last executing test programs: 3.560820361s ago: executing program 0 (id=3585): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000600)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000640)=ANY=[@ANYBLOB="58010000020201020000000000000000010000030800094000000004040003805c000a801800028014000180080001006401010108000200000000000800014000000000028005000100060000000c000280050001008400000008000140000000000400028008000140000000000800014000000000a0000a800800014000000001080001400000000108000140000000018400028006000340000000000c00028005000100010000002c00018014000300fe8000000000000000000000000000bb14000400fe8000000000000000000000000000352c00018014000300fe88000000000000000000000000010114000400fc01000000000800000000000000000006000340000300000c000280050001003a0000003c0003800c00028005000100210000002c00018014000300fe8000000000000000000000000000bb1400040000000000000000000000ffffffffffff"], 0x158}, 0x1, 0x0, 0x0, 0x81}, 0x800) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)="88d8ce92d5ad3dd44a5bb374edbeca0340d4e4a988e635195bd364", 0x1b}, 0x1, 0x0, 0x0, 0x20000040}, 0x4c090) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r3, 0x8919, 0x0) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = openat$ppp(0xffffffffffffff9c, 0x0, 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000140)) pwritev(r5, 0x0, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x400ad80, 0x0, 0x0) sendmmsg$inet6(r6, 0x0, 0x0, 0xc4) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r8, 0x0) r9 = socket$packet(0x11, 0x4000000000002, 0x300) setsockopt$packet_int(r9, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x800) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r8) sendmsg$DEVLINK_CMD_GET(r8, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)={0x70, r10, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x70}}, 0x4040010) sendmsg$nl_route(r4, 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a00000000000000040004"], 0x1c}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000030101030000000000"], 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x0) socket(0x9, 0x7e67755fc11ea131, 0x0) r11 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r11, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000480)={0x2, 0x3, 0x0, 0x3, 0x13, 0x0, 0x4070bd2c, 0x25dfdbfc, [@sadb_key={0x3, 0x9, 0x80, 0x0, "1cdc0dca1d9f68846960e56de42944af"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x7, @mcast1, 0x80000001}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0xff, @local, 0x1ff}}, @sadb_x_sa2={0x2, 0x13, 0x2, 0x0, 0x0, 0x70bd29, 0x3506}]}, 0x98}, 0x1, 0x7}, 0x0) 3.466357272s ago: executing program 4 (id=3588): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) (async, rerun: 64) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f00000000c0)={'macsec0\x00', 0x400}) (rerun: 64) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'pimreg0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r5, r4, 0x25, 0x0, @val=@netfilter={0x1, 0x0, 0x7}}, 0x20) close(r6) (async) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="0010000000000000240012800b000100697036746e6c000014000280050009002900000008000100", @ANYRES32, @ANYBLOB="08000400000058"], 0x4c}}, 0x0) (async) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f00000008c0)=@newsa={0x140, 0x10, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in, 0x0, 0x6c}, @in=@remote, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @replay_thresh={0x8, 0xb, 0x81}]}, 0x140}}, 0x400c000) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) (async) socket(0x10, 0x3, 0x0) (async) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'vlan0\x00', @random="932e894ae486"}) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3a, 0x703, 0x270bd24, 0x25dfdbf8, {0xd}}, 0x14}}, 0x4008800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r10) (async, rerun: 32) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0xc, 0x0, 0xaf}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40400}, 0x0) (rerun: 32) ioctl$BTRFS_IOC_BALANCE_CTL(0xffffffffffffffff, 0x40049421, 0x2) (async) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f0000000900)="bada30fbc99b5400040000ea0756", 0xe, 0x8040, &(0x7f00000001c0)={0x11, 0x86dd, r9, 0x1, 0xd8, 0x6, @multicast}, 0x14) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r12) sendmsg$NLBL_CIPSOV4_C_ADD(r12, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\b\b\n', @ANYRES16=r13, @ANYBLOB="010000000000000000de00000000080001000700000008000200020000002c0004800500030002000000060000000000000005000300000000000500030001e0ff000500030002"], 0x50}}, 0x0) 2.835014064s ago: executing program 0 (id=3592): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x5}}}}]}, 0x44}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) (async) r2 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0315000004000000140012800b0001006970766c616e00000400028008000500", @ANYRES32=r4, @ANYBLOB="03185a51ebb22676db92a7f2a82110d7edbf559d6c79000000000000000000", @ANYRES32=r3, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x4001}, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.773974826s ago: executing program 1 (id=3593): socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)) syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)="290000002000190f00003fffffffda060200007ffee80001dd0048040d000600fe7f00000005000500", 0x29}], 0x1) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCDELRT(r1, 0x890c, &(0x7f0000000000)={0x5e38b282e414372c, @default, @bpq0, 0x4, 'syz0\x00', @bcast, 0x5, 0x4, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000020000000000000000000002000000000000000002000004680800000000000001000000000000000000000001"], 0x0, 0x4a}, 0x20) 2.772405978s ago: executing program 4 (id=3594): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x1, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x9, 0xf}}, [@TCA_RATE={0x6, 0x5, {0xe}}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=@newtfilter={0xac, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x7c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x58, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x54, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x845}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x400}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xa}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xe8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xfffffff7}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2ee}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x101}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x20, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x1c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x101}]}]}]}}]}, 0xac}, 0x1, 0x0, 0x0, 0x22044038}, 0x40040) syz_emit_ethernet(0x0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="3400000000084491b491a90b652f2f2b3d29a3bab70bd8042ef418b6f8e9cd59620101000000000000000800001200050003002f"], 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0xc074) close(r0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000400)={'wpan0\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="440000bb", @ANYRESDEC=r0, @ANYRESOCT=r7, @ANYRESHEX=r8, @ANYBLOB="28002f800c00020002000000000000001800038004000000060001"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) close(r6) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1a3a700080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000006600000008000300", @ANYRES32=r12], 0x24}}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) 2.769784862s ago: executing program 2 (id=3596): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000003c0)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x8) 2.6541137s ago: executing program 2 (id=3597): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x1, 0x40}, @val={0x8, 0x3, r3}, @val={0xc}}}}, 0x30}}, 0x0) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r4, 0x29, 0xc8, &(0x7f0000000100), 0x4) setsockopt$MRT6_TABLE(r4, 0x29, 0xd1, &(0x7f0000000040)=0xfe, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={0x1, 0x58, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000600)={0x0, @multicast2, @private}, &(0x7f0000000640)=0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000780)={'tunl0\x00', &(0x7f0000000680)={'erspan0\x00', 0x0, 0x20, 0x8000, 0x400, 0x101, {{0x2b, 0x4, 0x0, 0x36, 0xac, 0x65, 0x0, 0x93, 0x4, 0x0, @empty, @multicast1, {[@end, @timestamp_addr={0x44, 0x2c, 0x69, 0x1, 0x5, [{@multicast1, 0x3}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x2}, {@rand_addr=0x64010102, 0x8}, {@empty, 0x9}, {@multicast2, 0x20c}]}, @timestamp_addr={0x44, 0x2c, 0x55, 0x1, 0x0, [{@rand_addr=0x64010102}, {@empty, 0x9}, {@multicast1, 0xf80b1c}, {@multicast2, 0x2}, {@empty, 0x3}]}, @lsrr={0x83, 0x23, 0xe9, [@empty, @multicast2, @multicast1, @multicast2, @private=0xa010101, @local, @remote, @dev={0xac, 0x14, 0x14, 0x44}]}, @timestamp={0x44, 0x1c, 0x81, 0x0, 0xe, [0x0, 0x7fff, 0x8, 0x456b, 0x4, 0x9]}]}}}}}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e40)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000a80)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)=ANY=[@ANYBLOB="58000000110000012abd7000fddbdf2507000000", @ANYRES32=r6, @ANYBLOB="00000000844000002000128008000100687372001400028008000200", @ANYRES32=r7, @ANYBLOB="08000200", @ANYRES32=r8, @ANYBLOB="08f62b3b4b00006108000500", @ANYRES32=r11, @ANYBLOB="0500100006000000"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20040000) r12 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) r14 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000200), r2) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x6c, r14, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x40}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x9}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40000}, 0x63c1917bd3e49c78) sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r13, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x1f8, 0x9, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x4}, @NFTA_SET_DESC={0x4c, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x8000}, @NFTA_SET_DESC_CONCAT={0x28, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7fffffff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffe000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x99b}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x2f}, @NFTA_SET_DESC={0x174, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_CONCAT={0x14, 0x2, 0x0, 0x1, [{0x4}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}]}, @NFTA_SET_DESC_CONCAT={0x10c, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffff00}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffa87}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}]}, {0x34}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xea71}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0x4}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x61}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_DESC_CONCAT={0x38, 0x2, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffff8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7fff}]}]}]}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x7ff}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x1d}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x220}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) setsockopt$packet_rx_ring(r12, 0x107, 0x5, &(0x7f0000000140)=@req3={0x2, 0x8400, 0x8, 0xf8, 0x1, 0x5, 0x3}, 0x1c) sendmsg$NFT_BATCH(r0, &(0x7f0000004c80)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000004c40)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELRULE={0x14, 0x8, 0xa, 0x307, 0x0, 0x0, {0x0, 0x0, 0x1}}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}}, @NFT_MSG_NEWTABLE={0x4c, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_TABLE_USERDATA={0x28, 0x6, "e554a8553ea57568720ad8eb41cea3974e9978eafcb19180943d8ed1726f53fa0b7a4eb2"}, @NFTA_TABLE_USERDATA={0xd, 0x6, "d92c67be3286f29144"}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xd4}, 0x1, 0x0, 0x0, 0x20044010}, 0x20004882) 2.594378945s ago: executing program 3 (id=3598): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$can_raw(r8, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newlink={0x5c, 0x10, 0x401, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0x1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x200, 0x200}}}}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x240400c4}, 0x841) ioctl$BTRFS_IOC_DEFRAG_RANGE(r4, 0x40309410, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8b04, &(0x7f00000001c0)={'wlan1\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="5400000010000104000000000200000000000000", @ANYRES32=r3, @ANYBLOB="0000faffffff000034001280110001006272696467655f736c617665000000001c000580050021000000000006001e000000000008002a"], 0x54}}, 0x800) sendmsg$nl_route(r5, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=@getlink={0x28, 0x12, 0x200, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, 0x60000}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c844}, 0x0) 2.52174886s ago: executing program 0 (id=3599): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, 0x0, 0x0) listen(r0, 0x5) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) sendto$packet(r1, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847fe7bf05ddc63ff512d4074687760a5fbd1fc97772c6f5027dcea15b6658de3b024a6ea22baafb4", 0x3c, 0x0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, 0x0, 0x0) write$bt_hci(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0x5}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r7 = socket$unix(0x1, 0x1, 0x0) close(r4) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000001300)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r10, {0x0, 0x6}, {}, {0x7, 0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xd, 0x1, 0x9, 0x3}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20048081}, 0x40c0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="600000000206050000000000000000000300000014000780080008000000000008001340000000080012400000000f05000000000000000900020073797a31000d000300686173683a6d616300"/93], 0x60}}, 0x0) socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 2.491460341s ago: executing program 1 (id=3600): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x13, &(0x7f0000000000)=0x3, 0x4) (async) r0 = socket$inet_smc(0x2b, 0x1, 0x0) recvmmsg(r0, &(0x7f0000000100)=[{{&(0x7f0000000040)=@can={0x1d, 0x0}, 0x80, &(0x7f00000000c0)}, 0x9}], 0x1, 0x12001, &(0x7f0000000140)={0x77359400}) (async) r2 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) pselect6(0x40, &(0x7f0000000180)={0x40, 0xbe, 0x0, 0x1c64, 0x8, 0x6, 0xfac, 0x8000}, &(0x7f00000001c0)={0x80, 0xa, 0xfd, 0x8, 0x0, 0x32, 0x4, 0xffffffffffffffff}, &(0x7f0000000200)={0x9, 0x2295, 0x3ff, 0x7a, 0x4, 0xfffffffffffffc01, 0x3, 0x6}, &(0x7f0000000240), &(0x7f00000002c0)={&(0x7f0000000280)={[0x9]}, 0x8}) (async) r3 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000300)={0x8}) close(r0) (async) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000340)=@gcm_256={{}, "7d396a48204fa33a", "29b6235982ab8c285920032a242151601d74d3f5a0bcf87677d4a65dcef834cc", "5a461d9c", "ba808c62b62780e2"}, 0x38) (async) ioctl$F2FS_IOC_GARBAGE_COLLECT(r2, 0x4004f506, &(0x7f0000000380)) ioctl$BTRFS_IOC_DEV_INFO(r3, 0xd000941e, &(0x7f00000003c0)={0x0, "2999b64154b0f16188ab1271610db8e5"}) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xc6) clock_gettime(0x0, &(0x7f0000004880)={0x0, 0x0}) recvmmsg(r5, &(0x7f0000004780)=[{{&(0x7f00000013c0)=@x25={0x9, @remote}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001440)=""/39, 0x27}, {&(0x7f0000001480)=""/74, 0x4a}, {&(0x7f0000001500)=""/8, 0x8}, {&(0x7f0000001540)=""/25, 0x19}, {&(0x7f0000001580)=""/48, 0x30}, {&(0x7f00000015c0)=""/60, 0x3c}], 0x6, &(0x7f0000001680)=""/163, 0xa3}}, {{&(0x7f0000001740)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f0000002c00)=[{&(0x7f00000017c0)=""/54, 0x36}, {&(0x7f0000001800)=""/146, 0x92}, {&(0x7f00000018c0)=""/221, 0xdd}, {&(0x7f00000019c0)=""/4096, 0x1000}, {&(0x7f00000029c0)=""/157, 0x9d}, {&(0x7f0000002a80)=""/115, 0x73}, {&(0x7f0000002b00)=""/223, 0xdf}], 0x7, &(0x7f0000002c80)=""/202, 0xca}, 0x6}, {{0x0, 0x0, &(0x7f0000004200)=[{&(0x7f0000002d80)=""/176, 0xb0}, {&(0x7f0000002e40)=""/85, 0x55}, {&(0x7f0000002ec0)=""/83, 0x53}, {&(0x7f0000002f40)=""/25, 0x19}, {&(0x7f0000002f80)=""/98, 0x62}, {&(0x7f0000003000)=""/165, 0xa5}, {&(0x7f00000030c0)=""/46, 0x2e}, {&(0x7f0000003100)=""/4096, 0x1000}, {&(0x7f0000004100)=""/230, 0xe6}], 0x9, &(0x7f00000042c0)=""/78, 0x4e}, 0x9}, {{&(0x7f0000004340)=@generic, 0x80, &(0x7f0000004680)=[{&(0x7f00000043c0)=""/41, 0x29}, {&(0x7f0000004400)=""/40, 0x28}, {&(0x7f0000004440)=""/191, 0xbf}, {&(0x7f0000004500)=""/172, 0xac}, {&(0x7f00000045c0)=""/7, 0x7}, {&(0x7f0000004600)=""/118, 0x76}], 0x6, &(0x7f0000004700)=""/97, 0x61}, 0x7}], 0x4, 0x200, &(0x7f00000048c0)={r6, r7+10000000}) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004940), 0xffffffffffffffff) (async) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000004980)={0x0, @private, @broadcast}, &(0x7f00000049c0)=0xc) sendmsg$ETHTOOL_MSG_STRSET_GET(r8, &(0x7f0000004b40)={&(0x7f0000004900)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000004b00)={&(0x7f0000004a00)={0xfc, r9, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x40, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) (async) getsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000004b80), &(0x7f0000004bc0)=0x4) ioctl$sock_ax25_SIOCADDRT(r5, 0x890b, &(0x7f0000004c00)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, 0x6, [@null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}) ioctl$sock_inet_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000004c80)={'ip6gretap0\x00', {0x2, 0x4e21, @empty}}) (async) ioctl$AUTOFS_IOC_FAIL(r3, 0x9361, 0x9) r11 = socket$packet(0x11, 0x1, 0x300) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LIST_PHY(r12, &(0x7f0000004d80)={&(0x7f0000004cc0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000004d40)={&(0x7f0000004d00)={0x14, 0x0, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) (async) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000004dc0)={r4, 0xa2, 0x3}) (async) r13 = getuid() setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000051c0)={{{@in6=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x2e}, 0x4e21, 0x4, 0x4e24, 0xe66, 0x2, 0xa0, 0x60, 0x3b, r10, r13}, {0x1, 0x1, 0x9, 0x7, 0x80000000, 0x9, 0xff, 0x9}, {0xb44, 0x3, 0x16b, 0x8}, 0x1000, 0x0, 0x0, 0x0, 0x2}, {{@in=@rand_addr=0x64010101, 0x4d5, 0x1}, 0xa, @in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x3507, 0x0, 0x0, 0xba, 0x9, 0x4, 0xfffffffd}}, 0xe8) (async) ioctl$AUTOFS_IOC_PROTOVER(r5, 0x80049363, &(0x7f00000052c0)) (async) ioctl$int_in(r11, 0x5452, &(0x7f0000005300)=0x9) 2.428703549s ago: executing program 3 (id=3601): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x2c}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r0}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="953a04"], 0x24}}, 0x0) recvmmsg$unix(r2, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000008c0)=""/200, 0xc8}, {&(0x7f0000000640)=""/249, 0xf9}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f00000007c0)=""/97, 0x61}, {&(0x7f00000001c0)=""/104, 0x68}, {&(0x7f0000000300)=""/25, 0x19}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/133, 0x85}], 0x8}}], 0x1, 0x2080, 0x0) write(r2, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000002c0)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x1e, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @generic={0x5, 0x0, 0xf, 0x0, 0x3}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 2.357199549s ago: executing program 4 (id=3602): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x16c}}, 0x24) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x11, 0x4, 0x4, 0x5}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000157b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r1, 0xffffffffffffffff, 0x500}, 0x57) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000340)=@filter={'filter\x00', 0xe, 0x4, 0x2f0, 0xffffffff, 0x1c0, 0x1c0, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x4, &(0x7f0000000000), {[{{@uncond, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@remote}}, @common=@inet=@socket2={{0x28}, 0x3448c61d20618fde}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x6, 0x5, 0x6, 0x0, 0x0, 0x1], 0x5, 0x3}, {0xffffffffffffffff, [0x2, 0x3, 0x7, 0x4, 0x0, 0x1], 0x4, 0x4}}}}, {{@ip={@multicast1, @loopback, 0x0, 0xffffff00, 'veth1_to_hsr\x00', 'vxcan1\x00', {0xff}, {}, 0x89, 0x0, 0x20}, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x350) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x0) 2.288409233s ago: executing program 1 (id=3603): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00'}) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={0x64, r1, 0x731, 0x0, 0x0, {0x38}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x64}, 0x1, 0x2}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha224)\x00'}, 0x58) syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000002", 0x3c, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x8, 0x2, 0x0, 0x0, {0x0, 0x6, "000810", 0x0, 0x2f, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, @private2, [@dstopts], "fb36eeca"}}}}}}}, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="64a465e8c8b19b44ba4dea57970686c91b493ce03f82124b84ddbf2653a98ea3217f2b957cf30e84d68a03b3c29dc13fba42c25d98a3974d4bd7d1302be820437b", 0x41) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x6, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0x9f}, [@ldst={0x7, 0x0, 0x3}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r3 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@bcast, @null, @remote, @bcast, @rose, @bcast, @bcast, @default]}, &(0x7f0000000100)=0x48) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r4, &(0x7f0000000300)={&(0x7f0000000040)={0x24, @none={0x0, 0xffff}}, 0x14, &(0x7f00000000c0)={0x0}, 0x7, 0x0, 0x0, 0x2004c004}, 0x0) accept$ax25(r3, 0x0, &(0x7f0000000140)) 2.266645553s ago: executing program 4 (id=3604): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff00000028711051000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x4, 0xfffb}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}, @TCA_CHAIN={0x8, 0xb, 0xa8}]}, 0x38}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) sendmsg$AUDIT_GET(r4, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3e8, 0x0, 0x70bd25, 0x25dfdbfb, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20000804}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x3, 0xfff1}, {0x4, 0xa}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048080}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f00000009c0)=ANY=[@ANYBLOB="340000006800010900000000000000000000000000000000060003000000000014000200ffffffffffff"], 0x34}}, 0x0) 2.133417413s ago: executing program 1 (id=3605): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x49) (async) sendmsg$kcm(r1, &(0x7f0000000040)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27050200160014000600002fb96dbcf706e105000700810000008100", 0x1c}, {&(0x7f0000002980)="bb08178d797d17619f51", 0xa}, {&(0x7f0000000240)="5feae35f3e6fc0f083c2788cffb0fb960e397627f1c5565237d118be3247e41d7caa693cfb9513167a7808f106ddc9a5bfd35d49436e2247e22c718c8be40c7ef3be48a6dae1344ea84e466f8a21106d42e1841b8ca770fee303306792c1e12772b89bebdf1d603a003ec0fb2be6c8dd7b8d65a46c66a93ad85d569be0b29d27029f4445eb6fa54711a0ec6cd4805a58dac022b1ec0479ed4a035ccbc08562797ae4068c9c4b51aa805388fc88b17f26d10bf35d23c19ed8b3e71a6a73434f596efeacb7fd30b5542819c120c8504d5feeb59434d1d8a48adc9e306195d8457519726b4e64f589228e69d4ee478c8d53e3c9224b0a531a79b9fb1217", 0xfc}, {&(0x7f0000000340)="791ae798ee48fc56555765b566abdba8d8efae9f0d99dddda6ddf0f4af19293388a96e0b243557345b2a201f677819d10369766b59a633d68b17f70a2c5589fe773e3b2e483e09f25eaa9239181ec0ea14a58ffd64e3b8d39708c399e7845bc038e651e0137cf479e9a939cd8d7a18fe5a70e2eb6fa3d31125fb6a475493e97e309f3860a4192bd334c53c1b298d6a296847ae9cbac779b9d3a7f1ca6e2ab7bd8dbf2e2ba64402b35410a458ae255b75886a78d4a86807297b0d6efa68530e9b1eb61928a17b7df8e7277111536672b0c805adcc3fe6cf39e0122295a43958c84be01106e3f2c3c48085e0d5fead8eb6755759e5817085e8d1f1c4318d001eefdbc6aef68f0e11ee7e00c3cdc8fd5b79a17bac1f8ef9445426d483f9539915b42ec449bdb53cdfab0ce299f809537fe9366b97a3672654e043fa70e02cd0afdd0c6d32325d2b6db2eec63aa14aa8bf7e0279f18d6f99158db240395f56a2fbbc4aff88ee3bd3a4a856598150999880f2cf715d78d2d9d346b0bac2f7ffd45f367a04d91ee704b6e98b9e045c4e325c8f3d03fc81a3123b72b56036c8a60e9ae91d268f54769cfbc86222ee60548f3a24ff6f4349b74eb5009658410beb6f0783e7410663b3c6c94129bace69254f1bec16ab1bbe950824b8d1457d0cf1060399b26749f3b7ae8b174a81fe8e6a2593b1a30b03c2f3e86bb10f84e2ab95841008305a5de682ccc12f682579c0b93e7f44c1e7ba0c1a51ace9a1661a2d410c4cb4e7a027631cbfae987d4095a4c1a3e675a2e3597d8e8de16a88aa12fb8de199f502a8d7e5075daf776faccf5e27b95d03c0d68f7e3cb046e76bead852f94d333899e911e0d66cf06ae517f59f0b324ad4abf89e968719b14b85474e3169c3cb089c3d7c81ad290e2e70d0da297018a5629ff16f33c41adb410182a831b1d830d4cd793244bfad04991c47994ee767f9af8eac24f3382e6f92d125bcd6e5b050730b505057c6abc79ea9cf25ce86036d61f3ca2c750687d8ef3d930223fc0fcd4b8c4e0bc0d7c0db587d0d60a7995c306be1610404ba31685fbe3b4b6db921e22170d136aa06f59bc0c1b3dc90d1f1f99973a82e064f89f53d3dd61fe214c8da9efbdb0f5c87984a931012786e94b3bc15ba956c674aecf98faa9fd53add1a6c3256b3ea3c6f515261ef687f11a81c970f4c5c8d58568d45816933dd5c5f46a938ca6fcc1f8c4d9fc4e82fb7a14f55c7d4b34509a0d91ac0163f6910493920e67999f5b653d367c5bd2d1f405784e9ad017433e1e4a8020a5128e0b107f91ff6b2cfd223cd5e32ccc9073c24f3da7056334dbf07a1ded53bb7da55a7f0f1e32343ae179b60c7ddd7c6ec5276556e66a21fe468c9223199f277596bc724a3e53ae866cde81479bc71648d41f05055599e0b4f89d0afd2123291b9b4d607b634454e9270b67aa0b6f9ca81ad9ca0fdf446e291b31beef8bbf5321903bfc8ffd875e1da790be2cc19ca1ff80c4045312fb4f14a1799a464ac501bd88e1e6a75984d6f7d03882415d5034410a92e3f5f70cb0f3d5976dd25db0362e5d2141595b825c769aa430f2518bcaea6e3f4979adf8b6b1f847be7713837402b025df9ad9c09af74dba8256087b23d57d40dd2ec2095895cf37244e1b4d14d68401ace381edeafaa4b19e941587a79fdf73fd9c05623b6885f505f7ea51a38b3df8e1e400da8f01d5f9fdd0dcf4020cfcff5b2223cb8cf3c4cad237a78285c0e3a83df193a6f3f5d61ea764c3fc763483495373d4947d9d9d600ad2e55fe73e73673a128862d6c8581ce905cd7ac4fd95303bd6eafe4d4fab764eea91049caf03d8382504d675133e10be199c05a9f023fd245cc6d3a68ab07ef116aa40907b3fa303d54ff7b413f56d770643f05ce283936b8c6a6042ed0810742557e35c2805c16e76142923be074047cd3c09cc415c262e5078f51997098b092991b56fa85c6c50860757e86462ee00380bbcb4853a371f1ad6ab1c345e143f21259175ddd2c0feaec5852ec3d462fe2963415c1b6e851c3ebd02d2b0c37a46f7687dae3addb539f20698fed26557fdcad1d6902676b80de7308e25c3526ff78f7cee67f89e0182ed209b551c4f2a0808a3f35567c4e9208c9c63ce3723e4592795690f044f93b8e5733fc17acfca35fe0fb1e05af0b294d127fb97b2b8c23ac66978e86a58043f4a092f292eb95172bcc80d7351c6693f2e9f36c4bb9fc043c7b8c37b30bc964752a0655a036941b69cedb089649a34b8696f30bcaca1005a98397d0be82fe40eced0bf4979f86fca8f94e48b76f1dfc14dba72423effb62fd37c8f3b5c7d48a62be7c702c137b7b7dab633a4e07c60cf7381466c89ee0d344afd0d6a4d6710de689fad92fc7cd0558c8159d27070b6c6e5bb7689046b32454bd9996fb94cafde77c109897d54f47c987333580c7a173ee7eabd5ae71a23df015e45d9505c4642e7a7cb85738de4c6000aa0c3d5496b2054e68931145373782355c8d9e96971dcb27a876e62f8c2786eaf4d08ee884d3fce57aea8476fd5c2104fb33d1e53d296a5aba6fd7daca69317ca7b85e569a32663058612edf98b991a4f5dde570a046ad2c5833c9aca373507b43f080e7a000a1bf72e02e7637424abecc4eefcdbc45740cc45f904c98a062812fe6a91185bcaf9bd1dfef4e0375a5b8421839f5f39f4d6142f85704faddfcbd9168f6f4991a56cff8e51c33028de522b46bee49380360f7b356a51e75503884b49fffdd0d2ad48c8d29aab0cf105bd6fed71e831ef2ceb1edf348054a2ff715595eacbdf6af0476ceaa083086e2e0e5de2eba478daad364fd321bdd52a6bdabe02cb03876b611982c40fd387bd15eba1708e96963819f5ea154d058741aceb64b1e4386e75b089b54d3831dd4fb9d0ec4d77d6a3c23f366756711daf6da093e6efe9b3d661b9c733d17a5fdd94261006227423e6ec90470e5aa2621801943d0d94b5a3302a90f73683ca508f136eca70c33347a232f57d5bb898d2b19972346ddd2fdfbf70957f3c63f8a1d704507fa10b58b29557a5d428e63cb84652f42268f78359f88e58841ce8db25308365889f54573bf580f445d25991bb04f6c5cc02b4bb59194be9a53027e20b6241fd4cf547322fe1ef917df8124c831ac7709a91fb5473b8032cd75d510e244684867c0090f268148596d81e7fabd84ac038e441f2c35815384e3e8cac5d1fbb196558e82850322465d3f0c725b07cb3ed49a73583f0ff4d6d2dc57c6319b847cc9d7684d46b20d83cfd71934eca9d3659e83d043459f1fdd2ba29f3b24d9b317e6efee9c04035fa19496192c944f83493a430b0c9f7bd9f074186d03f7ef5e58024ea05d77e1f150cdd0b8ea4e6c312f7820e0779b1bb84d1f14d2c040008a883b9c1e7aaeb83b24626411639e195487a1c1aeb36e0b255cbcaab6a3bd43633df6d3370475e8d6e63611e174973a56c759b29b79752d13c0facfb73d540f52f39a2b290f1b1971d608cb5fb393cbb95786a003b5fe85a7bace95e8bf7072cca752304bc258ab3adacd93106e2d15dd226405f928ff03c09b9f296666032ec011912642b00d766d84b47c973e70e4464ce91a0a", 0xa05}], 0x4}, 0xc0) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000009d00), r0) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000009dc0)={0x0, 0x0, &(0x7f0000009d80)={&(0x7f0000009d40)=ANY=[@ANYBLOB="24009b47", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250100000008000200020000000800010002000000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0xc050) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async) unshare(0x6a040000) (async) r3 = socket(0xa, 0x1, 0x20004) ioctl$sock_netrom_SIOCADDRT(r3, 0x6180, 0x0) (async) ioctl$sock_qrtr_TIOCINQ(r3, 0x541b, &(0x7f0000000040)) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r3) sendmsg$TIPC_NL_NET_GET(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r4, 0x200, 0x70bd2a, 0x8, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x401}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x800}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x4000840) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="a00000001900010000000000000000001c140000fe0000010000000084001900"], 0xa0}}, 0x0) 2.076422707s ago: executing program 1 (id=3606): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_COMPAT_GET(r1, &(0x7f00000025c0)={0x0, 0x0, &(0x7f0000002580)={&(0x7f0000000080)={0x2c, 0x0, 0xb, 0x5, 0x0, 0x0, {0x2}, [@NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_NAME={0x8, 0x1, 'osf\x00'}, @NFTA_COMPAT_REV={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ARP_VALIDATE={0x8}]}}}]}, 0x44}}, 0x0) 727.321912ms ago: executing program 2 (id=3607): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000004b00000095"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x90) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) (async) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000130a03000000000000000000020000000900020073797a31000000000800034000000001090001007379360700000000"], 0x34}}, 0x4000040) 716.400569ms ago: executing program 3 (id=3608): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000040)=0x2, 0x4) syz_emit_ethernet(0x66, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaa8aaaa88a800008100000086dd6076cd8a0028000020010000000000000000000000000000fe8000000000000000000000000000000004000000000000071800000000040000d604"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x62, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x5d}}, &(0x7f0000000480)='GPL\x00'}, 0x90) 662.085501ms ago: executing program 1 (id=3609): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="070000000400000008"], 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x33}}) 659.829509ms ago: executing program 0 (id=3610): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) (async) r0 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x80800) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f00000000c0)) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0xfe, 0x4, 0x0, 0x1, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0xffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)={0x5c, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9effffff}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000ec55010000000000000000000200080a20000000120a00080000000000000000000000060900010073797a3000000000140000001101010000000000000000000a00000a"], 0x48}, 0x1, 0x0, 0x0, 0x20000010}, 0x8000) (async) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r3, 0x8b2c, &(0x7f0000000040)) 607.290432ms ago: executing program 3 (id=3611): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r1, &(0x7f0000000380)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) getsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0x4, 0x0, &(0x7f0000000080)) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x2d}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_BITWISE_XOR={0x4}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x100}}, 0x0) 571.810094ms ago: executing program 2 (id=3612): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000004cc0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="a1", 0x1}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r1], 0x30, 0x40400d1}}], 0x1, 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x400000, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000280)="b106d8e6da1a56dbbc6559cba83ab4188b858542ce191eb1300fe05f2a4a515ea418214eed0c9edec2b8bee7f4", 0x2d}], 0x1}}], 0x1, 0xc044) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$netrom(0x6, 0x5, 0x0) 425.96958ms ago: executing program 3 (id=3613): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x800000}, [@alu={0x4, 0x0, 0x8, 0xa}]}, &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x62}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x4, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_ALL_TARGETS={0x8, 0x1e}]}}}]}, 0x3c}, 0x1, 0x2000000000000000}, 0x0) 425.499338ms ago: executing program 2 (id=3614): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xfe93, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r1, @ANYBLOB='\x00\x00g\x00\b\x00\b\x00', @ANYRESDEC=0x0], 0x24}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r5 = socket(0x15, 0x5, 0x0) getsockopt(r5, 0x200000000114, 0x5, &(0x7f0000000580)=""/102393, &(0x7f0000000000)=0x18ff9) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x503, 0x0, 0x703, {0x0, 0x0, 0x0, 0x0, 0x40220, 0x1006}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6, 0x6, 0x8001}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 397.4306ms ago: executing program 4 (id=3615): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a80)={0x6, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000340)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000580)={'veth0_macvtap\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r0, r3, 0x25, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0, 0x0, 0x9}}, 0x30) (async) r4 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r0, r3, 0x25, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0, 0x0, 0x9}}, 0x30) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f00000004c0)={r4, r1, 0x4, r0}, 0x10) r5 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r5, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000100)=0x4) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r5, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000100)=0x4) 391.715192ms ago: executing program 0 (id=3616): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x99}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit={0x95, 0x0, 0x1008}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={0x38, 0x2e, 0x9, 0x70bd26, 0x0, {0x4}, [@nested={0x24, 0x11, 0x0, 0x1, [@generic="9326988d2516e0eff7e551cd3040c3a66adbc8caab96d3061d1fe91ff4f07d0c"]}]}, 0x38}, 0x1, 0x0, 0x0, 0x42804}, 0x4000000) 160.573703ms ago: executing program 3 (id=3617): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELTABLE={0x28, 0x2, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELTABLE={0x174, 0x2, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_TABLE_USERDATA={0x69, 0x6, "e62807258a6d38caf4cb1d7a776a7a05e57912414e63207c5e61d47bb4016b21bd5593b033b0968722f2f0f4818a1a13fbb43e79d0ae674d071c0164df9d3701cc15211300766b6ebe326ada9e49cca5c2a074e0e46e35eabfb48a4cd2cd8379a97e705b01"}, @NFTA_TABLE_USERDATA={0xf2, 0x6, "4a9f349d38711c6dfb08293db5b082b71705f6a1c5542e4dfa98485ad7a2efeef2c685fdc4f6a9bdf1cf58ff4f3410b277e056ef871a161546636eb2300013e646b112de58d7540c750a873e1ebc01038ddc95acf94f46bd46ca93e440ab2f5e5f470faadb25806ab4014f67fd45b451f4e253da1bcd7b7625ad4cba3faa3ebcfa364997648be8f38d2a86c31ff31e954062424501a8998ec2ae4af96beedd5504fdc08ac97a7b18e2981f0c6d4acdd186e67fb9c3395f02883c3ef78413796baa8fb459270f8b547ec66672374b019da9e00f25514e5c5c7fba3a9fc0f90133b7dccaa07e74d44408c33cdf3fad"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x1c4}, 0x1, 0x0, 0x0, 0x2000c814}, 0x4000) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) bind$tipc(r0, 0x0, 0x0) recvmmsg$unix(r0, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/211, 0xd3}], 0x1}}], 0x1, 0x40000100, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a310000000014000380080001"], 0x138}, 0x1, 0x0, 0x0, 0x20040855}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000000010000103ffeb00feffffff0000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800e00010069703665727370616e0000002c00028014000500000000000000000000000000000000010500160002000000040012000500170040"], 0x60}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000021c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4001}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELSET={0x20, 0xb, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x880}, 0x4c0d0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$NFT_BATCH(r3, &(0x7f00000011c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f0000003100)={{0x14}, [@NFT_MSG_DELSETELEM={0xbf8, 0xe, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0xbb8, 0x3, 0x0, 0x1, [{0x580, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_EXPR={0x34, 0x7, 0x0, 0x1, @lookup={{0xfffffefc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET={0x9, 0x1, 'syz2\x00'}, @NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz2\x00'}]}}}, @NFTA_SET_ELEM_EXPR={0x530, 0x7, 0x0, 0x1, @range={{0xa}, @val={0x520, 0x2, 0x0, 0x1, [@NFTA_RANGE_TO_DATA={0xc0, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x71, 0x1, "1687358216a7b2f361215756eecd99041b09cbd579160408b5c650173cec1d575d3b154f72dd59033a1a9709f74aeeda014a24de6c6fe19e8e8a55e8da88a1c5bc5057fde9628ab45f4124b667de38ba5acc981f5362c433ab12a817099d99fc83ca1d882833a5fc263d007c62"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6}]}]}, @NFTA_RANGE_FROM_DATA={0x1a0, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VALUE={0x5d, 0x1, "284c89e518553f2cb6c39445d18ac77db48e0737318fd6ad6cff2473c14ae7efe3abfa912137fa3337a9ccb188f3c06f460c49bd56e945bf395f4a12fcb61199c1eabe1a42e0b44b50cb252d8d2b24dbfbe1405bb99fb1c66f"}, @NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x83, 0x1, "07e34e4e78ad7063440120724beb4d36a1ab9a6157dd0b29713c20d4aa2ca22f2e1add2497009d63bca95c105e75c0d8c66177f38be369c00436936aa2c49b6e59d1c4d714e92dac1043c6dc52ae63267d3c5a82c3169da8fab8fb4ddf45d928e731afaa6e28317113a885a9089f52f40025b8f74c229c2b46f288d30ffa6d"}, @NFTA_DATA_VALUE={0x5b, 0x1, "75a25950931a8a1da7731c02e362516b5c5679abab81a684befe1e67e145720e724d0d8a44f17b8ee002ebe5dab77db78d91f639ae04d97a11f5020dfac33bc94e7a7443e8a9dc4729340accf2f3dbb17ddec11acbdc16"}]}, @NFTA_RANGE_OP={0x8}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RANGE_TO_DATA={0x26c, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VALUE={0xcd, 0x1, "fdfa8435ada671e48f8ebdce373d0aef7750e49c5e408a64c81f4dbd473b3b0a55e297247bade58535497b0a10caab2992062ad1f3d62e7c94eaffed70099d3515dd9f1181bb438caa37cb8538e2a613bace390856558ff49d1261520d6903dcce106482229a004454224ee0dad5fd694c5400e877884d048ce3333496444b1ee8fbc58e9eac9ea0825c574498b2b54e71e7f5671ce93d4f4ac2abc0295d8cae4da09cfd19fbe93bb92fffe9a50c01183b6ee4cc75a58c955a34a736d7cdd793e41f2ea1a96ffc4f42"}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x5}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0x7e, 0x1, "99765833746653c9d642ba0a39d51c56a4ce3c65005762727fb5ee2904b2101d83f1de4f7d948b00ae7f290c7b821ac69c1f4ea1f09fdd90a6a2c1dfc1c226059238810a42618ed803557aeae040c72cf4fe277cf7d3ee8606af3a12731ed9589bbfffd86229b8e5f2ec46f26356167b1f13b5c7cc484fbb80d6"}, @NFTA_DATA_VALUE={0x5d, 0x1, "a0bc1eeb6e9c01339ac536787afefda9ad76ac9f6e86fd737900e2719c274ba4c72902bb1fe9fa89cd99586b66bce412064596a90657393af06260b52d145086b843164a2129ce9417927fa06bbcbbb7fa6a02baa9a5b47458"}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_RANGE_TO_DATA={0x40, 0x4, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}]}}}]}, {0x634, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x64, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_KEY_END={0x270, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xe2, 0x1, "94079fbe72ac67be00f8413e7b43b235b4e9e9371d6ee11be6e7fdc16e4b2eb05aff284d820d9a40478d02e331bb088e068ae6d5c6503232899f9ca0cb503d2f0611834680e4cebdc08207866c59ccf184d1229d6742dbc9daeff77f3824029597af56c4333ce4d08e9f0cbfd1d39948fabcb10620ff70d92c18e1787d328bf1f6a8625e78e15464f15459e5dcbe8dd9bc325b145b6466a5d4832bb367b2bbbe9b75755f48e8f5a29c7387d99d76f9ebff5a679b1cdaa3506ab2e4c519358dc75f24ece0cc2ea7c233114f82f307529cf296d7c86824a74ddd58a151571f"}, @NFTA_DATA_VALUE={0x26, 0x1, "4a1e403f3bebf84f9b9141bc600d780c83fd8614c465372f91b6b243b20d0b69b41d"}, @NFTA_DATA_VALUE={0xc9, 0x1, "9037d7928536c87e7f34d26c5038794b81ddd18b380a63d4175e350d0fe50f7ab8423ab5b60a3a3ac1a0e6f2dc068ddb455a74ed81f3d1d8391d66ae519d54636c13a0f8afdc886a1fa038285e7ca1f2f4085bff8b4a089b1765408477519b97edbf21750e9792c7605a888998b7a1c7dfbbcd221594141d6cdde383e072ae8b7ed56cc5e15908178b8c32da1c346ba306058d22f14fb2fc7f171f1e9f3f85e65d0d663017e0834902a3b7ef49b6060c6bbf5b1b2fbe25633e62d097d6e96322079658b577"}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x72, 0x1, "451121529e20448255025930df6beb184acdac2b4417cd8c5efa185a09ee8a1f3aa00293fe06837351666e47bec061ee66fd5378b5b66e1b32214976430a4f1bacf700f552c9f98049580223923f998885b1b7e15a4bbc1ab002885e02d0de2c6cca85ea0578753dec5e6ef234ff"}]}, @NFTA_SET_ELEM_KEY={0x3c, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x21, 0x1, "35a73d10e875812609f880276c74120ae21b6f7c7437e514d5fa9bcf17"}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x4c, 0xb, 0x0, 0x1, [{0x48, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_NAT_REG_ADDR_MAX={0x8, 0x4, 0x1, 0x0, 0x14}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x16}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0xb}, @NFTA_NAT_REG_PROTO_MAX={0x8, 0x6, 0x1, 0x0, 0x2c}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}]}}}, {0x0, 0x1, 0x0, 0x1, @log={{}, @val={0x0, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0x0, 0x5, 0x1, 0x0, 0x7}]}}}]}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @immediate={{0xe}, @void}}, @NFTA_SET_ELEM_KEY_END={0x1c0, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xed, 0x1, "454d799d8157b100bc1dc0085e2e281534ba871dea89c1ccfd9f3063adfdb288c7d7fe79e9d099f33a62943e2a9f7de06b66589f8ae8ad19e1e20c3060a577a80bbb23df503a218fa61d1fa95cb96309ccd6d463d70daf219c065f7fecef3a3a96dbba924a5d10d639b353f469afce75ab9b723270e3536b0a44ef879fc75abb0084122188cf1a408b03f870dfaad2402b7e7fd2dd2458a58295e4be92b9543f3e8b1fa41de56b0830b7eee44b05756bea874e9e8fe4b1fc0aff7b07213d538942d6a1940ab7bca4286d9fa92be812af0820e4269a7982c2ba20af60c48b1ebca4c2b3fe95fd89e5ed"}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_USERDATA={0xf5, 0x6, 0x1, 0x0, "9376b9315fdbdf3b305ab7faa531b6ffbf946c804a6bd4a02f703ab326985be5f60ca517b489df261774ee6036c598f508d37f591e9a3ded3e58359c32d0e2fbba27b50d4585f604cf58d7971264a6e41bd9b06cdf030d1006421e668983871dd66075c0164b750a7a2b6fb90272b8ad7ce3724ce1e6c4c2beba9c2f15e8e31dd59ed737e2a13c6cf4c1d8592fca6da79fa91d8ccd0d86714a3dc636f841997a91ce898dc447ce70af10bf0f33235e96163834f05578698cfaa6abf5ea9e28e3dac6d648633eed7fafb403e95ae746866da2492b1b4c571d6abcf8de21b8fb00a64bcc5eb312c8eda949e97a860bffacde"}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0xcc, 0x14, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_USERDATA={0xa9, 0x8, "85621bef948ee77def55b2a69a74d4f3b78ce13b732dc63c9c320f826c893c7f80e389e7f3935f6c17018835f2049b11163dbf331903666a361eb41eb78a4b0be80893e0e146ba3ab4fdf5ef27e2b54272df05f2766fa47cec94071c7d2fa8e4e5f4dd9e3a5a47a6495802b1ba6f0efdad01deff1f5962584281389cc279daabcf90d2a99ee28ef350c9641bb65b293cd5ba209bbd2e359e0a81f3d67475bf389f57111688"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcec}, 0x1, 0x0, 0x0, 0x4854}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd0002800800"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000007c0)=ANY=[@ANYBLOB="300000001a0001000000000000000000818000000003000000000000140001"], 0x30}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="01002d2c771e79423be5e9000000060001004e210000"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0xc010) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=ANY=[@ANYBLOB="02f6ff05c98115e47a730000000000000041b60500075f00000000"], 0x10}, 0x1, 0x7}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001d00070f000000000000000007000000", @ANYRES32=r10, @ANYBLOB="000052000600050001000000080008"], 0x2c}}, 0x4000000) socket$inet6(0xa, 0x800, 0x4) 154.129867ms ago: executing program 4 (id=3618): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x20008800) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a3c000000090a010600000000000000000a0000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000b"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@newtaction={0x78, 0x30, 0xb, 0x0, 0x0, {}, [{0x64, 0x1, [@m_skbmod={0x60, 0x1, 0x0, 0x0, {{0xb}, {0x34, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24}, @TCA_SKBMOD_DMAC={0xa, 0x3, @broadcast}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x78}}, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000), 0x10, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0xc0, 0x1ff, {r2, r3/1000+60000}, {}, {0x0, 0x1, 0x1, 0x1}, 0x1, @canfd={{0x0, 0x1}, 0x18, 0x2, 0x0, 0x0, "7816e7e15f7a0b777843fe7cd0426b7f2cc80ff9936a292722b937c88f4f9ada62c3535ffc77fd608bf318558bd93bcf1616acf59c2f2670c60c888925f44c05"}}, 0x80}}, 0x800) 138.168569ms ago: executing program 2 (id=3619): r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000180)={r0}) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffc}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="178d048604bf0bfb1945d7430008", 0x0, 0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) setsockopt$packet_int(r1, 0x107, 0x12, &(0x7f0000000240)=0xeabe, 0x4) syz_emit_ethernet(0x5e, &(0x7f00000000c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x50, 0x4, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010104, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xf, 0x0, 0x5, 0x0, 0x0, {[@mss={0x2, 0x4, 0x499}, @md5sig={0x1d, 0x12, "910000000000006f00"}, @md5sig={0x13, 0x12, "047362d4843af5cce037a189c9077f3f"}]}}}}}}}, 0x0) connect$pppoe(r0, &(0x7f0000000140)={0x18, 0x0, {0x20, @random="a380e37b9489", 'vcan0\x00'}}, 0x1e) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000440)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3400000010000100"/20, @ANYRES32=r5, @ANYBLOB="00000000000000000c001a800800028004000180080004"], 0x34}}, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000280), r1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0xcf}, @NFTA_REJECT_TYPE={0x8, 0x1, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) accept4$rose(r1, 0x0, &(0x7f0000000300), 0x80800) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x3}, @func_proto={0x2, 0x0, 0x0, 0x8, 0x2}, @var={0x2, 0x0, 0x0, 0xe, 0x4}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x48}, 0x28) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000002c0)=0x6, 0x4) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 'dvmrp0\x00'}}, 0x55) 0s ago: executing program 0 (id=3620): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010800000000000000000100000a0900010073797a300000000048000000090a010100000000000000000100000808000a40000000000900020073797a32000000000900010073797a300000000008000540000000020c000b4000000000000009212c0000000e0a01080000000000000000010000000900020073797a32000000000900010073797a30"], 0xbc}, 0x1, 0x0, 0x0, 0x801}, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000080)=0x2, 0x4) connect$unix(r1, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r3) close(r0) kernel console output (not intermixed with test programs): erflow at hook 1 [ 212.559103][T11351] !: renamed from bond_slave_0 [ 213.249076][T11387] netlink: 'syz.4.1644': attribute type 3 has an invalid length. [ 213.257433][T11387] netlink: 'syz.4.1644': attribute type 2 has an invalid length. [ 213.317402][T11389] openvswitch: netlink: Flow actions attr not present in new flow. [ 213.708433][T11408] ieee802154 phy0 wpan0: encryption failed: -90 [ 213.879873][T11419] netlink: 'syz.1.1655': attribute type 6 has an invalid length. [ 215.011608][T11460] netlink: 'syz.3.1667': attribute type 1 has an invalid length. [ 215.036086][T11460] netem: change failed [ 215.353325][T11481] netlink: 'syz.4.1674': attribute type 1 has an invalid length. [ 215.451298][T11485] pim6reg1: entered promiscuous mode [ 215.457275][T11485] pim6reg1: entered allmulticast mode [ 217.008573][ T5839] Bluetooth: hci3: command 0x0406 tx timeout [ 217.522539][T11522] __nla_validate_parse: 27 callbacks suppressed [ 217.522562][T11522] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1688'. [ 217.538791][T11522] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1688'. [ 217.549268][T11522] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1688'. [ 217.695847][T11533] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1691'. [ 217.751084][T11535] netlink: 'syz.2.1692': attribute type 2 has an invalid length. [ 217.956984][T11540] syzkaller0: entered allmulticast mode [ 218.085903][T11561] netlink: 'syz.2.1698': attribute type 2 has an invalid length. [ 218.098768][T11561] netlink: 'syz.2.1698': attribute type 8 has an invalid length. [ 218.108439][T11561] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1698'. [ 218.496644][T11587] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1708'. [ 218.821535][T11605] netlink: 'syz.4.1715': attribute type 1 has an invalid length. [ 218.829702][T11605] netlink: 232 bytes leftover after parsing attributes in process `syz.4.1715'. [ 218.910814][T11609] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1717'. [ 219.062419][T11619] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1720'. [ 219.139579][T11621] netlink: 'syz.1.1722': attribute type 12 has an invalid length. [ 219.165271][T11621] netlink: 'syz.1.1722': attribute type 12 has an invalid length. [ 219.446348][T11641] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1726'. [ 219.591917][T11649] netlink: 'syz.0.1731': attribute type 1 has an invalid length. [ 219.876901][T11617] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 220.494796][T11686] Bluetooth: MGMT ver 1.23 [ 220.931528][T11707] syzkaller1: entered promiscuous mode [ 220.940643][T11707] syzkaller1: entered allmulticast mode [ 221.040846][T11718] FAULT_INJECTION: forcing a failure. [ 221.040846][T11718] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 221.057504][T11718] CPU: 0 UID: 0 PID: 11718 Comm: syz.1.1751 Not tainted syzkaller #0 PREEMPT(full) [ 221.057532][T11718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 221.057544][T11718] Call Trace: [ 221.057552][T11718] [ 221.057562][T11718] dump_stack_lvl+0xe8/0x150 [ 221.057596][T11718] should_fail_ex+0x414/0x560 [ 221.057635][T11718] _copy_from_user+0x2d/0xb0 [ 221.057676][T11718] sctp_setsockopt+0x1c4/0x12c0 [ 221.057696][T11718] ? sock_common_setsockopt+0x36/0xc0 [ 221.057729][T11718] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 221.057765][T11718] do_sock_setsockopt+0x17c/0x1b0 [ 221.057796][T11718] __x64_sys_setsockopt+0x13f/0x1b0 [ 221.057827][T11718] do_syscall_64+0xec/0xf80 [ 221.057851][T11718] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.057872][T11718] ? trace_irq_disable+0x37/0x100 [ 221.057901][T11718] ? clear_bhb_loop+0x60/0xb0 [ 221.057926][T11718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.057948][T11718] RIP: 0033:0x7f7bcdf8f749 [ 221.057968][T11718] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 221.057987][T11718] RSP: 002b:00007f7bceee7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 221.058011][T11718] RAX: ffffffffffffffda RBX: 00007f7bce1e6090 RCX: 00007f7bcdf8f749 [ 221.058027][T11718] RDX: 0000000000000077 RSI: 0000000000000084 RDI: 0000000000000003 [ 221.058040][T11718] RBP: 00007f7bceee7090 R08: 0000000000000012 R09: 0000000000000000 [ 221.058053][T11718] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 221.058067][T11718] R13: 00007f7bce1e6128 R14: 00007f7bce1e6090 R15: 00007ffcf6ddfea8 [ 221.058104][T11718] [ 221.239335][ T5841] Bluetooth: hci0: command 0x0406 tx timeout [ 221.330495][T11724] netlink: 'syz.0.1753': attribute type 1 has an invalid length. [ 221.432730][T11728] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 222.161394][T11774] netlink: 'syz.0.1764': attribute type 12 has an invalid length. [ 222.620210][T11747] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 222.688214][T11803] FAULT_INJECTION: forcing a failure. [ 222.688214][T11803] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 222.702094][T11803] CPU: 1 UID: 0 PID: 11803 Comm: syz.0.1772 Not tainted syzkaller #0 PREEMPT(full) [ 222.702123][T11803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 222.702144][T11803] Call Trace: [ 222.702154][T11803] [ 222.702162][T11803] dump_stack_lvl+0xe8/0x150 [ 222.702196][T11803] should_fail_ex+0x414/0x560 [ 222.702237][T11803] _copy_to_user+0x31/0xb0 [ 222.702267][T11803] simple_read_from_buffer+0xe1/0x170 [ 222.702301][T11803] proc_fail_nth_read+0x1b3/0x220 [ 222.702327][T11803] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 222.702355][T11803] ? rw_verify_area+0x2a6/0x4d0 [ 222.702387][T11803] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 222.702413][T11803] vfs_read+0x200/0xa30 [ 222.702437][T11803] ? fdget_pos+0x247/0x320 [ 222.702470][T11803] ? __pfx___mutex_lock+0x10/0x10 [ 222.702495][T11803] ? __pfx_vfs_read+0x10/0x10 [ 222.702518][T11803] ? __fget_files+0x2a/0x420 [ 222.702549][T11803] ? __fget_files+0x3a0/0x420 [ 222.702573][T11803] ? __fget_files+0x2a/0x420 [ 222.702614][T11803] ksys_read+0x145/0x250 [ 222.702644][T11803] ? __pfx_ksys_read+0x10/0x10 [ 222.702673][T11803] do_syscall_64+0xec/0xf80 [ 222.702695][T11803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.702713][T11803] ? trace_irq_disable+0x37/0x100 [ 222.702740][T11803] ? clear_bhb_loop+0x60/0xb0 [ 222.702770][T11803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.702786][T11803] RIP: 0033:0x7f747258e15c [ 222.702800][T11803] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 222.702814][T11803] RSP: 002b:00007f7473347030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 222.702831][T11803] RAX: ffffffffffffffda RBX: 00007f74727e6090 RCX: 00007f747258e15c [ 222.702842][T11803] RDX: 000000000000000f RSI: 00007f74733470a0 RDI: 0000000000000004 [ 222.702852][T11803] RBP: 00007f7473347090 R08: 0000000000000000 R09: 0000000000000000 [ 222.702861][T11803] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 222.702871][T11803] R13: 00007f74727e6128 R14: 00007f74727e6090 R15: 00007ffe81c1d818 [ 222.702896][T11803] [ 223.476061][T11836] netlink: 'syz.1.1779': attribute type 3 has an invalid length. [ 223.477987][T11833] __nla_validate_parse: 7 callbacks suppressed [ 223.478045][T11833] netlink: 16215 bytes leftover after parsing attributes in process `syz.2.1781'. [ 223.668549][T11844] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1784'. [ 223.795846][ T5841] Bluetooth: hci0: command 0x0406 tx timeout [ 223.929276][T11853] bond3: entered allmulticast mode [ 223.949566][T11853] 8021q: adding VLAN 0 to HW filter on device bond3 [ 223.990589][T11862] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.1789'. [ 224.060970][T11849] syzkaller0: entered promiscuous mode [ 224.073594][T11849] syzkaller0: entered allmulticast mode [ 224.132936][T11866] tipc: Can't bind to reserved service type 2 [ 224.147255][T11866] netlink: 88 bytes leftover after parsing attributes in process `syz.4.1791'. [ 224.160255][T11867] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1790'. [ 224.195265][T11867] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1790'. [ 225.802715][T11892] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1797'. [ 225.820442][T11892] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1797'. [ 225.850277][T11892] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1797'. [ 225.871597][T11892] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1797'. [ 225.972754][T11897] geneve2: entered promiscuous mode [ 225.992831][T11897] geneve2: entered allmulticast mode [ 226.011872][ T148] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 226.023094][ T148] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 226.034206][ T148] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 226.043681][ T148] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 227.306311][T11979] netlink: 'syz.4.1826': attribute type 1 has an invalid length. [ 227.314407][T11979] netlink: 'syz.4.1826': attribute type 2 has an invalid length. [ 227.441581][T11989] ksmbd: Unknown IPC event: 3, ignore. [ 227.561593][T11995] netlink: 'syz.4.1831': attribute type 83 has an invalid length. [ 227.632663][T12004] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 227.640270][T12004] IPv6: NLM_F_CREATE should be set when creating new route [ 227.647910][T12004] IPv6: NLM_F_CREATE should be set when creating new route [ 227.655373][T12004] IPv6: NLM_F_CREATE should be set when creating new route [ 227.667304][T11990] syzkaller0: entered promiscuous mode [ 227.672887][T11990] syzkaller0: entered allmulticast mode [ 227.714362][T11994] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 229.576841][T12029] tipc: Enabling of bearer rejected, failed to enable media [ 229.588256][T12035] __nla_validate_parse: 134 callbacks suppressed [ 229.588279][T12035] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1841'. [ 229.615940][T12035] netlink: 92 bytes leftover after parsing attributes in process `syz.1.1841'. [ 229.635712][T12035] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.1841'. [ 229.815184][T12050] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1847'. [ 229.846319][T12051] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1848'. [ 229.873208][T12051] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1848'. [ 229.957388][T12060] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1849'. [ 230.319617][T12080] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1852'. [ 230.694222][T12099] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1860'. [ 231.081818][T12124] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1865'. [ 231.314985][T12134] netlink: 'syz.3.1868': attribute type 1 has an invalid length. [ 231.562951][T12145] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 233.340200][T12187] wlan0 speed is unknown, defaulting to 1000 [ 233.445031][T12187] wlan0 speed is unknown, defaulting to 1000 [ 233.482658][T12187] wlan0 speed is unknown, defaulting to 1000 [ 233.567344][T12187] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 233.724313][T12210] ipt_REJECT: TCP_RESET invalid for non-tcp [ 233.766801][T12187] wlan0 speed is unknown, defaulting to 1000 [ 233.811158][T12187] wlan0 speed is unknown, defaulting to 1000 [ 233.872599][T12187] wlan0 speed is unknown, defaulting to 1000 [ 233.899206][T12187] wlan0 speed is unknown, defaulting to 1000 [ 233.912926][T12187] wlan0 speed is unknown, defaulting to 1000 [ 234.031891][T12227] unsupported nlmsg_type 40 [ 234.572279][T12261] xt_TPROXY: Can be used only with -p tcp or -p udp [ 234.657505][T12263] __nla_validate_parse: 24 callbacks suppressed [ 234.657530][T12263] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1903'. [ 234.742166][T12269] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1905'. [ 234.977678][T12277] bond2: option mode: unable to set because the bond device has slaves [ 234.986750][T12277] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 235.044265][T12279] netlink: 1688 bytes leftover after parsing attributes in process `syz.4.1909'. [ 235.167678][T12286] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1910'. [ 235.190217][T12287] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1910'. [ 235.268852][T12296] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1914'. [ 235.289131][T12298] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1914'. [ 235.332415][T12296] bridge7: entered promiscuous mode [ 235.348102][T12296] bridge7: entered allmulticast mode [ 235.438507][T12298] bridge8: entered promiscuous mode [ 235.466721][T12298] bridge8: entered allmulticast mode [ 235.519270][T12301] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1916'. [ 235.681553][T12314] netlink: 'syz.1.1918': attribute type 4 has an invalid length. [ 235.713253][T12314] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1918'. [ 235.777073][T12314] `: renamed from bond0 (while UP) [ 235.838374][T12319] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1918'. [ 235.975578][T12315] bridge: RTM_NEWNEIGH with invalid ether address [ 236.543855][T12355] openvswitch: netlink: Message has 16 unknown bytes. [ 236.726949][T12351] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.980109][T12351] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 237.339509][T12368] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 237.457024][T11645] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.479383][T11645] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.509376][T11645] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.541541][T11645] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.575036][T11645] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.605739][T11645] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.614315][T11645] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 237.642286][T11645] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 237.860877][T12396] netlink: 'syz.4.1937': attribute type 1 has an invalid length. [ 237.870850][T12402] netlink: 'syz.1.1939': attribute type 72 has an invalid length. [ 237.884628][T12396] netlink: 'syz.4.1937': attribute type 2 has an invalid length. [ 237.936318][T12408] vcan0: tx drop: invalid sa for name 0xfffffffffffffffc [ 237.951208][ T30] audit: type=1800 audit(1768100208.794:4): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.009820][ T30] audit: type=1800 audit(1768100208.794:5): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.050799][ T30] audit: type=1800 audit(1768100208.794:6): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.082660][ T30] audit: type=1800 audit(1768100208.794:7): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.105654][ T30] audit: type=1800 audit(1768100208.794:8): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.128711][ T30] audit: type=1800 audit(1768100208.794:9): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.152568][ T30] audit: type=1800 audit(1768100208.794:10): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.224573][ T30] audit: type=1800 audit(1768100208.794:11): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.267996][ T30] audit: type=1800 audit(1768100208.794:12): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.351699][ T30] audit: type=1800 audit(1768100208.794:13): pid=12406 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1941" name="memory.events" dev="tmpfs" ino=1877 res=0 errno=0 [ 238.456491][T12423] macsec2: entered promiscuous mode [ 238.605486][T12439] IPVS: set_ctl: invalid protocol: 135 172.20.20.62:20001 [ 238.779770][T12436] syzkaller1: entered promiscuous mode [ 238.788465][T12448] netlink: 'syz.3.1954': attribute type 72 has an invalid length. [ 238.803594][T12436] syzkaller1: entered allmulticast mode [ 239.085537][T12464] netlink: 'syz.0.1958': attribute type 10 has an invalid length. [ 239.135032][T12469] netlink: 'syz.0.1958': attribute type 10 has an invalid length. [ 239.144703][T12465] netlink: 'syz.0.1958': attribute type 10 has an invalid length. [ 239.169102][T12469] 8021q: adding VLAN 0 to HW filter on device bond0 [ 239.203650][T12469] team0: Port device bond0 added [ 239.501182][T12491] syzkaller0: entered promiscuous mode [ 239.515074][T12491] syzkaller0: entered allmulticast mode [ 239.667314][T12501] __nla_validate_parse: 7 callbacks suppressed [ 239.667331][T12501] netlink: 184020 bytes leftover after parsing attributes in process `syz.0.1969'. [ 239.846370][T12503] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1970'. [ 239.860332][T12503] netlink: 'syz.2.1970': attribute type 8 has an invalid length. [ 240.026049][T12520] netlink: 'syz.1.1975': attribute type 29 has an invalid length. [ 240.061429][T12521] xt_hashlimit: max too large, truncated to 1048576 [ 240.381726][T12537] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1980'. [ 240.422884][T12539] netlink: 204 bytes leftover after parsing attributes in process `syz.4.1981'. [ 240.450273][T12547] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1982'. [ 240.520367][T12547] bridge_slave_0 (unregistering): left allmulticast mode [ 240.545190][T12547] bridge_slave_0 (unregistering): left promiscuous mode [ 240.552850][T12547] bridge0: port 1(bridge_slave_0) entered disabled state [ 241.273069][T12567] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1987'. [ 241.294074][T12567] nbd: couldn't find a device at index 0 [ 241.497693][T12574] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1989'. [ 241.626677][T12588] netlink: 'syz.2.1993': attribute type 11 has an invalid length. [ 241.636189][T12588] netlink: 199828 bytes leftover after parsing attributes in process `syz.2.1993'. [ 241.657899][T12589] syzkaller0: entered promiscuous mode [ 241.665591][T12589] syzkaller0: entered allmulticast mode [ 241.675593][T12587] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1994'. [ 241.701281][T12586] delete_channel: no stack [ 241.739276][T12592] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1995'. [ 241.947665][T12604] tipc: Enabled bearer , priority 0 [ 241.956890][T12604] syzkaller0: entered promiscuous mode [ 241.962426][T12604] syzkaller0: entered allmulticast mode [ 241.975365][T12604] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 242.002000][T12604] tipc: Resetting bearer [ 242.024802][T12603] tipc: Resetting bearer [ 242.070064][T12603] tipc: Disabling bearer [ 242.201387][T12617] netem: invalid attributes len -14 [ 242.206889][T12617] netem: change failed [ 242.886154][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 242.901294][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 242.930981][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 243.217866][T12665] infiniband syz2: set down [ 243.224576][ T9539] vxcan1 speed is unknown, defaulting to 1000 [ 243.231046][T12665] infiniband syz2: added vxcan1 [ 243.306593][T12665] RDS/IB: syz2: added [ 243.311445][T12665] smc: adding ib device syz2 with port count 1 [ 243.346592][T12665] smc: ib device syz2 port 1 has no pnetid [ 243.355586][ T9539] vxcan1 speed is unknown, defaulting to 1000 [ 243.367446][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 243.480557][T12685] validate_nla: 2 callbacks suppressed [ 243.480573][T12685] netlink: 'syz.1.2025': attribute type 9 has an invalid length. [ 243.763266][T12695] x_tables: duplicate underflow at hook 2 [ 243.867589][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 244.396290][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 245.010025][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 245.345335][T12726] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 245.351675][T12726] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 245.460439][T12726] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 245.485280][T12765] __nla_validate_parse: 21 callbacks suppressed [ 245.485306][T12765] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2049'. [ 245.502415][T12726] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 245.533876][T12726] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 245.542176][T12765] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2049'. [ 245.564637][T12726] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 245.581931][T12765] geneve2: entered promiscuous mode [ 245.597720][T12765] geneve2: entered allmulticast mode [ 245.604769][T12726] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 245.611194][T12726] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 245.618054][T12769] netlink: 'syz.2.2049': attribute type 28 has an invalid length. [ 245.636348][T12769] netlink: 'syz.2.2049': attribute type 3 has an invalid length. [ 245.644154][T12769] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2049'. [ 245.668692][T12726] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 245.700515][T12726] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 245.798295][T12665] vxcan1 speed is unknown, defaulting to 1000 [ 245.829318][T12773] netlink: 'syz.2.2050': attribute type 3 has an invalid length. [ 245.854628][T12773] netlink: 'syz.2.2050': attribute type 39 has an invalid length. [ 246.195817][ T9537] wlan0 speed is unknown, defaulting to 1000 [ 246.202233][ T9537] syz0: Port: 1 Link DOWN [ 246.688563][T12795] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2056'. [ 246.703572][T12797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2058'. [ 246.934093][T12807] wlan0 speed is unknown, defaulting to 1000 [ 246.961454][T12815] netlink: 212316 bytes leftover after parsing attributes in process `syz.2.2062'. [ 247.014048][T12807] vxcan1 speed is unknown, defaulting to 1000 [ 247.068834][T12810] bridge_slave_0: left allmulticast mode [ 247.097218][T12810] bridge_slave_0: left promiscuous mode [ 247.103368][T12810] bridge0: port 1(bridge_slave_0) entered disabled state [ 247.555813][T12844] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2069'. [ 247.878668][T12857] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2071'. [ 248.276894][ T5841] block nbd4: Receive control failed (result -32) [ 248.276894][ T5839] block nbd3: Receive control failed (result -32) [ 248.282655][ T5832] block nbd6: Receive control failed (result -32) [ 248.284147][ T5837] block nbd5: Receive control failed (result -32) [ 248.295032][ T5835] block nbd7: Receive control failed (result -32) [ 248.297776][ T52] block nbd8: Receive control failed (result -32) [ 248.318683][T12868] block nbd9: Receive control failed (result -32) [ 248.326377][ T5150] block nbd10: Receive control failed (result -32) [ 249.064252][T12907] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 249.071886][T12907] IPv6: NLM_F_CREATE should be set when creating new route [ 249.220934][T12912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 249.867090][T12948] netlink: 'syz.0.2090': attribute type 6 has an invalid length. [ 249.898728][T12948] netlink: 'syz.0.2090': attribute type 6 has an invalid length. [ 249.919212][T12948] netlink: 'syz.0.2090': attribute type 13 has an invalid length. [ 249.941187][T12948] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2090'. [ 249.962846][T12948] netlink: 'syz.0.2090': attribute type 13 has an invalid length. [ 249.983192][T12948] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2090'. [ 250.178006][T12955] 8021q: adding VLAN 0 to HW filter on device bond0 [ 250.197595][T12955] bond0: (slave rose0): Enslaving as an active interface with an up link [ 250.698774][T12977] __nla_validate_parse: 1 callbacks suppressed [ 250.698798][T12977] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2096'. [ 250.731312][T12974] bond0: entered promiscuous mode [ 250.743733][T12974] bond_slave_0: entered promiscuous mode [ 250.750509][T12979] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.2097'. [ 250.765892][T12979] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 250.772926][T12974] bond_slave_1: entered promiscuous mode [ 250.812349][T12974] bridge_slave_1: entered promiscuous mode [ 250.865917][ T10] syz1: Port: 1 Link DOWN [ 250.983023][T12992] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 251.037794][T12990] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 251.127887][T12983] syzkaller0: entered promiscuous mode [ 251.141280][T12983] syzkaller0: entered allmulticast mode [ 251.778693][T13033] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2109'. [ 251.876367][T13038] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 251.992127][T13046] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2112'. [ 252.273448][T13061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2116'. [ 252.319573][T13067] netlink: 'syz.0.2119': attribute type 11 has an invalid length. [ 252.344779][T13061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2116'. [ 252.364943][T13061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2116'. [ 252.386270][T13067] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2119'. [ 252.404894][T13061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2116'. [ 252.430840][T13061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2116'. [ 252.666749][T13083] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 252.883632][T13092] tunl0: left allmulticast mode [ 252.915559][T13092] vxcan0: left promiscuous mode [ 252.932808][T13092] vxcan0: left allmulticast mode [ 252.977833][T13092] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 253.098735][T13098] bond4: option resend_igmp: invalid value (32767) [ 253.109266][T13098] bond4: option resend_igmp: allowed values 0 - 255 [ 253.149012][T13098] bond4 (unregistering): Released all slaves [ 253.537033][T13129] macsec1: entered promiscuous mode [ 253.553131][T13129] bridge0: entered promiscuous mode [ 253.572386][T13129] macsec1: entered allmulticast mode [ 253.595085][T13129] bridge0: entered allmulticast mode [ 253.612800][T13129] bridge0: port 1(macsec1) entered blocking state [ 253.638819][T13129] bridge0: port 1(macsec1) entered disabled state [ 253.675411][T13129] bridge0: left allmulticast mode [ 253.681145][T13129] bridge0: left promiscuous mode [ 253.752937][T13137] bond4: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 253.779326][T13137] bond4 (unregistering): Released all slaves [ 253.797102][T13144] xt_policy: too many policy elements [ 254.415326][T13169] syzkaller1: entered promiscuous mode [ 254.420861][T13169] syzkaller1: entered allmulticast mode [ 254.820376][T13204] netlink: 'syz.1.2148': attribute type 1 has an invalid length. [ 254.950247][T13205] wlan0 speed is unknown, defaulting to 1000 [ 254.996966][T13205] vxcan1 speed is unknown, defaulting to 1000 [ 255.135724][T13217] netlink: 'syz.1.2151': attribute type 1 has an invalid length. [ 255.419985][T13235] IPv6: Can't replace route, no match found [ 255.879136][T13256] netlink: 'syz.2.2160': attribute type 1 has an invalid length. [ 255.905945][T13256] __nla_validate_parse: 68 callbacks suppressed [ 255.905965][T13256] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2160'. [ 256.142100][T13268] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 256.184870][T13269] bond0: entered allmulticast mode [ 256.221569][T13269] bond_slave_0: entered allmulticast mode [ 256.250657][T13269] bond_slave_1: entered allmulticast mode [ 256.272935][T13269] bridge_slave_1: entered allmulticast mode [ 256.566719][T13291] syzkaller0: entered promiscuous mode [ 256.572307][T13291] syzkaller0: entered allmulticast mode [ 260.997845][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 286.010985][T13399] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2172'. [ 286.022262][T13405] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2170'. [ 286.064053][T13399] macvlan0: entered promiscuous mode [ 286.078534][T13405] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2170'. [ 286.125572][T13405] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2170'. [ 286.329120][T13421] geneve2: entered promiscuous mode [ 286.474145][T13430] netlink: 'syz.4.2178': attribute type 1 has an invalid length. [ 286.600681][T13430] bond4: (slave veth0_to_bond): making interface the new active one [ 286.610603][T13430] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 286.655408][T13433] bond4: (slave veth3): Enslaving as an active interface with a down link [ 286.668686][T13430] bond4: entered promiscuous mode [ 286.673788][T13430] veth0_to_bond: entered promiscuous mode [ 286.689130][T13430] bond4: entered allmulticast mode [ 286.694357][T13430] veth0_to_bond: entered allmulticast mode [ 286.733136][T13433] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 286.794282][T13435] netlink: 'syz.0.2179': attribute type 12 has an invalid length. [ 287.020995][T13448] syzkaller0: entered promiscuous mode [ 287.027163][T13448] syzkaller0: entered allmulticast mode [ 287.397920][T13470] ieee802154 phy0 wpan0: encryption failed: -22 [ 287.418011][T13470] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2190'. [ 287.893129][T13495] bond9 (unregistering): Released all slaves [ 288.006352][T13500] bond9 (unregistering): Released all slaves [ 288.135987][T13515] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 288.387708][T13527] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2208'. [ 288.406025][T13527] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2208'. [ 288.435310][T13533] syzkaller1: entered promiscuous mode [ 288.440970][T13533] syzkaller1: entered allmulticast mode [ 288.488275][T13534] netlink: 'syz.0.2210': attribute type 39 has an invalid length. [ 288.628173][T13544] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2212'. [ 288.702281][T13546] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2215'. [ 288.770848][T13551] netlink: 'syz.4.2214': attribute type 83 has an invalid length. [ 288.883811][T13559] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2217'. [ 288.934033][T13559] openvswitch: netlink: nsh attr 2 has unexpected len 0 expected 16 [ 288.950821][T13565] netlink: 'syz.1.2220': attribute type 4 has an invalid length. [ 289.005061][T13568] tipc: Enabled bearer , priority 0 [ 289.029153][T13568] syzkaller0: entered promiscuous mode [ 289.034750][T13568] syzkaller0: entered allmulticast mode [ 289.082659][T13568] tipc: Resetting bearer [ 289.105021][T13567] tipc: Resetting bearer [ 289.157133][T13567] tipc: Disabling bearer [ 289.200470][T13581] xt_NFQUEUE: number of total queues is 0 [ 289.311231][T13571] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 289.382676][T13591] openvswitch: netlink: Missing valid actions attribute. [ 289.420272][T13591] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 289.582880][T13604] ipt_REJECT: TCP_RESET invalid for non-tcp [ 290.849617][T13677] netlink: 'syz.2.2252': attribute type 29 has an invalid length. [ 290.888193][T13677] netlink: 'syz.2.2252': attribute type 29 has an invalid length. [ 290.927596][T13679] blkio.reset_stats is deprecated [ 291.028830][T13683] __nla_validate_parse: 49 callbacks suppressed [ 291.028850][T13683] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2255'. [ 291.060561][T13683] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2255'. [ 291.106320][T13687] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2257'. [ 291.274843][T13695] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2259'. [ 291.333031][T13696] xt_NFQUEUE: number of queues (27568) out of range (got 68779) [ 291.342306][T13696] openvswitch: netlink: Missing key (keys=40, expected=80) [ 291.382787][T13701] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 291.511159][T13709] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 291.527211][T13707] netlink: 'syz.3.2263': attribute type 1 has an invalid length. [ 291.734205][T13724] netlink: 'syz.1.2269': attribute type 11 has an invalid length. [ 291.785984][T13719] bridge0: port 1(wlan1) entered blocking state [ 291.793948][T13719] bridge0: port 1(wlan1) entered disabled state [ 291.801090][T13724] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2269'. [ 291.814740][T13719] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 291.823626][T13719] mac80211_hwsim hwsim7 wlan1: entered promiscuous mode [ 291.833551][T13724] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2269'. [ 291.903969][T13724] gretap1: entered promiscuous mode [ 291.931397][T13724] gretap1: entered allmulticast mode [ 291.969405][T13732] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2271'. [ 291.982053][T13724] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2269'. [ 292.008434][T13732] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 292.076692][T13745] netlink: 'syz.0.2275': attribute type 8 has an invalid length. [ 292.086161][T13743] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2274'. [ 292.114729][T13745] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2275'. [ 292.154777][T13745] bond0: entered promiscuous mode [ 292.160064][T13745] bond0: left promiscuous mode [ 292.421408][T13769] ipt_REJECT: TCP_RESET invalid for non-tcp [ 292.640291][T13779] netlink: 'syz.0.2283': attribute type 4 has an invalid length. [ 292.718770][T13784] dvmrp6: entered allmulticast mode [ 292.844238][T13795] netlink: 'syz.2.2289': attribute type 15 has an invalid length. [ 292.892895][ T8686] netdevsim netdevsim2 netdevsim0: set [0, 1] type 1 family 0 port 2816 - 0 [ 292.905281][T13795] netlink: 'syz.2.2289': attribute type 15 has an invalid length. [ 292.921955][ T8686] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 292.932689][ T8686] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 292.943631][ T8686] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 2816 - 0 [ 293.022260][T13800] bond8: entered promiscuous mode [ 293.030628][T13800] bond8: entered allmulticast mode [ 293.039694][T13800] 8021q: adding VLAN 0 to HW filter on device bond8 [ 293.486915][T13829] x_tables: duplicate underflow at hook 2 [ 293.603368][T13835] tap0: tun_chr_ioctl cmd 2148553947 [ 293.656270][T13834] tap0: tun_chr_ioctl cmd 2148553947 [ 293.869258][T13847] ip6gretap1: entered promiscuous mode [ 293.882056][T13847] ip6gretap1: entered allmulticast mode [ 294.102312][T13858] syzkaller0: entered promiscuous mode [ 294.119137][T13858] syzkaller0: entered allmulticast mode [ 294.155238][T13860] syzkaller0: entered promiscuous mode [ 294.161371][T13860] syzkaller0: entered allmulticast mode [ 294.416165][T13872] v: renamed from ipvlan1 [ 294.636834][T13885] syzkaller0: entered promiscuous mode [ 294.650348][T13885] syzkaller0: entered allmulticast mode [ 295.279440][T13914] netlink: 'syz.3.2335': attribute type 58 has an invalid length. [ 295.537634][T13929] netlink: 'syz.2.2338': attribute type 5 has an invalid length. [ 296.059268][T13976] __nla_validate_parse: 34 callbacks suppressed [ 296.059290][T13976] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2349'. [ 296.168005][T13974] netlink: 'syz.2.2349': attribute type 1 has an invalid length. [ 296.232959][T13983] syzkaller0: entered promiscuous mode [ 296.241080][T13983] syzkaller0: entered allmulticast mode [ 296.512021][T13999] batadv3: entered allmulticast mode [ 296.800272][T14037] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2364'. [ 296.905252][T14044] x_tables: duplicate entry at hook 1 [ 296.969915][T14046] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2368'. [ 296.983203][T14046] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2368'. [ 297.020285][T14050] netlink: 'syz.2.2370': attribute type 28 has an invalid length. [ 297.061817][T14050] netlink: 'syz.2.2370': attribute type 3 has an invalid length. [ 297.094583][T14050] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2370'. [ 297.294324][T14071] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2375'. [ 297.339628][T14071] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2375'. [ 297.509344][T14085] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2378'. [ 297.652949][T14097] ieee802154 phy0 wpan0: encryption failed: -22 [ 297.718894][T14103] bridge3: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 297.781339][T14097] bridge_slave_0: left allmulticast mode [ 297.796993][T14097] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.953119][T14108] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2385'. [ 297.998814][T14112] netlink: 164 bytes leftover after parsing attributes in process `syz.1.2386'. [ 298.043550][T14116] team0: Device gtp0 is up. Set it down before adding it as a team port [ 298.170834][T14123] netlink: 'syz.4.2390': attribute type 4 has an invalid length. [ 298.273332][T14128] vcan1: entered promiscuous mode [ 298.297210][T14128] vcan1: entered allmulticast mode [ 298.438827][T14141] x_tables: duplicate underflow at hook 1 [ 298.457941][T14134] bond2: (slave lo): Releasing backup interface [ 298.469204][T14134] bond2: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 298.538029][T14134] bond0: (slave bridge_slave_1): Releasing backup interface [ 298.658509][T14134] bond0: (slave bond_slave_0): Releasing backup interface [ 298.673001][T14134] bond0: (slave bond_slave_1): Releasing backup interface [ 298.703552][T14134] team0: Port device team_slave_0 removed [ 298.715528][T14134] team0: Port device team_slave_1 removed [ 298.722452][T14134] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 298.730234][T14134] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 298.744079][T14134] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 298.751854][T14134] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 298.762250][T14134] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 299.319920][T14184] vlan2: entered promiscuous mode [ 299.328843][T14184] bridge0: entered promiscuous mode [ 299.498936][T14198] 8021q: VLANs not supported on ipvlan1 [ 300.798308][T14258] A link change request failed with some changes committed already. Interface batadv1 may have been left with an inconsistent configuration, please check. [ 301.081471][T14276] __nla_validate_parse: 9 callbacks suppressed [ 301.081491][T14276] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2433'. [ 301.185323][T14282] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2434'. [ 301.219143][T14288] syzkaller0: entered promiscuous mode [ 301.256078][T14288] syzkaller0: entered allmulticast mode [ 301.483707][T14305] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2440'. [ 301.566538][T14313] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2441'. [ 301.593695][T14314] netlink: 'syz.1.2442': attribute type 11 has an invalid length. [ 301.661392][T14314] bond0: entered promiscuous mode [ 301.676090][T14314] batadv0: entered promiscuous mode [ 301.693366][T14314] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 301.726978][T14314] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 301.739945][T14314] hsr1: entered allmulticast mode [ 301.762843][T14314] bond0: entered allmulticast mode [ 301.778184][T14314] batadv0: entered allmulticast mode [ 301.790707][T14314] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 301.810077][T14314] bond0: left promiscuous mode [ 301.817563][T14314] batadv0: left promiscuous mode [ 301.831736][T14322] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2445'. [ 301.859962][T14322] ipt_REJECT: TCP_RESET invalid for non-tcp [ 302.133678][T14334] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 302.268839][T14339] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2451'. [ 302.283470][T14343] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2452'. [ 302.317226][T14343] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2452'. [ 302.429288][T14345] bond6 (unregistering): Released all slaves [ 302.574710][T14347] bond6 (unregistering): Released all slaves [ 302.734791][T14362] IPv6: sit6: Disabled Multicast RS [ 303.101199][T14388] netlink: 'syz.3.2466': attribute type 3 has an invalid length. [ 303.109225][T14392] syzkaller0: entered promiscuous mode [ 303.120164][T14392] syzkaller0: entered allmulticast mode [ 303.191512][T14401] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.2467'. [ 303.210684][T14401] openvswitch: netlink: Flow actions attr not present in new flow. [ 304.724847][T14415] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2472'. [ 305.255982][T14447] x_tables: ip6_tables: udp match: only valid for protocol 17 [ 305.335179][T14453] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 305.523245][T14463] netlink: 'syz.1.2486': attribute type 21 has an invalid length. [ 305.532621][T14463] netlink: 'syz.1.2486': attribute type 5 has an invalid length. [ 305.641267][T14011] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.657086][T14011] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.716716][T14011] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.736901][T14011] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 306.322573][T14516] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 306.455246][T14528] __nla_validate_parse: 14 callbacks suppressed [ 306.455269][T14528] netlink: 256 bytes leftover after parsing attributes in process `syz.3.2504'. [ 306.533292][T14530] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2507'. [ 306.691175][T14530] macvtap1: entered promiscuous mode [ 306.712944][T14530] vlan0: entered promiscuous mode [ 306.730408][T14530] macvtap1: entered allmulticast mode [ 306.741179][T14530] vlan0: entered allmulticast mode [ 306.755646][T14530] veth0_vlan: entered allmulticast mode [ 307.030120][T14556] syzkaller0: entered promiscuous mode [ 307.049122][T14556] syzkaller0: entered allmulticast mode [ 307.250805][T14570] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.2519'. [ 307.354018][T14576] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2520'. [ 307.381580][T14575] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2520'. [ 307.459947][T14579] syzkaller1: entered promiscuous mode [ 307.482938][T14579] syzkaller1: entered allmulticast mode [ 307.860727][T14601] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.882295][T14601] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.923428][T14606] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2529'. [ 307.951283][T14608] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2530'. [ 307.961613][T14608] nbd: must specify a size in bytes for the device [ 308.163115][T14614] wlan0 speed is unknown, defaulting to 1000 [ 308.179444][T14614] vxcan1 speed is unknown, defaulting to 1000 [ 308.255357][T14621] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2533'. [ 308.312135][T14623] netlink: 'syz.2.2532': attribute type 11 has an invalid length. [ 308.523115][T14631] netlink: 'syz.4.2535': attribute type 3 has an invalid length. [ 308.541858][T14631] netlink: 'syz.4.2535': attribute type 1 has an invalid length. [ 308.552478][T14631] netlink: 212 bytes leftover after parsing attributes in process `syz.4.2535'. [ 308.584668][T14631] NCSI netlink: No device for ifindex 813332851 [ 308.818523][T14643] bond0: (slave bridge_slave_1): Releasing backup interface [ 308.862959][T14643] bridge_slave_1: left promiscuous mode [ 308.863305][T14650] netlink: 'syz.1.2541': attribute type 9 has an invalid length. [ 308.889273][T14643] bridge_slave_1: left allmulticast mode [ 308.915718][T14643] bond4: (slave veth0_to_bond): Releasing active interface [ 308.934482][T14643] veth0_to_bond: left promiscuous mode [ 308.940232][T14643] veth0_to_bond: left allmulticast mode [ 308.985401][T14643] bond0: (slave bond_slave_0): Releasing backup interface [ 309.019978][T14643] bond_slave_0: left promiscuous mode [ 309.034249][T14643] bond_slave_0: left allmulticast mode [ 309.069151][T14643] bond0: (slave bond_slave_1): Releasing backup interface [ 309.086911][T14643] bond_slave_1: left promiscuous mode [ 309.092652][T14643] bond_slave_1: left allmulticast mode [ 309.105411][T14643] team0: Port device team_slave_0 removed [ 309.119537][T14643] team0: Port device team_slave_1 removed [ 309.127106][T14643] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 309.135444][T14643] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 309.146757][T14643] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 309.157741][T14643] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 309.167185][T14643] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 309.256291][T14662] dvmrp6: left allmulticast mode [ 309.826953][T14687] macvtap0: Device is already in use. [ 310.144845][T14701] tipc: Enabled bearer , priority 0 [ 310.228927][T14701] syzkaller0: entered promiscuous mode [ 310.236893][T14701] syzkaller0: entered allmulticast mode [ 310.600122][T14736] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2562'. [ 311.880558][T14740] tipc: Enabling of bearer rejected, failed to enable media [ 311.901040][ T9551] tipc: Node number set to 369098752 [ 311.908948][T14699] tipc: Resetting bearer [ 311.958323][T14699] tipc: Disabling bearer [ 312.012346][T14744] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2567'. [ 312.161866][T14756] IPVS: set_ctl: invalid protocol: 115 172.20.20.63:20002 [ 312.237240][T14761] netlink: 165 bytes leftover after parsing attributes in process `syz.2.2573'. [ 312.417674][T14764] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2575'. [ 312.446730][T14764] openvswitch: netlink: Flow actions attr not present in new flow. [ 312.627275][T14791] netlink: 'syz.4.2580': attribute type 9 has an invalid length. [ 312.644569][T14791] netlink: 'syz.4.2580': attribute type 11 has an invalid length. [ 312.656207][T14791] netlink: 'syz.4.2580': attribute type 12 has an invalid length. [ 312.682232][T14791] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.2580'. [ 313.077219][T14822] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2588'. [ 313.091413][T14822] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2588'. [ 313.103337][T14822] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2588'. [ 313.453553][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 313.453574][ T30] audit: type=1107 audit(1768100284.294:40): pid=14839 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='.}y'*"^ -cp[u' [ 313.888007][T14861] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2603'. [ 313.902668][T14864] netlink: 'syz.2.2604': attribute type 1 has an invalid length. [ 313.908717][T14862] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2602'. [ 313.990663][T14871] bond6: (slave ip6gretap1): making interface the new active one [ 314.000484][T14871] bond6: (slave ip6gretap1): Enslaving as an active interface with an up link [ 314.016317][T14864] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2604'. [ 314.029813][T14864] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 314.150233][T14879] netlink: 'syz.1.2608': attribute type 10 has an invalid length. [ 314.170722][T14879] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 314.384080][T14894] netlink: 'syz.4.2613': attribute type 10 has an invalid length. [ 314.417737][T14894] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 314.465425][T14900] : renamed from hsr0 (while UP) [ 314.516935][T14900] netlink: 'syz.2.2614': attribute type 4 has an invalid length. [ 314.651310][T14915] syzkaller0: entered promiscuous mode [ 314.657248][T14915] syzkaller0: entered allmulticast mode [ 314.722421][T14920] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 314.810828][T14928] sch_tbf: burst 0 is lower than device lo mtu (18) ! [ 315.626636][T14982] openvswitch: netlink: Message has -2 unknown bytes. [ 316.033876][T15006] netlink: 'syz.0.2643': attribute type 1 has an invalid length. [ 316.568930][T15043] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 316.736710][T15055] tipc: Enabling of bearer rejected, failed to enable media [ 317.037354][T15074] __nla_validate_parse: 14 callbacks suppressed [ 317.037376][T15074] netlink: 164 bytes leftover after parsing attributes in process `syz.4.2667'. [ 317.152254][T15083] netlink: 'syz.4.2669': attribute type 11 has an invalid length. [ 317.415032][T15094] macsec0: entered promiscuous mode [ 317.421406][T15094] macsec0: entered allmulticast mode [ 317.429533][T15096] bond0: Device is already in use. [ 317.447807][T15094] veth1_macvtap: entered allmulticast mode [ 317.454061][T15094] macsec0: left promiscuous mode [ 317.460666][T15094] macsec0: left allmulticast mode [ 317.466009][T15094] veth1_macvtap: left allmulticast mode [ 317.490795][T15094] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2672'. [ 317.534725][T15099] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2674'. [ 317.544845][T15094] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2672'. [ 317.617137][T15103] netlink: 88 bytes leftover after parsing attributes in process `syz.3.2676'. [ 318.008222][T15129] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2687'. [ 318.056850][T15132] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2686'. [ 318.083923][T15132] netlink: 43 bytes leftover after parsing attributes in process `syz.0.2686'. [ 318.113470][T15132] netlink: 'syz.0.2686': attribute type 5 has an invalid length. [ 318.163991][T15132] netlink: 43 bytes leftover after parsing attributes in process `syz.0.2686'. [ 318.185133][T15144] erspan0: entered allmulticast mode [ 318.225829][T15144] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2689'. [ 318.243379][T15152] openvswitch: netlink: EtherType 0 is less than min 600 [ 319.009389][T15197] pim6reg1: entered promiscuous mode [ 319.015255][T15197] pim6reg1: entered allmulticast mode [ 319.183820][T15205] vlan3: entered promiscuous mode [ 319.190459][T15205] erspan0: entered promiscuous mode [ 319.592507][T15224] wlan0 speed is unknown, defaulting to 1000 [ 319.629179][T15228] openvswitch: netlink: Missing key (keys=40, expected=100) [ 319.666333][T15224] vxcan1 speed is unknown, defaulting to 1000 [ 321.426553][T15323] sctp: [Deprecated]: syz.4.2743 (pid 15323) Use of struct sctp_assoc_value in delayed_ack socket option. [ 321.426553][T15323] Use struct sctp_sack_info instead [ 321.588566][T15332] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 321.614864][T15336] syzkaller0: entered promiscuous mode [ 321.623576][T15336] syzkaller0: entered allmulticast mode [ 322.049477][T15367] __nla_validate_parse: 15 callbacks suppressed [ 322.049500][T15367] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2756'. [ 322.113531][T15374] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2759'. [ 322.185193][T15373] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2758'. [ 322.224095][T15379] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2760'. [ 322.224634][T15373] netlink: 'syz.2.2758': attribute type 1 has an invalid length. [ 322.247533][T15373] netlink: 'syz.2.2758': attribute type 2 has an invalid length. [ 322.339198][T15383] syzkaller0: entered promiscuous mode [ 322.356233][T15383] syzkaller0: entered allmulticast mode [ 322.390098][T15387] sch_tbf: burst 0 is lower than device lo mtu (18) ! [ 322.439004][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.484758][T15392] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2765'. [ 322.641600][T15392] macvtap1: entered promiscuous mode [ 322.647632][T15392] vlan0: entered promiscuous mode [ 322.653087][T15392] macvtap1: entered allmulticast mode [ 322.659317][T15392] vlan0: entered allmulticast mode [ 322.665016][T15392] v: entered allmulticast mode [ 322.770342][T15411] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2768'. [ 323.085835][T15442] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 323.167656][T15446] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2771'. [ 323.480416][T15442] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 323.488776][T15442] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 323.648453][T15462] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2778'. [ 323.658423][T15460] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2777'. [ 323.728740][T15466] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2779'. [ 323.982336][T15481] openvswitch: netlink: Missing key (keys=40, expected=80) [ 324.047883][T15486] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 324.488290][T15518] bridge3: entered promiscuous mode [ 324.493655][T15518] bridge3: entered allmulticast mode [ 324.507982][T15518] team0: Port device bridge3 added [ 324.513958][T15520] bridge0: port 2(team0) entered blocking state [ 324.521417][T15520] bridge0: port 2(team0) entered disabled state [ 324.538959][T15520] team0: entered allmulticast mode [ 324.545387][T15520] batadv1: entered allmulticast mode [ 324.555938][T15520] team0: left allmulticast mode [ 324.560971][T15520] batadv1: left allmulticast mode [ 324.677903][T15526] 8021q: adding VLAN 0 to HW filter on device bond6 [ 324.739396][T15531] bond7: option lp_interval: invalid value (0) [ 324.745816][T15531] bond7: option lp_interval: allowed values 1 - 2147483647 [ 324.756366][T15531] bond7 (unregistering): Released all slaves [ 324.810482][T15538] nbd: couldn't find a device at index 0 [ 325.298307][ T36] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.326083][ T36] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.354587][ T36] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.363390][ T36] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 325.631404][T15586] veth9: entered promiscuous mode [ 325.641138][T15586] veth9: entered allmulticast mode [ 326.099792][T15633] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 326.321325][T15643] can: request_module (can-proto-0) failed. [ 326.411332][T15643] syzkaller0: entered promiscuous mode [ 326.417968][T15643] syzkaller0: entered allmulticast mode [ 327.841701][T15671] __nla_validate_parse: 18 callbacks suppressed [ 327.841722][T15671] netlink: 11562 bytes leftover after parsing attributes in process `syz.2.2840'. [ 328.138321][T15681] netlink: 165 bytes leftover after parsing attributes in process `syz.2.2844'. [ 328.148532][T15683] netlink: 165 bytes leftover after parsing attributes in process `syz.2.2844'. [ 328.160217][T15676] wlan0 speed is unknown, defaulting to 1000 [ 328.181844][T15676] vxcan1 speed is unknown, defaulting to 1000 [ 328.307159][T12868] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 328.316759][T12868] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 328.324980][T12868] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 328.333061][T12868] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 328.341099][T12868] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 328.404343][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 328.412099][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 328.420191][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 328.440800][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 328.448849][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 328.650818][T15687] wlan0 speed is unknown, defaulting to 1000 [ 328.718612][T15705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2849'. [ 328.802679][T15702] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2850'. [ 328.897826][ T36] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.037934][T15687] vxcan1 speed is unknown, defaulting to 1000 [ 329.077320][ T36] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.217934][ T36] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.396118][ T36] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 329.704848][T15740] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2857'. [ 329.756540][T15743] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2858'. [ 329.762672][T15741] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2857'. [ 330.136802][T15754] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2860'. [ 330.172421][T15754] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2860'. [ 330.514969][ T52] Bluetooth: hci5: command tx timeout [ 330.980664][ T36] dvmrp0 (unregistering): left allmulticast mode [ 331.471976][ T36] team0: Port device bond0 removed [ 331.478921][ T36] bond0 (unregistering): Released all slaves [ 331.578448][ T36] bond1 (unregistering): Released all slaves [ 331.593248][ T36] bond2 (unregistering): Released all slaves [ 331.607435][ T36] bond3 (unregistering): Released all slaves [ 331.713424][ T36] bond4 (unregistering): Released all slaves [ 331.811201][ T36] bond5 (unregistering): Released all slaves [ 331.911801][ T36] bond6 (unregistering): Released all slaves [ 331.925625][ T36] bond7 (unregistering): Released all slaves [ 331.939361][ T36] bond8 (unregistering): Released all slaves [ 331.953604][ T36] bond9 (unregistering): Released all slaves [ 332.167213][ T36] tipc: Left network mode [ 332.169610][T15687] chnl_net:caif_netlink_parms(): no params data found [ 332.258598][T15802] IPVS: set_ctl: invalid protocol: 51 172.20.20.187:20004 [ 332.594782][ T52] Bluetooth: hci5: command tx timeout [ 332.860086][T15687] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.878343][T15687] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.902582][T15687] bridge_slave_0: entered allmulticast mode [ 332.922391][T15687] bridge_slave_0: entered promiscuous mode [ 332.957074][T15687] bridge0: port 2(bridge_slave_1) entered blocking state [ 332.992522][T15687] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.001174][T15687] bridge_slave_1: entered allmulticast mode [ 333.021283][T15687] bridge_slave_1: entered promiscuous mode [ 333.207512][T15851] __nla_validate_parse: 2 callbacks suppressed [ 333.207534][T15851] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2880'. [ 333.226621][T15848] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2879'. [ 333.245547][T15848] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2879'. [ 333.261070][T15687] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 333.341960][T15858] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 333.405431][T15687] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 333.482217][T15863] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input6 [ 333.749928][T15687] team0: Port device team_slave_0 added [ 333.773126][T15687] team0: Port device team_slave_1 added [ 333.945916][T15687] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 333.953031][T15687] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.006807][T15687] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 334.030083][T15687] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 334.048973][T15687] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 334.101983][T15687] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 334.231755][T15902] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2892'. [ 334.303097][T15895] veth0: entered promiscuous mode [ 334.318930][T15904] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2891'. [ 334.358998][T15902] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2892'. [ 334.548115][T15907] xt_connbytes: Forcing CT accounting to be enabled [ 334.674464][ T52] Bluetooth: hci5: command tx timeout [ 334.709364][T15913] bridge_slave_1: left allmulticast mode [ 334.717454][T15913] bridge_slave_1: left promiscuous mode [ 334.723385][T15913] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.757059][T15913] `: (slave bond_slave_0): Releasing backup interface [ 334.780643][T15913] `: (slave bond_slave_1): Releasing backup interface [ 334.813663][T15913] team0: Port device team_slave_0 removed [ 334.826269][T15913] team0: Port device team_slave_1 removed [ 334.832396][T15913] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 334.840565][T15913] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 334.848519][T15913] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 334.874095][ T36] hsr_slave_0: left promiscuous mode [ 334.880572][ T36] hsr_slave_1: left promiscuous mode [ 335.852436][ T148] smc: removing ib device syz2 [ 336.286646][T15687] hsr_slave_0: entered promiscuous mode [ 336.294053][T15687] hsr_slave_1: entered promiscuous mode [ 336.323722][T15687] debugfs: 'hsr0' already exists in 'hsr' [ 336.349133][T15927] netlink: 'syz.1.2900': attribute type 6 has an invalid length. [ 336.357039][T15687] Cannot create hsr debugfs directory [ 336.376987][T15927] netlink: 'syz.1.2900': attribute type 6 has an invalid length. [ 336.420551][T15932] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2899'. [ 336.767927][ T52] Bluetooth: hci5: command tx timeout [ 337.429568][T15962] wireguard0: entered promiscuous mode [ 337.457348][T15962] wireguard0: entered allmulticast mode [ 337.483708][T15962] team0: Port device wireguard0 added [ 337.646731][T15967] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2910'. [ 337.679619][T15967] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2910'. [ 337.762675][T15976] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2914'. [ 338.251967][T15993] x_tables: duplicate underflow at hook 2 [ 338.533406][T15687] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 338.578748][T15687] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 338.632743][T16011] tc_dump_action: action bad kind [ 338.645034][T15687] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 338.675845][T16012] tc_dump_action: action bad kind [ 338.687276][T15687] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 338.755652][T16019] netlink: 'syz.1.2927': attribute type 3 has an invalid length. [ 338.924086][T16035] __nla_validate_parse: 3 callbacks suppressed [ 338.924107][T16035] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2934'. [ 338.940520][T16035] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2934'. [ 338.984799][T15687] 8021q: adding VLAN 0 to HW filter on device bond0 [ 339.014932][T16037] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2934'. [ 339.024536][T16035] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2934'. [ 339.033532][T16035] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2934'. [ 339.098462][T15687] 8021q: adding VLAN 0 to HW filter on device team0 [ 339.130885][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.138152][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 339.162943][ T6496] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.170151][ T6496] bridge0: port 2(bridge_slave_1) entered forwarding state [ 339.399013][T16062] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2941'. [ 339.419693][T16062] openvswitch: netlink: Flow key attr not present in new flow. [ 339.455585][T16068] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2941'. [ 339.470136][T16071] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2943'. [ 339.503874][T16068] openvswitch: netlink: Flow key attr not present in new flow. [ 339.575986][T15687] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 339.708024][T15687] veth0_vlan: entered promiscuous mode [ 339.759020][T15687] veth1_vlan: entered promiscuous mode [ 339.874063][T16083] bond7: Removing last arp target with arp_interval on [ 339.917152][T16087] bond8: Removing last arp target with arp_interval on [ 340.022150][T15687] veth0_macvtap: entered promiscuous mode [ 340.051031][T15687] veth1_macvtap: entered promiscuous mode [ 340.104962][T15687] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 340.139065][T15687] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 340.161787][T16111] netlink: 'syz.3.2953': attribute type 9 has an invalid length. [ 340.184100][T16111] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2953'. [ 340.197465][ T80] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.232209][ T80] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.286990][ T80] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.335652][ T80] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.443886][ T148] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 340.472716][ T148] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 340.572213][T16126] block nbd11: Unsupported socket: should be TCP or UNIX. [ 340.598945][T16126] block nbd12: Unsupported socket: should be TCP or UNIX. [ 340.646991][ T6496] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 340.667932][ T6496] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 340.727068][T16131] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2958'. [ 341.017048][T16133] tipc: Enabling of bearer rejected, failed to enable media [ 341.241501][T16155] netlink: 'syz.3.2965': attribute type 21 has an invalid length. [ 341.287886][T16155] bond9: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 341.354190][T16155] bond9 (unregistering): Released all slaves [ 341.436652][T12868] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 341.449873][T12868] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 341.458861][T12868] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 341.476585][T12868] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 341.488894][T12868] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 341.662066][T16157] wlan0 speed is unknown, defaulting to 1000 [ 341.865534][T16165] unsupported nla_type 33542 [ 342.004925][T16175] tipc: Enabling of bearer rejected, failed to enable media [ 342.138670][T16184] netlink: 'syz.0.2973': attribute type 10 has an invalid length. [ 342.157147][T16184] syz_tun: entered promiscuous mode [ 342.170858][T16184] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 342.204785][T16189] netlink: 'syz.0.2973': attribute type 10 has an invalid length. [ 342.221436][T16185] set match dimension is over the limit! [ 342.245664][T16189] 8021q: adding VLAN 0 to HW filter on device bond0 [ 342.268475][T16189] team0: Port device bond0 added [ 342.301056][T16157] chnl_net:caif_netlink_parms(): no params data found [ 342.392878][T16199] syzkaller0: entered promiscuous mode [ 342.401814][T16199] syzkaller0: entered allmulticast mode [ 342.500047][T16203] IPVS: set_ctl: invalid protocol: 137 255.255.255.255:20000 [ 342.623074][T16157] bridge0: port 1(bridge_slave_0) entered blocking state [ 342.630442][T16157] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.639163][T16157] bridge_slave_0: entered allmulticast mode [ 342.648419][T16157] bridge_slave_0: entered promiscuous mode [ 342.657621][T16157] bridge0: port 2(bridge_slave_1) entered blocking state [ 342.665030][T16157] bridge0: port 2(bridge_slave_1) entered disabled state [ 342.672307][T16157] bridge_slave_1: entered allmulticast mode [ 342.682047][T16157] bridge_slave_1: entered promiscuous mode [ 342.736919][T16157] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 342.750528][T16157] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 342.765209][T16212] TCP: TCP_TX_DELAY enabled [ 342.840449][T16157] team0: Port device team_slave_0 added [ 342.866758][T16157] team0: Port device team_slave_1 added [ 342.974195][T16157] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 342.987300][T16157] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 343.017439][T16157] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 343.047362][T16157] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 343.055249][T16157] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 343.082229][T16157] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 343.234272][T16157] hsr_slave_0: entered promiscuous mode [ 343.255583][T16157] hsr_slave_1: entered promiscuous mode [ 343.262295][T16157] debugfs: 'hsr0' already exists in 'hsr' [ 343.279319][T16157] Cannot create hsr debugfs directory [ 343.552884][T16253] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 343.563294][T12868] Bluetooth: hci0: command tx timeout [ 343.789054][T16269] netlink: 'syz.3.2999': attribute type 1 has an invalid length. [ 344.190681][T16157] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 344.225154][T16157] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 344.250832][T16157] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 344.274673][T16291] 8021q: VLANs not supported on wg1 [ 344.281797][T16157] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 344.400232][T16306] __nla_validate_parse: 4 callbacks suppressed [ 344.400252][T16306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3011'. [ 344.417121][T16306] openvswitch: netlink: Flow actions attr not present in new flow. [ 344.451822][T16309] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3009'. [ 344.461981][T16306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3011'. [ 344.494570][T16306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3011'. [ 344.515160][T16306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3011'. [ 344.540397][T16309] team1: entered promiscuous mode [ 344.548511][T16309] team1: entered allmulticast mode [ 344.550246][T16303] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 344.613725][T16157] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.640987][T16157] 8021q: adding VLAN 0 to HW filter on device team0 [ 344.667136][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.674443][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 344.708635][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.715857][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.918182][T16327] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3014'. [ 344.928855][T16327] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3014'. [ 345.039864][T16157] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 345.120276][T16157] veth0_vlan: entered promiscuous mode [ 345.155966][T16157] veth1_vlan: entered promiscuous mode [ 345.208332][T16157] veth0_macvtap: entered promiscuous mode [ 345.231159][T16157] veth1_macvtap: entered promiscuous mode [ 345.283727][T16157] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 345.333202][T16157] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 345.364059][T16340] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.3018'. [ 345.400306][ T2207] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.435579][ T2207] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.459280][T16349] openvswitch: netlink: IP tunnel dst address not specified [ 345.470348][T16350] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3018'. [ 345.493858][ T2207] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.514810][T16350] block nbd11: Unsupported socket: should be TCP or UNIX. [ 345.526729][ T4270] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.635133][T12868] Bluetooth: hci0: command tx timeout [ 345.714163][ T2207] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.732899][ T2207] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.808920][ T4270] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.826668][ T4270] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 346.109289][T16379] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3027'. [ 346.390940][ T5150] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 346.401944][ T5150] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 346.410644][ T5150] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 346.419020][ T5150] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 346.429917][ T5150] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 346.523733][T16390] wlan0 speed is unknown, defaulting to 1000 [ 347.000143][ T36] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xf0 [ 347.102417][T16390] chnl_net:caif_netlink_parms(): no params data found [ 347.280876][T16390] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.288451][T16390] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.297000][T16390] bridge_slave_0: entered allmulticast mode [ 347.305037][T16390] bridge_slave_0: entered promiscuous mode [ 347.316835][T16390] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.324231][T16390] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.331736][T16390] bridge_slave_1: entered allmulticast mode [ 347.340340][T16390] bridge_slave_1: entered promiscuous mode [ 347.409284][T16390] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 347.426700][T16390] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 347.486356][T16390] team0: Port device team_slave_0 added [ 347.492147][T16444] bridge_slave_0: default FDB implementation only supports local addresses [ 347.504276][T16390] team0: Port device team_slave_1 added [ 347.571951][T16390] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 347.579710][T16390] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.605934][T16390] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 347.618442][T16390] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 347.626201][T16390] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.652307][T16390] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 347.716632][ T52] Bluetooth: hci0: command tx timeout [ 347.823716][T16451] netlink: 'syz.2.3044': attribute type 39 has an invalid length. [ 347.863437][T16453] syzkaller0: entered promiscuous mode [ 347.871092][T16453] syzkaller0: entered allmulticast mode [ 347.889668][T16390] hsr_slave_0: entered promiscuous mode [ 347.908643][T16390] hsr_slave_1: entered promiscuous mode [ 347.925499][T16390] debugfs: 'hsr0' already exists in 'hsr' [ 347.934556][T16390] Cannot create hsr debugfs directory [ 348.078506][T16464] veth0: entered promiscuous mode [ 348.126246][T16455] veth0: left promiscuous mode [ 348.495591][T16390] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 348.516313][ T52] Bluetooth: hci1: command tx timeout [ 348.522856][T16390] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 348.659465][T16390] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 348.682332][T16390] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 348.746185][T16495] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 348.765450][T16495] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 348.858460][T16498] bond7: option lp_interval: invalid value (0) [ 348.876042][T16498] bond7: option lp_interval: allowed values 1 - 2147483647 [ 348.886012][T16498] bond7 (unregistering): Released all slaves [ 348.948854][T16507] openvswitch: netlink: Flow key attr not present in new flow. [ 348.970664][T16390] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 348.998572][T16390] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 349.060843][T16505] !: renamed from bond_slave_0 (while UP) [ 349.070276][T16508] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 349.120714][T16508] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 349.169234][T16390] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 349.199703][T16390] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 349.487045][T16390] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 349.526278][T16390] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 349.584077][T16390] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 349.617139][T16390] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 349.797357][ T52] Bluetooth: hci0: command 0x0419 tx timeout [ 349.838321][T16544] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.862076][T16545] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 350.071486][T16390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 350.116956][T16390] 8021q: adding VLAN 0 to HW filter on device team0 [ 350.157049][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.159076][T16553] __nla_validate_parse: 12 callbacks suppressed [ 350.159129][T16553] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3070'. [ 350.164579][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 350.195390][T16553] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3070'. [ 350.237085][ T4270] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.244295][ T4270] bridge0: port 2(bridge_slave_1) entered forwarding state [ 350.561371][T16572] netlink: 288 bytes leftover after parsing attributes in process `syz.4.3079'. [ 350.595572][ T52] Bluetooth: hci1: command tx timeout [ 350.705400][T16390] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 350.800137][T16390] veth0_vlan: entered promiscuous mode [ 350.828223][T16390] veth1_vlan: entered promiscuous mode [ 350.921903][T16390] veth0_macvtap: entered promiscuous mode [ 350.942532][T16591] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3084'. [ 350.965903][T16390] veth1_macvtap: entered promiscuous mode [ 351.081934][T16390] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 351.126228][T16595] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3085'. [ 351.170373][T16390] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 351.185095][T16597] netlink: 'syz.0.3086': attribute type 11 has an invalid length. [ 351.230901][ T60] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.272527][ T60] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.293640][ T60] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.324584][ T60] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 351.527542][ T80] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 351.554293][ T80] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 351.576362][T16609] syzkaller1: entered promiscuous mode [ 351.586294][T16609] syzkaller1: entered allmulticast mode [ 351.628543][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 351.636462][T16613] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3093'. [ 351.636536][T16613] batadv1: left allmulticast mode [ 351.636556][T16613] batadv1: left promiscuous mode [ 351.636797][T16613] bridge0: port 3(batadv1) entered disabled state [ 351.667078][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 351.873896][T16624] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 351.877208][ T52] Bluetooth: hci0: command 0x0419 tx timeout [ 352.061881][T16638] Bluetooth: MGMT ver 1.23 [ 352.068164][T16637] xt_HMARK: spi-set and port-set can't be combined [ 352.125238][T16642] netlink: 'syz.1.3100': attribute type 29 has an invalid length. [ 352.161515][T16642] netlink: 'syz.1.3100': attribute type 29 has an invalid length. [ 352.237975][T16642] netlink: 'syz.1.3100': attribute type 29 has an invalid length. [ 352.281673][T16642] netlink: 'syz.1.3100': attribute type 29 has an invalid length. [ 352.293366][T16648] netlink: 'syz.0.3103': attribute type 4 has an invalid length. [ 352.315801][T16648] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3103'. [ 352.376331][T16646] bond1: Removing last arp target with arp_interval on [ 352.404051][T16642] netlink: 'syz.1.3100': attribute type 29 has an invalid length. [ 352.453799][T12868] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 352.476003][T16642] netlink: 'syz.1.3100': attribute type 29 has an invalid length. [ 352.476028][T12868] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 352.493902][T12868] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 352.502945][T12868] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 352.511697][T12868] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 352.571034][T16654] wlan0 speed is unknown, defaulting to 1000 [ 352.676152][T12868] Bluetooth: hci1: command tx timeout [ 352.998071][T16676] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3112'. [ 353.008921][T16676] gre0: entered promiscuous mode [ 353.070440][T16672] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3110'. [ 353.117720][T16672] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3110'. [ 353.321366][T16654] chnl_net:caif_netlink_parms(): no params data found [ 353.594572][T16695] ieee802154 phy0 wpan0: encryption failed: -22 [ 353.841069][T16703] tipc: Started in network mode [ 353.854290][T16703] tipc: Node identity ee111d72b82e, cluster identity 4711 [ 353.878536][T16703] tipc: Enabled bearer , priority 0 [ 353.888687][T16705] syzkaller0: entered promiscuous mode [ 353.913040][T16705] syzkaller0: entered allmulticast mode [ 354.030009][T16713] dvmrp0: entered allmulticast mode [ 354.099476][T16654] bridge0: port 1(bridge_slave_0) entered blocking state [ 354.113628][T16654] bridge0: port 1(bridge_slave_0) entered disabled state [ 354.125244][T16654] bridge_slave_0: entered allmulticast mode [ 354.144149][T16654] bridge_slave_0: entered promiscuous mode [ 354.161486][T16710] tipc: Resetting bearer [ 354.180491][T16710] tipc: Disabling bearer [ 354.193154][T16654] bridge0: port 2(bridge_slave_1) entered blocking state [ 354.202131][T16654] bridge0: port 2(bridge_slave_1) entered disabled state [ 354.212676][T16654] bridge_slave_1: entered allmulticast mode [ 354.233567][T16654] bridge_slave_1: entered promiscuous mode [ 354.311508][T16731] sctp: [Deprecated]: syz.0.3125 (pid 16731) Use of struct sctp_assoc_value in delayed_ack socket option. [ 354.311508][T16731] Use struct sctp_sack_info instead [ 354.372495][T16654] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 354.423945][T16654] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 354.531288][T16654] team0: Port device team_slave_0 added [ 354.559003][T16654] team0: Port device team_slave_1 added [ 354.594547][T12868] Bluetooth: hci4: command tx timeout [ 354.641014][T16732] wlan0 speed is unknown, defaulting to 1000 [ 354.660378][T16654] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 354.684240][T16654] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 354.743677][T16654] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 354.754935][T12868] Bluetooth: hci1: command tx timeout [ 354.805330][T16654] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 354.830152][T16654] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 354.886860][T16654] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 355.052175][T16654] hsr_slave_0: entered promiscuous mode [ 355.065719][T16654] hsr_slave_1: entered promiscuous mode [ 355.079351][T16654] debugfs: 'hsr0' already exists in 'hsr' [ 355.094457][T16654] Cannot create hsr debugfs directory [ 355.152979][T16756] xt_hashlimit: overflow, rate too high: 0 [ 355.313985][T16764] syz.4.3133 (16764) used obsolete PPPIOCDETACH ioctl [ 355.339225][T16771] __nla_validate_parse: 6 callbacks suppressed [ 355.339247][T16771] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3135'. [ 355.610972][T16781] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3137'. [ 355.758620][T16785] syzkaller0: entered promiscuous mode [ 355.766699][T16785] syzkaller0: entered allmulticast mode [ 355.867602][T16794] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3141'. [ 355.987866][T16654] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 355.999983][T16654] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 356.011672][T16654] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.071087][T16800] bond1: entered promiscuous mode [ 356.076579][T16800] bond1: entered allmulticast mode [ 356.082269][T16800] 8021q: adding VLAN 0 to HW filter on device bond1 [ 356.176318][T16807] openvswitch: netlink: Actions may not be safe on all matching packets [ 356.190010][T16654] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.214147][T16654] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 356.228235][T16654] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.267214][T16813] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3147'. [ 356.288121][T16811] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3146'. [ 356.327599][T16815] vlan0: entered promiscuous mode [ 356.332909][T16815] vlan0: entered allmulticast mode [ 356.346759][T16815] veth0_vlan: entered allmulticast mode [ 356.448696][T16654] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 356.468954][T16654] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 356.512658][T16654] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 356.624914][T16834] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3148'. [ 356.675230][T12868] Bluetooth: hci4: command tx timeout [ 356.900570][T16842] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3152'. [ 356.996508][T16654] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 357.018995][T16654] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 357.020023][T16845] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3153'. [ 357.030514][T16654] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 357.077094][T16848] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3153'. [ 357.107106][T16844] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3153'. [ 357.390548][T16654] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 357.431497][T16654] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 357.467284][T16654] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 357.504182][T16654] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 357.811150][T16654] 8021q: adding VLAN 0 to HW filter on device bond0 [ 357.869952][T16654] 8021q: adding VLAN 0 to HW filter on device team0 [ 357.895718][ T6496] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.902963][ T6496] bridge0: port 1(bridge_slave_0) entered forwarding state [ 357.987575][ T6496] bridge0: port 2(bridge_slave_1) entered blocking state [ 357.994865][ T6496] bridge0: port 2(bridge_slave_1) entered forwarding state [ 358.155154][T16896] pim6reg1: entered promiscuous mode [ 358.170442][T16896] pim6reg1: entered allmulticast mode [ 358.560734][ T6496] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.756215][T12868] Bluetooth: hci4: command tx timeout [ 358.789406][T16919] bond2 (unregistering): Released all slaves [ 358.824585][T16927] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 358.842752][T16927] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 358.887597][T16654] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 359.029164][T16654] veth0_vlan: entered promiscuous mode [ 359.059417][T16654] veth1_vlan: entered promiscuous mode [ 359.156538][T16936] wlan0 speed is unknown, defaulting to 1000 [ 359.217298][T16942] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 359.237917][T16942] bond2 (unregistering): Released all slaves [ 359.336607][T16953] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.440416][T16654] veth0_macvtap: entered promiscuous mode [ 359.492313][T16654] veth1_macvtap: entered promiscuous mode [ 359.526221][T16654] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 359.649901][T16654] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 359.678639][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.710022][T16965] netlink: 'syz.1.3183': attribute type 1 has an invalid length. [ 359.715027][ T80] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.757404][ T80] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.783339][ T4270] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.848060][T16969] x_tables: duplicate underflow at hook 1 [ 359.928785][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 359.940143][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 360.048524][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 360.070938][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 360.196421][T16983] netlink: 'syz.2.3102': attribute type 29 has an invalid length. [ 360.363775][T16984] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.371854][T16984] bridge0: port 1(bridge_slave_0) entered disabled state [ 360.457600][T16994] openvswitch: netlink: Key type 91 is out of range max 32 [ 360.576724][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 360.587657][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 360.597360][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 360.607461][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 360.616164][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 360.659381][T16984] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 360.677094][T16984] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 360.834762][T12868] Bluetooth: hci4: command tx timeout [ 360.880470][T16986] syz_tun: left promiscuous mode [ 360.890456][T16986] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.898209][T16986] bridge0: port 1(bridge_slave_0) entered disabled state [ 360.921138][T16995] __nla_validate_parse: 17 callbacks suppressed [ 360.921162][T16995] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3191'. [ 361.078165][ T36] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.094653][ T36] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.114038][ T36] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.143372][ T36] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 361.152580][T16996] wlan0 speed is unknown, defaulting to 1000 [ 361.158803][T17009] IPVS: set_ctl: invalid protocol: 28781 112.95.112.109:0 [ 361.313110][T17014] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3195'. [ 361.445368][T17024] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 361.452672][T17024] IPv6: NLM_F_CREATE should be set when creating new route [ 361.460002][T17024] IPv6: NLM_F_CREATE should be set when creating new route [ 361.467315][T17024] IPv6: NLM_F_CREATE should be set when creating new route [ 361.540021][T17030] sctp: [Deprecated]: syz.3.3198 (pid 17030) Use of struct sctp_assoc_value in delayed_ack socket option. [ 361.540021][T17030] Use struct sctp_sack_info instead [ 361.627716][T16996] chnl_net:caif_netlink_parms(): no params data found [ 361.888846][T16996] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.910535][T16996] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.910568][ T6600] IPVS: starting estimator thread 0... [ 361.925101][T16996] bridge_slave_0: entered allmulticast mode [ 361.947328][T16996] bridge_slave_0: entered promiscuous mode [ 361.961568][T16996] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.971861][T16996] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.979604][T16996] bridge_slave_1: entered allmulticast mode [ 361.988926][T16996] bridge_slave_1: entered promiscuous mode [ 362.025631][T17041] IPVS: using max 28 ests per chain, 67200 per kthread [ 362.117428][T17047] SET target dimension over the limit! [ 362.124273][T17047] x_tables: duplicate underflow at hook 2 [ 362.169554][T16996] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 362.186865][T16996] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 362.274302][T16996] team0: Port device team_slave_0 added [ 362.431719][T17053] team0 (unregistering): Port device team_slave_0 removed [ 362.442710][T17053] team0 (unregistering): Port device team_slave_1 removed [ 362.477925][T16996] team0: Port device team_slave_1 added [ 362.605311][T16996] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 362.617104][T16996] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 362.648386][T16996] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 362.678011][T12868] Bluetooth: hci2: command tx timeout [ 362.686874][T16996] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 362.694584][T16996] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 362.721512][T16996] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 362.881036][T16996] hsr_slave_0: entered promiscuous mode [ 362.905848][T16996] hsr_slave_1: entered promiscuous mode [ 362.921763][T16996] debugfs: 'hsr0' already exists in 'hsr' [ 362.934891][T16996] Cannot create hsr debugfs directory [ 363.029148][T17089] xt_CT: You must specify a L4 protocol and not use inversions on it [ 363.029513][T17086] netlink: 'syz.0.3214': attribute type 11 has an invalid length. [ 363.071428][T17082] syzkaller0: entered promiscuous mode [ 363.077245][T17082] syzkaller0: entered allmulticast mode [ 363.085132][T17086] netlink: 'syz.0.3214': attribute type 4 has an invalid length. [ 363.106829][T17086] netlink: 199768 bytes leftover after parsing attributes in process `syz.0.3214'. [ 363.233256][T17099] siw: device registration error -23 [ 364.303250][T17109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3219'. [ 364.746833][T17116] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3220'. [ 364.760668][T12868] Bluetooth: hci2: command tx timeout [ 364.781686][T17117] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3220'. [ 365.198671][T16996] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 365.237333][T16996] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.435289][T16996] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 365.454131][T16996] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.642463][T16996] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 365.665151][T16996] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.794061][T16996] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 365.810090][T16996] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 365.840164][T17169] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3233'. [ 365.846044][T17168] netlink: 'syz.3.3232': attribute type 6 has an invalid length. [ 366.081806][T16996] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 366.096511][T17174] netlink: 'syz.2.3234': attribute type 1 has an invalid length. [ 366.110037][T17174] netlink: 228 bytes leftover after parsing attributes in process `syz.2.3234'. [ 366.120680][T16996] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 366.137701][T16996] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 366.169019][T16996] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 366.437059][T16996] 8021q: adding VLAN 0 to HW filter on device bond0 [ 366.518849][T16996] 8021q: adding VLAN 0 to HW filter on device team0 [ 366.545360][T13992] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.552720][T13992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 366.598092][T13992] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.605365][T13992] bridge0: port 2(bridge_slave_1) entered forwarding state [ 366.834714][T12868] Bluetooth: hci2: command tx timeout [ 366.940951][T17208] netlink: 'syz.1.3245': attribute type 6 has an invalid length. [ 367.075833][T17214] wlan0 speed is unknown, defaulting to 1000 [ 367.147084][T17225] netlink: 'syz.1.3246': attribute type 2 has an invalid length. [ 367.174889][T17225] netlink: 119 bytes leftover after parsing attributes in process `syz.1.3246'. [ 367.255163][T16996] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 367.401437][T17234] netlink: 'syz.1.3248': attribute type 4 has an invalid length. [ 367.428857][T17233] netlink: 'syz.1.3248': attribute type 4 has an invalid length. [ 367.625392][T17240] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3249'. [ 368.087241][T16996] veth0_vlan: entered promiscuous mode [ 368.123320][T16996] veth1_vlan: entered promiscuous mode [ 368.161579][T17253] bridge_slave_0: left allmulticast mode [ 368.168034][T17253] bridge_slave_0: left promiscuous mode [ 368.174000][T17253] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.200916][T17253] bridge_slave_1: left allmulticast mode [ 368.225416][T17253] bridge_slave_1: left promiscuous mode [ 368.231686][T17253] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.299016][T17253] bond0: (slave 1!): Releasing backup interface [ 368.316425][T17264] ieee802154 phy0 wpan0: encryption failed: -22 [ 368.337025][T17253] bond0: (slave bond_slave_1): Releasing backup interface [ 368.395803][T17253] team0: Port device team_slave_0 removed [ 368.436711][T17253] team0: Port device team_slave_1 removed [ 368.454249][T17253] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 368.461950][T17253] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 368.487063][T17253] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 368.699972][T16996] veth0_macvtap: entered promiscuous mode [ 368.747442][T16996] veth1_macvtap: entered promiscuous mode [ 368.789503][T17281] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 368.796021][T17281] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 368.802723][T17279] netlink: 15 bytes leftover after parsing attributes in process `syz.3.3260'. [ 368.815879][T17279] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3260'. [ 368.851240][T16996] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 368.877045][T16996] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 368.902123][ T6496] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.914937][T12868] Bluetooth: hci2: command tx timeout [ 368.958990][ T6496] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.014964][ T6496] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.043049][T17291] netlink: 'syz.2.3263': attribute type 1 has an invalid length. [ 369.083107][ T6496] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 369.168488][T17289] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3263'. [ 369.327804][ T6496] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.359397][ T6496] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.448107][ T2207] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 369.468285][ T2207] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 369.663092][T17319] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3269'. [ 369.735156][T17334] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3273'. [ 369.924700][T17342] ip6gre1: entered allmulticast mode [ 370.152544][T17361] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3282'. [ 370.171787][T17362] IPVS: sync thread started: state = MASTER, mcast_ifn = geneve1, syncid = 0, id = 0 [ 370.191721][T17361] bridge_slave_1: left allmulticast mode [ 370.206813][T17361] bridge_slave_1: left promiscuous mode [ 370.224289][T17361] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.253666][T17361] bridge_slave_0: left allmulticast mode [ 370.267530][T17361] bridge_slave_0: left promiscuous mode [ 370.282060][T17361] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.689085][T17395] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 370.731692][T17390] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 370.902569][T17387] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 371.076991][ T9538] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 371.087820][ T9551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 371.297580][T17436] netlink: 536 bytes leftover after parsing attributes in process `syz.3.3305'. [ 371.470975][T17445] netlink: 'syz.2.3309': attribute type 13 has an invalid length. [ 371.625732][T17442] wlan0 speed is unknown, defaulting to 1000 [ 371.665315][T17462] netlink: 'syz.4.3312': attribute type 11 has an invalid length. [ 372.046769][T17478] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3319'. [ 372.115594][ T9539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 372.328266][T17500] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3324'. [ 372.338329][T17500] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 372.355852][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 372.409082][T17500] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 372.942415][T17532] netlink: 'syz.2.3333': attribute type 1 has an invalid length. [ 373.136832][T17535] bond1: (slave geneve2): making interface the new active one [ 373.145798][T17535] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 373.155830][ T9539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.185118][ T2060] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 373.216308][T17544] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3337'. [ 373.216783][ T2060] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 373.335800][T17544] bond2: entered promiscuous mode [ 373.340926][T17544] bond2: entered allmulticast mode [ 373.352040][T17544] 8021q: adding VLAN 0 to HW filter on device bond2 [ 373.378745][ T2060] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 373.387900][ T2060] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 373.546713][T17560] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3341'. [ 373.558725][T17560] netlink: 'syz.4.3341': attribute type 7 has an invalid length. [ 373.569963][T17560] netlink: 'syz.4.3341': attribute type 8 has an invalid length. [ 373.577894][T17560] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3341'. [ 373.597984][T17560] netlink: 'syz.4.3341': attribute type 1 has an invalid length. [ 373.624486][T17568] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3342'. [ 373.648814][ T2060] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.658293][ T7586] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.671882][ T9552] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.707006][T17568] netlink: 'syz.2.3342': attribute type 21 has an invalid length. [ 373.715390][T17568] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3342'. [ 373.747508][T17572] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.756958][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 373.845035][T17579] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3345'. [ 373.855616][T17577] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3346'. [ 374.116449][ T9551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 374.196739][ T9539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 374.220955][ T9551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 374.291812][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 374.301180][ T9551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 374.389511][T17609] bond3: option miimon: invalid value (18446744073709551585) [ 374.399405][T17609] bond3: option miimon: allowed values 0 - 2147483647 [ 374.408729][T17609] bond3 (unregistering): Released all slaves [ 374.462590][T17611] netlink: 'syz.0.3358': attribute type 83 has an invalid length. [ 375.461231][T17671] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 375.599287][T17686] syzkaller0: entered promiscuous mode [ 375.606249][T17686] syzkaller0: entered allmulticast mode [ 375.843836][T17711] syzkaller1: entered promiscuous mode [ 375.850664][T17711] syzkaller1: entered allmulticast mode [ 375.859246][T17711] netlink: 'syz.2.3386': attribute type 21 has an invalid length. [ 375.868895][T17711] netlink: 'syz.2.3386': attribute type 1 has an invalid length. [ 376.324911][T17719] __nla_validate_parse: 73 callbacks suppressed [ 376.324932][T17719] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3389'. [ 376.644820][T17728] netlink: 492 bytes leftover after parsing attributes in process `syz.3.3391'. [ 376.696534][T17735] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.3396'. [ 376.930619][T17758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3402'. [ 376.990943][T17768] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3404'. [ 377.529612][T17805] syz.4.3412 uses old SIOCAX25GETINFO [ 377.673007][T17807] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 377.695982][T17807] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3414'. [ 377.718472][T17807] tipc: Enabled bearer , priority 0 [ 377.738908][T17806] tipc: Disabling bearer [ 377.784708][T17815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3417'. [ 377.806439][T17815] netlink: 92 bytes leftover after parsing attributes in process `syz.2.3417'. [ 377.826500][T17815] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3417'. [ 377.954997][T17826] netlink: 'syz.4.3421': attribute type 4 has an invalid length. [ 377.963808][T17824] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3422'. [ 378.781411][T17869] net_ratelimit: 12 callbacks suppressed [ 378.781430][T17869] openvswitch: netlink: Multiple metadata blocks provided [ 378.895120][T17877] openvswitch: netlink: Missing valid actions attribute. [ 378.907191][T17877] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 378.947471][T17879] netlink: 'syz.2.3436': attribute type 2 has an invalid length. [ 378.955548][T17879] netlink: 'syz.2.3436': attribute type 8 has an invalid length. [ 378.993280][T17877] xt_CT: You must specify a L4 protocol and not use inversions on it [ 379.014839][T17882] tipc: Cannot configure node identity twice [ 379.268304][T17900] netlink: 'syz.0.3439': attribute type 4 has an invalid length. [ 379.397064][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.407680][ T9539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.418363][ T5890] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.431870][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 379.480330][T17912] netlink: 'syz.0.3447': attribute type 21 has an invalid length. [ 379.541606][T17914] x_tables: duplicate underflow at hook 2 [ 379.596759][T17916] netlink: 'syz.0.3449': attribute type 7 has an invalid length. [ 379.693386][T17923] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 379.988104][T17943] veth0_to_bridge: entered promiscuous mode [ 380.010172][T17943] gre0: entered promiscuous mode [ 380.110159][T17953] sctp: [Deprecated]: syz.3.3460 (pid 17953) Use of struct sctp_assoc_value in delayed_ack socket option. [ 380.110159][T17953] Use struct sctp_sack_info instead [ 380.233398][T17941] veth0_to_bridge: left promiscuous mode [ 380.345079][T17965] netem: invalid attributes len -24 [ 380.365796][T17965] netem: change failed [ 380.377482][T17965] netlink: 'syz.3.3466': attribute type 1 has an invalid length. [ 380.441182][ T9538] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 380.449396][ T9538] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 380.544736][T17973] syzkaller0: entered promiscuous mode [ 380.550428][T17973] syzkaller0: entered allmulticast mode [ 381.299858][T17996] sctp: [Deprecated]: syz.2.3477 (pid 17996) Use of struct sctp_assoc_value in delayed_ack socket option. [ 381.299858][T17996] Use struct sctp_sack_info instead [ 381.349716][T17996] sctp: [Deprecated]: syz.2.3477 (pid 17996) Use of struct sctp_assoc_value in delayed_ack socket option. [ 381.349716][T17996] Use struct sctp_sack_info instead [ 381.373538][T17996] sctp: [Deprecated]: syz.2.3477 (pid 17996) Use of struct sctp_assoc_value in delayed_ack socket option. [ 381.373538][T17996] Use struct sctp_sack_info instead [ 381.393149][T18002] __nla_validate_parse: 17 callbacks suppressed [ 381.393170][T18002] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3478'. [ 381.394517][T18005] sctp: [Deprecated]: syz.2.3477 (pid 18005) Use of struct sctp_assoc_value in delayed_ack socket option. [ 381.394517][T18005] Use struct sctp_sack_info instead [ 381.538514][T18012] netlink: 'syz.0.3482': attribute type 64 has an invalid length. [ 381.573711][T18012] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3482'. [ 381.606784][T18019] netlink: 'syz.0.3482': attribute type 9 has an invalid length. [ 381.625525][T18002] hsr_slave_0 (unregistering): left promiscuous mode [ 381.644599][T18019] netlink: 'syz.0.3482': attribute type 11 has an invalid length. [ 381.662238][T18019] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.3482'. [ 381.694769][T18013] syzkaller1: entered promiscuous mode [ 381.704505][T18013] syzkaller1: entered allmulticast mode [ 381.972778][T18041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3489'. [ 382.026263][T18046] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3490'. [ 382.112063][T18046] bond3: entered promiscuous mode [ 382.123492][T18046] bond3: entered allmulticast mode [ 382.129351][T18046] 8021q: adding VLAN 0 to HW filter on device bond3 [ 382.149249][T18049] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3495'. [ 382.321807][T18063] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3497'. [ 382.450655][T18070] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 382.469408][T18070] bond3: (slave lo): Enslaving as a backup interface with an up link [ 382.754305][T18091] : entered promiscuous mode [ 382.837923][T18095] 8021q: adding VLAN 0 to HW filter on device bond1 [ 382.855466][T18095] veth1_to_batadv: entered promiscuous mode [ 382.899577][T18095] bond1: (slave veth1_to_batadv): making interface the new active one [ 382.962380][T18095] bond1: (slave veth1_to_batadv): Enslaving as an active interface with an up link [ 383.118278][T18116] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3513'. [ 383.355969][T18131] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3520'. [ 383.512383][T18145] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3524'. [ 383.622054][T18149] tipc: Started in network mode [ 383.627171][T18149] tipc: Node identity a2978dab65ed, cluster identity 4711 [ 383.636446][T18149] tipc: Enabled bearer , priority 0 [ 383.670645][T18149] syzkaller0: entered promiscuous mode [ 383.676683][T18149] syzkaller0: entered allmulticast mode [ 383.720362][T18147] tipc: Resetting bearer [ 383.742946][T18147] tipc: Disabling bearer [ 383.878418][ T1298] net_ratelimit: 9 callbacks suppressed [ 383.878438][ T1298] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 383.894500][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 384.070375][T18183] validate_nla: 2 callbacks suppressed [ 384.070395][T18183] netlink: 'syz.2.3529': attribute type 8 has an invalid length. [ 384.595692][ T9538] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 384.598216][ T9551] IPVS: starting estimator thread 0... [ 384.616405][T18206] bond3: Invalid ad_actor_system MAC address. [ 384.622611][T18206] bond3: option ad_actor_system: invalid value (1) [ 384.636074][T18206] bond3 (unregistering): Released all slaves [ 384.714460][T18215] IPVS: using max 27 ests per chain, 64800 per kthread [ 384.779055][T18219] xt_hashlimit: max too large, truncated to 1048576 [ 385.065509][T18244] netlink: 'syz.3.3552': attribute type 5 has an invalid length. [ 385.102143][T18247] netlink: 'syz.3.3552': attribute type 5 has an invalid length. [ 385.234767][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.243253][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.251669][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.260073][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.270662][T18256] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.300038][T18260] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.314703][T18260] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.364700][T18260] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.425209][T18264] vxcan2: entered allmulticast mode [ 385.525348][T18263] wlan0 speed is unknown, defaulting to 1000 [ 385.938753][ T9539] IPVS: starting estimator thread 0... [ 386.050737][T18280] IPVS: using max 38 ests per chain, 91200 per kthread [ 386.370416][T11645] IPVS: stop unused estimator thread 0... [ 386.516369][T18300] netlink: 'syz.3.3569': attribute type 1 has an invalid length. [ 386.553125][T18300] ip6tnl2: entered promiscuous mode [ 386.560285][T18300] ip6tnl2: entered allmulticast mode [ 386.585000][T18304] syzkaller1: entered promiscuous mode [ 386.592979][T18304] syzkaller1: entered allmulticast mode [ 386.808076][T18325] __nla_validate_parse: 18 callbacks suppressed [ 386.808101][T18325] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3572'. [ 386.834005][T18316] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3572'. [ 387.102473][T18340] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3581'. [ 387.261959][T18349] mac80211_hwsim hwsim37 wlan1: Caught tx_queue_len zero misconfig [ 387.413161][T18357] netlink: 220 bytes leftover after parsing attributes in process `syz.0.3585'. [ 387.442830][T18357] ieee802154 phy0 wpan0: encryption failed: -22 [ 388.168219][T18380] netlink: 'syz.0.3592': attribute type 1 has an invalid length. [ 388.196674][T18383] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3592'. [ 388.209710][T18388] netlink: 'syz.1.3593': attribute type 6 has an invalid length. [ 388.254010][T18385] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3594'. [ 388.384704][T18400] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3597'. [ 388.547055][T18408] x_tables: duplicate underflow at hook 2 [ 388.988923][T18431] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3604'. [ 390.082391][T18411] net_ratelimit: 172 callbacks suppressed [ 390.082411][T18411] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 390.105553][T18430] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 390.107594][T18431] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 390.247414][T18437] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3607'. [ 390.249596][T18431] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 390.345111][T18431] bond1: (slave veth1_to_batadv): Releasing active interface [ 390.395622][T18443] netdevsim netdevsim1: Direct firmware load for  failed with error -2 [ 390.411781][T18443] netdevsim netdevsim1: Falling back to sysfs fallback for:  [ 390.519791][T18451] netlink: 'syz.3.3613': attribute type 30 has an invalid length. [ 390.565139][T18451] bond4: option arp_missed_max: invalid value (0) [ 390.572818][T18451] bond4: option arp_missed_max: allowed values 1 - 255 [ 390.583392][T18451] bond4 (unregistering): Released all slaves [ 390.608492][T18462] netlink: 'syz.2.3614': attribute type 1 has an invalid length. [ 390.638676][T18454] workqueue: name exceeds WQ_NAME_LEN. Truncating to: &%Q0@æjʫ} [ 390.779223][T18466] netlink: 'syz.3.3617': attribute type 5 has an invalid length. [ 390.813590][T18466] netlink: 201064 bytes leftover after parsing attributes in process `syz.3.3617'. [ 390.855743][T18469] ------------[ cut here ]------------ [ 390.861337][T18469] WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0, CPU#0: syz.2.3619/18469 [ 390.872407][T18469] Modules linked in: [ 390.876667][T18469] CPU: 0 UID: 0 PID: 18469 Comm: syz.2.3619 Not tainted syzkaller #0 PREEMPT(full) [ 390.886119][T18469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 390.896285][T18469] RIP: 0010:__skb_flow_dissect+0xb57/0x68b0 [ 390.902264][T18469] Code: 55 00 00 80 3d 74 c5 36 06 01 0f 85 b3 55 00 00 e8 9e 8d 8b f8 e9 83 f9 ff ff e8 94 8d 8b f8 e9 b0 03 00 00 e8 8a 8d 8b f8 90 <0f> 0b 90 e9 16 ff ff ff e8 7c 8d 8b f8 c6 05 3d c5 36 06 01 48 c7 [ 390.922057][T18469] RSP: 0018:ffffc9000e446f40 EFLAGS: 00010283 [ 390.928216][T18469] RAX: ffffffff8935c72e RBX: 0000000000000001 RCX: 0000000000080000 [ 390.936266][T18469] RDX: ffffc9000c3d9000 RSI: 00000000000005b4 RDI: 00000000000005b5 [ 390.944279][T18469] RBP: ffffc9000e447558 R08: ffffffff893562e8 R09: ffffffff8df41aa0 [ 390.952426][T18469] R10: ffffc9000e4475e0 R11: fffff52001c88ec6 R12: dffffc0000000000 [ 390.960495][T18469] R13: ffffffff893562e8 R14: 0000000000000000 R15: ffffffff8f825fd0 [ 390.968558][T18469] FS: 00007ff317c4f6c0(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 390.977566][T18469] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 390.984276][T18469] CR2: 00007f8fb5b156c0 CR3: 0000000045d78000 CR4: 00000000003526f0 [ 390.992591][T18469] Call Trace: [ 390.995946][T18469] [ 390.998931][T18469] ? stack_trace_save+0x9c/0xe0 [ 391.003847][T18469] ? __pfx_stack_trace_save+0x10/0x10 [ 391.009314][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.014318][T18469] ? __pfx___skb_flow_dissect+0x10/0x10 [ 391.019957][T18469] ? __update_page_owner_handle+0x5a/0x570 [ 391.025852][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.031449][T18469] ? lock_acquire+0x107/0x340 [ 391.036229][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.041833][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.047558][T18469] ? __page_table_check_zero+0x397/0x3e0 [ 391.053247][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.058899][T18469] ? post_alloc_hook+0x247/0x290 [ 391.063892][T18469] ? get_page_from_freelist+0x24e0/0x2580 [ 391.069707][T18469] ? rht_lock+0x8b/0x180 [ 391.074034][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.079070][T18469] ? rcu_is_watching+0x15/0xb0 [ 391.083901][T18469] ? trace_mm_page_alloc+0x3e/0x140 [ 391.089211][T18469] ? __alloc_frozen_pages_noprof+0x1d6/0x370 [ 391.095281][T18469] ? pfn_valid+0x125/0x4d0 [ 391.099756][T18469] ? lock_acquire+0x107/0x340 [ 391.104514][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.109594][T18469] __bond_xmit_hash+0x2d7/0xba0 [ 391.114549][T18469] ? __pfx___bond_xmit_hash+0x10/0x10 [ 391.120005][T18469] ? pfn_valid+0x125/0x4d0 [ 391.124504][T18469] ? lock_acquire+0x107/0x340 [ 391.129230][T18469] ? pfn_valid+0x125/0x4d0 [ 391.133714][T18469] bond_xdp_get_xmit_slave+0x1fd/0x710 [ 391.139269][T18469] xdp_master_redirect+0x13f/0x2c0 [ 391.144481][T18469] bpf_test_run_xdp_live+0x14b8/0x1b20 [ 391.150001][T18469] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 391.155729][T18469] ? bpf_test_run_xdp_live+0x393/0x1b20 [ 391.161347][T18469] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 391.167261][T18469] ? 0xffffffffa02057c0 [ 391.171484][T18469] ? 0xffffffffa02016b8 [ 391.175714][T18469] ? 0xffffffffa0201a50 [ 391.179910][T18469] ? 0xffffffffa0203790 [ 391.184168][T18469] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 391.190178][T18469] ? _copy_from_user+0x94/0xb0 [ 391.195033][T18469] ? bpf_test_init+0x113/0x150 [ 391.199849][T18469] ? xdp_convert_md_to_buff+0x5b/0x330 [ 391.205399][T18469] bpf_prog_test_run_xdp+0x7c0/0x10e0 [ 391.210852][T18469] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 391.216754][T18469] ? __fget_files+0x2a/0x420 [ 391.221407][T18469] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 391.227307][T18469] bpf_prog_test_run+0x2c7/0x340 [ 391.232311][T18469] __sys_bpf+0x562/0x860 [ 391.236647][T18469] ? __pfx___sys_bpf+0x10/0x10 [ 391.241496][T18469] ? rcu_is_watching+0x15/0xb0 [ 391.246372][T18469] __x64_sys_bpf+0x7c/0x90 [ 391.250840][T18469] do_syscall_64+0xec/0xf80 [ 391.255426][T18469] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.261540][T18469] ? trace_irq_disable+0x37/0x100 [ 391.266661][T18469] ? clear_bhb_loop+0x60/0xb0 [ 391.271399][T18469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.277376][T18469] RIP: 0033:0x7ff316d8f749 [ 391.281836][T18469] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 391.301536][T18469] RSP: 002b:00007ff317c4f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 391.310068][T18469] RAX: ffffffffffffffda RBX: 00007ff316fe5fa0 RCX: 00007ff316d8f749 [ 391.318145][T18469] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 391.326287][T18469] RBP: 00007ff316e13f91 R08: 0000000000000000 R09: 0000000000000000 [ 391.334307][T18469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 391.342452][T18469] R13: 00007ff316fe6038 R14: 00007ff316fe5fa0 R15: 00007ffe0e17a7a8 [ 391.350530][T18469] [ 391.353594][T18469] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 391.360913][T18469] CPU: 0 UID: 0 PID: 18469 Comm: syz.2.3619 Not tainted syzkaller #0 PREEMPT(full) [ 391.370358][T18469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 391.380466][T18469] Call Trace: [ 391.383795][T18469] [ 391.386768][T18469] vpanic+0x1e0/0x670 [ 391.390812][T18469] panic+0xb9/0xc0 [ 391.394586][T18469] ? __pfx_panic+0x10/0x10 [ 391.399084][T18469] __warn+0x317/0x4b0 [ 391.403118][T18469] ? __skb_flow_dissect+0xb57/0x68b0 [ 391.408460][T18469] ? __skb_flow_dissect+0xb57/0x68b0 [ 391.413764][T18469] __report_bug+0x288/0x500 [ 391.418323][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.423275][T18469] ? __skb_flow_dissect+0xb57/0x68b0 [ 391.428580][T18469] ? __pfx___report_bug+0x10/0x10 [ 391.433630][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.438694][T18469] ? unwind_next_frame+0xa5/0x23d0 [ 391.443822][T18469] ? is_bpf_text_address+0x26/0x2b0 [ 391.449136][T18469] ? lock_acquire+0x107/0x340 [ 391.453870][T18469] ? __skb_flow_dissect+0xb57/0x68b0 [ 391.459214][T18469] report_bug+0x16a/0x220 [ 391.463590][T18469] ? __skb_flow_dissect+0xb57/0x68b0 [ 391.468928][T18469] ? __skb_flow_dissect+0xb59/0x68b0 [ 391.474325][T18469] handle_bug+0x98/0x200 [ 391.478618][T18469] exc_invalid_op+0x1a/0x50 [ 391.483198][T18469] asm_exc_invalid_op+0x1a/0x20 [ 391.488095][T18469] RIP: 0010:__skb_flow_dissect+0xb57/0x68b0 [ 391.494055][T18469] Code: 55 00 00 80 3d 74 c5 36 06 01 0f 85 b3 55 00 00 e8 9e 8d 8b f8 e9 83 f9 ff ff e8 94 8d 8b f8 e9 b0 03 00 00 e8 8a 8d 8b f8 90 <0f> 0b 90 e9 16 ff ff ff e8 7c 8d 8b f8 c6 05 3d c5 36 06 01 48 c7 [ 391.514055][T18469] RSP: 0018:ffffc9000e446f40 EFLAGS: 00010283 [ 391.520149][T18469] RAX: ffffffff8935c72e RBX: 0000000000000001 RCX: 0000000000080000 [ 391.528145][T18469] RDX: ffffc9000c3d9000 RSI: 00000000000005b4 RDI: 00000000000005b5 [ 391.536163][T18469] RBP: ffffc9000e447558 R08: ffffffff893562e8 R09: ffffffff8df41aa0 [ 391.544189][T18469] R10: ffffc9000e4475e0 R11: fffff52001c88ec6 R12: dffffc0000000000 [ 391.552238][T18469] R13: ffffffff893562e8 R14: 0000000000000000 R15: ffffffff8f825fd0 [ 391.560261][T18469] ? __skb_flow_dissect+0x408/0x68b0 [ 391.565636][T18469] ? __skb_flow_dissect+0x408/0x68b0 [ 391.571015][T18469] ? __skb_flow_dissect+0x684e/0x68b0 [ 391.576511][T18469] ? stack_trace_save+0x9c/0xe0 [ 391.581424][T18469] ? __pfx_stack_trace_save+0x10/0x10 [ 391.586876][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.591887][T18469] ? __pfx___skb_flow_dissect+0x10/0x10 [ 391.597490][T18469] ? __update_page_owner_handle+0x5a/0x570 [ 391.603369][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.608964][T18469] ? lock_acquire+0x107/0x340 [ 391.613710][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.619319][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.624912][T18469] ? __page_table_check_zero+0x397/0x3e0 [ 391.630585][T18469] ? __page_table_check_zero+0x6a/0x3e0 [ 391.636201][T18469] ? post_alloc_hook+0x247/0x290 [ 391.641193][T18469] ? get_page_from_freelist+0x24e0/0x2580 [ 391.646972][T18469] ? rht_lock+0x8b/0x180 [ 391.651320][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.656312][T18469] ? rcu_is_watching+0x15/0xb0 [ 391.661126][T18469] ? trace_mm_page_alloc+0x3e/0x140 [ 391.666413][T18469] ? __alloc_frozen_pages_noprof+0x1d6/0x370 [ 391.672442][T18469] ? pfn_valid+0x125/0x4d0 [ 391.676911][T18469] ? lock_acquire+0x107/0x340 [ 391.681643][T18469] ? __lock_acquire+0x6b6/0x2cf0 [ 391.686633][T18469] __bond_xmit_hash+0x2d7/0xba0 [ 391.691557][T18469] ? __pfx___bond_xmit_hash+0x10/0x10 [ 391.697003][T18469] ? pfn_valid+0x125/0x4d0 [ 391.701490][T18469] ? lock_acquire+0x107/0x340 [ 391.706574][T18469] ? pfn_valid+0x125/0x4d0 [ 391.711060][T18469] bond_xdp_get_xmit_slave+0x1fd/0x710 [ 391.716585][T18469] xdp_master_redirect+0x13f/0x2c0 [ 391.721756][T18469] bpf_test_run_xdp_live+0x14b8/0x1b20 [ 391.727278][T18469] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 391.733001][T18469] ? bpf_test_run_xdp_live+0x393/0x1b20 [ 391.738626][T18469] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 391.744498][T18469] ? 0xffffffffa02057c0 [ 391.748723][T18469] ? 0xffffffffa02016b8 [ 391.752929][T18469] ? 0xffffffffa0201a50 [ 391.757130][T18469] ? 0xffffffffa0203790 [ 391.761426][T18469] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 391.767362][T18469] ? _copy_from_user+0x94/0xb0 [ 391.772172][T18469] ? bpf_test_init+0x113/0x150 [ 391.776986][T18469] ? xdp_convert_md_to_buff+0x5b/0x330 [ 391.782474][T18469] bpf_prog_test_run_xdp+0x7c0/0x10e0 [ 391.787898][T18469] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 391.793757][T18469] ? __fget_files+0x2a/0x420 [ 391.798407][T18469] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 391.804256][T18469] bpf_prog_test_run+0x2c7/0x340 [ 391.809221][T18469] __sys_bpf+0x562/0x860 [ 391.813485][T18469] ? __pfx___sys_bpf+0x10/0x10 [ 391.818359][T18469] ? rcu_is_watching+0x15/0xb0 [ 391.823179][T18469] __x64_sys_bpf+0x7c/0x90 [ 391.827632][T18469] do_syscall_64+0xec/0xf80 [ 391.832156][T18469] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.838258][T18469] ? trace_irq_disable+0x37/0x100 [ 391.843324][T18469] ? clear_bhb_loop+0x60/0xb0 [ 391.848019][T18469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.853939][T18469] RIP: 0033:0x7ff316d8f749 [ 391.858377][T18469] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 391.878007][T18469] RSP: 002b:00007ff317c4f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 391.886477][T18469] RAX: ffffffffffffffda RBX: 00007ff316fe5fa0 RCX: 00007ff316d8f749 [ 391.894482][T18469] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 391.902498][T18469] RBP: 00007ff316e13f91 R08: 0000000000000000 R09: 0000000000000000 [ 391.910507][T18469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 391.918528][T18469] R13: 00007ff316fe6038 R14: 00007ff316fe5fa0 R15: 00007ffe0e17a7a8 [ 391.926549][T18469] [ 391.930217][T18469] Kernel Offset: disabled [ 391.934554][T18469] Rebooting in 86400 seconds..