.464832][ T3469] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 596.546605][T24222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 596.580241][T24222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 596.887927][T26079] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5631'. [ 596.962283][T26089] netlink: 100 bytes leftover after parsing attributes in process `syz.2.5739'. [ 597.072686][T26095] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5741'. [ 597.182501][T26099] veth0_to_bridge: entered promiscuous mode [ 597.226946][T26106] sctp: [Deprecated]: syz.4.5743 (pid 26106) Use of struct sctp_assoc_value in delayed_ack socket option. [ 597.226946][T26106] Use struct sctp_sack_info instead [ 597.270359][T26100] veth0_to_bridge: left promiscuous mode [ 597.323851][T26106] tipc: Enabled bearer , priority 0 [ 597.355209][T26113] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5746'. [ 597.499746][T26106] syzkaller0: entered promiscuous mode [ 597.509853][T26123] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5749'. [ 597.519174][T26106] syzkaller0: entered allmulticast mode [ 597.529476][T26106] tipc: Resetting bearer [ 597.593189][T26104] tipc: Resetting bearer [ 599.471041][T26104] tipc: Disabling bearer [ 599.497004][T26134] __nla_validate_parse: 1 callbacks suppressed [ 599.497025][T26134] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5752'. [ 599.767798][T26162] netlink: 'syz.1.5761': attribute type 3 has an invalid length. [ 599.768099][T26154] xt_CT: You must specify a L4 protocol and not use inversions on it [ 599.792573][T26166] netlink: 'syz.3.5759': attribute type 2 has an invalid length. [ 599.951624][T26166] xt_CT: You must specify a L4 protocol and not use inversions on it [ 599.973804][T26172] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5766'. [ 599.975664][T26166] netlink: 'syz.3.5759': attribute type 2 has an invalid length. [ 600.011889][T26174] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5765'. [ 600.026615][T26174] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5765'. [ 600.289316][ T5836] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 600.300447][ T5836] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 600.312725][T26186] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 600.320910][ T5836] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 600.330359][ T5836] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 600.349572][ T5836] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 600.533634][T26191] netlink: 'syz.1.5771': attribute type 8 has an invalid length. [ 600.588327][T26188] syzkaller0: entered promiscuous mode [ 600.593883][T26188] syzkaller0: entered allmulticast mode [ 602.390714][ T5836] Bluetooth: hci5: command tx timeout [ 602.532624][T26209] tipc: Enabling not permitted [ 602.539157][T26209] tipc: Enabling of bearer rejected, failed to enable media [ 602.552884][T26208] tipc: Enabling not permitted [ 602.563427][T26208] tipc: Enabling of bearer rejected, failed to enable media [ 602.636258][T26182] wlan0 speed is unknown, defaulting to 1000 [ 602.660402][T26182] lo speed is unknown, defaulting to 1000 [ 602.727220][T26220] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5777'. [ 602.795502][T26214] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5778'. [ 603.090245][T26233] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5783'. [ 603.106165][T26237] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5782'. [ 603.129101][T26237] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5782'. [ 603.140628][T26237] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5782'. [ 603.434641][T26182] chnl_net:caif_netlink_parms(): no params data found [ 603.540412][T26258] netlink: 'syz.0.5791': attribute type 11 has an invalid length. [ 603.639816][T26182] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.649049][T26182] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.656377][T26182] bridge_slave_0: entered allmulticast mode [ 603.665342][T26182] bridge_slave_0: entered promiscuous mode [ 603.675565][T26182] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.685572][T26182] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.697599][T26182] bridge_slave_1: entered allmulticast mode [ 603.706063][T26182] bridge_slave_1: entered promiscuous mode [ 603.815412][T26182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 603.839415][T26182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 603.969480][T26281] netlink: 'syz.2.5797': attribute type 33 has an invalid length. [ 604.053617][T26182] team0: Port device team_slave_0 added [ 604.082560][T26182] team0: Port device team_slave_1 added [ 604.175901][T26182] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 604.190658][T26182] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.234331][T26182] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 604.275138][T26285] tipc: Started in network mode [ 604.289966][T26285] tipc: Node identity aaaaaaaaaa35, cluster identity 4711 [ 604.317827][T26285] tipc: Enabled bearer , priority 2 [ 604.325445][T26182] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 604.344965][T26182] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.415266][T26182] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 604.448526][T26291] netlink: 'syz.2.5801': attribute type 10 has an invalid length. [ 604.467474][ T5836] Bluetooth: hci5: command tx timeout [ 604.474428][T26291] netlink: 'syz.2.5801': attribute type 5 has an invalid length. [ 604.553539][T26293] tipc: Enabled bearer , priority 0 [ 604.609348][T26295] __nla_validate_parse: 4 callbacks suppressed [ 604.609450][T26295] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5803'. [ 604.638329][T26293] syzkaller0: entered promiscuous mode [ 604.643972][T26293] syzkaller0: entered allmulticast mode [ 604.650448][T26293] tipc: Resetting bearer [ 604.658463][T26297] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5804'. [ 604.678726][T26182] hsr_slave_0: entered promiscuous mode [ 604.685690][T26182] hsr_slave_1: entered promiscuous mode [ 604.693741][T26182] debugfs: 'hsr0' already exists in 'hsr' [ 604.700146][T26182] Cannot create hsr debugfs directory [ 604.700168][T26301] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5803'. [ 604.750617][T26301] nbd: couldn't find a device at index 0 [ 604.813370][T26305] netlink: 'syz.2.5805': attribute type 83 has an invalid length. [ 604.833511][T24272] tipc: Resetting bearer [ 604.840733][T26292] tipc: Resetting bearer [ 606.550022][ T5836] Bluetooth: hci5: command tx timeout [ 606.577466][T26292] tipc: Disabling bearer [ 606.588483][T26323] IPVS: length: 24 != 4081176 [ 606.603726][ T6043] tipc: Node number set to 10463914 [ 606.624075][T26322] mac80211_hwsim hwsim29 : renamed from wlan1 [ 606.992357][T26343] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5818'. [ 607.043694][T26182] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 607.067722][T26182] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.190460][T26182] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 607.201824][T26182] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.288612][T26350] syzkaller0: entered promiscuous mode [ 607.294122][T26350] syzkaller0: entered allmulticast mode [ 607.359450][T26182] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 607.371994][T26182] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.958416][T26377] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5827'. [ 607.980714][T26377] xt_hashlimit: size too large, truncated to 1048576 [ 608.637200][ T5836] Bluetooth: hci5: command tx timeout [ 609.448522][T26370] tipc: Enabling of bearer rejected, failed to enable media [ 609.522800][T26182] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 609.533568][T26182] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.873504][T26182] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 609.889751][T26182] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 609.903251][T26182] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 609.920759][T26182] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 609.963385][T26398] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5835'. [ 610.132495][T26182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 610.164515][T26182] 8021q: adding VLAN 0 to HW filter on device team0 [ 610.267308][T26182] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 610.278339][T26182] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 610.297336][ T9473] bridge0: port 1(bridge_slave_0) entered blocking state [ 610.304866][ T9473] bridge0: port 1(bridge_slave_0) entered forwarding state [ 610.316476][ T9473] bridge0: port 2(bridge_slave_1) entered blocking state [ 610.323816][ T9473] bridge0: port 2(bridge_slave_1) entered forwarding state [ 610.624617][T26420] tipc: Enabled bearer , priority 0 [ 610.717749][ T5836] Bluetooth: hci5: command tx timeout [ 610.762495][T26420] syzkaller0: entered promiscuous mode [ 610.775474][T26420] syzkaller0: entered allmulticast mode [ 610.798460][T26420] tipc: Resetting bearer [ 610.856482][T26419] tipc: Resetting bearer [ 613.745370][T26419] tipc: Disabling bearer [ 613.782507][T26182] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 613.925947][T26454] netlink: 'syz.1.5849': attribute type 10 has an invalid length. [ 613.934583][T26454] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5849'. [ 613.985141][T26454] team0: Port device geneve0 added [ 614.021833][T26452] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 614.044772][T26458] netlink: 'syz.0.5850': attribute type 21 has an invalid length. [ 614.055338][T26459] netlink: 'syz.0.5850': attribute type 21 has an invalid length. [ 614.069390][T26452] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 614.075941][T26458] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5850'. [ 614.090064][T26459] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5850'. [ 614.117983][T26452] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 614.134085][T26462] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 614.144006][T26458] netlink: 3 bytes leftover after parsing attributes in process `syz.0.5850'. [ 614.158939][T26459] netlink: 3 bytes leftover after parsing attributes in process `syz.0.5850'. [ 614.229379][T26460] netdevsim netdevsim0: Direct firmware load for .. failed with error -2 [ 614.238614][T26460] netdevsim netdevsim0: Falling back to sysfs fallback for: .. [ 614.262492][T26452] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 614.299726][T26452] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 614.352932][T26452] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 614.453137][T26452] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 614.463802][T26452] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 614.475221][T26452] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 614.503695][T26477] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.5854'. [ 614.598806][T26452] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 614.617997][T26452] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 614.628095][T26452] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 614.706109][T26182] veth0_vlan: entered promiscuous mode [ 614.745938][T26182] veth1_vlan: entered promiscuous mode [ 614.810271][ T2916] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 614.823010][ T2916] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.844595][T26488] netlink: 'syz.1.5857': attribute type 1 has an invalid length. [ 614.853269][ T2916] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 614.895961][T26488] 8021q: adding VLAN 0 to HW filter on device bond2 [ 614.943464][T26488] bond2: (slave veth3): Enslaving as an active interface with a down link [ 614.956527][ T4468] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 614.976946][ T4468] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.986040][ T4468] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 615.043582][T26492] syzkaller0: entered promiscuous mode [ 615.049275][T26492] syzkaller0: entered allmulticast mode [ 615.064759][T26491] tipc: Enabled bearer , priority 0 [ 615.089113][ T3503] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 615.097885][ T3503] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 615.106237][ T3503] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 615.117465][T26489] tipc: Resetting bearer [ 617.091031][T26489] tipc: Disabling bearer [ 617.167178][T24859] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 617.182295][T24859] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.191021][T24859] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 617.239759][T26182] veth0_macvtap: entered promiscuous mode [ 617.506004][T26182] veth1_macvtap: entered promiscuous mode [ 617.623732][T26182] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 617.637136][T26528] x_tables: duplicate underflow at hook 2 [ 617.643335][T26528] x_tables: duplicate underflow at hook 2 [ 617.691200][T26182] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 617.762758][T19837] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.795930][T19837] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.825457][T19837] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.886138][T19837] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 617.953627][T26546] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5872'. [ 617.981119][ T9473] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 618.008163][ T9473] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 618.062196][T26549] tipc: Enabled bearer , priority 0 [ 618.140808][T26549] syzkaller0: entered promiscuous mode [ 618.146462][T26549] syzkaller0: entered allmulticast mode [ 618.154950][T26549] tipc: Resetting bearer [ 618.172169][ T9473] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 618.197222][ T9473] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 618.243084][T26555] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5874'. [ 618.256360][ T1155] tipc: Resetting bearer [ 618.269647][T26548] tipc: Resetting bearer [ 618.431464][T26561] IPVS: set_ctl: invalid protocol: 60 172.20.20.170:20002 [ 620.037696][T26548] tipc: Disabling bearer [ 620.317408][T26581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5881'. [ 620.347121][T26581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5881'. [ 620.448772][T26590] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 620.676333][T26599] syzkaller0: entered promiscuous mode [ 620.686067][T26599] syzkaller0: entered allmulticast mode [ 622.839290][T26625] netlink: 128 bytes leftover after parsing attributes in process `syz.2.5897'. [ 622.861222][T26627] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5896'. [ 623.016478][T26633] syzkaller0: entered promiscuous mode [ 623.029727][T26633] syzkaller0: entered allmulticast mode [ 623.161769][T26643] Cannot find map_set index 0 as target [ 623.322115][T26652] tipc: Started in network mode [ 623.327205][T26652] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 623.334777][T26652] tipc: Enabled bearer , priority 10 [ 623.342721][ T5904] IPVS: starting estimator thread 0... [ 623.402039][T26656] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5906'. [ 623.477054][T26653] IPVS: using max 26 ests per chain, 62400 per kthread [ 623.696070][T26667] netlink: 5 bytes leftover after parsing attributes in process `syz.2.5910'. [ 623.715204][T26671] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5911'. [ 623.756550][T26675] netlink: 92 bytes leftover after parsing attributes in process `syz.0.5913'. [ 623.774140][T26671] rdma_rxe: rxe_newlink: failed to add lo [ 623.779285][T26675] netlink: 'syz.0.5913': attribute type 1 has an invalid length. [ 624.117362][T26694] netlink: 'syz.2.5918': attribute type 1 has an invalid length. [ 624.228386][T26701] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5922'. [ 624.287434][T26698] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5919'. [ 624.341375][ T5904] tipc: Node number set to 10005162 [ 624.379687][T26711] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 624.480262][T26718] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5928'. [ 624.694938][T26733] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5931'. [ 624.716411][T26733] netlink: 2108 bytes leftover after parsing attributes in process `syz.3.5931'. [ 625.099384][T26746] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5937'. [ 625.112129][T26746] netlink: 'syz.1.5937': attribute type 12 has an invalid length. [ 625.122216][T26746] netlink: 'syz.1.5937': attribute type 11 has an invalid length. [ 625.820989][T26785] syzkaller0: entered promiscuous mode [ 625.826554][T26785] syzkaller0: entered allmulticast mode [ 626.220338][T26817] netlink: 'syz.3.5957': attribute type 1 has an invalid length. [ 626.302298][T26817] bond7: entered promiscuous mode [ 626.309042][T26817] 8021q: adding VLAN 0 to HW filter on device bond7 [ 626.362789][T26821] bond7: (slave bridge8): making interface the new active one [ 626.372185][T26821] bridge8: entered promiscuous mode [ 626.379298][T26821] bond7: (slave bridge8): Enslaving as an active interface with an up link [ 626.505146][T26829] Cannot find map_set index 0 as target [ 627.135815][T26865] Cannot find map_set index 0 as target [ 627.888520][T26898] ip6gre1: entered promiscuous mode [ 627.913550][T26901] netlink: 'syz.2.5987': attribute type 4 has an invalid length. [ 628.030085][T26541] IPVS: starting estimator thread 0... [ 628.053922][T26906] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 628.125540][T26914] netlink: 'syz.2.5990': attribute type 1 has an invalid length. [ 628.139750][T26909] IPVS: using max 27 ests per chain, 64800 per kthread [ 628.281372][T26914] 8021q: adding VLAN 0 to HW filter on device bond8 [ 628.413259][T26932] netlink: 'syz.0.5993': attribute type 3 has an invalid length. [ 628.431159][T26918] bond8: (slave veth7): Enslaving as an active interface with a down link [ 628.508252][T26919] vlan2: entered allmulticast mode [ 628.520125][T26919] veth1: entered allmulticast mode [ 628.526371][T26919] veth1: entered promiscuous mode [ 628.535614][T26919] veth1: left promiscuous mode [ 628.545182][T26919] bond8: (slave vlan2): making interface the new active one [ 628.557830][T26919] veth1: entered promiscuous mode [ 628.563951][T26919] vlan2: entered promiscuous mode [ 628.572295][T26919] bond8: (slave vlan2): Enslaving as an active interface with an up link [ 628.760151][T26952] __nla_validate_parse: 7 callbacks suppressed [ 628.777069][T26952] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5998'. [ 629.211846][T26975] netdevsim netdevsim3: Direct firmware load for . failed with error -2 [ 629.252695][T26975] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 629.416174][T26982] syzkaller0: entered promiscuous mode [ 629.431130][T26982] syzkaller0: entered allmulticast mode [ 629.450363][T26986] syzkaller0: entered promiscuous mode [ 629.456007][T26986] syzkaller0: entered allmulticast mode [ 629.467907][T26991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6007'. [ 629.483700][T26979] netlink: 'syz.2.6002': attribute type 41 has an invalid length. [ 629.499772][T26979] netlink: 'syz.2.6002': attribute type 41 has an invalid length. [ 629.509992][T26991] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6007'. [ 629.524647][T26991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6007'. [ 629.535821][T26991] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6007'. [ 629.590476][T26991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6007'. [ 629.600466][T26991] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6007'. [ 629.831608][T27000] sctp: [Deprecated]: syz.1.6009 (pid 27000) Use of int in maxseg socket option. [ 629.831608][T27000] Use struct sctp_assoc_value instead [ 630.063104][T27011] netlink: 'syz.0.6015': attribute type 1 has an invalid length. [ 630.131431][T27011] bond2: (slave xfrm1): The slave device specified does not support setting the MAC address [ 630.142449][T27011] bond2: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 630.157354][T27011] bond2: (slave xfrm1): making interface the new active one [ 630.165795][T27011] bond2: (slave xfrm1): Enslaving as an active interface with an up link [ 630.198345][T27011] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6015'. [ 630.236104][T27011] bond2 (unregistering): (slave xfrm1): Releasing backup interface [ 630.290674][T27011] bond2 (unregistering): Released all slaves [ 630.335336][T27021] team0: No ports can be present during mode change [ 630.345267][T27020] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6016'. [ 630.378537][T27016] netlink: 'syz.0.6015': attribute type 4 has an invalid length. [ 630.798135][T27018] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6013'. [ 630.818485][T27018] netlink: 'syz.2.6013': attribute type 5 has an invalid length. [ 631.005244][T27053] vlan2: entered allmulticast mode [ 631.026199][T27053] hsr0: entered allmulticast mode [ 631.035391][T27053] hsr_slave_0: entered allmulticast mode [ 631.043656][T27053] hsr_slave_1: entered allmulticast mode [ 631.061389][T27055] pim6reg1: entered promiscuous mode [ 631.067368][T27055] pim6reg1: entered allmulticast mode [ 631.075005][T27055] veth0: entered promiscuous mode [ 631.081547][T27056] veth0: left promiscuous mode [ 631.300464][T27068] syzkaller0: entered promiscuous mode [ 631.306031][T27068] syzkaller0: entered allmulticast mode [ 631.851200][T27099] netlink: 'syz.2.6040': attribute type 2 has an invalid length. [ 632.042604][T27109] netlink: 'syz.0.6044': attribute type 29 has an invalid length. [ 632.125282][T27120] netlink: 'syz.1.6047': attribute type 1 has an invalid length. [ 632.194524][T27125] xt_NFQUEUE: number of queues (27568) out of range (got 68779) [ 632.261119][T27128] xt_NFQUEUE: number of queues (27568) out of range (got 68779) [ 632.274633][T27133] netdevsim netdevsim0: Direct firmware load for . failed with error -2 [ 632.293939][T27133] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 632.682216][T27143] xt_CT: You must specify a L4 protocol and not use inversions on it [ 632.756438][T27143] netlink: 'syz.3.6054': attribute type 2 has an invalid length. [ 633.118611][T27174] x_tables: duplicate underflow at hook 1 [ 633.229084][T27180] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 633.236406][T27180] IPv6: NLM_F_CREATE should be set when creating new route [ 633.243705][T27180] IPv6: NLM_F_CREATE should be set when creating new route [ 633.251020][T27180] IPv6: NLM_F_CREATE should be set when creating new route [ 633.266277][T27180] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 633.781578][T27205] __nla_validate_parse: 14 callbacks suppressed [ 633.781601][T27205] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.6074'. [ 634.022091][T27218] netlink: 'syz.2.6079': attribute type 9 has an invalid length. [ 634.037727][T27218] netlink: 210020 bytes leftover after parsing attributes in process `syz.2.6079'. [ 634.051745][T27218] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6079'. [ 634.242823][T27228] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6082'. [ 634.261452][T27225] syzkaller0: entered promiscuous mode [ 634.277999][T27225] syzkaller0: entered allmulticast mode [ 634.322924][T27191] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 634.575998][T27241] validate_nla: 2 callbacks suppressed [ 634.576024][T27241] netlink: 'syz.2.6085': attribute type 10 has an invalid length. [ 634.616162][T27241] netlink: 'syz.2.6085': attribute type 10 has an invalid length. [ 634.639538][T27241] 8021q: adding VLAN 0 to HW filter on device bond0 [ 634.651035][T27247] netlink: 'syz.1.6084': attribute type 1 has an invalid length. [ 634.661352][T27241] team0: Port device bond0 added [ 634.668148][T27247] netlink: 96 bytes leftover after parsing attributes in process `syz.1.6084'. [ 634.681067][T27250] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6086'. [ 634.683137][T27247] netlink: 1 bytes leftover after parsing attributes in process `syz.1.6084'. [ 634.700413][T27247] netlink: 658 bytes leftover after parsing attributes in process `syz.1.6084'. [ 634.714437][T27249] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6087'. [ 634.723926][T27249] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6087'. [ 634.751876][T27248] team0: Port device bond0 removed [ 634.767585][T27248] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 635.855777][T27308] xt_HMARK: spi-set and port-set can't be combined [ 635.912618][T27311] netlink: 'syz.0.6104': attribute type 1 has an invalid length. [ 636.171828][T27330] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 636.531837][T27342] Cannot find map_set index 0 as target [ 636.675654][T27350] bond0: entered promiscuous mode [ 636.887649][T27363] IPv6: NLM_F_CREATE should be specified when creating new route [ 637.185886][T27374] syzkaller0: entered promiscuous mode [ 637.192077][T27374] syzkaller0: entered allmulticast mode [ 637.308448][T27384] vxcan0: tx drop: invalid sa for name 0x0000000000000001 [ 637.420643][T27388] netlink: 'syz.0.6127': attribute type 14 has an invalid length. [ 637.895893][ T2916] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.905316][ T2916] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.920417][ T2916] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.929915][ T2916] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 638.165704][T27423] x_tables: duplicate underflow at hook 2 [ 638.300891][T27432] syzkaller1: entered promiscuous mode [ 638.307324][T27432] syzkaller1: entered allmulticast mode [ 638.979602][T27465] netlink: 'syz.4.6153': attribute type 1 has an invalid length. [ 638.991953][ T5202] udevd[5202]: worker [27474] terminated by signal 33 (Unknown signal 33) [ 639.007555][T27465] __nla_validate_parse: 19 callbacks suppressed [ 639.007577][T27465] netlink: 244 bytes leftover after parsing attributes in process `syz.4.6153'. [ 639.029586][ T5202] udevd[5202]: worker [27474] failed while handling '/fs/nfs/net/nfs_client' [ 639.112600][T27473] wlan0 speed is unknown, defaulting to 1000 [ 639.168757][T27473] lo speed is unknown, defaulting to 1000 [ 639.217873][T27472] wlan0 speed is unknown, defaulting to 1000 [ 639.271939][T27481] tipc: Enabling of bearer rejected, failed to enable media [ 639.397334][T27480] tipc: Enabling of bearer rejected, failed to enable media [ 639.628159][T12880] vlan2: left promiscuous mode [ 639.678624][T27496] x_tables: ip6_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT/POSTROUTING [ 639.720564][T27501] openvswitch: netlink: Missing key (keys=40, expected=100) [ 639.735515][T27472] lo speed is unknown, defaulting to 1000 [ 640.502989][T27522] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6172'. [ 640.541572][T27522] netlink: 'syz.0.6172': attribute type 6 has an invalid length. [ 640.686306][T27529] netlink: 84 bytes leftover after parsing attributes in process `syz.1.6175'. [ 640.703580][T27533] FAULT_INJECTION: forcing a failure. [ 640.703580][T27533] name failslab, interval 1, probability 0, space 0, times 0 [ 640.752854][T27533] CPU: 0 UID: 0 PID: 27533 Comm: syz.0.6176 Not tainted syzkaller #0 PREEMPT(full) [ 640.752886][T27533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 640.752901][T27533] Call Trace: [ 640.752910][T27533] [ 640.752921][T27533] dump_stack_lvl+0xe8/0x150 [ 640.752959][T27533] should_fail_ex+0x414/0x560 [ 640.753006][T27533] should_failslab+0xa8/0x100 [ 640.753035][T27533] __kmalloc_cache_noprof+0x84/0x700 [ 640.753057][T27533] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 640.753096][T27533] ? sctp_add_bind_addr+0x8c/0x370 [ 640.753134][T27533] sctp_add_bind_addr+0x8c/0x370 [ 640.753169][T27533] sctp_copy_local_addr_list+0x30b/0x4e0 [ 640.753205][T27533] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 640.753234][T27533] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 640.753267][T27533] ? sctp_v6_is_any+0x64/0x80 [ 640.753299][T27533] ? sctp_copy_one_addr+0x93/0x360 [ 640.753333][T27533] sctp_bind_addr_copy+0xb3/0x3c0 [ 640.753366][T27533] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 640.753395][T27533] sctp_connect_new_asoc+0x2e0/0x690 [ 640.753421][T27533] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 640.753445][T27533] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 640.753467][T27533] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 640.753488][T27533] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 640.753512][T27533] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 640.753535][T27533] ? security_sctp_bind_connect+0x7e/0x2e0 [ 640.753561][T27533] sctp_sendmsg+0x155c/0x2840 [ 640.753597][T27533] ? __pfx_sctp_sendmsg+0x10/0x10 [ 640.753615][T27533] ? aa_sk_perm+0x15f/0x920 [ 640.753645][T27533] ? aa_sk_perm+0x7ee/0x920 [ 640.753678][T27533] ? __pfx_aa_sk_perm+0x10/0x10 [ 640.753709][T27533] ? sock_rps_record_flow+0x19/0x410 [ 640.753744][T27533] ? inet_sendmsg+0x2f4/0x370 [ 640.753772][T27533] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 640.753798][T27533] __sock_sendmsg+0x19c/0x270 [ 640.753836][T27533] ____sys_sendmsg+0x505/0x820 [ 640.753871][T27533] ? __pfx_____sys_sendmsg+0x10/0x10 [ 640.753909][T27533] ? import_iovec+0x74/0xa0 [ 640.753942][T27533] ___sys_sendmsg+0x21f/0x2a0 [ 640.753973][T27533] ? __pfx____sys_sendmsg+0x10/0x10 [ 640.754043][T27533] ? __fget_files+0x2a/0x420 [ 640.754070][T27533] ? __fget_files+0x3a0/0x420 [ 640.754121][T27533] __x64_sys_sendmsg+0x19b/0x260 [ 640.754152][T27533] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 640.754191][T27533] ? __pfx_ksys_write+0x10/0x10 [ 640.754227][T27533] do_syscall_64+0xec/0xf80 [ 640.754251][T27533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.754273][T27533] ? trace_irq_disable+0x37/0x100 [ 640.754302][T27533] ? clear_bhb_loop+0x60/0xb0 [ 640.754330][T27533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.754352][T27533] RIP: 0033:0x7ff82798f749 [ 640.754374][T27533] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 640.754394][T27533] RSP: 002b:00007ff828839038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 640.754420][T27533] RAX: ffffffffffffffda RBX: 00007ff827be5fa0 RCX: 00007ff82798f749 [ 640.754437][T27533] RDX: 0000000000004000 RSI: 00002000000019c0 RDI: 0000000000000004 [ 640.754452][T27533] RBP: 00007ff828839090 R08: 0000000000000000 R09: 0000000000000000 [ 640.754467][T27533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 640.754480][T27533] R13: 00007ff827be6038 R14: 00007ff827be5fa0 R15: 00007ffc5974d528 [ 640.754519][T27533] [ 641.206606][T27526] [ 641.209017][T27526] ====================================================== [ 641.216161][T27526] WARNING: possible circular locking dependency detected [ 641.223403][T27526] syzkaller #0 Not tainted [ 641.227861][T27526] ------------------------------------------------------ [ 641.235087][T27526] syz.2.6173/27526 is trying to acquire lock: [ 641.241190][T27526] ffffffff8f4746b8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 641.250570][T27526] [ 641.250570][T27526] but task is already holding lock: [ 641.258151][T27526] ffff888030b4b670 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0xcce/0x2570 [ 641.267537][T27526] [ 641.267537][T27526] which lock already depends on the new lock. [ 641.267537][T27526] [ 641.278548][T27526] [ 641.278548][T27526] the existing dependency chain (in reverse order) is: [ 641.287608][T27526] [ 641.287608][T27526] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 641.295755][T27526] _raw_spin_lock_bh+0x36/0x50 [ 641.301236][T27526] nr_rt_device_down+0x12a/0x720 [ 641.306747][T27526] nr_device_event+0x137/0x150 [ 641.312077][T27526] notifier_call_chain+0x19d/0x3a0 [ 641.317958][T27526] __dev_notify_flags+0x18d/0x2e0 [ 641.323574][T27526] netif_change_flags+0xe8/0x1a0 [ 641.329120][T27526] dev_change_flags+0x130/0x260 [ 641.334550][T27526] dev_ioctl+0x7b4/0x1150 [ 641.339465][T27526] sock_do_ioctl+0x22c/0x300 [ 641.344643][T27526] sock_ioctl+0x576/0x790 [ 641.349553][T27526] __se_sys_ioctl+0xfc/0x170 [ 641.354722][T27526] do_syscall_64+0xec/0xf80 [ 641.359774][T27526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.366239][T27526] [ 641.366239][T27526] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 641.374553][T27526] _raw_spin_lock_bh+0x36/0x50 [ 641.380054][T27526] nr_rt_device_down+0xa9/0x720 [ 641.385461][T27526] nr_device_event+0x137/0x150 [ 641.390769][T27526] notifier_call_chain+0x19d/0x3a0 [ 641.396431][T27526] __dev_notify_flags+0x18d/0x2e0 [ 641.402004][T27526] netif_change_flags+0xe8/0x1a0 [ 641.407495][T27526] dev_change_flags+0x130/0x260 [ 641.412908][T27526] dev_ioctl+0x7b4/0x1150 [ 641.417805][T27526] sock_do_ioctl+0x22c/0x300 [ 641.422969][T27526] sock_ioctl+0x576/0x790 [ 641.427892][T27526] __se_sys_ioctl+0xfc/0x170 [ 641.433042][T27526] do_syscall_64+0xec/0xf80 [ 641.438097][T27526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.444540][T27526] [ 641.444540][T27526] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 641.452483][T27526] __lock_acquire+0x15a6/0x2cf0 [ 641.458101][T27526] lock_acquire+0x107/0x340 [ 641.463176][T27526] _raw_spin_lock_bh+0x36/0x50 [ 641.468507][T27526] nr_remove_neigh+0x25/0xe0 [ 641.473666][T27526] nr_add_node+0x1d9f/0x2570 [ 641.478836][T27526] nr_rt_ioctl+0xc12/0xd50 [ 641.483911][T27526] sock_do_ioctl+0xdc/0x300 [ 641.488970][T27526] sock_ioctl+0x576/0x790 [ 641.493860][T27526] __se_sys_ioctl+0xfc/0x170 [ 641.499007][T27526] do_syscall_64+0xec/0xf80 [ 641.504159][T27526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.510605][T27526] [ 641.510605][T27526] other info that might help us debug this: [ 641.510605][T27526] [ 641.521999][T27526] Chain exists of: [ 641.521999][T27526] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 641.521999][T27526] [ 641.535885][T27526] Possible unsafe locking scenario: [ 641.535885][T27526] [ 641.543538][T27526] CPU0 CPU1 [ 641.549020][T27526] ---- ---- [ 641.554408][T27526] lock(&nr_node->node_lock); [ 641.559459][T27526] lock(nr_node_list_lock); [ 641.566591][T27526] lock(&nr_node->node_lock); [ 641.573913][T27526] lock(nr_neigh_list_lock); [ 641.578721][T27526] [ 641.578721][T27526] *** DEADLOCK *** [ 641.578721][T27526] [ 641.586890][T27526] 1 lock held by syz.2.6173/27526: [ 641.592029][T27526] #0: ffff888030b4b670 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0xcce/0x2570 [ 641.602002][T27526] [ 641.602002][T27526] stack backtrace: [ 641.607935][T27526] CPU: 1 UID: 0 PID: 27526 Comm: syz.2.6173 Not tainted syzkaller #0 PREEMPT(full) [ 641.607962][T27526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 641.607977][T27526] Call Trace: [ 641.607986][T27526] [ 641.607995][T27526] dump_stack_lvl+0xe8/0x150 [ 641.608027][T27526] print_circular_bug+0x2e2/0x300 [ 641.608058][T27526] check_noncircular+0x12e/0x150 [ 641.608089][T27526] __lock_acquire+0x15a6/0x2cf0 [ 641.608125][T27526] ? nr_remove_neigh+0x25/0xe0 [ 641.608150][T27526] lock_acquire+0x107/0x340 [ 641.608170][T27526] ? nr_remove_neigh+0x25/0xe0 [ 641.608195][T27526] ? nr_add_node+0xcce/0x2570 [ 641.608215][T27526] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 641.608239][T27526] ? nr_remove_neigh+0x25/0xe0 [ 641.608259][T27526] _raw_spin_lock_bh+0x36/0x50 [ 641.608292][T27526] ? nr_remove_neigh+0x25/0xe0 [ 641.608311][T27526] nr_remove_neigh+0x25/0xe0 [ 641.608332][T27526] nr_add_node+0x1d9f/0x2570 [ 641.608352][T27526] ? dev_get_by_name+0x21/0x200 [ 641.608389][T27526] ? dev_get_by_name+0x21/0x200 [ 641.608413][T27526] ? dev_get_by_name+0x21/0x200 [ 641.608436][T27526] ? nr_call_to_digi+0x136/0x1b0 [ 641.608456][T27526] nr_rt_ioctl+0xc12/0xd50 [ 641.608480][T27526] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 641.608503][T27526] ? apparmor_capable+0x137/0x1a0 [ 641.608534][T27526] ? capable+0x89/0xe0 [ 641.608552][T27526] ? nr_ioctl+0x1b1/0x3b0 [ 641.608579][T27526] sock_do_ioctl+0xdc/0x300 [ 641.608611][T27526] ? __pfx_sock_do_ioctl+0x10/0x10 [ 641.608635][T27526] ? do_futex+0x395/0x420 [ 641.608651][T27526] ? __fget_files+0x2a/0x420 [ 641.608681][T27526] sock_ioctl+0x576/0x790 [ 641.608706][T27526] ? __pfx_sock_ioctl+0x10/0x10 [ 641.608730][T27526] ? __fget_files+0x2a/0x420 [ 641.608750][T27526] ? __fget_files+0x3a0/0x420 [ 641.608772][T27526] ? __fget_files+0x2a/0x420 [ 641.608795][T27526] ? bpf_lsm_file_ioctl+0x9/0x20 [ 641.608815][T27526] ? __pfx_sock_ioctl+0x10/0x10 [ 641.608839][T27526] __se_sys_ioctl+0xfc/0x170 [ 641.608868][T27526] do_syscall_64+0xec/0xf80 [ 641.608886][T27526] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.608904][T27526] ? clear_bhb_loop+0x60/0xb0 [ 641.608923][T27526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 641.608941][T27526] RIP: 0033:0x7fc71d58f749 [ 641.608958][T27526] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 641.608974][T27526] RSP: 002b:00007fc71e4f2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 641.608993][T27526] RAX: ffffffffffffffda RBX: 00007fc71d7e5fa0 RCX: 00007fc71d58f749 [ 641.609007][T27526] RDX: 0000200000000000 RSI: 000000000000890b RDI: 000000000000000b [ 641.609019][T27526] RBP: 00007fc71d613f91 R08: 0000000000000000 R09: 0000000000000000 [ 641.609032][T27526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 641.609043][T27526] R13: 00007fc71d7e6038 R14: 00007fc71d7e5fa0 R15: 00007ffccd12d1e8 [ 641.609066][T27526] [ 642.011815][T27540] syzkaller0: entered promiscuous mode [ 642.017624][T27540] syzkaller0: entered allmulticast mode [ 645.566460][ T9473] ------------[ cut here ]------------ [ 645.572076][ T9473] wlan1: Dropped data frame as no usable bitrate found while scanning and associated. Target station: 08:02:11:00:00:00 on 5 GHz band [ 645.585956][ T9473] WARNING: net/mac80211/tx.c:758 at ieee80211_tx_h_rate_ctrl+0xbdd/0x1760, CPU#0: kworker/u8:18/9473 [ 645.596945][ T9473] Modules linked in: [ 645.600886][ T9473] CPU: 0 UID: 0 PID: 9473 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT(full) [ 645.610492][ T9473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 645.620601][ T9473] Workqueue: events_unbound cfg80211_wiphy_work [ 645.626937][ T9473] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xc4a/0x1760 [ 645.633569][ T9473] Code: 00 00 48 8b 44 24 50 8b 30 45 31 ff 83 e6 07 41 0f 95 c7 31 ff e8 66 32 e9 f6 43 8d 0c 7f 83 c1 02 48 89 df 4c 89 f6 4c 89 e2 <67> 48 0f b9 3a 41 be 01 00 00 00 49 bf 00 00 00 00 00 fc ff df e9 [ 645.653226][ T9473] RSP: 0018:ffffc9001a6e73c0 EFLAGS: 00010206 [ 645.659353][ T9473] RAX: ffffffff8ad7c99a RBX: ffffffff8f930590 RCX: 0000000000000005 [ 645.667411][ T9473] RDX: ffff88801f2853c4 RSI: ffff8880560657c8 RDI: ffffffff8f930590 [ 645.675439][ T9473] RBP: ffffc9001a6e7528 R08: ffff88807b36a9c7 R09: 1ffff1100f66d538 [ 645.683474][ T9473] R10: dffffc0000000000 R11: ffffed100f66d539 R12: ffff88801f2853c4 [ 645.691512][ T9473] R13: 1ffff920034dce8c R14: ffff8880560657c8 R15: 0000000000000001 [ 645.699564][ T9473] FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 645.708564][ T9473] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 645.715173][ T9473] CR2: 00007f54b73b7198 CR3: 0000000075c62000 CR4: 00000000003526f0 [ 645.723232][ T9473] Call Trace: [ 645.726532][ T9473] [ 645.729512][ T9473] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 645.735602][ T9473] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 645.741819][ T9473] invoke_tx_handlers_late+0xba/0x18a0 [ 645.747325][ T9473] ? invoke_tx_handlers_early+0xa0c/0x1d50 [ 645.753160][ T9473] ieee80211_tx+0x2ac/0x460 [ 645.757709][ T9473] ? __pfx_ieee80211_tx+0x10/0x10 [ 645.762766][ T9473] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 645.768882][ T9473] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 645.774728][ T9473] ? ieee80211_scan_state_send_probe+0x4e8/0xa00 [ 645.781141][ T9473] ieee80211_scan_state_send_probe+0x594/0xa00 [ 645.787402][ T9473] ieee80211_scan_work+0x65f/0x1c50 [ 645.792670][ T9473] cfg80211_wiphy_work+0x2ab/0x450 [ 645.797839][ T9473] ? process_scheduled_works+0x9ef/0x1770 [ 645.803572][ T9473] process_scheduled_works+0xad1/0x1770 [ 645.809169][ T9473] ? __pfx_process_scheduled_works+0x10/0x10 [ 645.815160][ T9473] ? do_raw_spin_lock+0x121/0x290 [ 645.820238][ T9473] worker_thread+0x8a0/0xda0 [ 645.824854][ T9473] ? __kthread_parkme+0x7b/0x200 [ 645.829892][ T9473] kthread+0x711/0x8a0 [ 645.833988][ T9473] ? __pfx_worker_thread+0x10/0x10 [ 645.839187][ T9473] ? __pfx_kthread+0x10/0x10 [ 645.843803][ T9473] ? _raw_spin_unlock_irq+0x23/0x50 [ 645.849077][ T9473] ? __pfx_kthread+0x10/0x10 [ 645.853692][ T9473] ret_from_fork+0x510/0xa50 [ 645.858345][ T9473] ? __pfx_ret_from_fork+0x10/0x10 [ 645.863482][ T9473] ? __switch_to+0xc9e/0x1480 [ 645.868268][ T9473] ? __pfx_kthread+0x10/0x10 [ 645.872890][ T9473] ret_from_fork_asm+0x1a/0x30 [ 645.877735][ T9473] [ 645.880887][ T9473] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 645.888399][ T9473] CPU: 0 UID: 0 PID: 9473 Comm: kworker/u8:18 Not tainted syzkaller #0 PREEMPT(full) [ 645.898078][ T9473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 645.908251][ T9473] Workqueue: events_unbound cfg80211_wiphy_work [ 645.915052][ T9473] Call Trace: [ 645.918362][ T9473] [ 645.921367][ T9473] vpanic+0x1e0/0x670 [ 645.925401][ T9473] panic+0xb9/0xc0 [ 645.929166][ T9473] ? __pfx_panic+0x10/0x10 [ 645.933610][ T9473] ? ret_from_fork_asm+0x1a/0x30 [ 645.938599][ T9473] __warn+0x317/0x4b0 [ 645.942675][ T9473] ? ieee80211_tx_h_rate_ctrl+0xbdd/0x1760 [ 645.948530][ T9473] ? ieee80211_tx_h_rate_ctrl+0xbdd/0x1760 [ 645.954359][ T9473] __report_bug+0x288/0x500 [ 645.958887][ T9473] ? ieee80211_tx_h_rate_ctrl+0xbdd/0x1760 [ 645.964711][ T9473] ? __pfx___report_bug+0x10/0x10 [ 645.969760][ T9473] ? kasan_save_track+0x4f/0x80 [ 645.974627][ T9473] ? kasan_save_track+0x3e/0x80 [ 645.979501][ T9473] ? __kasan_slab_alloc+0x6c/0x80 [ 645.984558][ T9473] ? kmalloc_reserve+0xbd/0x290 [ 645.989447][ T9473] ? __alloc_skb+0x204/0x3a0 [ 645.994073][ T9473] ? __netdev_alloc_skb+0xc1/0x850 [ 645.999306][ T9473] ? ieee80211_probereq_get+0x60/0x270 [ 646.004844][ T9473] ? ieee80211_build_probe_req+0x178/0x480 [ 646.010671][ T9473] report_bug_entry+0x19a/0x290 [ 646.015562][ T9473] ? ieee80211_tx_h_rate_ctrl+0xc4a/0x1760 [ 646.021566][ T9473] ? ieee80211_tx_h_rate_ctrl+0xc4f/0x1760 [ 646.027417][ T9473] handle_bug+0xca/0x200 [ 646.031688][ T9473] exc_invalid_op+0x1a/0x50 [ 646.036390][ T9473] asm_exc_invalid_op+0x1a/0x20 [ 646.041689][ T9473] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xc4a/0x1760 [ 646.048300][ T9473] Code: 00 00 48 8b 44 24 50 8b 30 45 31 ff 83 e6 07 41 0f 95 c7 31 ff e8 66 32 e9 f6 43 8d 0c 7f 83 c1 02 48 89 df 4c 89 f6 4c 89 e2 <67> 48 0f b9 3a 41 be 01 00 00 00 49 bf 00 00 00 00 00 fc ff df e9 [ 646.068034][ T9473] RSP: 0018:ffffc9001a6e73c0 EFLAGS: 00010206 [ 646.074117][ T9473] RAX: ffffffff8ad7c99a RBX: ffffffff8f930590 RCX: 0000000000000005 [ 646.082279][ T9473] RDX: ffff88801f2853c4 RSI: ffff8880560657c8 RDI: ffffffff8f930590 [ 646.090272][ T9473] RBP: ffffc9001a6e7528 R08: ffff88807b36a9c7 R09: 1ffff1100f66d538 [ 646.098283][ T9473] R10: dffffc0000000000 R11: ffffed100f66d539 R12: ffff88801f2853c4 [ 646.106269][ T9473] R13: 1ffff920034dce8c R14: ffff8880560657c8 R15: 0000000000000001 [ 646.114260][ T9473] ? ieee80211_tx_h_rate_ctrl+0xc3a/0x1760 [ 646.120095][ T9473] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 646.126266][ T9473] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 646.132437][ T9473] invoke_tx_handlers_late+0xba/0x18a0 [ 646.137943][ T9473] ? invoke_tx_handlers_early+0xa0c/0x1d50 [ 646.143799][ T9473] ieee80211_tx+0x2ac/0x460 [ 646.148329][ T9473] ? __pfx_ieee80211_tx+0x10/0x10 [ 646.153420][ T9473] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 646.159419][ T9473] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 646.165247][ T9473] ? ieee80211_scan_state_send_probe+0x4e8/0xa00 [ 646.171608][ T9473] ieee80211_scan_state_send_probe+0x594/0xa00 [ 646.177823][ T9473] ieee80211_scan_work+0x65f/0x1c50 [ 646.183046][ T9473] cfg80211_wiphy_work+0x2ab/0x450 [ 646.188187][ T9473] ? process_scheduled_works+0x9ef/0x1770 [ 646.193949][ T9473] process_scheduled_works+0xad1/0x1770 [ 646.199538][ T9473] ? __pfx_process_scheduled_works+0x10/0x10 [ 646.205538][ T9473] ? do_raw_spin_lock+0x121/0x290 [ 646.210595][ T9473] worker_thread+0x8a0/0xda0 [ 646.215203][ T9473] ? __kthread_parkme+0x7b/0x200 [ 646.220158][ T9473] kthread+0x711/0x8a0 [ 646.224256][ T9473] ? __pfx_worker_thread+0x10/0x10 [ 646.229403][ T9473] ? __pfx_kthread+0x10/0x10 [ 646.234013][ T9473] ? _raw_spin_unlock_irq+0x23/0x50 [ 646.239240][ T9473] ? __pfx_kthread+0x10/0x10 [ 646.243876][ T9473] ret_from_fork+0x510/0xa50 [ 646.248539][ T9473] ? __pfx_ret_from_fork+0x10/0x10 [ 646.253667][ T9473] ? __switch_to+0xc9e/0x1480 [ 646.258380][ T9473] ? __pfx_kthread+0x10/0x10 [ 646.262987][ T9473] ret_from_fork_asm+0x1a/0x30 [ 646.267821][ T9473] [ 646.271458][ T9473] Kernel Offset: disabled [ 646.275795][ T9473] Rebooting in 86400 seconds..