last executing test programs: 1m24.435629731s ago: executing program 0 (id=737): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001640)=[{{&(0x7f0000000640)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000001140)="c59a9693bd6a6c6f68ff71648498a367bdd52f96c8c8c32944821a214b18eeae3026eca24316d74dab904d48ca637f80acae1aed1a92b9eeed726e39fcb8852848a8ef3dc763d87488bad0b1ccc03b780aaedb671c0405a083db6ac3d2c0c643d53d0280347df6222f5ebdfdf9c27d021458b1368ab240eca40fb3329706f869d159def1c4feab40790624fefb6174e24d0334afa341225350a6236445cb9a29929abae2e059732f998afc3b4226190bc6aa0ea3e9413c92a8dafb1d594ff2e1759d8d616e450534a0f3b97c544b397a9e7d915cabfa37e0b30859a9", 0xdc}], 0x1}}, {{&(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000800)="931748ffe238461bdd06ee7e0d91513b33ece4dcaea59e2e0347875bf70f67848d383772091cd824a63ddbe4c37eaa9010826853e1b39394932183afd94615404d05a248bd0e18029c91f1", 0x4b}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x2}, 0x8) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xb, 0xfffd, 0x2, 0x3, 0xfff, 0x6, 0x401, 0x4]}}]}]}]}, 0x38}}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e000100000000000000000001"], 0x114}], 0x1}, 0x0) 1m11.420347168s ago: executing program 0 (id=737): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001640)=[{{&(0x7f0000000640)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000001140)="c59a9693bd6a6c6f68ff71648498a367bdd52f96c8c8c32944821a214b18eeae3026eca24316d74dab904d48ca637f80acae1aed1a92b9eeed726e39fcb8852848a8ef3dc763d87488bad0b1ccc03b780aaedb671c0405a083db6ac3d2c0c643d53d0280347df6222f5ebdfdf9c27d021458b1368ab240eca40fb3329706f869d159def1c4feab40790624fefb6174e24d0334afa341225350a6236445cb9a29929abae2e059732f998afc3b4226190bc6aa0ea3e9413c92a8dafb1d594ff2e1759d8d616e450534a0f3b97c544b397a9e7d915cabfa37e0b30859a9", 0xdc}], 0x1}}, {{&(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000800)="931748ffe238461bdd06ee7e0d91513b33ece4dcaea59e2e0347875bf70f67848d383772091cd824a63ddbe4c37eaa9010826853e1b39394932183afd94615404d05a248bd0e18029c91f1", 0x4b}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x2}, 0x8) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xb, 0xfffd, 0x2, 0x3, 0xfff, 0x6, 0x401, 0x4]}}]}]}]}, 0x38}}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e000100000000000000000001"], 0x114}], 0x1}, 0x0) 58.939686793s ago: executing program 0 (id=737): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001640)=[{{&(0x7f0000000640)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000001140)="c59a9693bd6a6c6f68ff71648498a367bdd52f96c8c8c32944821a214b18eeae3026eca24316d74dab904d48ca637f80acae1aed1a92b9eeed726e39fcb8852848a8ef3dc763d87488bad0b1ccc03b780aaedb671c0405a083db6ac3d2c0c643d53d0280347df6222f5ebdfdf9c27d021458b1368ab240eca40fb3329706f869d159def1c4feab40790624fefb6174e24d0334afa341225350a6236445cb9a29929abae2e059732f998afc3b4226190bc6aa0ea3e9413c92a8dafb1d594ff2e1759d8d616e450534a0f3b97c544b397a9e7d915cabfa37e0b30859a9", 0xdc}], 0x1}}, {{&(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000800)="931748ffe238461bdd06ee7e0d91513b33ece4dcaea59e2e0347875bf70f67848d383772091cd824a63ddbe4c37eaa9010826853e1b39394932183afd94615404d05a248bd0e18029c91f1", 0x4b}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x2}, 0x8) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xb, 0xfffd, 0x2, 0x3, 0xfff, 0x6, 0x401, 0x4]}}]}]}]}, 0x38}}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e000100000000000000000001"], 0x114}], 0x1}, 0x0) 54.9229472s ago: executing program 3 (id=1965): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000001880)=ANY=[@ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="02"], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) r4 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r6, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={0x0, 0xf4}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) (async) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r6, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={0x0, 0xf4}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="5400000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000804003002c0012800b00010067726574617000001c00028006000e00010000f4060010004e27000008000700ac14142808000a00", @ANYRES32=r7], 0x54}}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="5400000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000804003002c0012800b00010067726574617000001c00028006000e00010000f4060010004e27000008000700ac14142808000a00", @ANYRES32=r7], 0x54}}, 0x0) 54.579000671s ago: executing program 3 (id=1971): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async, rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x4000000}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}, 0x1, 0x0, 0x0, 0x24004094}, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000003540)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x34000041) (async, rerun: 32) recvmsg$can_raw(r2, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000003c0)=""/33, 0x21}], 0x1}, 0x1) (rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000071122c000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000040)={0x9, [0x0, 0xeba8, 0x9, 0x0, 0x4, 0x9, 0x0, 0x8, 0xb086]}, &(0x7f0000000080)=0x16) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb0100180000000000000018070000000500000001000001000000000000000004000000e8000001015f0000006100"], 0x0, 0x37, 0x0, 0xa}, 0x20) 54.420051874s ago: executing program 3 (id=1972): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000005000400000000000900020073797a30000000001400078008001340000000040800124080000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@var={0x5, 0x0, 0x0, 0xe, 0x4, 0x2}]}, {0x0, [0x61, 0x0, 0x0]}}, &(0x7f00000001c0)=""/163, 0x2d, 0xa3, 0x0, 0x92, 0x10000}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYRES64=r0, @ANYRESDEC=r1], &(0x7f00000005c0)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x40f00, 0x18, '\x00', 0x0, 0xf, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) 42.415410838s ago: executing program 0 (id=737): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001640)=[{{&(0x7f0000000640)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000001140)="c59a9693bd6a6c6f68ff71648498a367bdd52f96c8c8c32944821a214b18eeae3026eca24316d74dab904d48ca637f80acae1aed1a92b9eeed726e39fcb8852848a8ef3dc763d87488bad0b1ccc03b780aaedb671c0405a083db6ac3d2c0c643d53d0280347df6222f5ebdfdf9c27d021458b1368ab240eca40fb3329706f869d159def1c4feab40790624fefb6174e24d0334afa341225350a6236445cb9a29929abae2e059732f998afc3b4226190bc6aa0ea3e9413c92a8dafb1d594ff2e1759d8d616e450534a0f3b97c544b397a9e7d915cabfa37e0b30859a9", 0xdc}], 0x1}}, {{&(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000800)="931748ffe238461bdd06ee7e0d91513b33ece4dcaea59e2e0347875bf70f67848d383772091cd824a63ddbe4c37eaa9010826853e1b39394932183afd94615404d05a248bd0e18029c91f1", 0x4b}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x2}, 0x8) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xb, 0xfffd, 0x2, 0x3, 0xfff, 0x6, 0x401, 0x4]}}]}]}]}, 0x38}}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e000100000000000000000001"], 0x114}], 0x1}, 0x0) 41.175146585s ago: executing program 3 (id=1972): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000005000400000000000900020073797a30000000001400078008001340000000040800124080000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@var={0x5, 0x0, 0x0, 0xe, 0x4, 0x2}]}, {0x0, [0x61, 0x0, 0x0]}}, &(0x7f00000001c0)=""/163, 0x2d, 0xa3, 0x0, 0x92, 0x10000}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYRES64=r0, @ANYRESDEC=r1], &(0x7f00000005c0)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x40f00, 0x18, '\x00', 0x0, 0xf, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) 25.311587505s ago: executing program 3 (id=1972): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000005000400000000000900020073797a30000000001400078008001340000000040800124080000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@var={0x5, 0x0, 0x0, 0xe, 0x4, 0x2}]}, {0x0, [0x61, 0x0, 0x0]}}, &(0x7f00000001c0)=""/163, 0x2d, 0xa3, 0x0, 0x92, 0x10000}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYRES64=r0, @ANYRESDEC=r1], &(0x7f00000005c0)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x40f00, 0x18, '\x00', 0x0, 0xf, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) 24.2993549s ago: executing program 0 (id=737): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001640)=[{{&(0x7f0000000640)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000001140)="c59a9693bd6a6c6f68ff71648498a367bdd52f96c8c8c32944821a214b18eeae3026eca24316d74dab904d48ca637f80acae1aed1a92b9eeed726e39fcb8852848a8ef3dc763d87488bad0b1ccc03b780aaedb671c0405a083db6ac3d2c0c643d53d0280347df6222f5ebdfdf9c27d021458b1368ab240eca40fb3329706f869d159def1c4feab40790624fefb6174e24d0334afa341225350a6236445cb9a29929abae2e059732f998afc3b4226190bc6aa0ea3e9413c92a8dafb1d594ff2e1759d8d616e450534a0f3b97c544b397a9e7d915cabfa37e0b30859a9", 0xdc}], 0x1}}, {{&(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000800)="931748ffe238461bdd06ee7e0d91513b33ece4dcaea59e2e0347875bf70f67848d383772091cd824a63ddbe4c37eaa9010826853e1b39394932183afd94615404d05a248bd0e18029c91f1", 0x4b}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x2}, 0x8) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xb, 0xfffd, 0x2, 0x3, 0xfff, 0x6, 0x401, 0x4]}}]}]}]}, 0x38}}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e000100000000000000000001"], 0x114}], 0x1}, 0x0) 6.724182761s ago: executing program 3 (id=1972): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000005000400000000000900020073797a30000000001400078008001340000000040800124080000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@var={0x5, 0x0, 0x0, 0xe, 0x4, 0x2}]}, {0x0, [0x61, 0x0, 0x0]}}, &(0x7f00000001c0)=""/163, 0x2d, 0xa3, 0x0, 0x92, 0x10000}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYRES64=r0, @ANYRESDEC=r1], &(0x7f00000005c0)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x40f00, 0x18, '\x00', 0x0, 0xf, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) 5.73695634s ago: executing program 0 (id=737): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000001640)=[{{&(0x7f0000000640)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000001140)="c59a9693bd6a6c6f68ff71648498a367bdd52f96c8c8c32944821a214b18eeae3026eca24316d74dab904d48ca637f80acae1aed1a92b9eeed726e39fcb8852848a8ef3dc763d87488bad0b1ccc03b780aaedb671c0405a083db6ac3d2c0c643d53d0280347df6222f5ebdfdf9c27d021458b1368ab240eca40fb3329706f869d159def1c4feab40790624fefb6174e24d0334afa341225350a6236445cb9a29929abae2e059732f998afc3b4226190bc6aa0ea3e9413c92a8dafb1d594ff2e1759d8d616e450534a0f3b97c544b397a9e7d915cabfa37e0b30859a9", 0xdc}], 0x1}}, {{&(0x7f0000000480)={0x2, 0x4e22, @remote}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000800)="931748ffe238461bdd06ee7e0d91513b33ece4dcaea59e2e0347875bf70f67848d383772091cd824a63ddbe4c37eaa9010826853e1b39394932183afd94615404d05a248bd0e18029c91f1", 0x4b}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x2}, 0x8) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@dellink={0x28, 0x11, 0x101, 0x0, 0x0, {}, [@IFLA_NET_NS_FD={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xb, 0xfffd, 0x2, 0x3, 0xfff, 0x6, 0x401, 0x4]}}]}]}]}, 0x38}}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e000100000000000000000001"], 0x114}], 0x1}, 0x0) 3.949733847s ago: executing program 1 (id=2297): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) unshare(0x6020400) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r1, 0x0, 0x0}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_mpls={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8848}, @TCA_MPLS_LABEL={0x8}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'syztnl1\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x40, 0x1, 0xd7, 0x80000000, {{0x18, 0x4, 0x2, 0x2c, 0x60, 0x66, 0x0, 0x9, 0x2d, 0x0, @dev={0xac, 0x14, 0x14, 0x3e}, @rand_addr=0x64010102, {[@lsrr={0x83, 0x17, 0xbf, [@loopback, @multicast1, @rand_addr=0x64010102, @private=0xfffffffc, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x1c, 0xb, 0x1, 0x6, [{@rand_addr=0x64010100, 0x1}, {@remote, 0x5}, {@dev={0xac, 0x14, 0x14, 0x12}, 0x8}]}, @cipso={0x86, 0x15, 0x3, [{0x1, 0x5, "b16caf"}, {0x1, 0xa, "f1e4a559ca8c9ab7"}]}]}}}}}) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000005c0)=@o_path={&(0x7f0000000580)='./file0\x00', 0x0, 0x10, r2}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x8, 0x13, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x800}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='syzkaller\x00', 0xffffff80, 0xc4, &(0x7f0000000280)=""/196, 0x41100, 0x20, '\x00', r3, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000540)={0xb, 0xa, 0xffffff01, 0xf}, 0x10, 0x0, r4, 0x8, 0x0, &(0x7f0000000600)=[{0x2, 0x1, 0xf, 0x4}, {0x3, 0x3, 0x10, 0xb}, {0x2, 0x2, 0xa, 0x4}, {0x2, 0x1, 0xc, 0x4}, {0x0, 0x3, 0x1, 0x5}, {0x2, 0x3, 0x1, 0xa}, {0x5, 0x4, 0x8, 0x7}, {0x2, 0x2, 0x2, 0xb}], 0x10, 0x8}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1, 0x3, 0x261, 0xc3f5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r6}, 0x50) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@RTM_NEWMDB={0xf8, 0x54, 0x2, 0x70bd2a, 0x25dfdbfd, {0x7, r3}, [@MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x1, 0x1, 0x1, {@in6_addr=@mcast2, 0x8edd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x1, 0x2, 0x1, {@in6_addr=@private2, 0x86dd}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x0, 0x0, 0x0, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x0, 0x3, 0x3, {@in6_addr=@local, 0x18b67}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x1, 0x1, 0x0, {@in6_addr=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x18367}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x1, 0x2, 0x2, {@in6_addr=@rand_addr=' \x01\x00', 0x800}}}, @MDBA_SET_ENTRY={0x20, 0x1, {r6, 0x0, 0x2, 0x2, {@ip4=@multicast2}}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000000) 2.290590472s ago: executing program 1 (id=2300): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}}, 0x0) (async) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="b1429181aa31992051ac27000000", @ANYRES16=r3, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r1, @ANYBLOB], 0x1c}}, 0x0) (async, rerun: 64) r5 = socket(0x34, 0xa, 0x2) (async, rerun: 64) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r7 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r6, 0x84, 0x1b, &(0x7f0000000080)={r8}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f00000001c0)={r8, 0x8}, &(0x7f0000000300)=0x8) (async, rerun: 64) close(0x3) (async, rerun: 64) close(r6) (async, rerun: 64) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), r9) (async) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x2c, r10, 0x1, 0x70bd3c, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x32}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r11}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40111}, 0x200008c0) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)={0x58, r10, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x44004}, 0xcb5936d61f6809a7) 2.054018548s ago: executing program 1 (id=2304): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000200b703000000000000850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f0000000000)=0x9f04, 0x4) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000000)='mlxsw_sp_acl_tcam_vregion_migrate_end\x00', r1, 0x0, 0x7fffffffffffffff}, 0x18) 1.984934703s ago: executing program 2 (id=2305): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000080)=0x400, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2, 0x0, 0x48}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x15, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x82000, 0x1, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) unshare(0x2c020400) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) listen(r1, 0x0) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000100)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x3}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000240)={r3, &(0x7f0000000180)="06a78c3f15983d1622d3c7c494d66811ec1e25e8e87284214429f82c71d7b5d75ea037a3fe90149b9bf5bee98d71d78dac98f4b9d6506d0f207339f7ccbf7b218d53aa0e178e713a4eb6319cea373be900544979a1b1e75ce17b880823fa6f1d2714ef2e32cea9b50d717212c65f12a1ff5d0e6b0e156fa7a79212308afed0925d1a523e6c9ef65ba07a7cabcae29871e9b80a7d251b7ed732a4ec34a3e58db884465c83af4e12"}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r4, &(0x7f0000000840), &(0x7f0000004880)=@udp=r1}, 0x20) ioctl$int_in(r1, 0x5452, &(0x7f00000000c0)=0x14f) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x1c, 0x52, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @fd=r5}]}, 0x1c}}, 0x0) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000480)=""/149, 0x95}], 0x1}, 0x22) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_VIF(r7, 0x0, 0xcb, &(0x7f0000000180)={0x1, 0x8, 0x0, 0x2, @vifc_lcl_ifindex, @multicast1}, 0x10) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) sendmsg$inet(r6, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x1) r9 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003480)={0x6, 0x2, &(0x7f00000001c0)=ANY=[@ANYBLOB="0701000009090c040500feff"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x11}, 0x90) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) write(r1, &(0x7f00000005c0)="0c3ccc893bf979369c9a01add1ac52ac76984f27be6c30f52d2e3624386321f2917e211418ff150c77f7e044173e8bdb3df90dd2e1499cc04863d59fe4ed16cc4aaefea7497391c53a114eb325894033e009f5ebcc7f8d9d669a2732bba7ea0d257a073cc42ff9b3a9d31164e8949a10cdf0d8ba3bd7cf5e807eaaaf787949076538aafafc2076868e6e9117fd2e86295c9b22c4ebbac9eb0e876f41ca49082ce5f431811370613f960f7d8940b6a8b23f810611ffa3bf18c0e68e630e347d00f57d449c28661111444cc38b6c47b2446b3d48dc9e840f9c1af7f9b13f941875e4021b9eb4cddc4b80087135f64b76d33418822cc76f62a79560782a54d99159008a8deff3579cae5bf1024821396361b511edf7b75a2566eafbc8a21930b6a556406b69a1ccadc20be0fa203f88e285b66c9f2848fc63188ecb75ae43d4133faae9e01246969d20e8303be9a754cfe4ac905baf4af2626a6e258345377e6cee8d5fd5ca5de2ee9ec88692dcaed05f106a575ad36961725bc0440a42403600461d5f322a162504588bc1b92491b06a1bfe7c28abc9ed38600f561acf2d77037fdbd581ba5eba56e7a7c944ed742b41830b4361009409b392bd428d39662d606be9a2c1ad37132a90cb4b8dbd8ae32cc2a3943f184633a8237737c9fb9e660e51a0034fa93a67214e8a550c416fc83fa8bc26890836c52975996aef9f1107af2630c2f634f7ba7658eeead6410c82730a28789977b71d192d111bd6169452608a8e7049a535e65e490315126f5d7e9ef81720a189ae65e607df3f947883764ab3396ce6eff08ed67cb3e3c30496730d40c435e593f49727536c39b0eece0be0db20791a97a9c428fe0470d354f2892be287dd8693368ed71bcdfeaacb3fd0c3f08e8b6b73d27f6eea52a0882280cb113e402a321373b2e54dbb61619e12a77db4cafc24711e5ab373725d093f596daae488d0c04d3aec57bc81cffb00955e3967fd127f25308ebd5d66cfa675ce003d2d5bc25cfc850671ab0e75fa0636d3eb92fa4d8f3c39bdb93692084fc72a258f6aecc2c73b6404532fd5fa96d78a77f5259deda89d799805bf8417f43055b9baefa837d3f6d8b6d2373e7c4de5768a8369876d14c2dec82e5e7ad4a7435e4697ccc8d64ce82a44827940fcc6520475f382fa32be56568ab1661050748bc4f9497fcbbc99ae5e52366bdd2c0e17dd28cc0ecb5125d9ea904683446f81d228326d96ed0d70d1f1cf2b12f9cd12ec85a82e8223f246285fe450e2fbc81fea532256795c2eb3b4703697fdb5c84eccf6930bbb28213d78a911d3ce7df64a08f3e18b294426ac6e6480c52298f5a341bec55c38435d9b1e2f288b204313aba9d1f46fa3be58e5e886a2e97da17011e6abcf475b8d8dec72218a5efd6cc89a8cb6a1efe90e23f9592a721dc98dadd77c3e2ea46b406e7d26f5baebfbf81ae80a03ccfb0068feee3da72d2ac20211505a5eb624a49169e50b0902469e82cb3ad7c8a24c26fec7865bf586eca59543d045a96c9837cf1780874f4b920dcf4d3d361b431eb0a8843bf41b80ff4ad1ffef8693741f7a41c2f19068d4ab2455b36d1a9a5132f58664c9ddf604be579f1b85162489bcfb0636b3a5b750192e280c3c6f6b23a045a2c47cf48e45eb30229040a2609ed58fe6431da34246b34be179cce53f04d4d0f10db43110d1643f072de51914d3bdaca35ebd56338c7fca926b4995caeaa8e415c9f0d2ad0643581feedeea7a94e5fe2e2acbb867f58c3c1e299291b2bd0d8886bfa15f2507d81a5ece67ac333355bae5329417b4dde5902697ed31eae8122c3c01bbb7124d776ccaf31a7e683c34f813e7231ecb648a9092a8861e5b9be38066ee656b117bae55137dd271abb33547748e03c018afbc7faee50afa6b38d685f99752e48ba37a68076525c8ae1068bb9e5121b58d203f8461c53045404d63c7b115b8c9473b0beaa1a398e4a41dbbba629b26a7a52562382b465ee35dbb5584d2531fdeea3aca5a2aef5f40e45ea59b78611ad37f3facfc80971c059ca91da04c80f17cf678b29077f091aa0e0c129f2216e69fc25655a8ae89ff0e4b8169aaba1330af265e9f7998a458ce3ef96ccbd75cf250b6fee93f213ed8320cd00e422ce2de3beefff341046cf68925bd7835a9c3384b70f9d55511a9d65a8dbf5d9ae092a1f89879007d85cad8acf64721558ad71febdf9d6eba80769deb72d7e0f250f9d0aac0b5e22b01a38e32eda3f7710e536187f570781a1eae0988129a9d436a6de72d3236784a2c866148280fa416f376bd489f769e7382ef6f2895a911d1ba8c8ec8e2b7e34295b2208efb65f1f5319620c1cc8ed98eb6dc7a6186f144ba81e9f61c2d92caf87cfc8c0850f5f2259c52da6e2a7c4799a867257a84020f4e1fb45636537f897dfb701eaf79bc235f623d105950a19d0744e50a2bfc40029903ebf3dda481adf5c4349f2497087c70e16eb9e7003f8dc885d413c3f2df3f0f9053508096a22e0ccf61e139d1e260f58549862181a14ad4bbd152368df98e69425ef5491cd438dd83f6c3ea2e4a6c01f89de8d585184492e9cf60a3969f2b361f7ba9cdf223f68da85f61178058d50f1d1cb138a04cf10055943541f0fb2b7d30afb3878ece8bd7e8855a3dbc68548376ff859b0b17c69fe11ab74c313b3ce018ae2ed09617e369669c6dd865c9a124b9deab5a2d6c4875ea1cd07c29dfe658e39601323c7ae4ed0c884e2515bc38b94885a90eccea1279dd87f7f741277aecbdef376512a5e54fffcd30d48bedbead9f4169e3579303eb432bb65efcdd84d5751a0657945c8b3faaddcaaf49b7fb65342a93990206bad93b2317fcdfed8c4fc3004ca321ca99b7b7e515f822987ab870ab27cfbf439eafa4eb677ee3ef82ac7577c67c993432c2c44c7c6042a098b08029fdb89f727de76782040e6c98f52614284c0e342491dc37419e9e9c026b029211cc5fcbdb6217cc81916ee88f9a02f1fb57a037938ef66d4c1d5afe6830d44168fa238064239c81bfe0e7fd1a02351518f81e150b944c69b9c6ad935391c7b737990d6e05d163df0488e0b046bcf21d89886b0f10974919794fbe1f2150f4ab451ef7a3b595029b161060c0b200a32730b2db4445343eff3ed02007e53e6d637b38d7dcb018673e6ff6c57d9cbe783a2e094b9b3ad5989d63b9b2c3eed3b56c95dcd2e56eeb411c253f50a18e727c4e2b47c12ccdfe36d6c72b68f2d21328a29d6f77206964421fdd609afb32e69a6cc7e17b4e48c19a1fc29be03a074ee4e986d1171e373c76a8cf7878a144399c9b7406a1394d67421b07a69c16e908d795ce104c4ec1ed17b14a05907ddb12fb55e3916201f9e83279aeba62504884204c771cd942826849c8c082aa548cd2733237b217f8b841a69344aa0e32691bfad2fdee7d36599d7e1cca5c5c4dbe89b04260058b3064927ac2401c08398655d90ecfc229b80110edde4fba3fb94a9f81a45eccadc52e8d7e88f553cdc8153577a2adccbdf20be51659b68b025b44c5561b914bcfeec01a7f04ac475c8e1fc07756e58837b7e3b0c0b56edfe392a947b74c6dc8194dc95bf7c96a4b540dd948ba01f73914ab3e46dbbecdbe6d8f6cbed018d903811c06b8630f50b1eb87b9df86dbd5aa380e523404c6d62098bebedcc3fff0dd6673a977e754727fc2309ca96ec62f0d08a8f327a3663304868aa338ccd7e2723117e878a4fcc6432828f89482a67db350a6a0a98c1ee02c9d51d2f4fa9712f4b60d74442d964420c44aed3d529c30ef528a769fa929985216a6279030231f0c22a2c736d4bfba68f95fb8c01cc20ec0d067937c5ffb54ae0498d38846d4656ffabc47f77e39fba9b9a8e91fe1ea9f824c11e9cb0e3d68dc51e7cb4a4b8f9acbe1c887584ecf1f641e55ec0b7d8eb59eb9d4c023f9838d8df8a24b11de01df5198474f2dca39042cff05e29ef3fc6a656ccfe2ccf60ddacb0c070d7d70ebb4d27e59e07d451a8eedc552cdd9214c50b1e032346df6d206152f87463119b5e5204573e4ead1688088e38791744859dcc3c3d45feb930c93c32051a219f8990ef039d5a62afe6a929bf6589eccda6a4759939a7c2a98825c613e5a0f92004988f80299673ac84eb9c166a4a0b7dd80692912ed49ebecfc0ebcc2098489d9c6a3d228a0f2b9bbb0d0356900affe25fe336c5ae38fdfe71fc54be6d571b416005471c1ca4fc5f50db5b6fe4c1cf4d4bef13fb17c2591bf3ebba6fe467a5d52189cb77b05538f5e52e8770fba03c61d497d18023b660574182c7cb1dddf9d4ddd9341cf1e673ae63aa096c67ef72420adc4080999583d0b19f343e54aa4644251c8172b9a5c6054eb61a894213d841f1db772c58a3ef6d6fba59149091823f4b3971f9fa04cb372a31a63a44e48bd88ff3e1dd82824a49f4048631a8dce48c1b622f6108d2f56b5fd58e7d0fa995d1aefd3229b771c82e8cb29ff2a62176fe4b46ec9759953df3ae83447e8f739966ed5f4c10654ce6c009f6f517f258063b7ce5ecf9cbb64303f5e7bd1ec5eb3f35008d4ac7b1cc7951feeb456bf0c387cd607716584425c34dbae63ed73de69f45b93b3a5186273dce4d5395208d140178ce6b2a74c26c05227035f80f1eb83cdfa8307ee42f1a4fcb9f7a5fe1e364b33e93d55a0baca723bc52e8125db6a9efc605c9e63a8629ac6353ae8a42e9a063ef8861cbec55191d77607c3adebcf69854ee2d4142914666a9ebdc8b3905f6c8814bae8993a4de28dc6f55fc4e6361595b1aa5150f35fc44637ff301205ef6026bf6750d6642856efdda46c4769fd2bc1442b1b8ec5f359256490c864efdd770948cfc2517c7cf5619c77b9ef52f83b39bb34654efba90749b240fe63cf2f29534b53f63935eb3fa0d4802753d9109ac9bd939122a3fca7f83dd2219c228e77ab8c5ef80e822146c500b18aaaaf5dd812e61e600500006cf4b6380fa1478371693ee38cb53f7f9c3c2b9d97a0f6a8881e98f510c4959511ac4f36c0228a76745c939d55308e34aa60ac892c0fffce3570321daab0834aa9595b8b7968fa4d1fb5fcb4ce602ef8288fd3eaf1e7f14b8fdbfdeac5ce3aebe2511632aec1f3662cbb9eeb994f197ca4c5bd8635d76d932589d291d2ebd5a15256a6f37111a2c6d4637345eb216f5a9aaa80d795f790fd1480d383705a70bd656108d1e851910d616e130d4347292153ae11c6385c852d629727004187dbbb73cb5c420803f96a1b30ec525305ef485c79edcca3a3b217ecb1538970cf62598fdfe01ce441e0a7595b7fe08aa2afd3525cf595baf296bbec929b5f8194869ea42e9129b1b40cc7ccbdc755e7d59e53e0a7ddeb80f8998119df3f33a4930a0deb9cdb9aef16c6770c3fecf6c4ad80fac6500bca07ac803d69c5656849d04c56caca4e60e0eb1c374a0c78a3832ff2e07e8507be78ed4763427a49b05ae6c2a1d50c650c3cf9b831621bc2af9211f4fa3d095575b39fad7633273ea5dadc41be795ebc6385530eb8c60fc727328cb547dc188528194d7c40c234bf11a894830920cfe5687cc391973c0d06f04136ab0194dc68cc7ed421fb93b050e7216c5c8f8cf26cd979c8bcf1b676510f997cd4be483ac0bc07ef390effcdda3ea34765b38e94781edea992123eac19a360d5f7b8496d834c644d3f0c699e879b6e4f9509f8b7edbef9a9d00dc534625db1fd117bff40a64a1903ad480087f12ca3e37fa59d92e7db4f4f27c2d46433366cd97e49aec01d03edc8276040cad3", 0x1000) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x20, 0x52, 0x1, 0x0, 0x0, {0x1c}, [@typed={0xc, 0x6, 0x0, 0x0, @u64}]}, 0x20}}, 0x0) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, 0x0, &(0x7f00000000c0)) 1.864045262s ago: executing program 1 (id=2306): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) setsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000000040)=0x2, 0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e24, @empty}, 0x10) setsockopt$inet_tcp_buf(r3, 0x6, 0xd, &(0x7f00000000c0)='v', 0x1) r4 = socket(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000ac0)=@raw={'raw\x00', 0x3c1, 0x3, 0x328, 0x0, 0x178, 0xc, 0x128, 0x178, 0x258, 0x258, 0x258, 0x258, 0x258, 0x3, 0x0, {[{{@uncond, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@hl={{0x28}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff}, {0xffffffffffffffff, 0x40}}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @mcast1, [], [], 'gretap0\x00', 'vlan0\x00'}, 0x0, 0xd0, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@remote}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x388) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000100)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000068000100030000000000008000000000000000000c000200010000000600000204000c80"], 0x28}}, 0x40000) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r6, 0x1, 0x23, 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r7, 0x29, 0x46, 0x0, 0x0) getsockopt$inet6_int(r7, 0x29, 0x46, 0x0, &(0x7f00000000c0)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) unshare(0x6020400) r8 = gettid() syz_open_procfs$namespace(r8, &(0x7f0000000000)='ns/uts\x00') syz_open_procfs$namespace(r8, &(0x7f0000000240)='ns/mnt\x00') unshare(0x2c060000) close(0x3) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000002100010000004312000400b4c008570e000063b02b7862400200020000000000"], 0x24}}, 0x44044) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r4, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x54, r2, 0x400, 0x70bd2f, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x3f0}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xbb5}]}, 0x54}}, 0x4000) 1.038921304s ago: executing program 4 (id=2310): r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0x0, 0x1}, 0x20) bind$l2tp6(r2, &(0x7f0000000040)={0xa, 0x0, 0xc38, @private1, 0x6}, 0x20) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) r4 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x9, 0x0, r6}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0x8c, r4, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{{0x8, 0x1, r5}, {0x70, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x34, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4}}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24004000}, 0x24044880) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xc, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="850000002200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x1e2febc4, 0x0, 0x8}, 0x10, 0xffffffffffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r8, 0x0, 0xcc0, 0xfffffffffffffde6, &(0x7f00000001c0)="348b0d151f8218e3c73697e4080049c416b90900000093291cfc5e8b99005e8b9900", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000000)={0x2454, 0x7, 0x7f, 0x69, 0x4000, 0x6, 0x2, 0xffffffffffffffff}, &(0x7f0000000080)={0x5, 0x1, 0x43f6, 0x5, 0x9, 0x5, 0x8001}, &(0x7f00000000c0)={0x235, 0x7, 0x3, 0xaaa, 0x2, 0x6, 0x1aa, 0x5}, &(0x7f0000000140)={r9, r10+10000000}, &(0x7f00000001c0)={&(0x7f0000000180), 0x8}) socket$inet6_sctp(0xa, 0x5, 0x84) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010003081000418e0ec00004fcff", 0x58}], 0x1) 1.002461797s ago: executing program 2 (id=2311): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000004000ffffffff0200000008000300", @ANYRES32=r3, @ANYBLOB="080002002e"], 0x24}, 0x1, 0x6c00, 0x0, 0x4d080}, 0x0) r4 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r4, 0x8915, &(0x7f0000000000)={'virt_wifi0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x4, &(0x7f0000001100)=ANY=[@ANYBLOB="18000000000000000000000000000000711226000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x90) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000004000ffffffff0200000008000300", @ANYRES32=r3, @ANYBLOB="080002002e"], 0x24}, 0x1, 0x6c00, 0x0, 0x4d080}, 0x0) (async) socket$qrtr(0x2a, 0x2, 0x0) (async) ioctl$sock_qrtr_SIOCGIFADDR(r4, 0x8915, &(0x7f0000000000)={'virt_wifi0\x00'}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x4, &(0x7f0000001100)=ANY=[@ANYBLOB="18000000000000000000000000000000711226000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x90) (async) 901.364897ms ago: executing program 4 (id=2312): r0 = socket(0x840000000002, 0x3, 0xff) setsockopt$inet_int(r0, 0x0, 0x16, &(0x7f0000000000)=0x9, 0x4) sendmmsg$inet(r0, &(0x7f0000000400)=[{{&(0x7f00000001c0)={0x2, 0x0, @local}, 0x10, &(0x7f0000001980)=[{&(0x7f0000000200)="a9050000000074640006000000003552", 0x10}, {&(0x7f0000000600)="174640b6d80fb2eedc81ba60cc0800", 0xf}], 0x2}}], 0x1, 0x0) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) r1 = socket(0x38, 0x2, 0x6) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r1, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000fe0000000000000008000f00fd000000", 0x24) 795.086497ms ago: executing program 1 (id=2313): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000001c80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x2, [@int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @union={0x0, 0x1, 0x0, 0x5, 0x1, 0x4, [{0x0, 0x1}]}]}}, 0x0, 0x42}, 0x20) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)={0x98, 0x13, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_USERDATA={0x2f, 0x8, "40733c73c836ba7879e79089715907c6b258012387950eb0b94fb3b521ad898129ba7a0e3ceda439ba09b2"}]}, 0x98}, 0x1, 0x0, 0x0, 0x90}, 0x80) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f0000000080)=0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x4, 0x4, 0x4, 0xbf25}, 0x48) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="034886dd09032800050030000000600000001228110081e949b93897bc3b0000000040007d01ff020000000000000000000000000001"], 0xfdef) 751.619921ms ago: executing program 4 (id=2314): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f0000000040)=0x800, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x2c, &(0x7f0000000000)={0x0, 0x0}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x2c, &(0x7f0000000000)={0x0, 0x0}, 0x10) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00'}, 0x94) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x2a, &(0x7f00000000c0)=0x7a, 0x30) (async) setsockopt$inet_tcp_int(r2, 0x6, 0x2a, &(0x7f00000000c0)=0x7a, 0x30) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r3) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="14000000130001ffffff7f8cd913e90002"], 0x14}], 0x1}, 0x0) recvmmsg(r5, &(0x7f0000001940)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) ioctl$SIOCX25GFACILITIES(r4, 0x89e2, &(0x7f0000000000)) (async) ioctl$SIOCX25GFACILITIES(r4, 0x89e2, &(0x7f0000000000)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) socket$packet(0x11, 0x3, 0x300) (async) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000440)={0x0, 0x1005}, 0x4) 686.931566ms ago: executing program 2 (id=2315): r0 = socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000240)=0x401, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2c0000003d0007010000000000000000037c000018003780130003007174722834141faa532df09a"], 0x2c}}, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x10, 0x1406, 0x1}, 0x10}}, 0x40) sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x30, 0x1401, 0x200, 0x70bd2d, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x8001}, 0x4000040) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000200)={'sit0\x00', &(0x7f00000001c0)={@broadcast, 0x0, 0x0, 0x20, 0x0, [{@multicast2}, {@local}]}}) 526.955404ms ago: executing program 4 (id=2316): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000240)={0x1080}, 0x10) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[@ANYBLOB="240000001200211700000000000000f706000000", @ANYRES32=0x0, @ANYBLOB="000000000000000004002b"], 0x24}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@ipv6_newrule={0x24, 0x18, 0x409, 0x0, 0x0, {}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}]}, 0x24}}, 0x0) 499.65897ms ago: executing program 2 (id=2317): r0 = socket$igmp(0x2, 0x3, 0x2) (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000002c80)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001c000100000000000000000007000000", @ANYRES32=r3, @ANYBLOB="40003a000a000200aa"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x48000) (async) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000005400)={'filter\x00', 0x0, 0x0, 0x0, [], 0x0, 0x0, 0x0}, &(0x7f0000005480)=0x108) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000071121e000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 377.573876ms ago: executing program 4 (id=2318): r0 = socket$nl_rdma(0x10, 0x3, 0x14) syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000d40)=0x1, 0x4) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x3) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2}}}}}}, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000c80)={0x0, 0x68, &(0x7f0000000080)=[@in={0x2, 0x4e22, @private=0xa010101}, @in6={0xa, 0x4e20, 0x7fff, @private2={0xfc, 0x2, '\x00', 0x1}, 0xfffffffe}, @in={0x2, 0x4e21, @empty}, @in={0x2, 0x4e24, @multicast2}, @in6={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}]}, &(0x7f0000000cc0)=0x10) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f0000000d00)={r4, 0xf5}, 0x8) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000000)={0x6, 'rose0\x00', {0xffffffff}, 0x7}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081780000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071103b00000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afc0513466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea01d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a07f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a126a1bdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0d5d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f10bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d00b07862c4fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52c094016406cdd32abf77fea373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515dca8811922929e08538fab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f57cbc05cd897f40693ec427ea71578130cde48de3b4dda0c7b615b57ccd4f8ac729a80f891d91a89d967948b9d95b1f22480ab48969e86b854a8c17f3e264ce11f9f63552364e759eec94572f2f7b0e2f293573d0b80709815f4344f908c00"/2646], &(0x7f0000001780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffe04, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}, 0xfffffffffffffd00}, 0x48) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000001401"], 0x30}}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$inet6_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000d40)=0x1, 0x4) (async) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) (async) listen(r1, 0x3) (async) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2}}}}}}, 0x0) (async) socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000c80)={0x0, 0x68, &(0x7f0000000080)=[@in={0x2, 0x4e22, @private=0xa010101}, @in6={0xa, 0x4e20, 0x7fff, @private2={0xfc, 0x2, '\x00', 0x1}, 0xfffffffe}, @in={0x2, 0x4e21, @empty}, @in={0x2, 0x4e24, @multicast2}, @in6={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}]}, &(0x7f0000000cc0)=0x10) (async) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, &(0x7f0000000d00)={r4, 0xf5}, 0x8) (async) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000000)={0x6, 'rose0\x00', {0xffffffff}, 0x7}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081780000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071103b00000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afc0513466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea01d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a07f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a126a1bdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0d5d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f10bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d00b07862c4fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52c094016406cdd32abf77fea373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515dca8811922929e08538fab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f57cbc05cd897f40693ec427ea71578130cde48de3b4dda0c7b615b57ccd4f8ac729a80f891d91a89d967948b9d95b1f22480ab48969e86b854a8c17f3e264ce11f9f63552364e759eec94572f2f7b0e2f293573d0b80709815f4344f908c00"/2646], &(0x7f0000001780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffe04, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}, 0xfffffffffffffd00}, 0x48) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000001401"], 0x30}}, 0x0) (async) 270.472043ms ago: executing program 2 (id=2319): socket$kcm(0x10, 0x2, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)={0x1c, r2, 0x101, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000080000000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00'], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="ff0000000000e4ffffffffffffff0020f46e0500", @ANYRES32=r4, @ANYBLOB="0000000000000000b70300004f000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r5}, 0xc) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_ro(r7, &(0x7f0000000040)='blkio.throttle.io_serviced\x00', 0x0, 0x0) preadv(r8, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/140, 0x8c}], 0x1, 0x0, 0x0) (async) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0x8, 0xb}, 0x48) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r10}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x17, 0x9, &(0x7f0000000880)=ANY=[@ANYBLOB="18080000000000000000000000000000e810000085000000bb0000000000000000000000ed9400000000000000000000000000000000040000be3936503dff3cdf96c4205d8bcfb83a8786d30900b1ec20bb0e0f28803c458f36abe9dbe8ddd48f9b7293397e26175c7737ee4313b4e3ba54ec2bc9b4df30d2de4900ebd327413c47676c44b01807ff32"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x14}, 0x90) (async) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r11 = socket(0x400000000010, 0x3, 0x0) (async) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r13, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) (async) sendmsg$nl_route_sched(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {}, {0xc, 0x9}}, [@TCA_RATE={0x6, 0x5, {0xff, 0xa8}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000810}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x4, 0x9, 0x7, 0x8001, 0x9, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7, 0x10, 0x1000, 0x40}}) socket$l2tp(0x2, 0x2, 0x73) (async) sendmsg$nl_route(r8, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f0000000980)=@can_newroute={0x3ac, 0x18, 0x20, 0x70bd28, 0x25dfdbfe, {0x1d, 0x1, 0x7}, [@CGW_CS_XOR={0x8, 0x5, {0xfffffffffffffffa, 0xfffffffffffffffc, 0xfffffffffffffff9}}, @CGW_CS_XOR={0x8, 0x5, {0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x96}}, @CGW_SRC_IF={0x8, 0x9, r14}, @CGW_DST_IF={0x8, 0xa, r15}, @CGW_CS_CRC8={0x11e, 0x6, {0x49, 0xe, 0x36, 0xff, 0xff, "4ac5a83db1c299b92ae60c7dc34496287a251fbb949ba147cce77ffb754dcfc20340f09b880eab75d7c955b48090eca3d68de86291bcb65a7b3f63c1a49fcd0fd64494ea6e8170fd94a76d20095b6071688f3c9d9a6dd2eb9aa7e31f415a358a0ce872c5053e3ab566dc7993a77b13996000559f3f492ed8e17c86391afd1d32bcdd21d95037c5eafc6818836ddcdc06cdad86505c70ec378ec1396eadc871d5040a93e60cd4d8352bb2afc68ac52c2a58d1769fabcf689a2648595a7e8b31e079dae481aedf43a83af631b893675245bd6c5d55579e5617aab814f6e57eb67f903df029f6b7478ee60f25159e4debca54d1119961266675f28477cf2baace2b", 0x1, "e32d3cf06d50cce78eada65b58444d68d4293382"}}, @CGW_CS_CRC8={0x11e, 0x6, {0x48, 0x36, 0xfe, 0x2, 0x81, "d849c98e27ab08af8121c1425f004716e2cbbdef959723b7e5e3ce80bc4bde34603693456d9004590112d80dae5a52f59fbe4ce9c5cb99ca0c98bedc305051b93acf55ffdef5aec60094a3e3cb520dc950d87b163adc131809dd449491eab443d391e6987c701ac24e27dc381e6df152233cdcfa799097df920a3dd3a0e7ce96ce367cc9d9ea75d459c99d55bcb0afbb611aa84a9d21ad0daf31efa2d086c6a4af36f1681af2f8fbae981d23c86a3b7174588c2c73a9dd5ec6aee6d5769e7dc7128bb55f238abf13811c3fa88933e7de327da9a31aae6dfe9d52d1d285056834c921ec805f748d2a23e9000212da7a6b04d1a1e57d9c36198fe71778fa51fd11", 0x3, "2dd09b4b49b8786824238282800ddfa48cf82ef1"}}, @CGW_CS_CRC8={0x11e, 0x6, {0x32, 0x3, 0x4e, 0x5, 0x9, "f870417194614c3f6c1df428462331e6bb954f2906645548839862e30ee5c3ea98abdaa8c076fd4ef0f15b1dd2102f80064f5bb46932461d9253f8fe3b9501e138b446fdbc0b9ee54fb3802e9624d5bb1207c35650e002b852d9e26b9983f3f981630ca975c7b55c7eac8d935235874dd8072a87bce806caec3a403f7c083f99004bde08107675719ba2c8d599892a602e8c25e65bdb77bd34ba1460b916ff58835d56a8f4ce0a6439d84b26a12777441fb68c37e237e0e581c9590ba9f5fb989cc42a1d29b4fcb5c6e61c52e3e6a8fbe61a77a5b2486a77f387a321b76bbbc723f7c2d1c8e89b42e4d89d853937e34dbd1a027a8120c2369e2a4c6bfd6ad13f", 0x2, "618cfcb38f01763423ff41b80856d9387db2d566"}}, @CGW_MOD_XOR={0x15, 0x3, {{{0x1}, 0x5, 0x0, 0x0, 0x0, "4140f477e44997bd"}, 0x7}}]}, 0x3ac}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000580)={'wg1\x00'}) 269.293201ms ago: executing program 1 (id=2320): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = socket$inet(0x2, 0x3, 0x8) socket(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x54, 0x0, 0x2, 0x401, 0x0, 0x0, {0x7, 0x0, 0x6}, [@CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0xffffffff}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x81}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_EXPECT_MASTER={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @broadcast}}}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7}]}, 0x54}, 0x1, 0x0, 0x0, 0x8004}, 0x10) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x1e0, 0x0, 0xe138, 0x198, 0x0, 0x198, 0x148, 0x358, 0x358, 0x148, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @empty, 0xff000000, 0x0, 'xfrm0\x00', 'team_slave_1\x00', {}, {}, 0x33}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x1, 0xd, 0x3, 'syz0\x00', {0x17}}}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x240) write$tun(r1, &(0x7f0000000280)={@val={0x1c, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x1c, {[@window={0xe, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x28, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x102, 0x0, 0x0, 0x1, [@typed={0xc, 0x22, 0x0, 0x0, @u64}, @typed={0xffffffb1, 0x1, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f"]}]}, 0x114}], 0x1}, 0x0) 62.912474ms ago: executing program 4 (id=2321): connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000000c0), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x32, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xfffffffe}}]}, 0x38}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000200)={'dummy0\x00', &(0x7f0000000140)=@ethtool_gfeatures={0x24}}) r1 = socket$inet6_sctp(0xa, 0x3, 0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xa, &(0x7f0000000140)=0x9d, 0x4) r3 = syz_genetlink_get_family_id$devlink(0x0, r0) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0xf0, r3, 0x400, 0x70bd29, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}]}, 0xf0}, 0x1, 0x0, 0x0, 0x4040810}, 0x5) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140011"], 0x48}}, 0x0) 0s ago: executing program 2 (id=2322): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) setsockopt$inet_tcp_int(r1, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r2, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000000)={0x20, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@newnexthop={0x28, 0x68, 0x400, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}, @NHA_FDB={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) (async) setsockopt$inet_tcp_int(r1, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r2, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000000)={0x20, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@newnexthop={0x28, 0x68, 0x400, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}, @NHA_FDB={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) (async) kernel console output (not intermixed with test programs): 246.834235][T11483] : entered promiscuous mode [ 246.964709][T11483] gre1: entered promiscuous mode [ 246.982799][T11497] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1471'. [ 246.991895][T11483] gre1: entered allmulticast mode [ 247.005633][T11498] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1473'. [ 247.028552][T11497] dummy0: left allmulticast mode [ 247.036122][T11497] bridge0: port 1(dummy0) entered disabled state [ 247.364207][ T3504] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.415817][T11508] tipc: Enabled bearer , priority 0 [ 247.498393][ T3504] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.752556][ T3504] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.936548][ T3504] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 248.026527][ T3504] bridge_slave_1: left allmulticast mode [ 248.032796][ T3504] bridge_slave_1: left promiscuous mode [ 248.039047][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.051988][ T3504] bridge_slave_0: left allmulticast mode [ 248.058400][ T3504] bridge_slave_0: left promiscuous mode [ 248.064172][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.378078][T11518] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1479'. [ 248.473942][T11524] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1482'. [ 248.740824][ T3504] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 248.771606][ T3504] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 248.783857][ T3504] bond0 (unregistering): Released all slaves [ 248.907080][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 248.918893][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 248.928945][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 248.937330][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 248.942611][T11536] netlink: 'syz.1.1487': attribute type 1 has an invalid length. [ 248.974464][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 248.995986][T11538] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1486'. [ 249.288256][T11533] lo speed is unknown, defaulting to 1000 [ 249.521552][T11555] IPv6: sit1: Disabled Multicast RS [ 249.559809][T11555] sit1: entered allmulticast mode [ 249.901264][T11573] 8021q: adding VLAN 0 to HW filter on device bond14 [ 250.181410][T11592] __nla_validate_parse: 3 callbacks suppressed [ 250.181432][T11592] netlink: 14560 bytes leftover after parsing attributes in process `syz.1.1502'. [ 250.198680][ T3471] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 250.213296][T11593] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1501'. [ 250.248613][T11597] netlink: 'syz.1.1502': attribute type 3 has an invalid length. [ 250.256524][T11597] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1502'. [ 250.606644][T11612] netlink: 'syz.1.1508': attribute type 1 has an invalid length. [ 250.650993][T11612] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1508'. [ 250.699691][T11612] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1508'. [ 250.759873][T11618] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1510'. [ 250.808661][T11618] netlink: 'syz.4.1510': attribute type 5 has an invalid length. [ 251.087424][ T5848] Bluetooth: hci3: command tx timeout [ 251.470285][T11621] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 251.757160][T11658] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 251.797969][ T3504] hsr_slave_0: left promiscuous mode [ 251.805084][ T3504] hsr_slave_1: left promiscuous mode [ 251.811477][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 251.820269][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 251.844788][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 251.856778][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 251.907311][ T3504] veth1_macvtap: left promiscuous mode [ 251.919738][ T3504] veth0_macvtap: left promiscuous mode [ 251.933584][ T3504] veth1_vlan: left promiscuous mode [ 251.947557][ T3504] veth0_vlan: left promiscuous mode [ 252.556006][ T3504] team0 (unregistering): Port device team_slave_1 removed [ 252.603042][ T3504] team0 (unregistering): Port device team_slave_0 removed [ 252.918569][ T5848] Bluetooth: hci4: command 0x0405 tx timeout [ 253.156989][ T51] Bluetooth: hci3: command tx timeout [ 253.258121][T11683] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1524'. [ 253.294870][T11685] netlink: 'syz.2.1525': attribute type 32 has an invalid length. [ 253.307649][T11683] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1524'. [ 253.317015][T11685] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1525'. [ 253.335647][T11683] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1524'. [ 253.367942][T11685] (unnamed net_device) (uninitialized): option coupled_control: invalid value (52) [ 253.435203][T11533] chnl_net:caif_netlink_parms(): no params data found [ 253.767619][T11685] netlink: 'syz.2.1525': attribute type 32 has an invalid length. [ 253.823754][T11685] (unnamed net_device) (uninitialized): option coupled_control: invalid value (52) [ 253.954735][T11533] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.971459][T11533] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.986362][T11533] bridge_slave_0: entered allmulticast mode [ 254.006070][T11720] IPv6: Can't replace route, no match found [ 254.018415][T11533] bridge_slave_0: entered promiscuous mode [ 254.042303][T11533] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.052953][T11533] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.060538][T11533] bridge_slave_1: entered allmulticast mode [ 254.069591][T11533] bridge_slave_1: entered promiscuous mode [ 254.144924][T11533] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 254.162782][T11533] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 254.172904][T11724] tipc: MTU too low for tipc bearer [ 254.255816][T11533] team0: Port device team_slave_0 added [ 254.273519][T11533] team0: Port device team_slave_1 added [ 254.293560][T11723] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 254.308326][T11723] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 254.405834][T11533] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 254.413820][T11533] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.449249][T11533] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 254.469551][T11533] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 254.476586][T11533] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.504386][T11533] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 254.592776][T11533] hsr_slave_0: entered promiscuous mode [ 254.600255][T11533] hsr_slave_1: entered promiscuous mode [ 254.606570][T11533] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 254.614555][T11533] Cannot create hsr debugfs directory [ 255.239425][ T5848] Bluetooth: hci3: command tx timeout [ 255.348976][T11533] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 255.364608][T11533] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 255.405187][T11533] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 255.434511][T11533] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 255.454670][T11775] __nla_validate_parse: 1 callbacks suppressed [ 255.454690][T11775] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1553'. [ 255.723488][T11533] 8021q: adding VLAN 0 to HW filter on device bond0 [ 255.745412][T11791] netlink: 'syz.3.1555': attribute type 1 has an invalid length. [ 255.749557][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 255.879260][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 255.905053][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 255.921635][T11533] 8021q: adding VLAN 0 to HW filter on device team0 [ 255.984649][ T9614] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.991924][ T9614] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.022036][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.057420][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 256.086925][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.113766][T11805] openvswitch: netlink: Message has 8 unknown bytes. [ 256.130868][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 256.143117][ T1023] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.150409][ T1023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.169702][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.202973][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 256.213778][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.239544][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 256.264612][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.285335][T11818] openvswitch: netlink: Actions may not be safe on all matching packets [ 256.288063][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 256.337273][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.351701][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 256.394329][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.424862][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1557'. [ 256.493922][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.525805][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.548452][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 256.578374][T11793] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 257.080731][T11533] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.222902][T11533] veth0_vlan: entered promiscuous mode [ 257.288617][T11533] veth1_vlan: entered promiscuous mode [ 257.317823][ T5848] Bluetooth: hci3: command 0x0419 tx timeout [ 257.369500][T11533] veth0_macvtap: entered promiscuous mode [ 257.394946][T11533] veth1_macvtap: entered promiscuous mode [ 257.489634][T11533] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 257.506148][T11533] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 257.526064][T11533] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.551238][T11533] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.574813][T11533] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.594162][T11533] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 257.911170][ T1023] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 257.931513][ T1023] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 257.984813][ T7244] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 258.004183][T11889] netlink: 'syz.3.1584': attribute type 11 has an invalid length. [ 258.028298][ T7244] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 258.459720][T11908] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 258.467078][T11908] IPv6: NLM_F_CREATE should be set when creating new route [ 258.672191][T11914] team0: Device gtp0 is up. Set it down before adding it as a team port [ 258.964191][ T7244] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.079476][ T7244] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.155119][ T7244] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.307188][ T7244] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 259.427889][ T7244] bridge_slave_1: left allmulticast mode [ 259.433608][ T7244] bridge_slave_1: left promiscuous mode [ 259.439748][ T7244] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.451223][ T7244] bridge_slave_0: left allmulticast mode [ 259.457322][ T7244] bridge_slave_0: left promiscuous mode [ 259.463898][ T7244] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.797364][ T7244] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 259.809160][ T7244] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 259.825120][ T7244] bond0 (unregistering): Released all slaves [ 260.553781][ T5848] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 260.564419][ T5848] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 260.574882][ T5848] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 260.584284][ T5848] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 260.593646][ T5848] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 260.704280][T11958] lo speed is unknown, defaulting to 1000 [ 260.743722][T11963] SET target dimension over the limit! [ 260.874643][T11967] __nla_validate_parse: 11 callbacks suppressed [ 260.874673][T11967] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1608'. [ 261.367678][T11989] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1615'. [ 261.735196][T12000] xt_hashlimit: max too large, truncated to 1048576 [ 261.743165][ T7244] hsr_slave_0: left promiscuous mode [ 261.792951][ T7244] hsr_slave_1: left promiscuous mode [ 261.806505][ T7244] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 261.847459][ T7244] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 261.868052][T12008] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1621'. [ 262.006359][T12017] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1622'. [ 262.099156][ T7244] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 262.109854][ T7244] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 262.160702][ T7244] veth1_macvtap: left promiscuous mode [ 262.166563][ T7244] veth0_macvtap: left promiscuous mode [ 262.181652][ T7244] veth1_vlan: left promiscuous mode [ 262.191403][ T7244] veth0_vlan: left promiscuous mode [ 262.684370][ T5848] Bluetooth: hci3: command tx timeout [ 262.803984][ T7244] team0 (unregistering): Port device team_slave_1 removed [ 262.854815][ T7244] team0 (unregistering): Port device team_slave_0 removed [ 263.433390][T12033] netlink: 'syz.4.1628': attribute type 1 has an invalid length. [ 263.611501][T12040] netlink: 'syz.2.1630': attribute type 10 has an invalid length. [ 263.788761][T12043] veth17: entered promiscuous mode [ 263.849243][T12043] bond10: (slave veth17): Enslaving as a backup interface with a down link [ 263.910316][T12040] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 263.934403][T12052] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1632'. [ 263.943806][T12052] tc_dump_action: action bad kind [ 264.120043][T12055] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1634'. [ 264.229334][T12065] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1636'. [ 264.399412][T12065] netlink: 'syz.2.1636': attribute type 1 has an invalid length. [ 264.404300][T12070] netlink: 'syz.4.1637': attribute type 1 has an invalid length. [ 264.407318][T12072] IPVS: sync thread started: state = BACKUP, mcast_ifn = erspan0, syncid = 0, id = 0 [ 264.511233][T12080] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1638'. [ 264.596105][T11958] chnl_net:caif_netlink_parms(): no params data found [ 264.757554][ T5848] Bluetooth: hci3: command tx timeout [ 264.808335][T12088] netlink: 'syz.4.1641': attribute type 2 has an invalid length. [ 264.816198][T12088] netlink: 119 bytes leftover after parsing attributes in process `syz.4.1641'. [ 264.888849][T12096] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 264.896152][T12096] IPv6: NLM_F_CREATE should be set when creating new route [ 264.942854][T12096] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1643'. [ 264.954774][T12098] xt_NFQUEUE: number of total queues is 0 [ 265.045893][T11958] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.070222][T11958] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.090998][T11958] bridge_slave_0: entered allmulticast mode [ 265.105495][T11958] bridge_slave_0: entered promiscuous mode [ 265.142679][T11958] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.157432][T11958] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.173962][T11958] bridge_slave_1: entered allmulticast mode [ 265.184721][T11958] bridge_slave_1: entered promiscuous mode [ 265.337185][T11958] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 265.353188][T12111] netlink: 'syz.2.1648': attribute type 30 has an invalid length. [ 265.357230][T11958] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 265.375479][T12114] tipc: Enabled bearer , priority 12 [ 265.515799][T11958] team0: Port device team_slave_0 added [ 265.531712][T11958] team0: Port device team_slave_1 added [ 265.634886][T11958] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 265.646763][T11958] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 265.690613][T11958] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 265.731847][T11958] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 265.744866][T11958] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 265.777796][T11958] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 265.923539][T11958] hsr_slave_0: entered promiscuous mode [ 265.934284][T11958] hsr_slave_1: entered promiscuous mode [ 265.943725][T11958] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 265.953371][T11958] Cannot create hsr debugfs directory [ 266.118747][ T7244] wlan1: Trigger new scan to find an IBSS to join [ 266.223034][T12157] __nla_validate_parse: 3 callbacks suppressed [ 266.223055][T12157] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1665'. [ 266.837661][ T5848] Bluetooth: hci3: command tx timeout [ 266.892134][T12191] netlink: 'syz.1.1672': attribute type 11 has an invalid length. [ 267.023498][T11958] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 267.068439][T11958] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 267.090205][T11958] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 267.110221][T11958] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 267.315968][T12209] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1677'. [ 267.358809][T12209] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1677'. [ 267.383178][T12209] netlink: 'syz.4.1677': attribute type 11 has an invalid length. [ 267.414566][T12213] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 267.431219][T12213] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 267.441914][T12213] gretap1: entered promiscuous mode [ 267.451140][T12213] gretap1: entered allmulticast mode [ 267.465776][T11958] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.485267][T12215] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 267.562283][T11958] 8021q: adding VLAN 0 to HW filter on device team0 [ 267.610488][ T9612] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.617747][ T9612] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.716470][ T3471] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.723786][ T3471] bridge0: port 2(bridge_slave_1) entered forwarding state [ 268.362271][T11958] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 268.532595][T11958] veth0_vlan: entered promiscuous mode [ 268.551705][T12268] netlink: 'syz.3.1690': attribute type 12 has an invalid length. [ 268.569216][T11958] veth1_vlan: entered promiscuous mode [ 268.595845][T12268] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (255) [ 268.660614][T11958] veth0_macvtap: entered promiscuous mode [ 268.672772][T11958] veth1_macvtap: entered promiscuous mode [ 268.723010][T11958] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 268.754503][T11958] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 268.790934][T11958] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.808188][T11958] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.818358][T11958] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.827423][T11958] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.849193][T12273] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1693'. [ 268.928685][ T5848] Bluetooth: hci3: command tx timeout [ 269.096722][T12275] xt_CT: No such helper "syz0" [ 269.110115][T12281] veth11: entered allmulticast mode [ 269.127996][T12280] lo speed is unknown, defaulting to 1000 [ 269.167118][ T1023] wlan1: Trigger new scan to find an IBSS to join [ 269.202934][ T9612] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 269.221700][T12289] xt_cluster: you have exceeded the maximum number of cluster nodes (257 > 32) [ 269.225312][ T9612] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 269.388174][ T9612] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 269.396086][ T9612] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 269.713844][T12307] netlink: 'syz.3.1703': attribute type 10 has an invalid length. [ 270.296377][ T9614] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.564016][ T9614] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.815337][ T9614] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.910606][ T9614] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.064169][ T9614] bridge_slave_1: left allmulticast mode [ 271.070054][ T9614] bridge_slave_1: left promiscuous mode [ 271.075883][ T9614] bridge0: port 2(bridge_slave_1) entered disabled state [ 271.091150][ T9614] bridge_slave_0: left allmulticast mode [ 271.097198][ T9614] bridge_slave_0: left promiscuous mode [ 271.102985][ T9614] bridge0: port 1(bridge_slave_0) entered disabled state [ 271.557038][T12333] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1711'. [ 271.566100][T12333] openvswitch: netlink: Flow key attr not present in new flow. [ 271.782274][ T9614] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 271.813052][ T9614] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 271.846456][ T9614] bond0 (unregistering): Released all slaves [ 271.908387][T12341] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 272.117656][ T12] wlan1: Creating new IBSS network, BSSID 42:70:42:4b:37:bc [ 272.233498][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 272.243274][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 272.254286][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 272.263964][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 272.272011][ T5850] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 272.457245][T12350] lo speed is unknown, defaulting to 1000 [ 272.670138][T12371] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1725'. [ 272.686190][T12371] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1725'. [ 272.842210][T12374] netlink: 576 bytes leftover after parsing attributes in process `syz.1.1726'. [ 273.128218][T12378] bond3: (slave veth7): Releasing backup interface [ 273.206536][T12378] bond4: (slave veth9): Releasing backup interface [ 273.558146][T12398] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (32767) [ 273.559964][T12403] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1734'. [ 273.603363][T12398] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 273.659181][T12403] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1734'. [ 273.722411][T12406] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 273.771067][T12406] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 274.047741][ T9614] hsr_slave_0: left promiscuous mode [ 274.062951][ T9614] hsr_slave_1: left promiscuous mode [ 274.088088][ T9614] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 274.095625][ T9614] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 274.118572][ T9614] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 274.135106][ T9614] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 274.244770][ T9614] veth1_macvtap: left promiscuous mode [ 274.260520][ T9614] veth0_macvtap: left promiscuous mode [ 274.268765][ T9614] veth1_vlan: left promiscuous mode [ 274.275000][ T9614] veth0_vlan: left promiscuous mode [ 274.290543][T12421] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1742'. [ 274.343874][T12426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1742'. [ 274.367531][ T51] Bluetooth: hci3: command tx timeout [ 274.897232][ T9614] team0 (unregistering): Port device team_slave_1 removed [ 274.943318][ T9614] team0 (unregistering): Port device team_slave_0 removed [ 275.443880][T12426] 8021q: VLANs not supported on ip6_vti0 [ 275.546652][T12350] chnl_net:caif_netlink_parms(): no params data found [ 275.843316][T12453] netlink: 'syz.1.1753': attribute type 1 has an invalid length. [ 276.044930][T12463] bond8: (slave bridge7): making interface the new active one [ 276.053679][T12463] bond8: (slave bridge7): Enslaving as an active interface with an up link [ 276.074042][T12350] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.088024][T12467] IPVS: set_ctl: invalid protocol: 1 172.30.1.3:20000 [ 276.103924][T12350] bridge0: port 1(bridge_slave_0) entered disabled state [ 276.138076][T12350] bridge_slave_0: entered allmulticast mode [ 276.166074][T12350] bridge_slave_0: entered promiscuous mode [ 276.203436][T12350] bridge0: port 2(bridge_slave_1) entered blocking state [ 276.228619][T12350] bridge0: port 2(bridge_slave_1) entered disabled state [ 276.236253][T12350] bridge_slave_1: entered allmulticast mode [ 276.258966][T12350] bridge_slave_1: entered promiscuous mode [ 276.344822][T12350] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 276.382011][T12350] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 276.437764][ T51] Bluetooth: hci3: command tx timeout [ 276.503111][T12350] team0: Port device team_slave_0 added [ 276.554141][T12487] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1761'. [ 276.581444][T12350] team0: Port device team_slave_1 added [ 276.649999][T12493] netlink: 'syz.1.1764': attribute type 1 has an invalid length. [ 276.694958][T12350] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 276.705124][T12350] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 276.732759][T12350] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 276.766119][T12493] veth13: entered promiscuous mode [ 276.776573][T12493] bond9: (slave veth13): Enslaving as a backup interface with a down link [ 276.786508][T12350] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 276.793754][T12350] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 276.820601][T12350] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 276.936199][T12350] hsr_slave_0: entered promiscuous mode [ 276.953357][T12350] hsr_slave_1: entered promiscuous mode [ 276.966094][T12350] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 276.983475][T12350] Cannot create hsr debugfs directory [ 277.294881][T12517] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1770'. [ 277.570277][T12532] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1774'. [ 277.790011][T12548] netlink: 'syz.1.1778': attribute type 1 has an invalid length. [ 278.042300][T12548] veth15: entered promiscuous mode [ 278.092462][T12548] bond10: (slave veth15): Enslaving as a backup interface with a down link [ 278.106183][ T30] audit: type=1800 audit(1752663927.199:4): pid=12569 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1780" name="memory.events" dev="tmpfs" ino=2106 res=0 errno=0 [ 278.168347][ T30] audit: type=1804 audit(1752663927.199:5): pid=12569 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1780" name="/newroot/411/memory.events" dev="tmpfs" ino=2106 res=1 errno=0 [ 278.517902][ T51] Bluetooth: hci3: command tx timeout [ 278.549386][T12589] netlink: 'syz.1.1784': attribute type 24 has an invalid length. [ 278.680047][T12593] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1787'. [ 278.700342][T12350] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 278.732387][T12350] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 278.761906][T12350] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 278.792515][T12350] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 278.880321][T12603] delete_channel: no stack [ 279.119567][T12612] netlink: 'syz.4.1793': attribute type 1 has an invalid length. [ 279.186243][T12350] 8021q: adding VLAN 0 to HW filter on device bond0 [ 279.296627][T12620] veth19: entered promiscuous mode [ 279.343109][T12620] bond11: (slave veth19): Enslaving as a backup interface with a down link [ 279.426356][T12350] 8021q: adding VLAN 0 to HW filter on device team0 [ 279.515825][ T1023] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.523107][ T1023] bridge0: port 1(bridge_slave_0) entered forwarding state [ 279.544559][ T1023] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.551815][ T1023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 279.659713][T12632] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1798'. [ 279.680955][T12350] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 279.692155][T12350] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 280.173926][T12659] netlink: 'syz.2.1807': attribute type 1 has an invalid length. [ 280.254042][T12663] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1808'. [ 280.257540][T12350] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.342577][T12659] veth25: entered promiscuous mode [ 280.367281][T12659] bond15: (slave veth25): Enslaving as a backup interface with a down link [ 280.482835][T12350] veth0_vlan: entered promiscuous mode [ 280.497777][T12350] veth1_vlan: entered promiscuous mode [ 280.560467][T12672] netlink: 'syz.4.1812': attribute type 4 has an invalid length. [ 280.598530][ T5848] Bluetooth: hci3: command tx timeout [ 280.650137][T12350] veth0_macvtap: entered promiscuous mode [ 280.675666][T12350] veth1_macvtap: entered promiscuous mode [ 280.763454][T12350] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 280.855782][T12350] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 280.871329][T12684] xt_CT: You must specify a L4 protocol and not use inversions on it [ 280.898489][T12350] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.915393][T12350] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.925755][T12350] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.936398][T12350] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.973109][T12686] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 280.983532][T12686] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 280.987257][T12691] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1817'. [ 281.107745][T12694] lo speed is unknown, defaulting to 1000 [ 281.212570][ T9614] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.235048][T12700] netlink: set zone limit has 8 unknown bytes [ 281.254235][ T9614] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 281.515053][ T9612] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 281.550960][ T9612] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 281.811305][T12719] netlink: 'syz.2.1824': attribute type 1 has an invalid length. [ 281.994944][T12719] veth27: entered promiscuous mode [ 282.004225][T12719] bond16: (slave veth27): Enslaving as a backup interface with a down link [ 282.089190][T12733] siw: device registration error -23 [ 282.678536][ T5848] Bluetooth: hci3: command 0x0411 tx timeout [ 283.015101][T12767] netlink: 'syz.1.1840': attribute type 1 has an invalid length. [ 283.115355][T12772] veth17: entered promiscuous mode [ 283.132207][T12772] bond11: (slave veth17): Enslaving as a backup interface with a down link [ 283.158779][T12771] gretap1: entered promiscuous mode [ 283.230859][T12777] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1839'. [ 283.336591][ T3504] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.461011][ T3504] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.538118][ T3504] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.596241][ T3504] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.697921][ T3504] bridge_slave_1: left allmulticast mode [ 283.703632][ T3504] bridge_slave_1: left promiscuous mode [ 283.709555][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.723919][ T3504] bridge_slave_0: left allmulticast mode [ 283.730495][ T3504] bridge_slave_0: left promiscuous mode [ 283.736333][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.085834][ T3504] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 284.099877][ T3504] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 284.110264][ T3504] bond0 (unregistering): Released all slaves [ 284.703662][T12790] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1842'. [ 284.741867][T12790] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1842'. [ 284.852761][ T3504] hsr_slave_0: left promiscuous mode [ 284.865609][ T3504] hsr_slave_1: left promiscuous mode [ 284.886064][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 284.905588][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 284.932850][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 284.951969][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 285.005839][ T3504] veth1_macvtap: left promiscuous mode [ 285.012142][ T3504] veth0_macvtap: left promiscuous mode [ 285.018076][ T3504] veth1_vlan: left promiscuous mode [ 285.023715][ T3504] veth0_vlan: left promiscuous mode [ 285.163143][ T5848] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 285.178513][ T5848] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 285.190307][ T5848] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 285.200647][ T5848] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 285.212370][ T5848] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 285.742528][ T3504] team0 (unregistering): Port device team_slave_1 removed [ 285.792558][ T3504] team0 (unregistering): Port device team_slave_0 removed [ 286.280870][T12790] veth19: entered allmulticast mode [ 286.426206][T12800] lo speed is unknown, defaulting to 1000 [ 286.580022][T12819] netlink: 'syz.2.1852': attribute type 1 has an invalid length. [ 286.660896][T12824] Cannot find set identified by id 752 to match [ 286.737848][T12825] veth29: entered promiscuous mode [ 286.886115][T12835] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1855'. [ 287.221737][T12851] tipc: Enabling of bearer rejected, failed to enable media [ 287.237874][ T5848] Bluetooth: hci3: command tx timeout [ 287.423741][T12855] netlink: 'syz.1.1861': attribute type 1 has an invalid length. [ 287.571946][T12855] 8021q: adding VLAN 0 to HW filter on device bond12 [ 287.722474][T12854] 8021q: adding VLAN 0 to HW filter on device bond12 [ 287.730294][T12854] bond12: (slave vxcan3): The slave device specified does not support setting the MAC address [ 287.743296][T12854] bond12: (slave vxcan3): Error -95 calling set_mac_address [ 287.855257][ T5920] hid-generic 0005:0C45:1010.0003: item fetching failed at offset 0/1 [ 287.889980][ T5920] hid-generic 0005:0C45:1010.0003: probe with driver hid-generic failed with error -22 [ 287.950795][T12868] netlink: 'syz.1.1864': attribute type 23 has an invalid length. [ 288.073590][T12800] chnl_net:caif_netlink_parms(): no params data found [ 288.213481][T12875] netlink: 'syz.2.1867': attribute type 1 has an invalid length. [ 288.359269][T12800] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.366602][T12800] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.374231][T12800] bridge_slave_0: entered allmulticast mode [ 288.382470][T12800] bridge_slave_0: entered promiscuous mode [ 288.419471][T12890] veth29: entered promiscuous mode [ 288.434006][T12890] bond18: (slave veth29): Enslaving as a backup interface with a down link [ 288.443583][T12800] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.449485][T12891] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1869'. [ 288.451658][T12800] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.477590][T12800] bridge_slave_1: entered allmulticast mode [ 288.487919][T12800] bridge_slave_1: entered promiscuous mode [ 288.505232][T12889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1868'. [ 288.652487][T12800] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 288.710647][T12800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 288.804940][T12902] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1872'. [ 288.850240][T12800] team0: Port device team_slave_0 added [ 288.861718][T12800] team0: Port device team_slave_1 added [ 289.024821][T12800] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 289.034508][T12800] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 289.074035][T12909] sctp: [Deprecated]: syz.2.1875 (pid 12909) Use of int in maxseg socket option. [ 289.074035][T12909] Use struct sctp_assoc_value instead [ 289.080318][T12914] netlink: 'syz.1.1877': attribute type 24 has an invalid length. [ 289.088699][T12800] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 289.091198][T12800] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 289.149859][T12800] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 289.213501][T12800] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 289.291125][T12922] netlink: 'syz.3.1880': attribute type 1 has an invalid length. [ 289.317020][ T5848] Bluetooth: hci3: command tx timeout [ 289.345683][T12923] netlink: 5356 bytes leftover after parsing attributes in process `syz.2.1879'. [ 289.438518][T12800] hsr_slave_0: entered promiscuous mode [ 289.457457][T12800] hsr_slave_1: entered promiscuous mode [ 289.464026][T12800] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 289.471875][T12800] Cannot create hsr debugfs directory [ 289.511408][T12922] veth11: entered promiscuous mode [ 289.526391][T12922] bond11: (slave veth11): Enslaving as a backup interface with a down link [ 289.889728][ T1023] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.902275][ T1023] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 289.915546][T12954] netlink: 'syz.4.1886': attribute type 2 has an invalid length. [ 290.186446][T12966] netlink: 80 bytes leftover after parsing attributes in process `syz.3.1890'. [ 290.393009][T12979] gtp0: entered promiscuous mode [ 290.418629][T12979] gtp0: entered allmulticast mode [ 290.443495][T12979] gtp1: entered promiscuous mode [ 290.472385][T12979] gtp1: entered allmulticast mode [ 290.505777][T12983] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1896'. [ 290.547435][T12979] gtp2: entered promiscuous mode [ 290.562765][T12979] gtp2: entered allmulticast mode [ 290.572408][T12986] netlink: 'syz.1.1898': attribute type 10 has an invalid length. [ 290.584992][T12986] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1898'. [ 290.595307][T12988] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1897'. [ 290.600768][T12979] gtp3: entered promiscuous mode [ 290.612002][T12979] gtp3: entered allmulticast mode [ 290.653789][T12986] batadv0: entered promiscuous mode [ 290.672308][T12986] batadv0: entered allmulticast mode [ 290.682034][T12986] bridge0: port 2(batadv0) entered blocking state [ 290.693787][T12986] bridge0: port 2(batadv0) entered disabled state [ 290.707988][T12986] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 290.737249][T12979] gtp4: entered promiscuous mode [ 290.742420][T12979] gtp4: entered allmulticast mode [ 290.768610][T12991] 8021q: VLANs not supported on vcan0 [ 290.789961][T12979] gtp5: entered promiscuous mode [ 290.795204][T12979] gtp5: entered allmulticast mode [ 290.824823][T12979] gtp6: entered promiscuous mode [ 290.830112][T12979] gtp6: entered allmulticast mode [ 290.852337][T12979] gtp7: entered promiscuous mode [ 290.860068][T12979] gtp7: entered allmulticast mode [ 290.874139][T12979] gtp8: entered promiscuous mode [ 290.880613][T12979] gtp8: entered allmulticast mode [ 290.903184][T12979] gtp9: entered promiscuous mode [ 290.910185][T12979] gtp9: entered allmulticast mode [ 290.925929][T12979] gtp10: entered promiscuous mode [ 290.931482][T12979] gtp10: entered allmulticast mode [ 290.964962][T12979] gtp11: entered promiscuous mode [ 290.970383][T12979] gtp11: entered allmulticast mode [ 290.993924][T12979] gtp12: entered promiscuous mode [ 291.001394][T12979] gtp12: entered allmulticast mode [ 291.033132][T12979] gtp13: entered promiscuous mode [ 291.038595][T12979] gtp13: entered allmulticast mode [ 291.071212][T12979] gtp14: entered promiscuous mode [ 291.078311][T12979] gtp14: entered allmulticast mode [ 291.114871][T12979] gtp15: entered promiscuous mode [ 291.120340][T12979] gtp15: entered allmulticast mode [ 291.131882][T12800] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 291.155661][T12979] gtp16: entered promiscuous mode [ 291.161254][T12979] gtp16: entered allmulticast mode [ 291.173077][T12800] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 291.195949][T12979] gtp17: entered promiscuous mode [ 291.202376][T12979] gtp17: entered allmulticast mode [ 291.207964][T13009] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 291.225017][T12800] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 291.244801][T12800] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 291.398084][ T5848] Bluetooth: hci3: command tx timeout [ 291.443627][T13022] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1904'. [ 291.546041][T12800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 291.614849][T12800] 8021q: adding VLAN 0 to HW filter on device team0 [ 291.662593][ T9614] bridge0: port 1(bridge_slave_0) entered blocking state [ 291.669934][ T9614] bridge0: port 1(bridge_slave_0) entered forwarding state [ 291.712080][ T9614] bridge0: port 2(bridge_slave_1) entered blocking state [ 291.719373][ T9614] bridge0: port 2(bridge_slave_1) entered forwarding state [ 292.215536][T13050] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1912'. [ 292.433399][T12800] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 292.638474][T12800] veth0_vlan: entered promiscuous mode [ 292.676113][T12800] veth1_vlan: entered promiscuous mode [ 292.796415][T13079] netlink: 'syz.1.1920': attribute type 1 has an invalid length. [ 292.819761][T12800] veth0_macvtap: entered promiscuous mode [ 292.975705][T12800] veth1_macvtap: entered promiscuous mode [ 293.067037][T13091] netlink: 'syz.3.1923': attribute type 1 has an invalid length. [ 293.109384][T13086] veth21: entered promiscuous mode [ 293.153740][T13086] bond13: (slave veth21): Enslaving as a backup interface with a down link [ 293.276036][T12800] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 293.322210][T12800] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 293.337191][T12800] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 293.346126][T12800] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 293.355092][T12800] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 293.364900][T12800] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 293.477806][ T5848] Bluetooth: hci3: command tx timeout [ 293.644403][T13120] FAULT_INJECTION: forcing a failure. [ 293.644403][T13120] name failslab, interval 1, probability 0, space 0, times 0 [ 293.661296][T13120] CPU: 0 UID: 0 PID: 13120 Comm: syz.3.1931 Not tainted 6.16.0-rc5-syzkaller-00204-gdae7f9cbd190 #0 PREEMPT(full) [ 293.661357][T13120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 293.661372][T13120] Call Trace: [ 293.661380][T13120] [ 293.661390][T13120] dump_stack_lvl+0x189/0x250 [ 293.661422][T13120] ? __pfx____ratelimit+0x10/0x10 [ 293.661457][T13120] ? __pfx_dump_stack_lvl+0x10/0x10 [ 293.661484][T13120] ? __pfx__printk+0x10/0x10 [ 293.661521][T13120] ? ref_tracker_alloc+0x318/0x460 [ 293.661559][T13120] should_fail_ex+0x414/0x560 [ 293.661596][T13120] should_failslab+0xa8/0x100 [ 293.661627][T13120] kmem_cache_alloc_noprof+0x73/0x3c0 [ 293.661657][T13120] ? skb_clone+0x212/0x3a0 [ 293.661693][T13120] skb_clone+0x212/0x3a0 [ 293.661727][T13120] __netlink_deliver_tap+0x404/0x850 [ 293.661770][T13120] ? netlink_deliver_tap+0x2e/0x1b0 [ 293.661798][T13120] netlink_deliver_tap+0x19c/0x1b0 [ 293.661826][T13120] netlink_unicast+0x730/0x8e0 [ 293.661863][T13120] netlink_sendmsg+0x805/0xb30 [ 293.661901][T13120] ? __pfx_netlink_sendmsg+0x10/0x10 [ 293.661932][T13120] ? aa_sock_msg_perm+0x94/0x160 [ 293.661967][T13120] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 293.661999][T13120] ? __pfx_netlink_sendmsg+0x10/0x10 [ 293.662028][T13120] __sock_sendmsg+0x21c/0x270 [ 293.662053][T13120] ____sys_sendmsg+0x505/0x830 [ 293.662089][T13120] ? __pfx_____sys_sendmsg+0x10/0x10 [ 293.662128][T13120] ? import_iovec+0x74/0xa0 [ 293.662158][T13120] ___sys_sendmsg+0x21f/0x2a0 [ 293.662190][T13120] ? __pfx____sys_sendmsg+0x10/0x10 [ 293.662264][T13120] ? __fget_files+0x2a/0x420 [ 293.662292][T13120] ? __fget_files+0x3a0/0x420 [ 293.662334][T13120] __x64_sys_sendmsg+0x19b/0x260 [ 293.662365][T13120] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 293.662406][T13120] ? __pfx_ksys_write+0x10/0x10 [ 293.662438][T13120] ? do_syscall_64+0xbe/0x3b0 [ 293.662464][T13120] do_syscall_64+0xfa/0x3b0 [ 293.662484][T13120] ? lockdep_hardirqs_on+0x9c/0x150 [ 293.662517][T13120] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.662538][T13120] ? clear_bhb_loop+0x60/0xb0 [ 293.662564][T13120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.662584][T13120] RIP: 0033:0x7f487fb8e929 [ 293.662603][T13120] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 293.662623][T13120] RSP: 002b:00007f48809bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 293.662645][T13120] RAX: ffffffffffffffda RBX: 00007f487fdb6080 RCX: 00007f487fb8e929 [ 293.662666][T13120] RDX: 0000000000000800 RSI: 00002000000006c0 RDI: 0000000000000003 [ 293.662679][T13120] RBP: 00007f48809bb090 R08: 0000000000000000 R09: 0000000000000000 [ 293.662692][T13120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 293.662704][T13120] R13: 0000000000000001 R14: 00007f487fdb6080 R15: 00007fffe30cec78 [ 293.662734][T13120] [ 293.685161][ T1023] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 293.975035][T13124] __nla_validate_parse: 3 callbacks suppressed [ 293.975055][T13124] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1932'. [ 294.036140][ T1023] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 294.067035][T13131] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1934'. [ 294.163692][ T3471] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 294.216931][ T3471] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 294.282228][T13146] netlink: 'syz.4.1937': attribute type 1 has an invalid length. [ 294.400293][T13151] netlink: 'syz.2.1939': attribute type 8 has an invalid length. [ 294.454380][T13146] veth23: entered promiscuous mode [ 294.473335][T13146] bond12: (slave veth23): Enslaving as a backup interface with a down link [ 294.527924][T13157] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1941'. [ 294.546648][T13155] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1940'. [ 294.564596][T13157] netlink: 272 bytes leftover after parsing attributes in process `syz.1.1941'. [ 294.585711][T13157] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1941'. [ 294.708323][T13160] netlink: 'syz.4.1943': attribute type 10 has an invalid length. [ 294.735871][T13160] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 294.793680][T13160] tipc: Invalid UDP bearer configuration [ 294.793750][T13160] tipc: Enabling of bearer rejected, failed to enable media [ 294.836963][T13172] FAULT_INJECTION: forcing a failure. [ 294.836963][T13172] name failslab, interval 1, probability 0, space 0, times 0 [ 294.871292][T13172] CPU: 1 UID: 0 PID: 13172 Comm: syz.3.1946 Not tainted 6.16.0-rc5-syzkaller-00204-gdae7f9cbd190 #0 PREEMPT(full) [ 294.871332][T13172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 294.871346][T13172] Call Trace: [ 294.871355][T13172] [ 294.871365][T13172] dump_stack_lvl+0x189/0x250 [ 294.871399][T13172] ? __pfx____ratelimit+0x10/0x10 [ 294.871436][T13172] ? __pfx_dump_stack_lvl+0x10/0x10 [ 294.871463][T13172] ? __pfx__printk+0x10/0x10 [ 294.871498][T13172] ? __pfx___might_resched+0x10/0x10 [ 294.871524][T13172] ? fs_reclaim_acquire+0x7d/0x100 [ 294.871575][T13172] should_fail_ex+0x414/0x560 [ 294.871613][T13172] should_failslab+0xa8/0x100 [ 294.871644][T13172] __kmalloc_noprof+0xcb/0x4f0 [ 294.871669][T13172] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 294.871692][T13172] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 294.871738][T13172] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 294.871784][T13172] genl_family_rcv_msg_doit+0xb8/0x300 [ 294.871829][T13172] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 294.871867][T13172] ? rcu_is_watching+0x15/0xb0 [ 294.871909][T13172] ? apparmor_capable+0x137/0x1b0 [ 294.871938][T13172] ? bpf_lsm_capable+0x9/0x20 [ 294.871962][T13172] ? security_capable+0x7e/0x2e0 [ 294.872002][T13172] genl_rcv_msg+0x60e/0x790 [ 294.872041][T13172] ? __pfx_genl_rcv_msg+0x10/0x10 [ 294.872070][T13172] ? ref_tracker_free+0x63a/0x7d0 [ 294.872101][T13172] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 294.872131][T13172] ? __pfx_nl80211_del_key+0x10/0x10 [ 294.872148][T13172] ? __pfx_nl80211_post_doit+0x10/0x10 [ 294.872180][T13172] ? __pfx_ref_tracker_free+0x10/0x10 [ 294.872226][T13172] netlink_rcv_skb+0x205/0x470 [ 294.872253][T13172] ? __pfx_genl_rcv_msg+0x10/0x10 [ 294.872286][T13172] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 294.872331][T13172] ? down_read+0x1ad/0x2e0 [ 294.872358][T13172] genl_rcv+0x28/0x40 [ 294.872387][T13172] netlink_unicast+0x759/0x8e0 [ 294.872423][T13172] netlink_sendmsg+0x805/0xb30 [ 294.872462][T13172] ? __pfx_netlink_sendmsg+0x10/0x10 [ 294.872494][T13172] ? aa_sock_msg_perm+0x94/0x160 [ 294.872529][T13172] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 294.872572][T13172] ? __pfx_netlink_sendmsg+0x10/0x10 [ 294.872600][T13172] __sock_sendmsg+0x21c/0x270 [ 294.872626][T13172] ____sys_sendmsg+0x505/0x830 [ 294.872662][T13172] ? __pfx_____sys_sendmsg+0x10/0x10 [ 294.872703][T13172] ? import_iovec+0x74/0xa0 [ 294.872733][T13172] ___sys_sendmsg+0x21f/0x2a0 [ 294.872765][T13172] ? __pfx____sys_sendmsg+0x10/0x10 [ 294.872889][T13172] ? __fget_files+0x2a/0x420 [ 294.872924][T13172] ? __fget_files+0x3a0/0x420 [ 294.872974][T13172] __x64_sys_sendmsg+0x19b/0x260 [ 294.873016][T13172] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 294.873056][T13172] ? __pfx_ksys_write+0x10/0x10 [ 294.873087][T13172] ? do_syscall_64+0xbe/0x3b0 [ 294.873115][T13172] do_syscall_64+0xfa/0x3b0 [ 294.873134][T13172] ? lockdep_hardirqs_on+0x9c/0x150 [ 294.873166][T13172] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 294.873187][T13172] ? clear_bhb_loop+0x60/0xb0 [ 294.873214][T13172] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 294.873235][T13172] RIP: 0033:0x7f487fb8e929 [ 294.873256][T13172] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 294.873275][T13172] RSP: 002b:00007f48809bb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 294.873298][T13172] RAX: ffffffffffffffda RBX: 00007f487fdb6080 RCX: 00007f487fb8e929 [ 294.873314][T13172] RDX: 0000000000000800 RSI: 00002000000006c0 RDI: 0000000000000003 [ 294.873328][T13172] RBP: 00007f48809bb090 R08: 0000000000000000 R09: 0000000000000000 [ 294.873342][T13172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 294.873355][T13172] R13: 0000000000000001 R14: 00007f487fdb6080 R15: 00007fffe30cec78 [ 294.873391][T13172] [ 295.776118][ T3471] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.802592][T13190] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not 'ªªªªªª' [ 296.324034][ T3471] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 296.395071][ T3471] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 296.457755][ T3471] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 296.561902][ T3471] bridge_slave_1: left allmulticast mode [ 296.569771][ T3471] bridge_slave_1: left promiscuous mode [ 296.576663][ T3471] bridge0: port 2(bridge_slave_1) entered disabled state [ 296.587317][ T3471] bridge_slave_0: left allmulticast mode [ 296.593012][ T3471] bridge_slave_0: left promiscuous mode [ 296.599427][ T3471] bridge0: port 1(bridge_slave_0) entered disabled state [ 296.938548][ T3471] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 296.951233][ T3471] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 296.962306][ T3471] bond0 (unregistering): Released all slaves [ 297.475246][T13195] vlan2: entered promiscuous mode [ 297.491367][T13199] netlink: 'syz.2.1952': attribute type 1 has an invalid length. [ 297.512675][T13199] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1952'. [ 297.517423][T13195] hsr_slave_1: entered promiscuous mode [ 297.556020][T13202] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1954'. [ 297.560986][T13195] vlan2: entered allmulticast mode [ 297.594268][T13195] hsr_slave_1: entered allmulticast mode [ 297.661781][ T3471] hsr_slave_0: left promiscuous mode [ 297.670427][ T3471] hsr_slave_1: left promiscuous mode [ 297.676679][ T3471] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 297.712587][ T3471] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 297.728879][ T3471] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 297.738037][T13208] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 297.747417][ T3471] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 297.794419][ T3471] veth1_macvtap: left promiscuous mode [ 297.807408][ T3471] veth0_macvtap: left promiscuous mode [ 297.818831][ T3471] veth1_vlan: left promiscuous mode [ 297.867441][ T3471] veth0_vlan: left promiscuous mode [ 297.931710][T13216] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 298.101602][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 298.113316][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 298.137152][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 298.147122][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 298.159369][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 298.503875][ T3471] team0 (unregistering): Port device team_slave_1 removed [ 298.553018][ T3471] team0 (unregistering): Port device team_slave_0 removed [ 299.010208][T13202] IPVS: Error connecting to the multicast addr [ 299.016624][T13195] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1953'. [ 299.116276][T13219] lo speed is unknown, defaulting to 1000 [ 299.193102][T13224] netlink: 'syz.2.1959': attribute type 30 has an invalid length. [ 299.202637][T13223] FAULT_INJECTION: forcing a failure. [ 299.202637][T13223] name failslab, interval 1, probability 0, space 0, times 0 [ 299.217543][T13224] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 299.226744][T13224] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 299.231968][T13223] CPU: 0 UID: 0 PID: 13223 Comm: syz.4.1958 Not tainted 6.16.0-rc5-syzkaller-00204-gdae7f9cbd190 #0 PREEMPT(full) [ 299.232001][T13223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 299.232014][T13223] Call Trace: [ 299.232023][T13223] [ 299.232032][T13223] dump_stack_lvl+0x189/0x250 [ 299.232064][T13223] ? __pfx____ratelimit+0x10/0x10 [ 299.232099][T13223] ? __pfx_dump_stack_lvl+0x10/0x10 [ 299.232125][T13223] ? __pfx__printk+0x10/0x10 [ 299.232161][T13223] ? __pfx___might_resched+0x10/0x10 [ 299.232186][T13223] ? fs_reclaim_acquire+0x7d/0x100 [ 299.232223][T13223] should_fail_ex+0x414/0x560 [ 299.232260][T13223] should_failslab+0xa8/0x100 [ 299.232290][T13223] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 299.232317][T13223] ? __alloc_skb+0x112/0x2d0 [ 299.232347][T13223] __alloc_skb+0x112/0x2d0 [ 299.232377][T13223] netlink_ack+0x146/0xa50 [ 299.232400][T13223] ? __pfx_genl_rcv_msg+0x10/0x10 [ 299.232429][T13223] ? ref_tracker_free+0x63a/0x7d0 [ 299.232461][T13223] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 299.232491][T13223] ? __pfx_nl80211_post_doit+0x10/0x10 [ 299.232523][T13223] ? __pfx_ref_tracker_free+0x10/0x10 [ 299.232569][T13223] netlink_rcv_skb+0x28c/0x470 [ 299.232596][T13223] ? __pfx_genl_rcv_msg+0x10/0x10 [ 299.232630][T13223] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 299.232677][T13223] ? down_read+0x1ad/0x2e0 [ 299.232703][T13223] genl_rcv+0x28/0x40 [ 299.232733][T13223] netlink_unicast+0x759/0x8e0 [ 299.232769][T13223] netlink_sendmsg+0x805/0xb30 [ 299.232815][T13223] ? __pfx_netlink_sendmsg+0x10/0x10 [ 299.232846][T13223] ? aa_sock_msg_perm+0x94/0x160 [ 299.232881][T13223] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 299.232913][T13223] ? __pfx_netlink_sendmsg+0x10/0x10 [ 299.232940][T13223] __sock_sendmsg+0x21c/0x270 [ 299.232964][T13223] ____sys_sendmsg+0x505/0x830 [ 299.233000][T13223] ? __pfx_____sys_sendmsg+0x10/0x10 [ 299.233039][T13223] ? import_iovec+0x74/0xa0 [ 299.233069][T13223] ___sys_sendmsg+0x21f/0x2a0 [ 299.233100][T13223] ? __pfx____sys_sendmsg+0x10/0x10 [ 299.233172][T13223] ? __fget_files+0x2a/0x420 [ 299.233199][T13223] ? __fget_files+0x3a0/0x420 [ 299.233240][T13223] __x64_sys_sendmsg+0x19b/0x260 [ 299.233271][T13223] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 299.233309][T13223] ? __pfx_ksys_write+0x10/0x10 [ 299.233332][T13223] ? rcu_is_watching+0x15/0xb0 [ 299.233361][T13223] ? do_syscall_64+0xbe/0x3b0 [ 299.233386][T13223] do_syscall_64+0xfa/0x3b0 [ 299.233405][T13223] ? lockdep_hardirqs_on+0x9c/0x150 [ 299.233437][T13223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.233456][T13223] ? clear_bhb_loop+0x60/0xb0 [ 299.233481][T13223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.233501][T13223] RIP: 0033:0x7f887758e929 [ 299.233520][T13223] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 299.233538][T13223] RSP: 002b:00007f88784cb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 299.233560][T13223] RAX: ffffffffffffffda RBX: 00007f88777b5fa0 RCX: 00007f887758e929 [ 299.233576][T13223] RDX: 0000000000000800 RSI: 00002000000006c0 RDI: 0000000000000003 [ 299.233589][T13223] RBP: 00007f88784cb090 R08: 0000000000000000 R09: 0000000000000000 [ 299.233601][T13223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 299.233613][T13223] R13: 0000000000000000 R14: 00007f88777b5fa0 R15: 00007ffce1599cd8 [ 299.233646][T13223] [ 299.715045][T13244] netlink: 'syz.3.1965': attribute type 1 has an invalid length. [ 299.731145][T13246] netlink: 'syz.3.1965': attribute type 1 has an invalid length. [ 299.883518][T13244] 8021q: adding VLAN 0 to HW filter on device bond12 [ 300.082643][T13262] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1969'. [ 300.196578][ T1023] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 300.207287][ T51] Bluetooth: hci3: command tx timeout [ 300.404095][ T3471] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 300.440983][ T3471] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.534390][ T3471] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 300.544948][ T3471] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.649963][ T3471] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 300.676377][ T3471] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.899510][ T3471] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 300.932679][ T3471] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.946708][T13279] syz.1.1977 uses old SIOCAX25GETINFO [ 301.004108][T13283] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1978'. [ 301.081245][T13286] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1978'. [ 301.171671][ T5848] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 301.181718][ T5848] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 301.191931][ T5848] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 301.200172][ T5848] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 301.208400][ T5848] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 301.292702][T13219] chnl_net:caif_netlink_parms(): no params data found [ 301.389773][T13297] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1981'. [ 301.414415][T13287] lo speed is unknown, defaulting to 1000 [ 302.174051][ T3471] bond0 (unregistering): Released all slaves [ 302.190310][ T3471] bond1 (unregistering): Released all slaves [ 302.207766][ T3471] bond2 (unregistering): Released all slaves [ 302.227819][ T3471] bond3 (unregistering): Released all slaves [ 302.249788][ T3471] bond4 (unregistering): Released all slaves [ 302.270955][ T3471] bond5 (unregistering): Released all slaves [ 302.278751][ T5848] Bluetooth: hci3: command tx timeout [ 302.290393][ T3471] bond6 (unregistering): Released all slaves [ 302.309786][ T3471] bond7 (unregistering): Released all slaves [ 302.343082][ T3471] bond8 (unregistering): Released all slaves [ 302.459178][ T3471] bond9 (unregistering): Released all slaves [ 302.475481][ T3471] bond10 (unregistering): Released all slaves [ 302.493199][ T3471] bond11 (unregistering): (slave veth11): Releasing backup interface [ 302.503613][ T3471] bond11 (unregistering): Released all slaves [ 302.618743][ T3471] bond12 (unregistering): Released all slaves [ 302.653364][T13310] pim6reg: entered allmulticast mode [ 302.819550][T13219] bridge0: port 1(bridge_slave_0) entered blocking state [ 302.827634][T13219] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.834948][T13219] bridge_slave_0: entered allmulticast mode [ 302.853362][T13219] bridge_slave_0: entered promiscuous mode [ 302.869515][ T3471] : left promiscuous mode [ 302.961502][T13219] bridge0: port 2(bridge_slave_1) entered blocking state [ 302.987575][T13219] bridge0: port 2(bridge_slave_1) entered disabled state [ 303.000796][T13219] bridge_slave_1: entered allmulticast mode [ 303.015323][T13219] bridge_slave_1: entered promiscuous mode [ 303.046263][ T3471] tipc: Disabling bearer [ 303.108117][ T3471] tipc: Left network mode [ 303.195285][T13327] openvswitch: netlink: Geneve opt len 63 is not a multiple of 4. [ 303.249477][ T5848] Bluetooth: hci0: command tx timeout [ 303.250374][T13324] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 303.312077][T13219] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 303.371521][T13219] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 303.574045][T13219] team0: Port device team_slave_0 added [ 303.595217][T13219] team0: Port device team_slave_1 added [ 303.736303][T13219] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 303.775060][T13219] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 303.801884][T13219] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 303.890065][T13219] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 303.911202][T13219] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 303.981569][T13219] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 304.192366][T13360] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1998'. [ 304.248950][ T3471] veth0_macvtap: left promiscuous mode [ 304.254788][ T3471] veth1_vlan: left promiscuous mode [ 304.366919][ T5848] Bluetooth: hci3: command tx timeout [ 305.317535][ T5848] Bluetooth: hci0: command tx timeout [ 305.697529][T13219] hsr_slave_0: entered promiscuous mode [ 305.704217][T13219] hsr_slave_1: entered promiscuous mode [ 305.711655][T13219] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 305.719340][T13219] Cannot create hsr debugfs directory [ 305.742738][T13364] FAULT_INJECTION: forcing a failure. [ 305.742738][T13364] name failslab, interval 1, probability 0, space 0, times 0 [ 305.797335][T13364] CPU: 0 UID: 0 PID: 13364 Comm: syz.4.1999 Not tainted 6.16.0-rc5-syzkaller-00204-gdae7f9cbd190 #0 PREEMPT(full) [ 305.797369][T13364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 305.797383][T13364] Call Trace: [ 305.797392][T13364] [ 305.797401][T13364] dump_stack_lvl+0x189/0x250 [ 305.797434][T13364] ? __pfx____ratelimit+0x10/0x10 [ 305.797468][T13364] ? __pfx_dump_stack_lvl+0x10/0x10 [ 305.797495][T13364] ? __pfx__printk+0x10/0x10 [ 305.797541][T13364] should_fail_ex+0x414/0x560 [ 305.797579][T13364] should_failslab+0xa8/0x100 [ 305.797611][T13364] __kmalloc_cache_noprof+0x70/0x3d0 [ 305.797637][T13364] ? nfc_genl_rcv_nl_event+0xa8/0x2b0 [ 305.797667][T13364] ? blocking_notifier_call_chain+0x54/0x90 [ 305.797700][T13364] nfc_genl_rcv_nl_event+0xa8/0x2b0 [ 305.797734][T13364] notifier_call_chain+0x1b3/0x3e0 [ 305.797770][T13364] blocking_notifier_call_chain+0x6a/0x90 [ 305.797801][T13364] netlink_release+0x1259/0x1b10 [ 305.797837][T13364] ? netlink_release+0x108/0x1b10 [ 305.797866][T13364] ? __pfx_netlink_release+0x10/0x10 [ 305.797894][T13364] ? down_write+0x162/0x1f0 [ 305.797918][T13364] ? __pfx_down_write+0x10/0x10 [ 305.797939][T13364] ? do_raw_spin_lock+0x121/0x290 [ 305.797973][T13364] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 305.798010][T13364] sock_close+0xc3/0x240 [ 305.798044][T13364] ? __pfx_sock_close+0x10/0x10 [ 305.798076][T13364] __fput+0x449/0xa70 [ 305.798132][T13364] task_work_run+0x1d1/0x260 [ 305.798169][T13364] ? __pfx_task_work_run+0x10/0x10 [ 305.798201][T13364] ? kick_process+0xeb/0x160 [ 305.798234][T13364] ? task_work_add+0x377/0x420 [ 305.798273][T13364] get_signal+0x11ed/0x1340 [ 305.798307][T13364] ? __fput_deferred+0x215/0x390 [ 305.798339][T13364] ? __pfx___fput_deferred+0x10/0x10 [ 305.798379][T13364] arch_do_signal_or_restart+0x9a/0x750 [ 305.798415][T13364] ? __x64_sys_sendmsg+0x230/0x260 [ 305.798447][T13364] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 305.798501][T13364] ? exit_to_user_mode_loop+0x40/0x110 [ 305.798529][T13364] exit_to_user_mode_loop+0x75/0x110 [ 305.798553][T13364] do_syscall_64+0x2bd/0x3b0 [ 305.798573][T13364] ? lockdep_hardirqs_on+0x9c/0x150 [ 305.798606][T13364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.798627][T13364] ? clear_bhb_loop+0x60/0xb0 [ 305.798654][T13364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.798675][T13364] RIP: 0033:0x7f887758e929 [ 305.798695][T13364] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 305.798713][T13364] RSP: 002b:00007f88784cb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 305.798736][T13364] RAX: 0000000000000058 RBX: 00007f88777b5fa0 RCX: 00007f887758e929 [ 305.798751][T13364] RDX: 0000000000000800 RSI: 00002000000006c0 RDI: 0000000000000003 [ 305.798765][T13364] RBP: 00007f88784cb090 R08: 0000000000000000 R09: 0000000000000000 [ 305.798778][T13364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 305.798790][T13364] R13: 0000000000000000 R14: 00007f88777b5fa0 R15: 00007ffce1599cd8 [ 305.798825][T13364] [ 306.173706][T13377] IPVS: set_ctl: invalid protocol: 50 172.30.1.3:20000 [ 306.181790][T13377] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2004'. [ 306.198714][T13377] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20004 [ 306.303045][T13383] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2005'. [ 306.365579][T13386] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 306.421185][T13388] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2007'. [ 306.437635][ T5848] Bluetooth: hci3: command tx timeout [ 306.447677][T13383] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 306.472513][T13383] bond0 (unregistering): Released all slaves [ 306.632973][T13287] chnl_net:caif_netlink_parms(): no params data found [ 306.749544][T13394] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2009'. [ 306.927270][T13394] netlink: 348 bytes leftover after parsing attributes in process `syz.2.2009'. [ 306.972235][ T3471] IPVS: stop unused estimator thread 0... [ 307.150785][T13287] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.167077][T13287] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.174337][T13287] bridge_slave_0: entered allmulticast mode [ 307.187770][T13287] bridge_slave_0: entered promiscuous mode [ 307.202523][T13414] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2015'. [ 307.216208][T13414] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2015'. [ 307.227112][T13414] netlink: 'syz.4.2015': attribute type 20 has an invalid length. [ 307.235964][T13414] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2015'. [ 307.245747][T13414] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2015'. [ 307.255208][T13287] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.264267][T13287] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.277779][T13414] netlink: 'syz.4.2015': attribute type 20 has an invalid length. [ 307.285957][T13287] bridge_slave_1: entered allmulticast mode [ 307.300515][T13287] bridge_slave_1: entered promiscuous mode [ 307.375437][T13287] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 307.396876][ T5848] Bluetooth: hci0: command tx timeout [ 307.439911][T13287] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 307.603857][T13287] team0: Port device team_slave_0 added [ 307.659633][T13287] team0: Port device team_slave_1 added [ 307.760975][T13287] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 307.777090][T13287] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 307.812808][T13287] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 307.839226][T13287] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 307.846264][T13287] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 307.879370][T13287] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 308.086431][T13287] hsr_slave_0: entered promiscuous mode [ 308.118574][T13287] hsr_slave_1: entered promiscuous mode [ 308.125137][T13287] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 308.162351][T13287] Cannot create hsr debugfs directory [ 308.414308][T13219] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 308.458400][T13219] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 308.480869][T13219] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 308.518537][T13219] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 308.764067][T13470] lo speed is unknown, defaulting to 1000 [ 308.983797][T13219] 8021q: adding VLAN 0 to HW filter on device bond0 [ 309.064913][T13219] 8021q: adding VLAN 0 to HW filter on device team0 [ 309.091779][ T1023] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.099103][ T1023] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.154801][ T9614] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.162215][ T9614] bridge0: port 2(bridge_slave_1) entered forwarding state [ 309.288372][T13479] __nla_validate_parse: 2 callbacks suppressed [ 309.288392][T13479] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2033'. [ 309.479403][ T5848] Bluetooth: hci0: command tx timeout [ 309.499315][T13287] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 309.553578][T13486] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2035'. [ 309.553578][T13487] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2035'. [ 309.577994][T13287] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 309.613915][T13287] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 309.657418][T13287] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 310.095276][T13287] 8021q: adding VLAN 0 to HW filter on device bond0 [ 310.183446][T13287] 8021q: adding VLAN 0 to HW filter on device team0 [ 310.225850][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.233150][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 310.338737][ T9612] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.345976][ T9612] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.362896][T13509] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.401481][T13219] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 310.623376][T13219] veth0_vlan: entered promiscuous mode [ 310.728606][T13219] veth1_vlan: entered promiscuous mode [ 310.883523][T13219] veth0_macvtap: entered promiscuous mode [ 310.904235][T13219] veth1_macvtap: entered promiscuous mode [ 310.981281][T13219] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 311.011492][T13219] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 311.057580][T13219] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.066375][T13219] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.117023][T13219] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.125822][T13219] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 311.231503][T13537] x_tables: duplicate entry at hook 2 [ 311.284432][T13287] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 311.388137][T13539] tipc: New replicast peer: 255.255.255.255 [ 311.401096][T13539] tipc: Enabled bearer , priority 10 [ 311.531215][ T3504] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.561381][ T3504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.617472][ T3504] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 311.621439][T13287] veth0_vlan: entered promiscuous mode [ 311.625358][ T3504] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.712296][T13287] veth1_vlan: entered promiscuous mode [ 311.758558][T13551] pimreg: entered allmulticast mode [ 311.833923][T13548] pimreg: left allmulticast mode [ 311.872510][T13553] bond0: entered promiscuous mode [ 311.880220][T13553] bond0: entered allmulticast mode [ 311.892644][T13553] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2055'. [ 311.900597][T13287] veth0_macvtap: entered promiscuous mode [ 311.919979][T13553] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2055'. [ 311.920214][T13287] veth1_macvtap: entered promiscuous mode [ 311.936027][T13553] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2055'. [ 311.995231][T13287] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 312.019752][T13287] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 312.067500][T13287] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.084633][T13287] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.107203][T13287] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.116011][T13287] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.312175][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.323252][T13544] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 312.455988][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.504509][ T9614] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 312.514916][ T9614] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 312.549006][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.579354][ T9614] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 312.588273][ T9614] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 312.698648][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 312.967162][ T12] bridge_slave_1: left allmulticast mode [ 312.972899][ T12] bridge_slave_1: left promiscuous mode [ 312.979682][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.990337][ T12] bridge_slave_0: left allmulticast mode [ 312.996624][ T12] bridge_slave_0: left promiscuous mode [ 313.007153][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 313.516158][T13566] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 313.615544][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 313.646667][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 313.671754][ T12] bond0 (unregistering): Released all slaves [ 313.719654][T13570] netlink: 'syz.4.2060': attribute type 1 has an invalid length. [ 313.866198][T13575] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2062'. [ 314.083634][T13583] netlink: 'syz.1.2065': attribute type 1 has an invalid length. [ 314.107355][T13583] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2065'. [ 314.113821][T13585] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2064'. [ 314.320348][T13590] x_tables: ip6_tables: SYNPROXY target: used from hooks PREROUTING, but only usable from INPUT/FORWARD [ 314.349166][T13593] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2069'. [ 314.358228][T13590] x_tables: ip6_tables: SYNPROXY target: used from hooks PREROUTING, but only usable from INPUT/FORWARD [ 314.375935][ T5850] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 314.383028][T13593] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 314.403895][ T5168] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 314.418688][ T5850] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 314.428010][ T5850] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 314.436538][ T5168] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 314.444205][ T5850] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 314.456281][ T5850] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 314.465598][ T5850] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 314.474385][ T5848] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 314.485713][ T5848] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 314.661058][T13592] lo speed is unknown, defaulting to 1000 [ 314.764106][T13616] netlink: 440 bytes leftover after parsing attributes in process `syz.2.2073'. [ 314.818239][T13620] netlink: 252 bytes leftover after parsing attributes in process `syz.1.2075'. [ 314.874765][T13624] xt_TCPMSS: Only works on TCP SYN packets [ 315.004674][T13627] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2076'. [ 315.185474][T13633] Bluetooth: MGMT ver 1.23 [ 315.194817][T13633] gretap0: left allmulticast mode [ 315.201817][T13633] bridge0: port 1(gretap0) entered disabled state [ 315.487755][T13642] netlink: 'syz.4.2082': attribute type 11 has an invalid length. [ 315.495668][T13642] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2082'. [ 315.600344][T13644] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 315.640677][T13644] syzkaller0: entered promiscuous mode [ 315.646237][T13644] syzkaller0: entered allmulticast mode [ 315.820372][T13599] lo speed is unknown, defaulting to 1000 [ 316.518501][ T51] Bluetooth: hci3: command tx timeout [ 316.596921][ T51] Bluetooth: hci0: command tx timeout [ 316.747290][T13592] chnl_net:caif_netlink_parms(): no params data found [ 316.915841][T13696] netlink: 'syz.2.2099': attribute type 83 has an invalid length. [ 317.176707][ T12] hsr_slave_0: left promiscuous mode [ 317.193706][ T12] hsr_slave_1: left promiscuous mode [ 317.201888][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 317.210198][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 317.225840][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 317.235277][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 317.268359][ T12] veth1_macvtap: left promiscuous mode [ 317.274148][ T12] veth0_macvtap: left promiscuous mode [ 317.280024][ T12] veth1_vlan: left promiscuous mode [ 317.285501][ T12] veth0_vlan: left promiscuous mode [ 317.498293][T13711] netlink: 'syz.4.2101': attribute type 1 has an invalid length. [ 317.888395][ T12] team0 (unregistering): Port device team_slave_1 removed [ 317.938272][ T12] team0 (unregistering): Port device team_slave_0 removed [ 318.394116][T13699] netlink: 340 bytes leftover after parsing attributes in process `syz.1.2098'. [ 318.597949][ T51] Bluetooth: hci3: command tx timeout [ 318.677017][ T51] Bluetooth: hci0: command tx timeout [ 318.684605][T13592] bridge0: port 1(bridge_slave_0) entered blocking state [ 318.696610][T13592] bridge0: port 1(bridge_slave_0) entered disabled state [ 318.726321][T13592] bridge_slave_0: entered allmulticast mode [ 318.779091][T13592] bridge_slave_0: entered promiscuous mode [ 318.800347][T13592] bridge0: port 2(bridge_slave_1) entered blocking state [ 318.807904][T13592] bridge0: port 2(bridge_slave_1) entered disabled state [ 318.815202][T13592] bridge_slave_1: entered allmulticast mode [ 318.823377][T13592] bridge_slave_1: entered promiscuous mode [ 318.977407][T13592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 319.032237][T13592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 319.092195][T13730] sctp: [Deprecated]: syz.4.2107 (pid 13730) Use of int in maxseg socket option. [ 319.092195][T13730] Use struct sctp_assoc_value instead [ 319.192481][T13592] team0: Port device team_slave_0 added [ 319.215054][T13592] team0: Port device team_slave_1 added [ 319.285424][T13592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 319.372849][T13592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.417431][T13592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 319.475030][T13592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 319.495547][T13592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 319.530275][T13592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 319.604413][T13743] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2110'. [ 319.875327][ T3504] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.895865][T13599] chnl_net:caif_netlink_parms(): no params data found [ 319.933911][T13592] hsr_slave_0: entered promiscuous mode [ 319.962343][T13592] hsr_slave_1: entered promiscuous mode [ 319.976960][T13592] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 319.985971][T13592] Cannot create hsr debugfs directory [ 320.018918][T13745] syzkaller0: entered promiscuous mode [ 320.024456][T13745] syzkaller0: entered allmulticast mode [ 320.081846][ T3504] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.339416][ T3504] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.430898][T13776] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2118'. [ 320.452515][T13778] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2119'. [ 320.474875][T13599] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.482562][T13599] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.490242][T13599] bridge_slave_0: entered allmulticast mode [ 320.498703][T13599] bridge_slave_0: entered promiscuous mode [ 320.547978][ T3504] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.571214][T13765] lo speed is unknown, defaulting to 1000 [ 320.579925][T13599] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.588295][T13599] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.595761][T13599] bridge_slave_1: entered allmulticast mode [ 320.604845][T13599] bridge_slave_1: entered promiscuous mode [ 320.678232][ T51] Bluetooth: hci3: command tx timeout [ 320.705532][T13783] openvswitch: netlink: Multiple metadata blocks provided [ 320.756915][ T51] Bluetooth: hci0: command tx timeout [ 320.955982][T13791] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2123'. [ 321.014424][T13599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 321.054292][T13599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 321.240953][T13599] team0: Port device team_slave_0 added [ 321.267390][T13599] team0: Port device team_slave_1 added [ 321.350684][T13599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 321.363348][T13599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 321.391793][T13599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 321.404812][T13599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 321.411988][T13599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 321.438317][T13599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 321.453565][ T3504] bridge_slave_1: left allmulticast mode [ 321.460627][ T3504] bridge_slave_1: left promiscuous mode [ 321.466612][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.479513][ T3504] bridge_slave_0: left allmulticast mode [ 321.485208][ T3504] bridge_slave_0: left promiscuous mode [ 321.491345][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.890764][ T3504] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 321.905168][ T3504] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 321.920479][ T3504] bond0 (unregistering): Released all slaves [ 322.018019][T13799] 8021q: adding VLAN 0 to HW filter on device team0 [ 322.043475][T13799] batman_adv: batadv0: Interface activated: team0 [ 322.059037][T13799] batman_adv: batadv0: Interface deactivated: team0 [ 322.065757][T13799] batman_adv: batadv0: Removing interface: team0 [ 322.088354][T13799] team0: Cannot enslave team device to itself [ 322.149562][T13804] sch_fq: defrate 0 ignored. [ 322.591796][T13599] hsr_slave_0: entered promiscuous mode [ 322.600236][T13599] hsr_slave_1: entered promiscuous mode [ 322.606908][T13599] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 322.626355][T13599] Cannot create hsr debugfs directory [ 322.757447][ T51] Bluetooth: hci3: command tx timeout [ 322.839836][ T51] Bluetooth: hci0: command tx timeout [ 323.092763][T13824] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 323.785733][T13837] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.2138'. [ 323.933075][ T3504] hsr_slave_0: left promiscuous mode [ 323.951986][ T3504] hsr_slave_1: left promiscuous mode [ 323.958808][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 323.966883][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 323.975131][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 323.986883][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 324.026649][ T3504] veth1_macvtap: left promiscuous mode [ 324.034116][ T3504] veth0_macvtap: left promiscuous mode [ 324.040314][ T3504] veth1_vlan: left promiscuous mode [ 324.047720][ T3504] veth0_vlan: left promiscuous mode [ 324.454186][T13845] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 324.484045][T13850] Bluetooth: hci0: Opcode 0x0c03 failed: -22 [ 324.560945][T13853] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2142'. [ 324.574786][T13853] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2142'. [ 324.752703][ T3504] team0 (unregistering): Port device team_slave_1 removed [ 324.795304][ T3504] team0 (unregistering): Port device team_slave_0 removed [ 325.370674][T13592] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 325.441041][T13592] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 325.551698][T13592] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 325.639757][T13592] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 326.000532][T13884] netlink: 'syz.4.2148': attribute type 3 has an invalid length. [ 326.060787][T13884] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.2148'. [ 326.163525][T13592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 326.225618][T13592] 8021q: adding VLAN 0 to HW filter on device team0 [ 326.236712][T13889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2151'. [ 326.357140][ T5848] Bluetooth: hci3: command 0x0405 tx timeout [ 326.368330][ T7240] bridge0: port 1(bridge_slave_0) entered blocking state [ 326.375559][ T7240] bridge0: port 1(bridge_slave_0) entered forwarding state [ 326.393124][ T7240] bridge0: port 2(bridge_slave_1) entered blocking state [ 326.400409][ T7240] bridge0: port 2(bridge_slave_1) entered forwarding state [ 326.514749][T13599] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 326.588873][T13599] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 326.618002][T13599] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 326.654816][T13599] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 326.916063][T13599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 326.982522][T13920] netlink: 'syz.4.2159': attribute type 1 has an invalid length. [ 327.003959][T13599] 8021q: adding VLAN 0 to HW filter on device team0 [ 327.076187][T13920] 8021q: adding VLAN 0 to HW filter on device bond0 [ 327.090045][T13930] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2159'. [ 327.142667][ T3504] bridge0: port 1(bridge_slave_0) entered blocking state [ 327.143575][T13920] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2159'. [ 327.149913][ T3504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 327.223348][ T3504] bridge0: port 2(bridge_slave_1) entered blocking state [ 327.230646][ T3504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 327.319962][T13592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 327.612027][T13592] veth0_vlan: entered promiscuous mode [ 327.668500][T13592] veth1_vlan: entered promiscuous mode [ 327.808850][T13592] veth0_macvtap: entered promiscuous mode [ 327.848459][T13592] veth1_macvtap: entered promiscuous mode [ 327.916579][T13592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 327.961345][T13592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 328.005521][T13953] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 328.020252][T13955] bridge0: port 1(gretap0) entered blocking state [ 328.040058][T13955] bridge0: port 1(gretap0) entered disabled state [ 328.051633][T13955] gretap0: entered allmulticast mode [ 328.061657][T13955] gretap0: entered promiscuous mode [ 328.082484][T13592] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.093396][T13592] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.104378][T13592] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.113725][T13592] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 328.297651][T13599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 328.405333][T13969] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2170'. [ 328.425478][T13969] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2170'. [ 328.455983][T13969] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2170'. [ 328.465506][ T3471] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.485951][ T3471] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.569194][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 328.596615][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 328.620901][T13599] veth0_vlan: entered promiscuous mode [ 328.689768][T13599] veth1_vlan: entered promiscuous mode [ 328.738025][T13976] tipc: Resetting bearer [ 328.884081][T13599] veth0_macvtap: entered promiscuous mode [ 328.911267][T13599] veth1_macvtap: entered promiscuous mode [ 328.956685][T13599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 328.982941][T13599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 329.009935][T13599] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.027144][T13599] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.043712][T13599] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.067008][T13599] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.307936][T13995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2179'. [ 329.375270][ T1023] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.407576][ T1023] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 329.512634][ T3504] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.681154][ T3504] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.728697][ T3471] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.753830][ T3471] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 329.914622][T14013] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.2184'. [ 329.932755][T14013] netlink: zone id is out of range [ 329.971658][T14013] netlink: get zone limit has 8 unknown bytes [ 330.072888][ T3504] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.183162][ T3504] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.355537][ T5168] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 330.365550][ T5168] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 330.373867][ T5168] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 330.382737][ T5168] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 330.391431][ T5168] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 330.543161][T14026] lo speed is unknown, defaulting to 1000 [ 330.579897][ T3504] bridge_slave_1: left allmulticast mode [ 330.592554][ T3504] bridge_slave_1: left promiscuous mode [ 330.608801][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.633920][ T3504] bridge_slave_0: left allmulticast mode [ 330.647275][ T3504] bridge_slave_0: left promiscuous mode [ 330.653140][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.148241][ T3504] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 331.161675][ T3504] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 331.174669][ T3504] bond0 (unregistering): Released all slaves [ 331.885095][ T3504] hsr_slave_0: left promiscuous mode [ 331.897083][ T3504] hsr_slave_1: left promiscuous mode [ 331.903418][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 331.911696][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 331.920167][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 331.927738][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 331.951078][ T3504] veth1_macvtap: left promiscuous mode [ 331.956654][ T3504] veth0_macvtap: left promiscuous mode [ 331.962611][ T3504] veth1_vlan: left promiscuous mode [ 331.968427][ T3504] veth0_vlan: left promiscuous mode [ 332.047066][T14034] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2189'. [ 332.440108][ T51] Bluetooth: hci0: command tx timeout [ 332.537849][ T5848] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 332.569533][ T5848] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 332.579254][ T5848] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 332.588037][ T5848] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 332.602136][ T5848] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 332.840054][ T3504] team0 (unregistering): Port device team_slave_1 removed [ 332.940020][ T3504] team0 (unregistering): Port device team_slave_0 removed [ 333.633895][T14035] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 333.660423][T14041] (unnamed net_device) (uninitialized): option mode: invalid value (133) [ 333.743020][T14043] lo speed is unknown, defaulting to 1000 [ 333.747652][T14026] chnl_net:caif_netlink_parms(): no params data found [ 334.165599][T14070] IPVS: ip_vs_edit_dest(): server weight less than zero [ 334.242356][T14026] bridge0: port 1(bridge_slave_0) entered blocking state [ 334.250117][T14026] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.273476][T14026] bridge_slave_0: entered allmulticast mode [ 334.288892][T14026] bridge_slave_0: entered promiscuous mode [ 334.315120][T14026] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.341929][T14026] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.367989][T14026] bridge_slave_1: entered allmulticast mode [ 334.376089][T14026] bridge_slave_1: entered promiscuous mode [ 334.438512][T14076] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2200'. [ 334.460275][T14076] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2200'. [ 334.517688][ T5848] Bluetooth: hci0: command tx timeout [ 334.559465][T14026] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 334.632737][T14026] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 334.677490][ T5848] Bluetooth: hci3: command tx timeout [ 334.827522][T14026] team0: Port device team_slave_0 added [ 334.873272][T14097] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2204'. [ 334.901147][ T3504] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.961959][T14026] team0: Port device team_slave_1 added [ 335.103604][ T3504] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.136006][T14108] Bluetooth: MGMT ver 1.23 [ 335.261670][ T3504] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.351268][T14115] delete_channel: no stack [ 335.386148][T14026] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 335.402178][T14026] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 335.438513][T14118] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 335.452060][T14026] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 335.562448][ T3504] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.612659][T14026] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 335.646842][T14026] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 335.693408][T14026] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 335.904145][T14026] hsr_slave_0: entered promiscuous mode [ 335.938207][T14026] hsr_slave_1: entered promiscuous mode [ 335.962486][T14026] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 335.983144][T14026] Cannot create hsr debugfs directory [ 336.010329][T14149] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2223'. [ 336.081302][T14147] netlink: 'syz.2.2220': attribute type 21 has an invalid length. [ 336.089463][T14147] IPv6: NLM_F_CREATE should be specified when creating new route [ 336.253617][T14161] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2225'. [ 336.283993][T14162] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2224'. [ 336.297328][T14162] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 336.307300][T14162] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 336.399883][T14167] netlink: 'syz.2.2226': attribute type 5 has an invalid length. [ 336.433699][T14161] netlink: 'syz.4.2225': attribute type 1 has an invalid length. [ 336.446149][ T3504] bridge_slave_1: left allmulticast mode [ 336.456332][ T3504] bridge_slave_1: left promiscuous mode [ 336.465117][ T3504] bridge0: port 2(bridge_slave_1) entered disabled state [ 336.484635][ T3504] bridge_slave_0: left allmulticast mode [ 336.493832][ T3504] bridge_slave_0: left promiscuous mode [ 336.502360][ T3504] bridge0: port 1(bridge_slave_0) entered disabled state [ 336.596983][ T5848] Bluetooth: hci0: command tx timeout [ 336.759506][ T5848] Bluetooth: hci3: command tx timeout [ 337.744422][ T3504] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 337.766150][ T3504] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 337.793464][ T3504] bond0 (unregistering): Released all slaves [ 337.816292][T14165] netlink: 'syz.4.2225': attribute type 1 has an invalid length. [ 337.877042][T14187] syzkaller1: entered promiscuous mode [ 337.898451][T14187] syzkaller1: entered allmulticast mode [ 337.933452][T14043] chnl_net:caif_netlink_parms(): no params data found [ 338.073703][T14193] bridge6: entered allmulticast mode [ 338.562771][T14043] bridge0: port 1(bridge_slave_0) entered blocking state [ 338.580351][T14043] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.598363][T14043] bridge_slave_0: entered allmulticast mode [ 338.611942][T14043] bridge_slave_0: entered promiscuous mode [ 338.652591][T14043] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.666958][T14043] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.681513][ T5848] Bluetooth: hci0: command tx timeout [ 338.713459][T14043] bridge_slave_1: entered allmulticast mode [ 338.771501][T14043] bridge_slave_1: entered promiscuous mode [ 338.837171][ T5848] Bluetooth: hci3: command tx timeout [ 339.135006][T14043] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 339.292222][T14043] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 339.340225][T14246] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2245'. [ 339.350378][T14246] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2245'. [ 339.359554][T14246] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2245'. [ 339.419339][T14043] team0: Port device team_slave_0 added [ 339.493880][ T3504] hsr_slave_0: left promiscuous mode [ 339.507150][ T3504] hsr_slave_1: left promiscuous mode [ 339.513385][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.533682][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.545001][ T3504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 339.549443][T14253] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 339.557468][ T3504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.609175][ T3504] veth1_macvtap: left promiscuous mode [ 339.614913][ T3504] veth0_macvtap: left promiscuous mode [ 339.635842][T14256] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2249'. [ 339.637471][ T3504] veth1_vlan: left promiscuous mode [ 339.650942][ T3504] veth0_vlan: left promiscuous mode [ 340.664814][ T3504] team0 (unregistering): Port device team_slave_1 removed [ 340.713697][ T3504] team0 (unregistering): Port device team_slave_0 removed [ 340.916995][ T5848] Bluetooth: hci3: command tx timeout [ 341.222788][T14043] team0: Port device team_slave_1 added [ 341.388215][T14299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2258'. [ 341.411467][T14299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2258'. [ 341.412378][T14043] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 341.434194][T14043] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.466911][T14043] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.487808][T14299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2258'. [ 341.489807][T14043] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 341.512238][T14043] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 341.543063][T14043] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 341.557182][ T5848] Bluetooth: hci1: command 0x0406 tx timeout [ 341.573537][T14296] netlink: 'syz.1.2257': attribute type 29 has an invalid length. [ 341.595496][T14299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2258'. [ 341.612076][T14304] netlink: 'syz.1.2257': attribute type 29 has an invalid length. [ 341.647611][T14299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2258'. [ 341.733283][T14299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2258'. [ 341.758706][T14043] hsr_slave_0: entered promiscuous mode [ 341.783896][T14043] hsr_slave_1: entered promiscuous mode [ 341.801518][T14043] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 341.815167][T14043] Cannot create hsr debugfs directory [ 342.104370][T14026] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 342.167747][T14026] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 342.208745][T14026] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 342.243803][T14026] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 342.624735][T14026] 8021q: adding VLAN 0 to HW filter on device bond0 [ 342.695692][T14026] 8021q: adding VLAN 0 to HW filter on device team0 [ 342.732160][ T9614] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.739426][ T9614] bridge0: port 1(bridge_slave_0) entered forwarding state [ 342.769597][ T1023] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.776880][ T1023] bridge0: port 2(bridge_slave_1) entered forwarding state [ 342.797875][T14316] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 342.873652][T14337] Bluetooth: MGMT ver 1.23 [ 342.901719][T14337] netlink: 'syz.1.2267': attribute type 11 has an invalid length. [ 343.050320][T14348] netlink: 'syz.4.2270': attribute type 9 has an invalid length. [ 343.085356][T14043] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 343.133615][T14043] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 343.161425][T14043] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 343.194057][T14043] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 343.260735][T14355] netlink: 'syz.2.2271': attribute type 10 has an invalid length. [ 343.959936][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 344.198836][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 344.202811][ T5848] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 345.026082][T14355] team0: Port device geneve0 added [ 345.188110][T14375] netlink: 'syz.4.2273': attribute type 11 has an invalid length. [ 345.317656][T14043] 8021q: adding VLAN 0 to HW filter on device bond0 [ 345.377906][T14026] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 345.425440][T14043] 8021q: adding VLAN 0 to HW filter on device team0 [ 345.482901][T14386] gtp1: entered promiscuous mode [ 345.507409][T14386] gtp1: entered allmulticast mode [ 345.523058][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.530304][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 345.553749][T14390] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.594204][T14390] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.635797][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.643078][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.723775][T14026] veth0_vlan: entered promiscuous mode [ 345.789616][T14397] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.802514][T14397] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.950841][T14397] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.966987][T14397] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.990845][T14026] veth1_vlan: entered promiscuous mode [ 346.129946][T14397] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 346.147240][T14397] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.235508][T14026] veth0_macvtap: entered promiscuous mode [ 346.366485][T14397] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 346.379524][T14397] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.401971][T14026] veth1_macvtap: entered promiscuous mode [ 346.510886][T14026] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 346.553326][T14043] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 346.578798][T14026] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 346.620755][T14397] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 346.647544][T14397] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.673884][T14026] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.697011][T14026] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.705908][T14026] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.726835][T14026] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.778212][T14397] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 346.786715][T14397] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.809862][T14397] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 346.844226][T14397] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.862092][T14411] syzkaller1: entered promiscuous mode [ 346.870749][T14411] syzkaller1: entered allmulticast mode [ 346.936200][T14397] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 346.980583][T14397] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.122781][T14043] veth0_vlan: entered promiscuous mode [ 347.130318][ T9612] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.148281][ T9612] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.181578][T14043] veth1_vlan: entered promiscuous mode [ 347.218873][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 347.233368][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 347.306271][T14043] veth0_macvtap: entered promiscuous mode [ 347.335505][T14043] veth1_macvtap: entered promiscuous mode [ 347.413929][T14043] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 347.446551][T14043] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 347.533257][T14043] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.568798][T14043] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.585416][T14043] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.604445][T14043] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 347.711145][T14445] __nla_validate_parse: 67 callbacks suppressed [ 347.711167][T14445] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2291'. [ 347.996276][ T3471] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.117834][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 348.215967][ T3471] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.303648][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 348.325391][ T3471] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.336324][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 348.422734][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 348.438237][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 348.463351][ T3471] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.742198][ T3471] bridge_slave_1: left allmulticast mode [ 348.748267][ T3471] bridge_slave_1: left promiscuous mode [ 348.754124][ T3471] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.768047][ T3471] bridge_slave_0: left allmulticast mode [ 348.773797][ T3471] bridge_slave_0: left promiscuous mode [ 348.779798][ T3471] bridge0: port 1(bridge_slave_0) entered disabled state [ 349.308398][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 349.326917][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 349.335553][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 349.348829][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 349.372848][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 349.434584][ T3471] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 349.445691][ T3471] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 349.456967][ T3471] bond0 (unregistering): Released all slaves [ 349.503174][T14459] lo speed is unknown, defaulting to 1000 [ 350.345300][ T3471] hsr_slave_0: left promiscuous mode [ 350.351825][ T3471] hsr_slave_1: left promiscuous mode [ 350.358259][ T3471] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 350.365832][ T3471] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 350.374858][ T3471] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 350.382572][ T3471] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 350.412476][ T3471] veth1_macvtap: left promiscuous mode [ 350.418178][ T3471] veth0_macvtap: left promiscuous mode [ 350.423803][ T3471] veth1_vlan: left promiscuous mode [ 350.429287][ T3471] veth0_vlan: left promiscuous mode [ 351.242443][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 351.255258][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 351.263866][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 351.273367][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 351.282928][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 351.402756][ T51] Bluetooth: hci0: command tx timeout [ 351.597597][ T3471] team0 (unregistering): Port device team_slave_1 removed [ 351.697325][ T3471] team0 (unregistering): Port device team_slave_0 removed [ 352.227727][T14459] chnl_net:caif_netlink_parms(): no params data found [ 352.473663][T14490] lo speed is unknown, defaulting to 1000 [ 352.744383][T14459] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.768174][T14459] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.775553][T14459] bridge_slave_0: entered allmulticast mode [ 352.825239][T14459] bridge_slave_0: entered promiscuous mode [ 352.844313][T14459] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.872448][T14459] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.888609][T14459] bridge_slave_1: entered allmulticast mode [ 352.892322][T14521] netlink: 'syz.4.2307': attribute type 1 has an invalid length. [ 352.897786][T14459] bridge_slave_1: entered promiscuous mode [ 352.945507][T14525] SET target dimension over the limit! [ 352.974393][T14459] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 353.002190][T14459] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 353.304145][T14459] team0: Port device team_slave_0 added [ 353.317085][ T51] Bluetooth: hci3: command tx timeout [ 353.331715][T14459] team0: Port device team_slave_1 added [ 353.399711][T14459] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 353.407442][T14459] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 353.435482][T14459] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 353.451928][T14459] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 353.460515][T14459] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 353.486513][ T51] Bluetooth: hci0: command tx timeout [ 353.493828][T14459] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 353.774611][T14459] hsr_slave_0: entered promiscuous mode [ 353.799031][T14459] hsr_slave_1: entered promiscuous mode [ 353.805516][T14459] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 353.824939][T14459] Cannot create hsr debugfs directory [ 353.885216][ T3471] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.136994][ T3471] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.236111][T14559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2317'. [ 354.380572][ T3471] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.530233][ T3504] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 354.547314][T14572] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2320'. [ 354.563177][ T3504] ------------[ cut here ]------------ [ 354.579178][ T3504] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1223:5 [ 354.616913][ T3504] index 11 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 354.677170][T14578] xt_CT: No such helper "syz0" [ 354.684048][ T3504] CPU: 1 UID: 0 PID: 3504 Comm: kworker/u8:7 Not tainted 6.16.0-rc5-syzkaller-00204-gdae7f9cbd190 #0 PREEMPT(full) [ 354.684096][ T3504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 354.684119][ T3504] Workqueue: events_unbound cfg80211_wiphy_work [ 354.684163][ T3504] Call Trace: [ 354.684178][ T3504] [ 354.684192][ T3504] dump_stack_lvl+0x189/0x250 [ 354.684245][ T3504] ? __pfx_dump_stack_lvl+0x10/0x10 [ 354.684277][ T3504] ? __pfx__printk+0x10/0x10 [ 354.684324][ T3504] ubsan_epilogue+0xa/0x40 [ 354.684365][ T3504] __ubsan_handle_out_of_bounds+0xe9/0xf0 [ 354.684400][ T3504] ieee80211_request_ibss_scan+0x600/0x8b0 [ 354.684452][ T3504] ieee80211_ibss_work+0xd85/0x1060 [ 354.684484][ T3504] ? lockdep_hardirqs_on+0x9c/0x150 [ 354.684521][ T3504] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 354.684553][ T3504] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 354.684587][ T3504] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 354.684626][ T3504] ? skb_dequeue+0x10e/0x150 [ 354.684645][ T3504] ? ieee80211_iface_work+0xcdb/0xfe0 [ 354.684671][ T3504] ? ieee80211_iface_work+0xf39/0xfe0 [ 354.684694][ T3504] ? rcu_is_watching+0x15/0xb0 [ 354.684727][ T3504] cfg80211_wiphy_work+0x2dc/0x460 [ 354.684754][ T3504] ? process_scheduled_works+0x9ef/0x17b0 [ 354.684782][ T3504] process_scheduled_works+0xae1/0x17b0 [ 354.684842][ T3504] ? __pfx_process_scheduled_works+0x10/0x10 [ 354.684890][ T3504] worker_thread+0x8a0/0xda0 [ 354.684950][ T3504] kthread+0x70e/0x8a0 [ 354.684985][ T3504] ? __pfx_worker_thread+0x10/0x10 [ 354.685010][ T3504] ? __pfx_kthread+0x10/0x10 [ 354.685043][ T3504] ? _raw_spin_unlock_irq+0x23/0x50 [ 354.685075][ T3504] ? lockdep_hardirqs_on+0x9c/0x150 [ 354.685106][ T3504] ? __pfx_kthread+0x10/0x10 [ 354.685138][ T3504] ret_from_fork+0x3fc/0x770 [ 354.685166][ T3504] ? __pfx_ret_from_fork+0x10/0x10 [ 354.685197][ T3504] ? __switch_to_asm+0x39/0x70 [ 354.685225][ T3504] ? __switch_to_asm+0x33/0x70 [ 354.685252][ T3504] ? __pfx_kthread+0x10/0x10 [ 354.685284][ T3504] ret_from_fork_asm+0x1a/0x30 [ 354.685340][ T3504] [ 354.685349][ T3504] ---[ end trace ]--- [ 354.939817][ T3504] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 354.947114][ T3504] CPU: 1 UID: 0 PID: 3504 Comm: kworker/u8:7 Not tainted 6.16.0-rc5-syzkaller-00204-gdae7f9cbd190 #0 PREEMPT(full) [ 354.959309][ T3504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 354.969396][ T3504] Workqueue: events_unbound cfg80211_wiphy_work [ 354.975672][ T3504] Call Trace: [ 354.978972][ T3504] [ 354.981923][ T3504] dump_stack_lvl+0x99/0x250 [ 354.986550][ T3504] ? __asan_memcpy+0x40/0x70 [ 354.991171][ T3504] ? __pfx_dump_stack_lvl+0x10/0x10 [ 354.996397][ T3504] ? __pfx__printk+0x10/0x10 [ 355.001036][ T3504] panic+0x2db/0x790 [ 355.004963][ T3504] ? __pfx_panic+0x10/0x10 [ 355.009400][ T3504] ? _printk+0xcf/0x120 [ 355.013587][ T3504] ? __pfx__printk+0x10/0x10 [ 355.018216][ T3504] check_panic_on_warn+0x89/0xb0 [ 355.023188][ T3504] __ubsan_handle_out_of_bounds+0xe9/0xf0 [ 355.028938][ T3504] ieee80211_request_ibss_scan+0x600/0x8b0 [ 355.034796][ T3504] ieee80211_ibss_work+0xd85/0x1060 [ 355.040047][ T3504] ? lockdep_hardirqs_on+0x9c/0x150 [ 355.045284][ T3504] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 355.051212][ T3504] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 355.057574][ T3504] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 355.063243][ T3504] ? skb_dequeue+0x10e/0x150 [ 355.067855][ T3504] ? ieee80211_iface_work+0xcdb/0xfe0 [ 355.073250][ T3504] ? ieee80211_iface_work+0xf39/0xfe0 [ 355.078645][ T3504] ? rcu_is_watching+0x15/0xb0 [ 355.083613][ T3504] cfg80211_wiphy_work+0x2dc/0x460 [ 355.088758][ T3504] ? process_scheduled_works+0x9ef/0x17b0 [ 355.094507][ T3504] process_scheduled_works+0xae1/0x17b0 [ 355.100114][ T3504] ? __pfx_process_scheduled_works+0x10/0x10 [ 355.106135][ T3504] worker_thread+0x8a0/0xda0 [ 355.110777][ T3504] kthread+0x70e/0x8a0 [ 355.114881][ T3504] ? __pfx_worker_thread+0x10/0x10 [ 355.120026][ T3504] ? __pfx_kthread+0x10/0x10 [ 355.124646][ T3504] ? _raw_spin_unlock_irq+0x23/0x50 [ 355.129878][ T3504] ? lockdep_hardirqs_on+0x9c/0x150 [ 355.135107][ T3504] ? __pfx_kthread+0x10/0x10 [ 355.139752][ T3504] ret_from_fork+0x3fc/0x770 [ 355.144392][ T3504] ? __pfx_ret_from_fork+0x10/0x10 [ 355.149537][ T3504] ? __switch_to_asm+0x39/0x70 [ 355.154330][ T3504] ? __switch_to_asm+0x33/0x70 [ 355.159123][ T3504] ? __pfx_kthread+0x10/0x10 [ 355.163748][ T3504] ret_from_fork_asm+0x1a/0x30 [ 355.168568][ T3504] [ 355.171927][ T3504] Kernel Offset: disabled [ 355.176329][ T3504] Rebooting in 86400 seconds..