last executing test programs: 3.270827626s ago: executing program 0 (id=5365): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='memory.numa_stat\x00', 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000003c0)={0x0, r0}, 0x8) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000480)={0x1b, 0x0, 0x0, 0x104, 0x0, r0, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x4}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={0x0, 0x400, 0x8}, 0xc) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x6d8, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x1, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xd8}, [@ldst={0x5}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x11, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001400add427323b472545b45602117fffffff81000e220e227f000008925a8e0013007b000b00984d000000000000008100ff0000f03a86100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x8, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8804}, 0x20000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0xf, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xe}, [@generic={0x3, 0x7, 0x0, 0x9, 0xba5}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0xbf}, @jmp={0x5, 0x1, 0x5, 0x6, 0xb, 0x10, 0x4}, @func]}, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) 3.006309254s ago: executing program 0 (id=5368): r0 = socket$inet6(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000", @ANYRES32, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@o_path={0x0, 0x0, 0x18}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1, 0x80802, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'veth0_to_batadv\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001400090527bd7000fddbdf25022040ff", @ANYRES32=r3, @ANYBLOB="0800040064010104080008000001000008000200ac14143c08000a00030000000800090003000000080009"], 0x48}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000004f80), r4) sendmsg$NL802154_CMD_SET_CHANNEL(r4, &(0x7f0000005100)={0x0, 0x0, &(0x7f00000050c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="01002cbd7000fcdbdf250980ac5d1f0003000db24e3a41ac8e49c63ff2696ab00df8c14473b559e4cd", @ANYRES32, @ANYRESDEC=r3], 0x1c}, 0x1, 0x0, 0x0, 0x4000011}, 0x48010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="180000"], 0x18}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r7, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000340)='./cgroup/cgroup.procs\x00', &(0x7f00000002c0)=[0x45c], 0x0, 0x0, 0x100000, 0x1}}, 0x40) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'tunl0\x00', &(0x7f0000000380)={'gretap0\x00', 0x0, 0x7, 0x48, 0x7, 0x0, {{0xa, 0x4, 0x1, 0x3, 0x28, 0x64, 0x0, 0x8, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0xc}, @private=0xa010101, {[@cipso={0x86, 0xa, 0x0, [{0x5, 0x4, "749d"}]}, @cipso={0x86, 0xa, 0x2, [{0x1, 0x4, "b3ce"}]}]}}}}}) syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @remote, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) setsockopt$bt_BT_SNDMTU(r8, 0x112, 0xc, 0x0, 0x5f) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000380)={'icmp\x00'}, &(0x7f00000003c0)=0x1e) readv(r6, &(0x7f00000037c0)=[{0x0}, {&(0x7f0000002780)=""/4096, 0x1000}], 0x2) socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000100)=0x730) sendmsg$NL802154_CMD_GET_SEC_DEV(r4, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r5, 0x400, 0x70bd25, 0x9, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x8000) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000000)={'veth1_to_bridge\x00', @link_local}) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2.869609611s ago: executing program 2 (id=5371): syz_emit_ethernet(0x86, &(0x7f0000000000)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x1b59, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x0, "0002000000753904030405a024f0dd00", "9384bbeb3018ad591b661fe808b21b77", {"694c875dfb1be5d2a0057a62022a1564", "a329d3a14a1d8c6900"}}}}}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f02feff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008004f0fffeffe809005300fff5dd000000100001000a0c10000000000000000000", 0x58}], 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x8, &(0x7f00000002c0)=@framed={{}, [@jmp={0x6, 0x0, 0x7, 0x0, 0x0, 0x1, 0x25}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit]}, &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) unshare(0x20400) r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000000c0)='ns/ipc\x00') r3 = socket(0x15, 0x3, 0x3a) ioctl$SIOCGETNODEID(r3, 0x89e1, &(0x7f0000000280)={0x3}) ioctl$NS_GET_NSTYPE(r2, 0xb703, 0x0) setsockopt$inet6_int(r1, 0x29, 0x33, &(0x7f0000000080)=0x7, 0x4) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000d00)={0x14, 0x14, 0x1, 0x70bd2d, 0x0, "", [@generic="09fa6c93"]}, 0x14}], 0x1}, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x6, 0x0, &(0x7f0000000240)) 2.64711524s ago: executing program 2 (id=5375): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2b, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x2, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xffe, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) sendmsg$NFT_MSG_GETTABLE(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="20000000010a0101"], 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x4008804) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)}, 0x20048812) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000040)={0x0, 0xea60}, 0x10) read(r4, &(0x7f0000000100)=""/41, 0x29) shutdown(r4, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000980)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x5, 0x0, 0x0, @multicast2, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xa010101, @local, {[@timestamp_addr={0x44, 0x1c, 0xfc, 0x1, 0x0, [{@rand_addr, 0x4e210000}, {@remote, 0x2}, {@local, 0x3ff}]}, @timestamp_addr={0x44, 0x2c, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@broadcast}]}]}}}}}}}, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r2, 0x4058587a, &(0x7f00000006c0)={{r3, &(0x7f0000000440)='\x00', 0x0, &(0x7f0000000480)={@_ha_fsid={[0x8, 0x8001]}, {0xa4, 0x4, 0x4, 0x8001}}, 0x1287, &(0x7f0000000600)={@_ha_fsid}, &(0x7f0000000640)=0x3a65}, {[0x2, 0x401, 0x0, 0x6]}, 0xbc, 0x2, &(0x7f0000000680)=""/2}) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000840), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000880)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f0000000980)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x4c, r6, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x2}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x9}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x7ff}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xffff}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x23}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000801) sendmsg$inet(r3, &(0x7f00000003c0)={&(0x7f0000000040)={0x2, 0x4e22, @rand_addr=0x64010101}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000180)="18", 0x1}], 0x1}, 0x4008840) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) setsockopt(r3, 0x84, 0x7f, &(0x7f0000000140)="0200000009800089", 0x8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000100)={@empty, @broadcast, 0x0}, &(0x7f0000000140)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@private0, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000400)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@private=0xa010101, 0x4e24, 0x2, 0x4e23, 0x6, 0xa, 0xa0, 0xa0, 0x73, r8, r9}, {0xf32, 0x1, 0x0, 0x2, 0x9b, 0x1, 0x0, 0x7}, {0xc, 0x4, 0x5, 0xffffffffffffffff}, 0x8, 0x6e6bbf, 0x1, 0x1, 0x2, 0x2}, {{@in=@broadcast, 0x4d3, 0x3c}, 0x2, @in6=@dev={0xfe, 0x80, '\x00', 0x41}, 0x3504, 0x0, 0x3, 0x1, 0xfff, 0x7398ed71, 0x2}}, 0xe8) r10 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x0) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={0x5c, r11, 0x1, 0x70bd28, 0x0, {}, [@TIPC_NLA_NODE={0x48, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x44, 0x4, {'gcm(aes)\x00', 0x1c, "e3de3d7b4cd07ec3ee777dee74fc7986cc8df2165c8a7cc0483e375b"}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000019000100000000c34453c4a8ef136cdbadd8c3cfbc16db0000000000e000000200000000000000000000000000000000000000000000000000000000c1310000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="d707000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff000000000000000000000000000000000000000000000002000000000000000000000000000000000001000000000000"], 0xb8}}, 0x2c000010) 1.911452876s ago: executing program 4 (id=5381): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@ipv6_getaddrlabel={0x24, 0x4a, 0x1, 0x0, 0x0, {}, [@IFAL_LABEL={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000900010073797a3000000000140003800800024001000000080001400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03000000000000000000020000000900020073797a30000000000900010073797a30000000002c0003800800024000000000080001400000000018000380140001006d61630400633000000000000000000014000000110001"], 0x80}}, 0x0) (async) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="20000000170a0101"], 0x20}, 0x1, 0x0, 0x0, 0x40001}, 0x800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x801, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x20, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) 1.88642908s ago: executing program 0 (id=5382): r0 = socket$netlink(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x16, 0x0, 0x8, 0x10002, 0x0, 0x1}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, r1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x2, 0x11, &(0x7f0000000200)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@map_val={0x18, 0x0, 0x2, 0x0, r1}]}, &(0x7f0000000980)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32], 0x5c}}, 0x40) 1.683433127s ago: executing program 4 (id=5383): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newlink={0x44, 0x10, 0x439, 0x80, 0x0, {0x0, 0x0, 0xe403, 0x0, 0x8}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_TLB_DYNAMIC_LB={0x5, 0x1b, 0x3}, @IFLA_BOND_ARP_VALIDATE={0x8}]}}}]}, 0x44}}, 0x0) 1.607261727s ago: executing program 2 (id=5385): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000600)=@filter={'filter\x00', 0x4, 0x4, 0x398, 0xffffffff, 0x1a0, 0x0, 0x0, 0xfeffffff, 0xffffffff, 0x2c8, 0x2c8, 0x2c8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast2, @empty, [0x47e128f2bce82ddb, 0xff], [0xff, 0xffffff00, 0xff, 0xffffff00], 'veth0_to_bond\x00', 'veth1_vlan\x00', {0xff}, {}, 0x6, 0x8, 0x1, 0x51}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@private0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff], [0x0, 0xff, 0xff000000, 0xffffff00], 'veth1_virt_wifi\x00', 'batadv_slave_0\x00', {}, {0xff}, 0xae, 0xe7, 0x4, 0x44}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@ipv6header={{0x28}, {0xc, 0x5c4274de50300c47}}, @common=@hl={{0x28}, {0x1, 0x5}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x5, 0x1}, {0x4, 0x0, 0x6}, 0x6, 0x817e}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), 0x4) ioctl$XFS_IOC_OPEN_BY_HANDLE(r0, 0xc038586b, &(0x7f00000002c0)={r0, &(0x7f0000000140)='GPL\x00', 0x2000, &(0x7f0000000180)={@_ha_fsid={[0x1, 0x8]}, {0x1, 0x6, 0x4b76, 0xffffffffffff8000}}, 0x2, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0x7}) socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e21, @rand_addr=0x64010101}]}, &(0x7f00000000c0)=0x10) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000040)=0xfc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x2, &(0x7f0000000100)=@raw=[@ldst={0x1, 0x0, 0x4, 0x0, 0x1, 0xf100}, @jmp={0x5, 0x0, 0x9}], &(0x7f0000000280)='GPL\x00'}, 0x90) 1.569911511s ago: executing program 0 (id=5386): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000800), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000140)={'wpan3\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x38, 0x0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xc0000000}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x1}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x20008810) sendmsg$IEEE802154_SCAN_REQ(r1, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x24, r2, 0xd5c15c672e322a81, 0x0, 0x0, {}, [@IEEE802154_ATTR_CHANNELS={0x8}, @IEEE802154_ATTR_SCAN_TYPE={0x5}]}, 0x24}}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000400)='cubic', 0x6) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg(r4, &(0x7f0000005ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)='7', 0x1}], 0x1}}], 0x1, 0x1) r5 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r5, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000200)={{{@in=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000000300)=0xe8) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xc4, 0x19, 0x1, 0x70bd2b, 0x400000, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x87, 0x0, r6}, {0x0, 0x73, 0x0, 0x9, 0x8, 0xfffffffffffffffb, 0x10000000, 0xfffffffffffffffb}, {0x0, 0x200, 0x200000004000000}}, [@mark={0xc, 0x15, {0x35075a, 0x10}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x100}, 0x2c000010) syz_emit_ethernet(0x5e, &(0x7f0000000780)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0000a0", 0x28, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0xe}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @private1, @ipv4={'\x00', '\xff\xff', @loopback}}}}}}}, 0x0) 1.456032437s ago: executing program 3 (id=5387): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000c200000095"], &(0x7f0000000500)='GPL\x00', 0x5, 0x11, &(0x7f00000017c0)=""/4098}, 0x90) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x8, [@const={0xe, 0x0, 0x0, 0xa, 0x5}]}, {0x0, [0x2e, 0x0, 0x30, 0x30, 0x30, 0x61]}}, &(0x7f0000000080)=""/111, 0x2c, 0x6f, 0x0, 0x0, 0x10000}, 0x28) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xed, 0xed, 0x7, [@datasec={0x5, 0x1, 0x0, 0xf, 0x3, [{0x3, 0x4, 0x3}], "6e0db9"}, @datasec={0x4, 0xa, 0x0, 0xf, 0x2, [{0x3, 0x1000, 0x2}, {0x3, 0x0, 0x6}, {0x3, 0x6, 0x4}, {0x4, 0x8, 0xa5b}, {0x1, 0x4, 0x9c2}, {0x1, 0xb04d, 0x4}, {0x3, 0x192, 0x3}, {0x4, 0x5, 0x200}, {0x2, 0x800, 0x9}, {0x3, 0x3078, 0x7}], '_:'}, @union={0x4, 0x3, 0x0, 0x5, 0x0, 0x4, [{0x10, 0x2, 0x5}, {0x1, 0x4, 0x6d4c}, {0xf, 0x4, 0xfffffff8}]}, @decl_tag={0xa, 0x0, 0x0, 0x11, 0x2, 0x4}, @const={0xd}]}, {0x0, [0x30, 0x2e, 0x30, 0x61, 0x2e]}}, &(0x7f0000000300)=""/7, 0x10f, 0x7, 0x1, 0x6}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x2, 0x2, 0x80000000, 0x8000, 0xffffffffffffffff, 0x5, '\x00', r1, r2, 0x3, 0x1, 0x4, 0x0, @value=r3}, 0x50) 1.328803863s ago: executing program 3 (id=5389): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000040)=0x2c17, 0x4) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000480), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_FDB={0x4}]}, 0x1c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newnexthop={0x30, 0x68, 0x1, 0x2, 0x7ffffffc, {0x0, 0x0, 0x6}, [@NHA_GROUP={0x14, 0x2, [{0x1, 0x5}, {0xfffffffd, 0x6}]}, @NHA_FDB={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000000000000100000008000600e0000001050004000100000008000b0049f7a0c1"], 0x2c}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r3, 0x300, 0x70bd26, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 1.208701912s ago: executing program 4 (id=5391): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="800000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001000000000008000740000000011c00108008000140000000000800024000000000080003"], 0x80}}, 0xc800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r1, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0}, 0x29c}], 0x1, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000000301019e"], 0x38}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r1}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x8, 0xf0, 0x401, 0x1, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20, 0x7, 0x7, 0x4}}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@gettfilter={0x3c, 0x2e, 0x800, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x5, 0x6}, {0xffff, 0xfff2}, {0xfff1, 0x1}}, [{0x8, 0xb, 0x8}, {0x8, 0xb, 0x800}, {0x8, 0xb, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40090}, 0x4000) 1.172135973s ago: executing program 1 (id=5392): socket(0x11, 0xa, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09002069fc0000000000003a00000008000300", @ANYRES32=r3, @ANYBLOB="04005b"], 0x28}}, 0x800) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000003c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="260000000000000000ff"], 0x20) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@bloom_filter={0x1e, 0xfff, 0x5, 0x2af, 0x42001, 0xffffffffffffffff, 0xcc2c, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x3, 0x9}, 0x50) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000003000000850000008600000018010000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r1) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x20, 0x45, 0x1, 0x80002, 0x25dfdbfd, {0x5}, [@typed={0xc, 0x2, 0x0, 0x0, @u64=0xfffffffffffffffe}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c0c1}, 0x4008094) sendmsg$TIPC_NL_NET_GET(r11, &(0x7f0000000440)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0x84, r12, 0x20, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x70, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6f5f}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x68b8}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "c1424001f4082b04ade8680d94ba9dae60ce467c33f8b1ec"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xffff}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7ff}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x4a2}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x800}, 0x40001) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00020076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) r14 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r14, 0x29, 0x1f, 0x0, &(0x7f0000000080)) r15 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r15, 0x114, 0xa, &(0x7f0000000180)=ANY=[@ANYBLOB="e1"], 0x4) close(r0) syz_emit_ethernet(0x3b6, &(0x7f0000000940)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, [{0x3, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1902"}, {0x0, 0x1, "000000050000000026000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "b8a3e100908f6164000000020000000000000000000000ffff008879e66485201a0015ca83747357a02745000400"/55}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f0000000040)=0x1, 0x4) 1.061461242s ago: executing program 3 (id=5393): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000005c40), 0xffffffffffffffff) (rerun: 64) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="a4000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fddbdf250300000008000400fffbffff3800018014000400fe880000000000000000000000000101080006"], 0xa4}, 0x1, 0x0, 0x0, 0x890}, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) (async) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000009c0)={0x0, 0x3c}, 0x5}, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r3 = accept4(r0, 0x0, 0x0, 0x800) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000500)={'syztnl1\x00', 0x0, 0x4, 0x8, 0x8, 0x0, 0x0, @loopback, @ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x7, 0xfffff214}}) (async) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) getsockname(r3, &(0x7f0000000300)=@alg, &(0x7f00000004c0)=0x80) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x5, 0x2, 0x4, 0x0, 0xffffffffffffffff, 0xffffffff}, 0x50) (async) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r4, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/243, 0xfffffdef}], 0x1) (async) write$tun(r5, 0x0, 0xb6) write$cgroup_subtree(r5, 0x0, 0xfe33) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32, @ANYBLOB="10005e01"], 0x2c}}, 0x800) 893.03661ms ago: executing program 1 (id=5394): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x2c, r1, 0x7, 0x800, 0x0, {}, [@ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x7f}, @ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG={0x5, 0x7, 0x3}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400e4}, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCBRIDGECHAN(0xffffffffffffffff, 0x40047435, &(0x7f0000000100)=0x400) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x403, 0x4, 0x25ffdbfe, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_NF_CALL_IP6TABLES={0x5}, @IFLA_BR_NF_CALL_ARPTABLES={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010003df600"/20, @ANYRES32=0x0, @ANYBLOB="000000e8ff070000140003002e000000000000d700000000000000001800128008000100707070000c00028008000100", @ANYRES32=r2], 0x4c}, 0x1, 0x0, 0x0, 0x11}, 0x0) 852.688069ms ago: executing program 3 (id=5395): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f00000011c0)=ANY=[@ANYBLOB="280000000b14010000e0ffffffffffff070001"], 0x28}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0xffff, @loopback}, 0x4}}, 0x2e) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)={0x30, r4, 0x1, 0x70bd25, 0x3, {0x7}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IFNAME={0x14}]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x2400c046) syz_emit_ethernet(0x4c, &(0x7f0000000140)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0x0, @remote, @local, {[], {0x3, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, "ffb00afe4e70"}}}}}}}, 0x0) 783.391628ms ago: executing program 1 (id=5396): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) (async) bind$alg(r0, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-384\x00'}, 0x58) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x1c, 0x26, 0x101, 0x70bd26, 0xffffffff, {0x28}, [@typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x1c, 0x26, 0x101, 0x70bd26, 0xffffffff, {0x28}, [@typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d40), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r6, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000d80)={0x38, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x101}]}]}, 0x38}}, 0x0) (async) sendmsg$TIPC_NL_PEER_REMOVE(r6, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000d80)={0x38, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x101}]}]}, 0x38}}, 0x0) sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000940)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000900)={&(0x7f0000000600)={0x2d4, r7, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}]}, @TIPC_NLA_BEARER={0x30, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}]}, @TIPC_NLA_SOCK={0x4}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NODE={0x248, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xb3, 0x3, "46294eabc801755ce9f02b4068f2c00be779486485e83ef440688043cbd60d97618a034b1e9bdad8dc5aeb35463598423786806f3e945c6551974eec2ca67a3ab079fa252c2401ae0c7184710a699221bd10e91daa1622c9808d67edb4bdef24fa4fd8cdca648768b167c70e5ca40e7e31451d598815cb86b0a93adf841292c64be0be3e8e9d32d469d509f06913af988593f58c4d5d41b0291b017ae8664668b503cff94080403f7bfdf3e2935367"}, @TIPC_NLA_NODE_ID={0x62, 0x3, "b448c37e6c8befc35dc1dc0cfa3f3a661dca0eb02bb21485fea13441f1a7454105559f38a92b710a92f6c27009175a1b2ae557db740ffcf1e8ee9820f6fb83b67ebcb8d4c4ed52778b6c9cb9a338cdf5810d23fac3cb23758aaf93a75865"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xe584}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}, @TIPC_NLA_NODE_ID={0xc0, 0x3, "ef4a71b5cac59591311d9ee531dfdded7fafe21dd4442e538086618afe9d1773cd50289b2707cc2c5e5edb3815e49152c682f0f3e55299100c7a396d3cb56fa289f14b780beae434591830cfd7ba4e5fa698a5f92b21ed200981ec38a3a02cf7b0d07ae49e444d0d097197b1f995918d9b1c82d86b46de7f2bf88b323a29514d2bf94a22056e03283c5f00019dbe4f3e08dc645c170bd08e6368eea2bec9ad2960996c9e41e3d772fc1b29d7ae2010fca8be6cf46ad651d4b191cd74"}, @TIPC_NLA_NODE_ID={0x51, 0x3, "e46c731017f3bae1217473e0b4cfc9dda953260debd7e663d1451af2ab57210ba95d5759e3ee08e22aa5cad34e9669050d5615701395cf959b161ce39efe82ada3cbf70ffa54608b905214e0d6"}]}]}, 0x2d4}, 0x1, 0x0, 0x0, 0x40010}, 0x20000010) getsockopt$sock_timeval(r5, 0x1, 0x4c, 0x0, &(0x7f0000000300)) listen(0xffffffffffffffff, 0x80) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@ipv4_newaddr={0x48, 0x14, 0x509, 0x70bd27, 0x25dfdbfc, {0x2, 0x1f, 0x0, 0xff, r4}, [@IFA_BROADCAST={0x8, 0x4, @multicast1}, @IFA_FLAGS={0x8, 0x8, 0xa164d9c2c504f2c3}, @IFA_LOCAL={0x8, 0x2, @private=0xa010102}, @IFA_LOCAL={0x8, 0x2, @multicast2}, @IFA_FLAGS={0x8, 0x8, 0x4}, @IFA_RT_PRIORITY={0x8, 0x9, 0x100}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) (async) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) accept4(r0, 0x0, 0x0, 0x800) (async) r8 = accept4(r0, 0x0, 0x0, 0x800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r9, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000dc0)={0x14, 0x0, 0x6, 0x401}, 0x14}}, 0x0) (async) sendmsg$nl_netfilter(r9, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000dc0)={0x14, 0x0, 0x6, 0x401}, 0x14}}, 0x0) r10 = syz_genetlink_get_family_id$gtp(&(0x7f0000000100), r8) r11 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/time\x00') ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r11, 0x8004b707, 0x0) sendmsg$GTP_CMD_ECHOREQ(r6, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x7c, r10, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_MS_ADDR6={0x14, 0xc, @dev={0xfe, 0x80, '\x00', 0x30}}, @GTPA_VERSION={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @empty}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_VERSION={0x8}, @GTPA_NET_NS_FD={0x8, 0x7, r11}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_MS_ADDR6={0x14, 0xc, @ipv4={'\x00', '\xff\xff', @multicast1}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f00000001c0)=ANY=[@ANYRES16=r0], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x4, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000000)={0x3}, 0x10}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f00000001c0)=ANY=[@ANYRES16=r0], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x4, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000000)={0x3}, 0x10}, 0x94) 756.978659ms ago: executing program 4 (id=5397): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0xfffe}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd4}}, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) r8 = syz_open_procfs$namespace(r5, &(0x7f0000001780)='ns/ipc\x00') r9 = getpid() sendmmsg$unix(r3, &(0x7f0000001b00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {r5, 0x0, 0xee00}}}], 0x20, 0x4044014}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c, 0x1, 0x2, {r5, 0x0, r7}}}, @cred={{0x1c, 0x1, 0x2, {r9, r6}}}, @rights={{0x18, 0x1, 0x1, [r8, 0xffffffffffffffff]}}], 0x58, 0x800}}], 0x2, 0x0) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000000)=0x0) gettid() sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001c40)={0xe4c, 0x23, 0x301, 0x270bda5, 0x25dfdbfa, {0x1}, [@generic="2d2088a0227d2b7f1399df9dc3b6798812648ea394a01717919b99df55f9ed63a63c35d632e716cde5818d69434dae9482df2960653a194e326c87a99c219b86196fd87678c3fd65b70b2b16aec18085802df287aad4a797c00b892f6a7b5a71e7da38a42ef8e0ac906b5e3a11f6337bf74fff8a0551cc78a6458633308902ba7c3dbb56d9cd2b49b30c56d44cd716606e71b9d4e1f225181546dc37ff6830d459d4e414fead06ff5e57ebe37c65bfa53298cda0616a2091c1bc32dd8faeb803ce", @nested={0x1d8, 0x115, 0x0, 0x1, [@nested={0x1aa, 0x15e, 0x0, 0x1, [@typed={0x8, 0x126, 0x0, 0x0, @u32=0x2}, @nested={0x4, 0x7c}, @typed={0xc, 0x2b, 0x0, 0x0, @u64=0xfe5}, @nested={0x4, 0x119}, @nested={0x4, 0xf9}, @generic="4707bba4797d93db98388aaaf3a9711c947ddb10bfa6298a04383be6ca48d7f7094ba1b6234d3885da86e32c68130ea9781391c970e9c4b074d6f64c7a3820817f73ae0e72bfd7a4ed38b28848a616c5e05ff1a57eeecf5a1392e4effc30d01aed6482309dc214ef7318870e4f66084e9f51a00983f5493332b1201c028557bf551763c12090ba41f0b5850763f066baa0eeedf7de800aa4bb18fafabf1acdb126900c713b8d34fe011cb137cdfd6b9b7e53dcea46325ad56c04042e673ca5ee386fc08f484af34e2b6e86f50678021f2b7b5fcffd49fdeec06ec9d2c8461f3d", @nested={0x4, 0x12a}, @generic="9778569ecb14bb2a567b0201029c016d4d1909f9bdcfeba5355d2a91f7d47782351d78e4caf3888781c00bb4e061ba00a993e2cc2cf9f0a4243ee10ac1d5e33f777305342cfa27803bd7114eb3a9421ee84d84ccb0b7345b59da85dd945e966ff8639f9518534cd2283960b751c7561ce9be2d567bf9d1fb78db330050c7bb22e4469d006ef1ec73eb70a9725241e8748a7f56800cd84aa5a590cf4ca18a9795c683"]}, @typed={0x14, 0x14c, 0x0, 0x0, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}}, @typed={0xc, 0x168, 0x0, 0x0, @u64=0x100000001}, @typed={0x8, 0x162, 0x0, 0x0, @fd=r0}]}, @typed={0x8, 0x1e, 0x0, 0x0, @pid=r5}, @nested={0x2bb, 0xf0, 0x0, 0x1, [@generic="77f543a01a719f9b51f035cea65fcf122652b10571fad079e34f92810e7a2bb9c78a3c46aaff5294b2d8", @nested={0x4, 0xf0}, @nested={0x1a1, 0xdd, 0x0, 0x1, [@generic="d9e5fa2c20ffbb5246b946674357f898d7b050fd97a3b64312e08aaed482ed6bf10da5f9ad5b91fdaf0f22a476750ffae348712d03588858ed5bcc8aab950bbaec3e65ca6ed353a8f2b3d89b66f0a278679d25fb9cbcf271c7b4fe9bad42fbfa8b1c54938770b43ca319814940acaec7f3278545bf87dfb2d2b316deae21370f9ca780af8c865d8a02e387bdc163d3243f726b5d74012cd4af3dad379abff4e1fb76f8f7d009e8e0e603c1f3925aba893864beec6f8a7338cb3729c3b705fb58f7ed3fc91899", @generic="0000000000000001c056f1342bbe061e8e8de78a6a7a29a7c1d845f43c0183f03536ca8f34a7788650da097c45cdbf787a890cd1af1dd3c94b36b637003d362458d73de100cb4f03e0e6cb0ada1ef6175369869256cc6614ff5546cc5ec52ce7ec9bbd6a0254b95b93a51774edcead1a5541655fac74df52b2c5f964dd3efacd7fec778b39aac69ae74fcb42055d93034bb3cf66bb91483a6bbad5f1b5221feed404aeb5d7f4bcf646c88942db49ae7dbb6910a6e1cbd9424a23c792de9248e4075b774d80822ff4bb953c847ba604", @typed={0x8, 0x100, 0x0, 0x0, @uid=r6}]}, @typed={0x14, 0xb4, 0x0, 0x0, @ipv6=@mcast1}, @nested={0x2c, 0x44, 0x0, 0x1, [@typed={0x8, 0x94, 0x0, 0x0, @uid=r6}, @typed={0xc, 0x4f, 0x0, 0x0, @u64=0xd}, @typed={0xb, 0x161, 0x0, 0x0, @str='ns/ipc\x00'}, @typed={0x8, 0x101, 0x0, 0x0, @uid=r6}]}, @nested={0x62, 0x93, 0x0, 0x1, [@typed={0x8, 0xce, 0x0, 0x0, @uid=r6}, @generic="8f8db58fc677d87cf6780ccc196daf5094109064d2faa441b5c7b6533fbc1c685a24b518e148d620d43bc88bd90fe1213080817d8eada3553b5a", @typed={0x8, 0xfa, 0x0, 0x0, @uid=r6}, @typed={0xb, 0xa8, 0x0, 0x0, @str='ns/ipc\x00'}, @typed={0x8, 0x43, 0x0, 0x0, @u32}]}, @generic="cbf171b7ea9a1e53e750c8ce587761ffd8e1eba0b1779a086108a7038571cb6edcb8af6ec8cfccee7a01f755050dd817c2bd8e07febcb70389f7f49f3477ceb8c7"]}, @generic="3c765b8f253b9d3a8eaffc057a0bdd4eb2551b5b52e68078165e838bd3ef6c1247174d57392ee40d3e6eca5a4a10184b22bc1cfbf6a652636fe14b7baea9aee4155144c7f8d2e51a1aedd88e", @typed={0xe7, 0x9d, 0x0, 0x0, @binary="921fff316a52449678ae79693cd3765bd3a64d4d3369a052b92f5f94cff849b0b49e3b47e7883a63381b0bdbad4dd41404fe61e0f954dc8d4303156f0d751be0b98290ca8c9bf55aaf459982e9a01de158c8a5c6a88b5f9ace265c577e5db198385ae8e69597dea34dd7764babff30941c4ab3d257baac8db0ada1d901321663d0894b19b6d7db3a520d5d619ef0c53ae307315bcac9e92f277ff24410155cfe4d4280c4ac958ca4416d03209a610cbda61064b65e9cc0f709eaaf7a9ac166ca012cbf87ab39a39ed0481d6ad4f3dc67ed24b3d9ba048cf6dd6fc6f394001f5319c704"}, @nested={0x60d, 0xb5, 0x0, 0x1, [@generic="633c66344c20cbfa978c29afb5974e6f8050d29d044d44a51ddfc8123d42a037d0d78693a1ff080fc2531ef1e569dbaaa51f174805761d4e559636d08745ec3a046c1ec909ba9523d1", @typed={0x8, 0x9a, 0x0, 0x0, @u32=0x1}, @typed={0x14, 0xda, 0x0, 0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @generic="8e5fde9e57ea8eb77c347593e10e7bbd225e23b8b32ef9a6cc2c7dbe41bfa0ef2c9bbe03f457c7ef6f9c2c1214e84234f932d8fe9cc55a56fed0bc07821faed933a7d6acb95abedd8a4cd9b5bb5f28daf41949a525ab1d8c5837", @generic="97821ba1f8ba14df59b37dd3122365a2e2175f3822d4ab00d8ef21f045bf4b43a5d322a189d07a71df671cf9a1d93616d6550bcd023f33dba789ee0abed94f5617735b7b51b371c27c5a20d32a633e659454e98c2e20505a69a0f8036040299cc52c0ac04398dab84c6049f1372b2f533436f5b638636ac2931944fbe89940689168e9ae1a02df5bfe", @nested={0x185, 0x2d, 0x0, 0x1, [@generic="2f2ac75b7bfba6970158c36ad9872ee0bd40c8d20109d6d996294a3dc42fb298ceb67f5eafc5e42a311d5663465cc25cd3bf0aa6f3a14182bda39f9a44092902060ac7d5658b7de595a5b3ce", @typed={0x8, 0x6f, 0x0, 0x0, @pid=r10}, @generic="0fa346bd72d3bc977d9cf7c88c88ccc898", @typed={0x8, 0x167, 0x0, 0x0, @uid=r6}, @generic="77952cf56638fe54e6da64dabffc0b8f11d98275b64431999060cd2e71b0cfc6208b61681c958b70c57643c3f509460e88392c977495517bc28970a351dcfc89dc3222f5001012faeb13b3375fcebc01c2014e3346c2377252b842aec40c0b5c86a072901beaffcc2cbe6b205afc650417e2d66fcab34f28160feeca0705a0964782855422f7dbcdc98899c3b9ab2b0bd321724070dfc7ac56b19c3a962346a11c4d63d07ebd1966bb88fe741f29e1cd50020d6ff60353289f05766a13a8911a1378ac42a3fcdb4a9b31cd4a0764b8d6ad6444e9de89", @typed={0x8, 0x14c, 0x0, 0x0, @uid=r6}, @generic="c0b6bc7f55d0dc84efc17b4e1334245b835ad23df3af5f9ba60328519f2abf3d016f2e3aff057d9518bc95aeac66", @typed={0x8, 0x94, 0x0, 0x0, @pid=r5}]}, @generic="def25f30d01d3664378c04b127d370a09e9758858a5ed52ecfc2922e9000f3e48c9757303358aa5312e38c29a958b4c688680a8804f67deaa91d1affcd5ee463d8817c682487f7a827c5fe4281bbacbd501e11a84ac49fb47df98f854450bc68801e952b0216ab79384e7e80d4c05ecc2ad7c1107a2acf90374abe39b74f0429243eba4483ac4e8c9aa942881ed406ab3fc0af9a96fa59a4080dfc3f2e78d07270ed74c26fa5b92bcf9206264c4b533518009261bb3d5f04df621a9a7766b56b2dcc770826", @typed={0x9d, 0x140, 0x0, 0x0, @binary="1712385888dadaa71e88b3cf3b4ecd38d970f8c3b9f82639a858d5ef72a6c3018998ca9d59d1d689e287c56c53d991931d5b2454fd4181f26d06386fb62b5be356c0f591e56cd4a4ee749b8bca759c229c334df6409ba53a275b85672be3e07d31950e17a65ea1f566ab1e0ff8f822f86b5632672eb96f3da661367a7aee4947f2abe87d01ef354d386e1830420fcce19b19ed157bb106d6c1"}, @nested={0x1d1, 0xed, 0x0, 0x1, [@generic="cf070621049d297a5328eedb9b93d15fab476bee28f16b78b0a3074af19fc0245e8d9eb9fb67d7be8960025e449f557fc4839bc74e3eb6fc5b335e6556db6628998dbc32fcc45644fef5d4834a817e67fd47e57385938700069b4edb7b43b75275201aa9066c469e8e7d4c011af4ee20caca57cc1699696aa6bb002771cfd49e", @generic="79baa08c1fba7c134b74190c6824cbd04e627f622282bdf73d71c3d615f3a6ecd63269f519ec69c7a7e2e124cc8a7252c4743b5e0d34410bd475276103fd439f752cddfcf2ad7c005a507df2c378d5f872072ad326bd09ba53b49408fb586c4d791710e24cb48df3e7740cdfb9ced967516bfa4bd1e6ae443566c29b1edd64d2ac3e018a8d885ec263bbd883ce8e890e262d70d01297f8b6939ebe90aa4470a5599000a74c2e10f0e142e00b4befd70c000000", @generic="28157f58d42499cf81eb1be6e36ab91307ac97b3d55c3ae8f759e60abed5d06ecd850ccd09bb36b702710ab23fd80bac5527e984bdcbd5267bcb5969b507dd99e722540e17341d989b3cc8ba8a5bd80f5fe6d0ba78f620e93f77cc794cebf8880091ff1d97adc2dbcf7895f043d8749230fc98ea0d5fee956989599b4004e96ac17d", @nested={0x4, 0x1d}, @nested={0x4, 0xc7}, @nested={0x4, 0x88}, @typed={0xc, 0x100, 0x0, 0x0, @u64=0xd}]}]}, @generic="50a33a0ca1c7b88932e15b0f97a92e6afc0485b9f02fb88a796c91ec2ac602bee203414c1931eb2a53280fdae87bc6b082797c60d7fecc07365cf4d5390a998eb79804787da93b645d28505b104d5bbbb9a8290f98a4c7862e95cdd31f4e6796f08b49f38981e2d1c5552b42ef195d83333828f95da920a09e69667e23f19afb1db888afb4a0198945e12963c535c7c04074903d9b4667f46496f9a033638a077086b60b6ec53dab21a08fada5727491d090e9ee", @generic="819bfeab0ac042fd297843df0fe00b77dca25fd40eb0128fc6e2de9366b7c298e8b630b0f9ee7d75e25d14f8f06d2688d52e19a06efe908d33fd8fc99a1636d2d8cf7afdee7f0e126d58cb95304f018e5e7c6ceb3002f765138b820d2f268d307f3015c28009be1ba72f703fe3c62471c35eee93f2ef270aa2330ee13d3ec7adeb84a4a6019d6151be2389a44f869508865beaf0fdd09277e607cea8e7c431372e4bd1342f14df27c30d24a2182c7de20bbb945768f2fdb339432e8dd38012dfa534802eae107da36caa61a9f90cf5a1d7343d27f62967613f55ae", @typed={0x8, 0xcd, 0x0, 0x0, @pid=r5}]}, 0xe4c}}, 0x20000880) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_SB_GET(r11, 0x0, 0x20000800) r12 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r12, 0x0, 0x30, 0x0, @void}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 722.03312ms ago: executing program 3 (id=5398): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffffffff}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x58}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x14, 0x0, &(0x7f0000000180)) 607.023453ms ago: executing program 2 (id=5399): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x18, 0x7, 0x0, &(0x7f0000000140)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x5}]}]}, 0x58}}, 0x0) pselect6(0x40, &(0x7f00000003c0)={0x1000, 0x101, 0x7ff, 0x8, 0x7ff, 0x401, 0xcb, 0x80000000}, &(0x7f0000000400)={0x5, 0x1, 0x4c, 0xffffffffffff8001, 0x7, 0x0, 0xffffffffffffffff, 0x6e50800}, &(0x7f0000000440)={0x0, 0x14f, 0x401, 0x8000000000000000, 0x7, 0x10, 0x94, 0x4}, &(0x7f0000000480), &(0x7f0000000900)={&(0x7f00000008c0)={[0x5]}, 0x8}) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}}, 0xb8}}, 0x2c000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000040000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000058000000060a0104"], 0xcc}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="2c0000003f00070100000000fddbdf25027c00001800378013000100717472283414d6bb"], 0x2c}, 0x1, 0x0, 0x0, 0xc880}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e000000200000000000000000000000000000000000000000000000a"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x10, 0x80}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, 0x0, 0x6e6bb5, 0x0, 0x0, 0x3, 0x2}}, 0xb8}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f0000000340)=r0}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x18, 0x25, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x58c}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x101}}, @ldst={0x0, 0x2, 0x3, 0xb, 0x1, 0x0, 0xffffffffffffffff}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ff}}, @initr0={0x18, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x5}, @tail_call={{0x18, 0x2, 0x1, 0x0, r7}}]}, &(0x7f00000006c0)='GPL\x00', 0x8, 0x5e, &(0x7f0000000700)=""/94, 0x41000, 0x42, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x2, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x1, 0x1, 0x5, 0x6}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a31000000001400048008000240a04b3d02080001400000000308000540000000001c0008800c00014000000000000000090c000240000000000018ab6e14000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r8 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r8, &(0x7f0000001c00)={&(0x7f0000000000)={0xa, 0xa, 0x3, @dev={0xfe, 0x80, '\x00', 0x3c}}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000040)="671723d7c6012c", 0x7}, {&(0x7f0000000100)="9e91d93a92dc7c8fff658bb539e2a1485d4c9223a7dfe538a2e2fea2", 0x1c}, {&(0x7f0000000200)='\x00\x00\x00\x00\x00', 0x5}, {&(0x7f0000000140)="2bc4", 0x4b}], 0x4}, 0x20008b88) 582.59138ms ago: executing program 0 (id=5400): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000c00)}, 0x10004000) 569.450173ms ago: executing program 1 (id=5401): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x1) (async) shutdown(r0, 0x1) (async) r1 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r1, 0x29, 0x4a, &(0x7f0000000000)=0x9, 0x4) (async) syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @random="6a5d0e8f64aa", @void, {@ipv6={0x86dd, @generic={0xc, 0x6, '\x00', 0x8, 0x2c, 0x1, @local, @mcast2, {[@hopopts={0xff}]}}}}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x2}, @NFT_OBJECT_CONNLIMIT=@NFTA_OBJ_TYPE={0x8}}], {0x14}}, 0x44}}, 0x4000001) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x300, 0x70bd29, 0x25dfdbfc, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e22}, @FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x20000080) (async) r3 = socket(0xa, 0x2400000001, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x2c, 0xe, 0x6, 0x801, 0x0, 0x0, {0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x81) (async) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000034000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}}, 0xfffffffffffffe6d) (async) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f00000002c0)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) (async) getsockopt$inet6_buf(r3, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000002280)=0x90) recvmmsg(r1, &(0x7f0000000180)=[{{0x0, 0xfffffffffffffcfa, 0x0, 0x0, 0x0, 0x1}, 0x496}], 0x1, 0x102, 0x0) 507.344973ms ago: executing program 3 (id=5402): bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1e000000000000000a000000fbffff7f"], 0x50) r0 = socket$inet6_udp(0xa, 0x2, 0x0) recvmsg(r0, &(0x7f0000000fc0)={&(0x7f00000006c0)=@qipcrtr, 0x80, &(0x7f0000000ec0)=[{&(0x7f0000000740)=""/140, 0x8c}, {&(0x7f0000000800)=""/189, 0xbd}, {&(0x7f00000008c0)=""/30, 0x1e}, {&(0x7f0000000900)=""/162, 0xa2}, {&(0x7f00000009c0)}, {&(0x7f0000000a00)=""/250, 0xfa}, {&(0x7f0000000b00)=""/164, 0xa4}, {&(0x7f0000000bc0)=""/220, 0xdc}, {&(0x7f0000000cc0)=""/251, 0xfb}, {&(0x7f0000000dc0)=""/232, 0xe8}], 0xa, &(0x7f0000000f80)=""/28, 0x1c}, 0x40) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1}, "040065580000ffff"}}}}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x2, 0x5, 0x628, 0x0, 0x488, 0xffffffff, 0x0, 0x268, 0x558, 0x558, 0xffffffff, 0x558, 0x558, 0x5, 0x0, {[{{@uncond, 0x0, 0x220, 0x268, 0x0, {}, [@common=@rt={{0x138}, {0x4, [0x3, 0x800], 0x0, 0xf23d8cefb056ae2b, 0x7, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @private0, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @remote}, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @dev={0xfe, 0x80, '\x00', 0x2b}, @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote], 0x9}}, @common=@unspec=@connlimit={{0x40}, {[0x0, 0xffffffff, 0xffffffff, 0xff000000], 0xffffff7f, 0x1, {0x4}}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote}}}, {{@ipv6={@dev, @loopback, [], [], 'batadv0\x00', 'veth1_vlan\x00'}, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@loopback, @ipv6=@private0, @icmp_id, @icmp_id}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x1b}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @gre_key, @gre_key}}}, {{@ipv6={@remote, @mcast1, [0x0, 0xff000000], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x688) 439.882831ms ago: executing program 4 (id=5403): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYRES64=r1, @ANYRES32=r1, @ANYBLOB="00004000395a21cd8b7158cc458fe49c2877a9dd3135fda2028d1f581a090519c6d8cce86e6d1bac97e3f73b0189ac423b85877bfcd1a95e178ebe65a4649b621c8f8b855b969ec9a46c83c86830589324524db4a4d86d2a31c135c0ead0378fedde25685d4e0242efdbd4c119e0b7bf59db764dba5963637972745bb5b3c9e5b76a95e6bd34397d9008bca31364f5981b018ba0e9996735d2c6319faf055b10702d9dcd372d516cd6d42c", @ANYRES32=0x0, @ANYRES64], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x0) 367.394977ms ago: executing program 2 (id=5404): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000240)=ANY=[@ANYBLOB="29080000000000000502be960401e00109000000000000000000040108040100c9100000000000000000000000000000000107180000001711850b000400000000000000018000"/80], 0x50) socket$kcm(0x2d, 0x2, 0x0) (async) socket$kcm(0x2d, 0x2, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000ffff00000000000000000080147ba0f85c616da6d342ec6b9e168e86b161fcba95f861ff7f7069f63eebde06775685b67205184ab77ec4ccfa9233912205ef5d4e9161d0e3d6eb776a5a9e6045378006c8e95fbd584417f713b4f6b11289d28e5e228dc6369e4b90a058", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bf8200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1b, 0xb, &(0x7f0000000540)=ANY=[], &(0x7f0000000000)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2000006}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1b, 0xb, &(0x7f0000000540)=ANY=[], &(0x7f0000000000)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x2000006}, 0x94) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETSTEERINGEBPF(r4, 0x800454e0, &(0x7f00000001c0)=r5) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) socket$unix(0x1, 0x1, 0x0) (async) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) socket$inet6(0xa, 0x2, 0x0) (async) r8 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) (async) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r9 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) (async) socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'veth1\x00'}) setsockopt$sock_attach_bpf(r9, 0x107, 0xf, &(0x7f0000000600), 0x56) r10 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r10, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) 316.028534ms ago: executing program 0 (id=5405): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x20000253) recvmsg$unix(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000300)=""/47, 0x2f}], 0x1}, 0x40010142) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000080)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000900)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x44) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000003c0)={@cgroup=r5, 0x5, 0x1, 0x7, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r3, @ANYBLOB="00001700000000001c003780"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r6, 0x84, 0x6, 0x0, &(0x7f00000002c0)) r7 = socket(0x1, 0x4, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0x0) 315.239928ms ago: executing program 1 (id=5406): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) (async) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r0, 0x5, 0x26, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r1, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r13, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @remote}}}, 0x84) sendmsg$FOU_CMD_ADD(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000009f0c67d750c87babf862b2a21a3d9a02e36ceb544a43be241d4d307a408c5ee0ff42f9ff7c3b15fe3b1e8a8700f5ea245fc36f41c875ee464c89f23aedbc2a36e35debb90591d2d4616c829b6eabcdc42f", @ANYRES16=r12, @ANYBLOB="5b5e26bd7000fcdbdf25010000009efe08007f000001"], 0x1c}}, 0x90) 210.463407ms ago: executing program 4 (id=5407): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000014c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x3a}, @NFTA_SET_EXPR={0x2c, 0x11, 0x0, 0x1, @target={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x4}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xa, 0x1, 'NFLOG\x00'}]}}}]}], {0x14, 0x10}}, 0xb0}}, 0x20000800) socketpair(0x1d, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r3, &(0x7f0000000040), 0x10) listen(r3, 0x0) accept4$unix(r3, 0x0, 0x0, 0x0) accept4(r3, 0x0, 0x0, 0x80800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x1, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x59, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x2000000, 0xe, 0xffffffffffffff94, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="18000000240001"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) recvmmsg(r2, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4077, 0xfed}], 0x1}, 0x9}], 0x1, 0x2000, 0x0) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="1801"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x8, 0x5, 0x9}, &(0x7f0000000140)=0x10) 46.25993ms ago: executing program 2 (id=5408): sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)="2f0000001c0005fffffff7000d000000020000000b000000ec0091c913000180f0ffffeb46860f21244e36c3fdb9c3", 0x2f}], 0x1}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000280)="2e9b3d0007e03dd65193dfb6c575963f86ddf06712e9232f328db0049d90491ceaebfd26d4eef23248000000f858dbb8a19052", 0x33}, {&(0x7f0000000680)="2a637c1b8b3894ec89aaef510a473f", 0xf}], 0x2) r2 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0xc}], 0x492492492492856, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)="2f0000001c0005fffffff7000d000000020000000b000000ec0091c913000180f0ffffeb46860f21244e36c3fdb9c3", 0x2f}], 0x1}, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) (async) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000280)="2e9b3d0007e03dd65193dfb6c575963f86ddf06712e9232f328db0049d90491ceaebfd26d4eef23248000000f858dbb8a19052", 0x33}, {&(0x7f0000000680)="2a637c1b8b3894ec89aaef510a473f", 0xf}], 0x2) (async) socket(0x10, 0x80002, 0x0) (async) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x3, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100), 0xc}], 0x492492492492856, 0x0) (async) 0s ago: executing program 1 (id=5409): r0 = socket(0x2, 0x3, 0x40) setsockopt(r0, 0xff, 0x1, 0x0, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3d}, 0x1c) (async) r2 = socket$unix(0x1, 0x1, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) (async) bind$unix(r2, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) listen(r2, 0x0) connect$unix(r2, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) recvfrom$inet6(r1, &(0x7f00000003c0)=""/151, 0x97, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): 9] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 582.596177][T19229] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 582.626749][T19229] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 582.921499][T19317] syzkaller0: entered promiscuous mode [ 582.945146][T19317] syzkaller0: entered allmulticast mode [ 584.415757][ T5639] Bluetooth: hci2: command tx timeout [ 585.663285][T19229] hsr_slave_0: entered promiscuous mode [ 585.670552][T19229] hsr_slave_1: entered promiscuous mode [ 585.683744][T19229] debugfs: 'hsr0' already exists in 'hsr' [ 585.702606][T19229] Cannot create hsr debugfs directory [ 585.770944][T19351] syzkaller0: entered promiscuous mode [ 585.793575][T19351] syzkaller0: entered allmulticast mode [ 586.229520][T19375] vlan2: entered allmulticast mode [ 586.239354][T19375] bond0: entered allmulticast mode [ 586.241221][T19382] openvswitch: netlink: Message has 244 unknown bytes. [ 586.244611][T19375] bond_slave_0: entered allmulticast mode [ 586.259859][T19375] bond_slave_1: entered allmulticast mode [ 586.306132][T19382] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3524'. [ 586.495399][ T5639] Bluetooth: hci2: command tx timeout [ 586.521024][T19388] bond2 (unregistering): Released all slaves [ 586.987764][T19413] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3529'. [ 587.574371][T19229] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.608123][T19229] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 587.643638][T19229] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 587.797810][T19449] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3536'. [ 587.798607][T19433] syzkaller0: entered promiscuous mode [ 587.826541][T19433] syzkaller0: entered allmulticast mode [ 587.889500][T19454] bond1: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 587.912182][T19454] bond1 (unregistering): Released all slaves [ 587.982168][T19449] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 588.002042][T19449] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 588.575410][ T5639] Bluetooth: hci2: command tx timeout [ 591.393691][T19229] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 591.404133][T19229] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 591.414654][T19229] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 591.471719][T19475] bridge_slave_1: left allmulticast mode [ 591.490440][T19475] bridge_slave_1: left promiscuous mode [ 591.519220][T19475] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.554365][T19475] bridge_slave_0: left allmulticast mode [ 591.570693][T19475] bridge_slave_0: left promiscuous mode [ 591.577067][T19475] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.628110][T19479] 8021q: VLANs not supported on wg0 [ 591.637165][T19480] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 591.661151][T19486] netlink: 'syz.3.3544': attribute type 4 has an invalid length. [ 591.741550][T19229] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 591.777635][T19229] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 591.807018][T19229] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 591.986791][T19498] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3549'. [ 591.999946][T19229] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 592.016251][T19229] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 592.027170][T19229] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 592.303647][T19511] netlink: 'syz.2.3553': attribute type 12 has an invalid length. [ 592.319713][T19511] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3553'. [ 592.379837][T19511] netlink: 'syz.2.3553': attribute type 39 has an invalid length. [ 592.425301][T19511] hsr_slave_0: left promiscuous mode [ 592.447140][T19511] hsr_slave_1: left promiscuous mode [ 592.474097][T19521] netlink: 'syz.1.3557': attribute type 1 has an invalid length. [ 592.733445][T15215] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.761525][T15215] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.804076][T19533] netlink: 'syz.4.3559': attribute type 1 has an invalid length. [ 592.814802][T19229] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 592.846466][T19229] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 592.855838][T19229] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 592.878097][T19229] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 592.949674][T19535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 592.960499][T19229] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 592.982969][T19229] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 593.000280][T19229] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 593.041639][T19229] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 593.066115][T19544] netlink: 'syz.2.3564': attribute type 10 has an invalid length. [ 593.202864][T19229] 8021q: adding VLAN 0 to HW filter on device bond0 [ 593.247214][T19229] 8021q: adding VLAN 0 to HW filter on device team0 [ 593.271809][ T1351] bridge0: port 1(bridge_slave_0) entered blocking state [ 593.279107][ T1351] bridge0: port 1(bridge_slave_0) entered forwarding state [ 593.314477][ T1351] bridge0: port 2(bridge_slave_1) entered blocking state [ 593.321740][ T1351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 593.438223][ T29] IPVS: starting estimator thread 0... [ 593.443826][T19561] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 593.527680][T19560] bridge0: port 2(bridge_slave_1) entered disabled state [ 593.535527][T19560] bridge0: port 1(bridge_slave_0) entered disabled state [ 593.555100][T19564] IPVS: using max 25 ests per chain, 60000 per kthread [ 593.734139][T19560] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 593.850903][T19581] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3572'. [ 593.929588][T19569] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3570'. [ 593.950577][T19570] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3570'. [ 593.970857][T15215] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.997241][T15215] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.051420][T19570] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3570'. [ 594.066918][T19570] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3570'. [ 594.081375][T15215] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.093064][T15215] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.304821][T19595] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 594.570431][T19620] rdma_op ffff8880791461f0 conn xmit_rdma 0000000000000000 [ 594.602055][T19622] vlan2: entered promiscuous mode [ 594.613699][T19622] bridge0: entered promiscuous mode [ 594.886408][T19637] xt_hashlimit: size too large, truncated to 1048576 [ 595.171551][T19229] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.261796][T19229] veth0_vlan: entered promiscuous mode [ 595.279175][T19229] veth1_vlan: entered promiscuous mode [ 595.349545][T19229] veth0_macvtap: entered promiscuous mode [ 595.363259][T19229] veth1_macvtap: entered promiscuous mode [ 595.409338][T19229] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 595.434490][T19229] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 595.448745][T15215] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.464821][T15215] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.474759][T15215] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.491659][ T5889] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.296936][T19653] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3587'. [ 597.068260][T19588] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 597.211073][T15215] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.238066][T15215] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.339773][T15210] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.367171][T19661] batman_adv: batadv0: Adding interface: wlan0 [ 597.377448][T15210] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.408646][T19661] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 597.454336][T19661] batman_adv: batadv0: Not using interface wlan0 (retrying later): interface not active [ 597.473519][T19667] netlink: 'syz.3.3593': attribute type 1 has an invalid length. [ 597.490598][T19663] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3591'. [ 597.617130][T19667] bond2: entered promiscuous mode [ 597.622838][T19667] 8021q: adding VLAN 0 to HW filter on device bond2 [ 597.674616][T19679] 8021q: adding VLAN 0 to HW filter on device bond2 [ 597.693001][T19679] bond2: (slave vti0): The slave device specified does not support setting the MAC address [ 597.713860][T19679] bond2: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 597.748554][T19679] bond2: (slave vti0): making interface the new active one [ 597.761915][T19679] vti0: entered promiscuous mode [ 597.776338][T19679] vti0: left promiscuous mode [ 597.941907][T19680] syzkaller0: entered promiscuous mode [ 597.973378][T19680] syzkaller0: entered allmulticast mode [ 598.082830][T19714] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3601'. [ 598.115247][T19712] bridge0: port 2(bridge_slave_1) entered disabled state [ 598.122819][T19712] bridge0: port 1(bridge_slave_0) entered disabled state [ 598.140277][T19716] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3601'. [ 598.176994][T19715] bridge0: port 2(bridge_slave_1) entered blocking state [ 598.184395][T19715] bridge0: port 2(bridge_slave_1) entered forwarding state [ 598.192887][T19715] bridge0: port 1(bridge_slave_0) entered blocking state [ 598.200162][T19715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 598.208705][T19715] bridge0: entered allmulticast mode [ 598.475232][T19732] netlink: 'syz.4.3606': attribute type 4 has an invalid length. [ 598.500747][T19728] netlink: 'syz.3.3605': attribute type 3 has an invalid length. [ 598.513117][T19728] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3605'. [ 598.527002][T19728] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3605'. [ 598.548592][T19732] IPVS: Unknown mcast interface: pimreg [ 598.567967][T19728] netlink: 'syz.3.3605': attribute type 10 has an invalid length. [ 598.638893][T19728] 8021q: adding VLAN 0 to HW filter on device team0 [ 598.658128][T19728] bond0: (slave team0): Enslaving as an active interface with an up link [ 598.906053][T19752] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3611'. [ 598.970382][T19752] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3611'. [ 599.142033][T19762] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3613'. [ 599.271025][T19766] bridge1: entered promiscuous mode [ 599.296540][T19766] bridge1: entered allmulticast mode [ 599.319732][T19766] team0: Port device bridge1 added [ 599.346086][T19768] netlink: 'syz.1.3616': attribute type 7 has an invalid length. [ 599.366568][T19766] bridge0: port 3(team0) entered blocking state [ 599.378369][T19766] bridge0: port 3(team0) entered disabled state [ 599.400051][T19766] team0: entered allmulticast mode [ 599.416570][T19766] team_slave_0: entered allmulticast mode [ 599.428457][T19766] team_slave_1: entered allmulticast mode [ 599.447623][T19766] team0: entered promiscuous mode [ 599.453264][T19766] team_slave_0: entered promiscuous mode [ 599.469593][T19766] team_slave_1: entered promiscuous mode [ 599.519390][T19779] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3620'. [ 599.560588][T19779] netlink: 220 bytes leftover after parsing attributes in process `syz.0.3620'. [ 599.677286][T19786] syzkaller0: entered promiscuous mode [ 599.697284][T19786] syzkaller0: entered allmulticast mode [ 599.746559][T19791] macvlan0: entered promiscuous mode [ 600.126389][T19805] netlink: 'syz.4.3627': attribute type 7 has an invalid length. [ 600.155593][T19805] netlink: 'syz.4.3627': attribute type 8 has an invalid length. [ 600.371235][T19823] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 601.318037][T19862] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 601.529462][ T30] audit: type=1804 audit(1783053324.791:18): pid=19873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.3647" name="/newroot/15/cgroup.controllers" dev="tmpfs" ino=96 res=1 errno=0 [ 601.580415][ T30] audit: type=1800 audit(1783053324.791:19): pid=19873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3647" name="cgroup.controllers" dev="tmpfs" ino=96 res=0 errno=0 [ 601.653690][T19880] bridge1: entered promiscuous mode [ 601.683125][T19880] bridge1: entered allmulticast mode [ 601.814815][T19892] netlink: 'syz.1.3653': attribute type 3 has an invalid length. [ 601.897893][T15215] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 601.947640][T19887] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 601.986328][ T30] audit: type=1800 audit(1783053325.251:20): pid=19900 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3655" name="memory.events" dev="tmpfs" ino=762 res=0 errno=0 [ 602.004644][T19887] syzkaller1: entered promiscuous mode [ 602.021700][T19887] syzkaller1: entered allmulticast mode [ 602.129276][T19909] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1500) ! [ 602.211099][T19913] netlink: 'syz.1.3659': attribute type 4 has an invalid length. [ 602.309909][T19913] .`: renamed from bond0 (while UP) [ 602.550501][T19930] __nla_validate_parse: 9 callbacks suppressed [ 602.550524][T19930] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3664'. [ 602.595965][T15210] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.638513][T15210] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.654581][T15210] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.681095][T15210] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 602.704313][T19935] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3665'. [ 602.749399][T19938] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3666'. [ 603.037960][T19956] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3672'. [ 603.199927][T19956] bond1 (unregistering): Released all slaves [ 603.241689][T19970] netlink: 'syz.3.3674': attribute type 1 has an invalid length. [ 603.243443][T19969] netlink: 'syz.3.3674': attribute type 1 has an invalid length. [ 603.379604][ T5639] Bluetooth: hci2: command tx timeout [ 603.466795][T19974] geneve2: entered promiscuous mode [ 603.472381][T19974] geneve2: entered allmulticast mode [ 603.481380][T15214] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 603.507312][T15214] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 603.538533][T15214] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 603.549396][T15214] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 603.564294][T19976] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3677'. [ 603.710838][T19985] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3681'. [ 603.738382][T19984] tunl0: entered promiscuous mode [ 603.746024][T19990] netlink: 45349 bytes leftover after parsing attributes in process `syz.4.3683'. [ 603.748091][T19984] netlink: 'syz.1.3682': attribute type 3 has an invalid length. [ 603.764686][T19984] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3682'. [ 603.804527][T19991] vlan2: entered allmulticast mode [ 603.810799][T19991] bridge2: entered allmulticast mode [ 603.841449][T19985] bridge2: port 1(erspan0) entered blocking state [ 603.860308][T19985] bridge2: port 1(erspan0) entered disabled state [ 603.884818][T19985] erspan0: entered allmulticast mode [ 603.907225][T19985] erspan0: entered promiscuous mode [ 603.914596][T19985] bridge2: port 1(erspan0) entered blocking state [ 603.921395][T19985] bridge2: port 1(erspan0) entered forwarding state [ 603.942849][T19990] 0XD: renamed from gretap0 (while UP) [ 604.009777][T19999] netlink: 'syz.2.3685': attribute type 1 has an invalid length. [ 604.069219][T20004] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3683'. [ 604.071623][T20001] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3687'. [ 604.662947][T19990] 0XD: entered allmulticast mode [ 604.737299][T19995] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 604.813478][T20014] syzkaller0: entered promiscuous mode [ 604.836198][T20014] syzkaller0: entered allmulticast mode [ 605.032276][T20036] netlink: 'syz.1.3696': attribute type 9 has an invalid length. [ 605.668978][T20030] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 607.927242][T20064] netlink: 'syz.3.3700': attribute type 1 has an invalid length. [ 607.988091][T20064] __nla_validate_parse: 4 callbacks suppressed [ 607.988111][T20064] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3700'. [ 608.078038][T20069] xt_nat: multiple ranges no longer supported [ 608.129555][T20071] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3705'. [ 608.180251][T20071] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3705'. [ 608.240586][T20081] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3708'. [ 608.390830][T20084] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3710'. [ 608.507182][T20084] team0: Port device team_slave_0 removed [ 609.410867][T20134] netlink: 'syz.4.3724': attribute type 3 has an invalid length. [ 609.437824][T20134] netlink: 'syz.4.3724': attribute type 1 has an invalid length. [ 609.458523][T20134] netlink: 204 bytes leftover after parsing attributes in process `syz.4.3724'. [ 609.492854][T20140] ieee802154 phy0 wpan0: encryption failed: -22 [ 609.518641][T20138] 8021q: adding VLAN 0 to HW filter on device bond3 [ 609.519117][T20140] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3726'. [ 609.528267][T20138] bond0: (slave bond3): Enslaving as an active interface with an up link [ 609.957134][T20169] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3733'. [ 609.961690][T20151] syzkaller0: entered promiscuous mode [ 609.983720][T20151] syzkaller0: entered allmulticast mode [ 610.143422][T20177] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3734'. [ 610.261250][T20183] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3736'. [ 613.171943][T20224] xt_ecn: cannot match TCP bits for non-tcp packets [ 613.268840][T20224] nbd: couldn't find a device at index 134742304 [ 613.675787][T20254] x_tables: duplicate underflow at hook 2 [ 613.690794][T20248] __nla_validate_parse: 1 callbacks suppressed [ 613.690817][T20248] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3752'. [ 613.723487][T20248] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3752'. [ 613.918339][T20262] netlink: 'syz.4.3758': attribute type 4 has an invalid length. [ 613.973213][T20272] netlink: 'syz.4.3758': attribute type 4 has an invalid length. [ 614.196840][T20285] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3766'. [ 614.297348][T20285] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3766'. [ 614.313306][T20288] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3767'. [ 614.317403][T20289] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3767'. [ 614.323788][T20288] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3767'. [ 614.336936][T20285] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3766'. [ 614.351595][T20289] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3767'. [ 614.586040][T20297] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 614.605499][T20299] IPv6: sit1: Disabled Multicast RS [ 614.627671][T20299] sit1: entered allmulticast mode [ 614.682957][T20305] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 614.903039][T20316] netlink: 'syz.1.3776': attribute type 16 has an invalid length. [ 614.925052][T20316] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3776'. [ 614.934416][T20316] veth0_macvtap: entered allmulticast mode [ 614.950152][T20319] netlink: 'syz.2.3777': attribute type 1 has an invalid length. [ 614.992083][T20319] 8021q: adding VLAN 0 to HW filter on device bond2 [ 615.017226][T20319] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 615.081985][T20319] macvlan2: entered promiscuous mode [ 615.105389][T20319] macvlan2: entered allmulticast mode [ 615.130039][T20319] bond2: entered promiscuous mode [ 615.146743][T20319] veth0_to_bond: entered promiscuous mode [ 615.188883][T20319] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 615.229406][T20319] bond2: left promiscuous mode [ 615.250383][T20319] veth0_to_bond: left promiscuous mode [ 615.298171][T20341] netlink: 'syz.0.3781': attribute type 32 has an invalid length. [ 615.602880][T20355] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 615.614424][T20360] netlink: 'syz.0.3785': attribute type 11 has an invalid length. [ 615.658333][T20360] netlink: 'syz.0.3785': attribute type 4 has an invalid length. [ 615.972664][T20380] netlink: 'syz.4.3792': attribute type 49 has an invalid length. [ 615.976686][T20378] netlink: 'syz.1.3793': attribute type 21 has an invalid length. [ 615.991572][T20379] syzkaller0: entered promiscuous mode [ 615.998501][T20379] syzkaller0: entered allmulticast mode [ 616.040100][T20378] netlink: 'syz.1.3793': attribute type 21 has an invalid length. [ 616.053152][ T1351] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 616.062734][ T1351] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 616.083230][ T1351] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 616.109282][ T1351] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 616.125992][T20379] netlink: 'syz.2.3791': attribute type 10 has an invalid length. [ 616.148777][T20379] geneve1: entered promiscuous mode [ 616.157227][T20379] geneve1: entered allmulticast mode [ 616.164595][T20379] team0: Port device geneve1 added [ 616.171602][T15221] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.202190][T15221] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.223125][T15221] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.277884][T15221] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 616.297371][T20389] gretap0: entered promiscuous mode [ 616.329459][T20389] vlan2: entered promiscuous mode [ 616.440146][T20394] netlink: 'syz.3.3797': attribute type 1 has an invalid length. [ 616.456647][T20394] netlink: 'syz.3.3797': attribute type 1 has an invalid length. [ 616.623914][T20407] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 616.664112][T20410] syzkaller0: entered promiscuous mode [ 616.671180][T20410] syzkaller0: entered allmulticast mode [ 616.720658][T20413] bond0: entered promiscuous mode [ 616.726328][T20413] 8021q: adding VLAN 0 to HW filter on device bond0 [ 617.060825][ T5749] IPVS: starting estimator thread 0... [ 617.068668][T20428] IPVS: ip_vs_add_dest(): server weight less than zero [ 617.165127][T20429] IPVS: using max 26 ests per chain, 62400 per kthread [ 617.288156][T20436] 8021q: adding VLAN 0 to HW filter on device bond1 [ 618.443182][T20500] syzkaller0: entered promiscuous mode [ 618.466204][T20500] syzkaller0: entered allmulticast mode [ 618.878472][T20521] __nla_validate_parse: 12 callbacks suppressed [ 618.878492][T20521] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3829'. [ 618.979202][T20522] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3830'. [ 619.028536][T20522] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3830'. [ 619.063805][T20522] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3830'. [ 619.084091][T20522] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3830'. [ 619.277018][T20530] 8021q: adding VLAN 0 to HW filter on device bond3 [ 619.351141][T20534] bond3: (slave gretap1): making interface the new active one [ 619.363025][T20534] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 619.397114][T20545] 0XD: left allmulticast mode [ 619.584844][T20560] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 619.634244][T20545] vlan2: left allmulticast mode [ 619.642688][T20545] bond0: left allmulticast mode [ 619.651629][T20545] bond_slave_0: left allmulticast mode [ 619.659626][T20545] bond_slave_1: left allmulticast mode [ 619.868230][T20556] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3837'. [ 620.263094][T20566] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 620.651682][T20608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 620.662559][T20605] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3850'. [ 620.690105][T20611] validate_nla: 10 callbacks suppressed [ 620.690127][T20611] netlink: 'syz.2.3853': attribute type 3 has an invalid length. [ 620.693015][T20605] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3850'. [ 620.754812][T20605] netlink: 'syz.3.3850': attribute type 6 has an invalid length. [ 620.808805][T20605] TC_ACT_REPEAT abuse ? [ 620.942735][T20624] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3857'. [ 621.339079][T20628] openvswitch: netlink: IP tunnel dst address not specified [ 621.347738][T20628] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 621.366903][T20636] netlink: 'syz.4.3862': attribute type 1 has an invalid length. [ 621.461352][ T5639] Bluetooth: hci5: command 0x0406 tx timeout [ 621.481691][T20640] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3862'. [ 621.502064][T20636] 8021q: adding VLAN 0 to HW filter on device bond1 [ 621.561393][T20636] bond1: (slave bridge0): making interface the new active one [ 621.570702][T20636] bond1: (slave bridge0): Enslaving as an active interface with an up link [ 621.963033][T20668] netlink: 'syz.0.3872': attribute type 11 has an invalid length. [ 622.095235][T20668] xt_CT: No such helper "snmp_trap" [ 622.193431][T20677] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 622.273871][T20686] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 622.538198][T20699] nbd: must specify at least one socket [ 622.711071][T20709] syzkaller0: entered promiscuous mode [ 622.718091][T20709] syzkaller0: entered allmulticast mode [ 623.353679][T20729] netlink: 'syz.2.3893': attribute type 1 has an invalid length. [ 623.586399][T20729] bond4: entered promiscuous mode [ 623.610435][T20729] bond4: entered allmulticast mode [ 623.634512][T20729] 8021q: adding VLAN 0 to HW filter on device bond4 [ 623.689388][T20733] erspan1: entered allmulticast mode [ 623.703937][T20733] bond4: (slave erspan1): making interface the new active one [ 623.716082][T20733] erspan1: entered promiscuous mode [ 623.727092][T20733] bond4: (slave erspan1): Enslaving as an active interface with an up link [ 624.003690][T20748] __nla_validate_parse: 8 callbacks suppressed [ 624.003711][T20748] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3897'. [ 624.018391][T20750] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3899'. [ 624.072099][T20756] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3899'. [ 624.226764][T20759] netlink: 'syz.2.3901': attribute type 1 has an invalid length. [ 624.248386][T20759] netlink: 208 bytes leftover after parsing attributes in process `syz.2.3901'. [ 624.340699][T20768] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3903'. [ 624.503288][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.511235][ T1315] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 624.565313][T20776] netlink: 'syz.4.3906': attribute type 12 has an invalid length. [ 624.571613][T20775] IPv6: sit1: Disabled Multicast RS [ 624.650100][T20771] bond4: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 624.677498][T20771] bond4 (unregistering): Released all slaves [ 624.932479][T20784] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3911'. [ 625.247758][T20797] macvlan0: entered promiscuous mode [ 625.473548][T20805] netlink: 'syz.4.3918': attribute type 4 has an invalid length. [ 625.607499][T20811] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3920'. [ 625.641769][T20811] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3920'. [ 625.682395][T20813] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3921'. [ 625.685182][T20811] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3920'. [ 625.858643][T20823] IPv6: addrconf: prefix option has invalid lifetime [ 626.154148][T20833] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 626.161467][T20833] IPv6: NLM_F_CREATE should be set when creating new route [ 626.168808][T20833] IPv6: NLM_F_CREATE should be set when creating new route [ 626.479662][T20853] netlink: 'syz.4.3933': attribute type 1 has an invalid length. [ 626.566834][T20853] 8021q: adding VLAN 0 to HW filter on device bond2 [ 626.643336][T20861] vlan3: entered allmulticast mode [ 626.657462][T20861] bond2: entered allmulticast mode [ 626.800088][T20861] bond2: (slave gretap0): making interface the new active one [ 626.812067][T20861] gretap0: entered allmulticast mode [ 626.822812][T20861] bond2: (slave gretap0): Enslaving as an active interface with an up link [ 626.926362][T20889] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 626.948831][T20888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 627.063206][T20898] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 627.082638][T20897] netlink: 'syz.2.3944': attribute type 32 has an invalid length. [ 627.292642][T20897] bond5: option coupled_control: invalid value (192) [ 627.340192][T20897] bond5 (unregistering): Released all slaves [ 627.568484][T20918] netlink: 'syz.0.3949': attribute type 32 has an invalid length. [ 627.718420][T20931] Cannot find add_set index 4 as target [ 627.727114][T20931] netlink: 'syz.2.3950': attribute type 1 has an invalid length. [ 627.851884][T20909] veth5: entered promiscuous mode [ 627.865049][T20909] veth5: entered allmulticast mode [ 628.001839][T20936] netlink: 'syz.0.3952': attribute type 10 has an invalid length. [ 628.041937][T20936] geneve3: entered promiscuous mode [ 628.054213][T20936] geneve3: entered allmulticast mode [ 628.402799][T20952] 8021q: VLANs not supported on ip_vti0 [ 628.700066][T20968] tipc: Enabling of bearer rejected, failed to enable media [ 628.757768][T20973] geneve2: entered promiscuous mode [ 628.768380][ T1351] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 52793 - 0 [ 628.792145][ T1351] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 52793 - 0 [ 628.822634][ T1351] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 52793 - 0 [ 628.853820][ T1351] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 52793 - 0 [ 628.886210][T20980] netlink: 'syz.0.3966': attribute type 1 has an invalid length. [ 629.021027][T20986] __nla_validate_parse: 21 callbacks suppressed [ 629.021049][T20986] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3969'. [ 629.094214][T20985] syzkaller1: entered promiscuous mode [ 629.103907][T20985] syzkaller1: entered allmulticast mode [ 629.253678][T21000] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3973'. [ 629.520210][T21013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3978'. [ 629.629211][T21019] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3981'. [ 629.670537][T21019] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 630.158650][T21053] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 630.199873][T21055] netlink: 'syz.1.3988': attribute type 1 has an invalid length. [ 630.383165][T21055] 8021q: adding VLAN 0 to HW filter on device bond1 [ 630.417350][T21064] bond1: (slave veth3): Enslaving as an active interface with a down link [ 630.432749][T21055] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3988'. [ 630.437604][T21065] netlink: 'syz.4.3991': attribute type 2 has an invalid length. [ 630.469353][T21067] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 630.476614][T21067] bond1: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 655.693283][T21089] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3997'. [ 655.732090][T21087] bond5 (unregistering): Released all slaves [ 655.957757][T21105] netlink: 'syz.1.3994': attribute type 11 has an invalid length. [ 655.982414][T21105] netlink: 'syz.1.3994': attribute type 1 has an invalid length. [ 655.994908][T21105] netlink: 'syz.1.3994': attribute type 2 has an invalid length. [ 656.024394][T21105] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3994'. [ 656.226285][T21118] x_tables: ip_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 656.491967][T21134] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4006'. [ 656.896543][T21150] xt_CT: You must specify a L4 protocol and not use inversions on it [ 656.964157][T21158] netlink: 'syz.1.4012': attribute type 11 has an invalid length. [ 657.055813][T21164] netlink: 'syz.4.4013': attribute type 83 has an invalid length. [ 657.284421][T21174] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4015'. [ 657.295881][ T5639] Bluetooth: hci4: command 0x0406 tx timeout [ 657.967369][T21210] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4022'. [ 658.000550][T21210] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4022'. [ 658.033455][T21210] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4022'. [ 658.134122][T21218] netlink: 45 bytes leftover after parsing attributes in process `syz.0.4024'. [ 658.329924][T21229] Bluetooth: MGMT ver 1.23 [ 658.721615][T21257] netlink: 'syz.3.4031': attribute type 8 has an invalid length. [ 658.746038][T21257] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4031'. [ 658.785941][T14889] hid-generic 0005:0C45:100E.0001: unknown main item tag 0x0 [ 658.819410][T21257] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.827356][T21257] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.912109][T14889] hid-generic 0005:0C45:100E.0001: hidraw0: BLUETOOTH HID vc3.36 Device [syz0] on aa:aa:aa:aa:aa:aa [ 658.960915][T21264] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4033'. [ 658.980040][ T5287] veth0_vlan: left promiscuous mode [ 659.081766][ T5749] veth0_vlan: entered promiscuous mode [ 659.166212][T21268] Cannot find add_set index 0 as target [ 659.378648][T21281] netlink: 'syz.1.4038': attribute type 5 has an invalid length. [ 659.455947][T21281] ip6gre2: entered promiscuous mode [ 659.480155][T21281] ip6gre2: entered allmulticast mode [ 659.504719][T21289] netlink: 'syz.2.4041': attribute type 12 has an invalid length. [ 660.761305][T21335] __nla_validate_parse: 5 callbacks suppressed [ 660.761326][T21335] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4048'. [ 660.926567][T21321] syzkaller1: entered promiscuous mode [ 660.937000][T21321] syzkaller1: entered allmulticast mode [ 661.192341][T21353] netlink: 'syz.0.4054': attribute type 1 has an invalid length. [ 661.233570][T21353] netlink: 244 bytes leftover after parsing attributes in process `syz.0.4054'. [ 661.265104][T21356] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4056'. [ 661.276964][T21350] syzkaller0: entered promiscuous mode [ 661.287703][T21350] syzkaller0: entered allmulticast mode [ 661.293486][T21356] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4056'. [ 661.627192][T21376] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4059'. [ 661.718237][T21384] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4063'. [ 661.745258][T21384] netlink: 'syz.0.4063': attribute type 7 has an invalid length. [ 661.764071][T21384] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4063'. [ 661.798681][T21385] netlink: 'syz.0.4063': attribute type 21 has an invalid length. [ 661.834192][T21391] netlink: 'syz.0.4063': attribute type 21 has an invalid length. [ 661.851895][T21385] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4063'. [ 661.882508][T21391] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4063'. [ 661.891088][T21394] netlink: 'syz.3.4066': attribute type 1 has an invalid length. [ 661.967418][T21394] bond4: entered promiscuous mode [ 661.973256][T21394] 8021q: adding VLAN 0 to HW filter on device bond4 [ 661.979219][T21399] netlink: 108 bytes leftover after parsing attributes in process `syz.3.4066'. [ 662.129477][T21394] bond4: (slave bridge3): making interface the new active one [ 662.148414][T21394] bridge3: entered promiscuous mode [ 662.171752][T21394] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 662.306147][T21417] FAULT_INJECTION: forcing a failure. [ 662.306147][T21417] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 662.364150][T21417] CPU: 1 UID: 0 PID: 21417 Comm: syz.2.4073 Not tainted syzkaller #0 PREEMPT(full) [ 662.364177][T21417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 662.364189][T21417] Call Trace: [ 662.364197][T21417] [ 662.364207][T21417] dump_stack_lvl+0xe8/0x150 [ 662.364249][T21417] should_fail_ex+0x40c/0x560 [ 662.364422][T21417] _copy_from_user+0x2d/0xb0 [ 662.364468][T21417] ___sys_sendmsg+0x1c6/0x360 [ 662.364601][T21417] ? __lock_acquire+0x683/0x2cf0 [ 662.364634][T21417] ? __pfx____sys_sendmsg+0x10/0x10 [ 662.364694][T21417] ? __fget_files+0x2a/0x420 [ 662.364736][T21417] ? __fget_files+0x3a2/0x420 [ 662.364772][T21417] __x64_sys_sendmsg+0x1b1/0x290 [ 662.364801][T21417] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 662.364848][T21417] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.364872][T21417] do_syscall_64+0x174/0x580 [ 662.364926][T21417] ? trace_irq_disable+0x3b/0x140 [ 662.364969][T21417] ? clear_bhb_loop+0x40/0x90 [ 662.364994][T21417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.365014][T21417] RIP: 0033:0x7f5f2b39de59 [ 662.365035][T21417] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 662.365052][T21417] RSP: 002b:00007f5f2c321028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 662.365075][T21417] RAX: ffffffffffffffda RBX: 00007f5f2b625fa0 RCX: 00007f5f2b39de59 [ 662.365090][T21417] RDX: 0000000000000080 RSI: 0000200000000680 RDI: 0000000000000003 [ 662.365103][T21417] RBP: 00007f5f2c321090 R08: 0000000000000000 R09: 0000000000000000 [ 662.365115][T21417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 662.365127][T21417] R13: 00007f5f2b626038 R14: 00007f5f2b625fa0 R15: 00007ffe1857b6c8 [ 662.365161][T21417] [ 662.791691][T21425] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 663.601897][T21465] macsec1: entered allmulticast mode [ 663.607466][T21465] bond0: entered allmulticast mode [ 663.612671][T21465] bond_slave_0: entered allmulticast mode [ 663.623090][T21465] bond_slave_1: entered allmulticast mode [ 663.632395][T21465] bond_slave_0: entered promiscuous mode [ 663.640083][T21465] bond_slave_1: entered promiscuous mode [ 663.649738][T21465] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 663.658562][T21465] bond0: left allmulticast mode [ 663.663591][T21465] bond_slave_0: left allmulticast mode [ 663.669346][T21465] bond_slave_1: left allmulticast mode [ 663.700858][T21459] lo: entered promiscuous mode [ 663.712982][T21459] netlink: 'syz.3.4084': attribute type 2 has an invalid length. [ 663.721612][T21459] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 663.769210][ T5742] bond_slave_0: left promiscuous mode [ 663.776724][ T5742] bond_slave_1: left promiscuous mode [ 663.794471][T21478] syzkaller1: entered promiscuous mode [ 663.816324][T21478] syzkaller1: entered allmulticast mode [ 663.869347][T21483] lo: left promiscuous mode [ 664.003475][T21489] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 664.020701][T21489] batman_adv: batadv0: Adding interface: gretap1 [ 664.028946][T21489] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 664.058157][T21489] batman_adv: batadv0: Interface activated: gretap1 [ 664.682268][T21512] bond0: (slave team0): Releasing backup interface [ 664.743782][T21512] team0 (unregistering): Port device team_slave_0 removed [ 664.771361][T21524] netlink: 'syz.4.4100': attribute type 11 has an invalid length. [ 664.798796][T21512] team0 (unregistering): Port device team_slave_1 removed [ 665.050101][T21534] ipt_REJECT: TCP_RESET invalid for non-tcp [ 665.440581][T21552] netlink: 'syz.3.4110': attribute type 1 has an invalid length. [ 665.440581][T21549] netlink: 'syz.3.4110': attribute type 1 has an invalid length. [ 665.801390][T21579] __nla_validate_parse: 9 callbacks suppressed [ 665.801411][T21579] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4118'. [ 665.831948][T21580] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4117'. [ 665.836264][T21584] IPVS: set_ctl: invalid protocol: 43 172.20.20.14:20000 [ 666.034427][T21597] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4121'. [ 666.091202][T21596] netlink: 'syz.2.4122': attribute type 1 has an invalid length. [ 666.115422][T21596] netlink: 220 bytes leftover after parsing attributes in process `syz.2.4122'. [ 666.148300][T21596] sock: sock_timestamping_bind_phc: sock not bind to device [ 666.159598][T21596] syzkaller1: entered promiscuous mode [ 666.169111][T21596] syzkaller1: entered allmulticast mode [ 666.520762][T21619] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4127'. [ 666.527611][T21614] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4130'. [ 666.848230][T21636] netlink: 'syz.1.4133': attribute type 4 has an invalid length. [ 666.892797][T21636] netlink: 'syz.1.4133': attribute type 4 has an invalid length. [ 666.969496][T21641] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4135'. [ 667.071651][T21645] tipc: Started in network mode [ 667.080293][T21645] tipc: Node identity ac14142f, cluster identity 4711 [ 667.085893][T21648] netlink: 'syz.1.4137': attribute type 1 has an invalid length. [ 667.088212][T21645] tipc: New replicast peer: 0.0.0.0 [ 667.102201][T21645] tipc: Enabled bearer , priority 10 [ 667.148415][T21648] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4137'. [ 667.293378][T21648] bond2: (slave gretap1): making interface the new active one [ 667.306458][T21657] netlink: 'syz.4.4140': attribute type 9 has an invalid length. [ 667.332938][T21648] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 667.383746][T21660] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4139'. [ 667.500008][T21660] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4139'. [ 668.286535][T21693] bridge2: port 1(erspan0) entered disabled state [ 668.369483][T21693] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.377336][T21693] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.560944][T21693] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 668.592106][T14903] tipc: Node number set to 2886997039 [ 668.782000][T21720] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 668.927764][T21726] 8021q: adding VLAN 0 to HW filter on device bond3 [ 668.984430][T21726] macvlan2: entered promiscuous mode [ 668.991190][T21726] macvlan2: entered allmulticast mode [ 669.002331][T21726] bond3: entered promiscuous mode [ 669.008601][T21726] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 669.047834][T21726] bond3: left promiscuous mode [ 669.490264][T21747] netlink: 'syz.3.4167': attribute type 13 has an invalid length. [ 670.443833][T21800] netlink: 'syz.2.4179': attribute type 1 has an invalid length. [ 670.516825][T21785] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 670.774372][T21785] bond3 (unregistering): Released all slaves [ 670.986668][T21820] netlink: 'syz.0.4180': attribute type 1 has an invalid length. [ 670.994803][T21820] netlink: 'syz.0.4180': attribute type 4 has an invalid length. [ 671.003247][T21820] __nla_validate_parse: 9 callbacks suppressed [ 671.003265][T21820] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.4180'. [ 671.024415][T21803] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4176'. [ 671.038010][T21803] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4176'. [ 671.055208][T21803] netlink: 'syz.3.4176': attribute type 3 has an invalid length. [ 671.382258][T21832] netlink: 'syz.2.4185': attribute type 11 has an invalid length. [ 671.387557][T21830] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4184'. [ 671.560823][T21838] netlink: 'syz.3.4187': attribute type 2 has an invalid length. [ 671.704041][ T1351] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0xa3 [ 671.901391][T21858] IPVS: length: 8 != 1152 [ 672.630386][T21900] syzkaller1: entered promiscuous mode [ 672.636520][T21900] syzkaller1: entered allmulticast mode [ 673.018143][T21922] Cannot find add_set index 4 as target [ 674.533641][T21838] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 674.854363][T21955] dvmrp0: entered allmulticast mode [ 675.273911][T21987] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4219'. [ 675.673973][T22009] bond5: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 675.688698][T22009] bond5 (unregistering): Released all slaves [ 675.930869][T22026] 8021q: VLANs not supported on ip_vti0 [ 676.001219][T22028] 8021q: adding VLAN 0 to HW filter on device bond0 [ 676.108352][T14886] IPVS: starting estimator thread 0... [ 676.217282][T22039] IPVS: using max 26 ests per chain, 62400 per kthread [ 676.226499][T22043] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 676.329470][ T30] audit: type=1804 audit(1783053399.591:21): pid=22050 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4235" name="/newroot/269/cgroup.controllers" dev="tmpfs" ino=1396 res=1 errno=0 [ 676.357504][ T30] audit: type=1800 audit(1783053399.591:22): pid=22050 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4235" name="cgroup.controllers" dev="tmpfs" ino=1396 res=0 errno=0 [ 676.448805][T22055] syzkaller0: entered promiscuous mode [ 676.464639][T22055] syzkaller0: entered allmulticast mode [ 676.514254][T22055] xt_TCPMSS: Only works on TCP SYN packets [ 676.614358][T22059] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 676.700964][T22068] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4241'. [ 677.070248][T22082] lo: Caught tx_queue_len zero misconfig [ 677.220883][T22104] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 677.435861][T22117] ip_vti0: entered allmulticast mode [ 677.630858][T22128] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4258'. [ 677.778790][T22131] syzkaller0: entered promiscuous mode [ 677.784312][T22131] syzkaller0: entered allmulticast mode [ 677.790442][ T5639] Bluetooth: hci1: command 0x0406 tx timeout [ 678.100328][T22143] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 678.725740][T22163] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4265'. [ 678.956254][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b43f000: rx timeout, send abort [ 679.458787][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807f84c800: rx timeout, send abort [ 679.467243][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b43f000: abort rx timeout. Force session deactivation [ 679.501345][ C1] vcan0: j1939_xtp_rx_rts_session_active: 0xffff88807f84c800: connection exists (fe ff). last cmd: 20 [ 679.754543][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b185400: rx timeout, send abort [ 680.262900][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b185400: abort rx timeout. Force session deactivation [ 681.610875][T22192] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4273'. [ 681.652072][T22194] netlink: 165 bytes leftover after parsing attributes in process `syz.0.4272'. [ 681.683706][T22192] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4273'. [ 682.115711][T22208] syzkaller0: entered promiscuous mode [ 682.129236][T22208] syzkaller0: entered allmulticast mode [ 682.503834][T22225] netlink: 176 bytes leftover after parsing attributes in process `syz.0.4282'. [ 682.601130][T22223] SET target dimension over the limit! [ 682.619124][T22225] netlink: 'syz.0.4282': attribute type 1 has an invalid length. [ 682.738161][T22235] pim6reg: entered allmulticast mode [ 682.762872][T22238] pim6reg: left allmulticast mode [ 682.899691][ T5639] Bluetooth: hci3: command 0x0406 tx timeout [ 683.587416][T22284] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4294'. [ 683.999979][T22298] syzkaller0: entered promiscuous mode [ 684.021602][T22298] syzkaller0: entered allmulticast mode [ 684.053995][T22314] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4300'. [ 684.075239][T22298] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 684.160628][T22314] netlink: 176 bytes leftover after parsing attributes in process `syz.4.4300'. [ 684.209513][T22314] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4300'. [ 684.242754][T22313] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4300'. [ 684.267952][T22313] netlink: 176 bytes leftover after parsing attributes in process `syz.4.4300'. [ 684.312166][T22313] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4300'. [ 684.829232][T22344] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 684.838745][T22344] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 684.852244][T22346] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4307'. [ 684.874728][T22346] hsr_slave_0: left promiscuous mode [ 684.937004][T22348] xt_hashlimit: size too large, truncated to 1048576 [ 684.961367][T22346] hsr_slave_1: left promiscuous mode [ 685.057959][T22352] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4308'. [ 685.100486][T22352] 1XD: renamed from 00XD (while UP) [ 685.160583][T22352] 1XD: entered allmulticast mode [ 685.275923][T22358] x_tables: duplicate underflow at hook 2 [ 685.422209][T22363] xt_hashlimit: size too large, truncated to 1048576 [ 685.942100][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.949859][ T1315] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 686.142336][T22404] openvswitch: netlink: IP tunnel dst address not specified [ 686.209589][T22404] openvswitch: netlink: IP tunnel dst address not specified [ 686.384574][T22417] syzkaller0: entered promiscuous mode [ 686.408270][T22417] syzkaller0: entered allmulticast mode [ 686.679921][T22432] atomic_op ffff88807cfc1998 conn xmit_atomic 0000000000000000 [ 686.926171][T22448] netlink: 'syz.0.4335': attribute type 6 has an invalid length. [ 687.107349][T22453] bond3: entered promiscuous mode [ 687.113227][T22453] 8021q: adding VLAN 0 to HW filter on device bond3 [ 687.284531][T22468] Cannot find set identified by id 65535 to match [ 687.829806][T22491] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 687.886857][T22491] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 687.887786][T22495] __nla_validate_parse: 5 callbacks suppressed [ 687.887801][T22495] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4353'. [ 687.952496][T22497] netlink: 14544 bytes leftover after parsing attributes in process `syz.4.4352'. [ 688.597039][T22526] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4360'. [ 688.799867][T22533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4362'. [ 688.822003][T22533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4362'. [ 688.833898][T22533] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4362'. [ 688.902552][T22539] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4367'. [ 689.080332][T22546] tipc: Enabled bearer , priority 10 [ 689.118506][T22556] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4370'. [ 689.154359][T22556] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4370'. [ 689.233246][T22560] sctp: [Deprecated]: syz.0.4373 (pid 22560) Use of int in maxseg socket option. [ 689.233246][T22560] Use struct sctp_assoc_value instead [ 689.282364][T22562] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4374'. [ 689.309462][T22565] sch_tbf: burst 0 is lower than device lo mtu (16527) ! [ 689.656460][T22584] netlink: 'syz.1.4383': attribute type 1 has an invalid length. [ 689.671668][T22560] sctp: [Deprecated]: syz.0.4373 (pid 22560) Use of int in maxseg socket option. [ 689.671668][T22560] Use struct sctp_assoc_value instead [ 689.688778][T22588] netlink: 'syz.2.4382': attribute type 6 has an invalid length. [ 689.899927][T22595] IPVS: set_ctl: invalid protocol: 0 172.20.20.29:20003 [ 689.932465][T22596] bridge4: port 1(erspan0) entered blocking state [ 689.955634][T22596] bridge4: port 1(erspan0) entered disabled state [ 689.977664][T22596] erspan0: entered allmulticast mode [ 690.004300][T22596] erspan0: entered promiscuous mode [ 690.195328][T14889] tipc: Node number set to 2886997039 [ 690.243071][T22612] netlink: 'syz.1.4392': attribute type 3 has an invalid length. [ 690.764340][T22647] netlink: 'syz.3.4399': attribute type 5 has an invalid length. [ 690.817858][T22649] netlink: 'syz.2.4400': attribute type 1 has an invalid length. [ 691.030410][T22649] 8021q: adding VLAN 0 to HW filter on device bond5 [ 691.151120][T22655] bond5: (slave ip6gretap1): making interface the new active one [ 691.179157][T22655] bond5: (slave ip6gretap1): Enslaving as an active interface with an up link [ 691.771769][T22697] netlink: 'syz.0.4410': attribute type 1 has an invalid length. [ 691.931235][T22708] netlink: 'syz.1.4413': attribute type 4 has an invalid length. [ 692.213840][T22716] netlink: 'syz.3.4416': attribute type 8 has an invalid length. [ 692.238837][T22715] netlink: 'syz.3.4416': attribute type 8 has an invalid length. [ 692.398375][T22733] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 692.581657][T22742] netlink: 'syz.0.4424': attribute type 10 has an invalid length. [ 692.603652][T22742] veth1_macvtap: left promiscuous mode [ 692.646818][T22742] bond0: (slave macsec0): Error -34 calling dev_set_mtu [ 692.698153][T22745] netlink: 'syz.0.4424': attribute type 11 has an invalid length. [ 692.768980][T22749] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 693.047702][ T5637] Bluetooth: hci2: link tx timeout [ 693.060184][ T5637] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 693.245370][T22780] __nla_validate_parse: 14 callbacks suppressed [ 693.245391][T22780] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4438'. [ 693.268526][T22778] syzkaller0: entered promiscuous mode [ 693.277842][T22778] syzkaller0: entered allmulticast mode [ 693.410885][T22787] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4439'. [ 693.441252][T22787] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4439'. [ 693.781739][T22807] xt_ecn: cannot match TCP bits for non-tcp packets [ 693.858617][T22812] syzkaller0: entered promiscuous mode [ 693.884316][T22812] syzkaller0: entered allmulticast mode [ 693.905867][T22812] FAULT_INJECTION: forcing a failure. [ 693.905867][T22812] name failslab, interval 1, probability 0, space 0, times 1 [ 693.930077][T22812] CPU: 1 UID: 0 PID: 22812 Comm: syz.3.4444 Not tainted syzkaller #0 PREEMPT(full) [ 693.930107][T22812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 693.930118][T22812] Call Trace: [ 693.930127][T22812] [ 693.930137][T22812] dump_stack_lvl+0xe8/0x150 [ 693.930176][T22812] should_fail_ex+0x40c/0x560 [ 693.930214][T22812] should_failslab+0xa8/0x100 [ 693.930246][T22812] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 693.930269][T22812] ? local_lock_release+0x9c/0x160 [ 693.930394][T22812] ? __alloc_skb+0x1d7/0x7a0 [ 693.930415][T22812] ? __alloc_skb+0x1d7/0x7a0 [ 693.930445][T22812] __alloc_skb+0x1d7/0x7a0 [ 693.930473][T22812] alloc_skb_with_frags+0xc6/0x760 [ 693.930520][T22812] ? __lock_acquire+0x683/0x2cf0 [ 693.930560][T22812] sock_alloc_send_pskb+0x878/0x990 [ 693.930596][T22812] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 693.930682][T22812] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 693.930717][T22812] ? dev_get_by_index+0x22/0x2d0 [ 693.930768][T22812] ? dev_get_by_index+0x22/0x2d0 [ 693.930803][T22812] packet_sendmsg+0x3258/0x5040 [ 693.930882][T22812] ? aa_label_sk_perm+0x532/0x6e0 [ 693.930974][T22812] ? __lock_acquire+0x683/0x2cf0 [ 693.931022][T22812] ? unwind_next_frame+0x8f/0x2550 [ 693.931063][T22812] ? __pfx_packet_sendmsg+0x10/0x10 [ 693.931105][T22812] ? __pfx_aa_sk_perm+0x10/0x10 [ 693.931134][T22812] ? aa_sock_msg_perm+0xf1/0x1b0 [ 693.931188][T22812] ? __pfx_packet_sendmsg+0x10/0x10 [ 693.931214][T22812] sock_sendmsg_nosec+0x13a/0x180 [ 693.931274][T22812] ____sys_sendmsg+0x54e/0x850 [ 693.931305][T22812] ? __pfx_____sys_sendmsg+0x10/0x10 [ 693.931346][T22812] ? import_iovec+0x73/0xa0 [ 693.931401][T22812] ___sys_sendmsg+0x2a5/0x360 [ 693.931425][T22812] ? __lock_acquire+0x683/0x2cf0 [ 693.931457][T22812] ? __pfx____sys_sendmsg+0x10/0x10 [ 693.931521][T22812] ? __fget_files+0x2a/0x420 [ 693.931545][T22812] ? __fget_files+0x3a2/0x420 [ 693.931578][T22812] __x64_sys_sendmsg+0x1b1/0x290 [ 693.931601][T22812] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 693.931643][T22812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.931662][T22812] do_syscall_64+0x174/0x580 [ 693.931681][T22812] ? trace_irq_disable+0x3b/0x140 [ 693.931704][T22812] ? clear_bhb_loop+0x40/0x90 [ 693.931727][T22812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.931745][T22812] RIP: 0033:0x7f5fd019de59 [ 693.931764][T22812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 693.931779][T22812] RSP: 002b:00007f5fd10f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 693.931801][T22812] RAX: ffffffffffffffda RBX: 00007f5fd0425fa0 RCX: 00007f5fd019de59 [ 693.931815][T22812] RDX: 0000000000000004 RSI: 00002000000000c0 RDI: 0000000000000005 [ 693.931827][T22812] RBP: 00007f5fd10f7090 R08: 0000000000000000 R09: 0000000000000000 [ 693.931838][T22812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 693.931849][T22812] R13: 00007f5fd0426038 R14: 00007f5fd0425fa0 R15: 00007fffd77e1f08 [ 693.931879][T22812] [ 694.337596][T22815] veth0: entered promiscuous mode [ 694.439532][T22814] veth0: left promiscuous mode [ 694.578517][T22833] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 694.834537][T22849] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 694.984401][T22853] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4457'. [ 695.012183][T22853] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4457'. [ 695.048017][T22853] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4457'. [ 695.064222][T22857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4457'. [ 695.072821][T22854] sctp: [Deprecated]: syz.2.4456 (pid 22854) Use of int in max_burst socket option deprecated. [ 695.072821][T22854] Use struct sctp_assoc_value instead [ 695.135463][ T5639] Bluetooth: hci2: command 0x0406 tx timeout [ 695.252189][T22860] syzkaller0: entered promiscuous mode [ 695.267947][T22860] syzkaller0: entered allmulticast mode [ 695.437981][T22869] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4462'. [ 695.601088][T22875] bond4: option lp_interval: invalid value (0) [ 695.632813][T22875] bond4: option lp_interval: allowed values 1 - 2147483647 [ 695.729700][T22875] bond4 (unregistering): Released all slaves [ 695.829417][T22893] validate_nla: 4 callbacks suppressed [ 695.829438][T22893] netlink: 'syz.1.4465': attribute type 8 has an invalid length. [ 696.212661][T22887] syzkaller0: entered promiscuous mode [ 696.224207][T22887] syzkaller0: entered allmulticast mode [ 696.548774][T22929] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4473'. [ 699.602966][T22926] veth0_to_team: mtu less than device minimum [ 699.797225][T22951] syzkaller0: entered promiscuous mode [ 699.817670][T22951] syzkaller0: entered allmulticast mode [ 699.841181][T22951] FAULT_INJECTION: forcing a failure. [ 699.841181][T22951] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 699.864765][T22955] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4477'. [ 699.867985][T22958] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4479'. [ 699.875387][T22951] CPU: 0 UID: 0 PID: 22951 Comm: syz.2.4476 Not tainted syzkaller #0 PREEMPT(full) [ 699.875412][T22951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 699.875423][T22951] Call Trace: [ 699.875430][T22951] [ 699.875438][T22951] dump_stack_lvl+0xe8/0x150 [ 699.875472][T22951] should_fail_ex+0x40c/0x560 [ 699.875504][T22951] _copy_from_iter+0x1d3/0x1660 [ 699.875522][T22951] ? skb_set_owner_w+0x263/0x3d0 [ 699.875558][T22951] ? __pfx__copy_from_iter+0x10/0x10 [ 699.875587][T22951] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 699.875614][T22951] skb_copy_datagram_from_iter+0xe6/0x720 [ 699.875640][T22951] ? dev_get_by_index+0x22/0x2d0 [ 699.875666][T22951] ? skb_put+0x112/0x210 [ 699.875688][T22951] packet_sendmsg+0x36ab/0x5040 [ 699.875753][T22951] ? __lock_acquire+0x683/0x2cf0 [ 699.875792][T22951] ? unwind_next_frame+0x8f/0x2550 [ 699.875826][T22951] ? __pfx_packet_sendmsg+0x10/0x10 [ 699.875862][T22951] ? __pfx_aa_sk_perm+0x10/0x10 [ 699.875889][T22951] ? aa_sock_msg_perm+0xf1/0x1b0 [ 699.875917][T22951] ? __pfx_packet_sendmsg+0x10/0x10 [ 699.875939][T22951] sock_sendmsg_nosec+0x13a/0x180 [ 699.875969][T22951] ____sys_sendmsg+0x54e/0x850 [ 699.875997][T22951] ? __pfx_____sys_sendmsg+0x10/0x10 [ 699.876028][T22951] ? import_iovec+0x73/0xa0 [ 699.876053][T22951] ___sys_sendmsg+0x2a5/0x360 [ 699.876073][T22951] ? __lock_acquire+0x683/0x2cf0 [ 699.876101][T22951] ? __pfx____sys_sendmsg+0x10/0x10 [ 699.876158][T22951] ? __fget_files+0x2a/0x420 [ 699.876180][T22951] ? __fget_files+0x3a2/0x420 [ 699.876212][T22951] __x64_sys_sendmsg+0x1b1/0x290 [ 699.876238][T22951] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 699.876278][T22951] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.876298][T22951] do_syscall_64+0x174/0x580 [ 699.876321][T22951] ? trace_irq_disable+0x3b/0x140 [ 699.876344][T22951] ? clear_bhb_loop+0x40/0x90 [ 699.876366][T22951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.876383][T22951] RIP: 0033:0x7f5f2b39de59 [ 699.876402][T22951] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 699.876417][T22951] RSP: 002b:00007f5f2c321028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 699.876438][T22951] RAX: ffffffffffffffda RBX: 00007f5f2b625fa0 RCX: 00007f5f2b39de59 [ 699.876451][T22951] RDX: 0000000000000004 RSI: 00002000000000c0 RDI: 0000000000000005 [ 699.876462][T22951] RBP: 00007f5f2c321090 R08: 0000000000000000 R09: 0000000000000000 [ 699.876473][T22951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 699.876483][T22951] R13: 00007f5f2b626038 R14: 00007f5f2b625fa0 R15: 00007ffe1857b6c8 [ 699.876513][T22951] [ 700.243417][T22970] netlink: 'syz.1.4481': attribute type 16 has an invalid length. [ 700.252559][T22970] netlink: 'syz.1.4481': attribute type 17 has an invalid length. [ 700.322663][T22970] tunl0: left promiscuous mode [ 700.398319][T22970] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.405595][T22970] bridge0: port 2(bridge_slave_1) entered listening state [ 700.413071][T22970] bridge0: port 1(bridge_slave_0) entered blocking state [ 700.420320][T22970] bridge0: port 1(bridge_slave_0) entered listening state [ 700.464672][T22970] 8021q: adding VLAN 0 to HW filter on device .` [ 700.513907][T22980] xt_TPROXY: Can be used only with -p tcp or -p udp [ 700.590986][T22970] veth0_macvtap: left allmulticast mode [ 700.621798][T22970] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 700.622102][T22990] netlink: 'syz.4.4486': attribute type 39 has an invalid length. [ 700.651002][T22970] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 700.690476][T22970] batman_adv: batadv0: Interface activated: wlan0 [ 700.724430][T22970] bond0: left promiscuous mode [ 700.756627][T22970] ip6gre2: left promiscuous mode [ 700.769268][T22970] ip6gre2: left allmulticast mode [ 700.779195][T22970] 8021q: adding VLAN 0 to HW filter on device bond2 [ 700.792129][T22970] bond3: left promiscuous mode [ 700.909344][ T5889] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 700.976092][ T5889] bond1: (slave veth3): making interface the new active one [ 701.046056][ T5889] bond1: active interface up! [ 701.072477][T23005] netlink: 'syz.0.4491': attribute type 4 has an invalid length. [ 701.145987][T23016] syzkaller0: entered promiscuous mode [ 701.185022][T23016] syzkaller0: entered allmulticast mode [ 701.231390][T23016] FAULT_INJECTION: forcing a failure. [ 701.231390][T23016] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 701.269554][T23016] CPU: 0 UID: 0 PID: 23016 Comm: syz.1.4494 Not tainted syzkaller #0 PREEMPT(full) [ 701.269582][T23016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 701.269594][T23016] Call Trace: [ 701.269602][T23016] [ 701.269612][T23016] dump_stack_lvl+0xe8/0x150 [ 701.269648][T23016] should_fail_ex+0x40c/0x560 [ 701.269685][T23016] _copy_to_user+0x31/0xb0 [ 701.269713][T23016] simple_read_from_buffer+0xe1/0x170 [ 701.269795][T23016] proc_fail_nth_read+0x1bb/0x230 [ 701.269847][T23016] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 701.269879][T23016] ? rw_verify_area+0x24a/0x4c0 [ 701.269911][T23016] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 701.269941][T23016] vfs_read+0x213/0xa80 [ 701.269977][T23016] ? __pfx___mutex_lock+0x10/0x10 [ 701.270047][T23016] ? __pfx_vfs_read+0x10/0x10 [ 701.270079][T23016] ? __fget_files+0x2a/0x420 [ 701.270110][T23016] ? __fget_files+0x3a2/0x420 [ 701.270133][T23016] ? __fget_files+0x2a/0x420 [ 701.270169][T23016] ksys_read+0x150/0x270 [ 701.270200][T23016] ? __pfx_ksys_read+0x10/0x10 [ 701.270240][T23016] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.270263][T23016] do_syscall_64+0x174/0x580 [ 701.270283][T23016] ? trace_irq_disable+0x3b/0x140 [ 701.270308][T23016] ? clear_bhb_loop+0x40/0x90 [ 701.270334][T23016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.270355][T23016] RIP: 0033:0x7fa05ab5e68e [ 701.270375][T23016] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 701.270392][T23016] RSP: 002b:00007fa05ba01fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 701.270415][T23016] RAX: ffffffffffffffda RBX: 00007fa05ba026c0 RCX: 00007fa05ab5e68e [ 701.270430][T23016] RDX: 000000000000000f RSI: 00007fa05ba020a0 RDI: 0000000000000009 [ 701.270442][T23016] RBP: 00007fa05ba02090 R08: 0000000000000000 R09: 0000000000000000 [ 701.270455][T23016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 701.270467][T23016] R13: 00007fa05ae26038 R14: 00007fa05ae25fa0 R15: 00007ffeae03a968 [ 701.270503][T23016] [ 701.579558][T23025] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4495'. [ 701.698374][T23019] veth1_to_bond: entered allmulticast mode [ 701.727442][T23025] veth1_to_bond (unregistering): left allmulticast mode [ 701.797267][T23025] bond0: (slave bond_slave_1): Releasing backup interface [ 702.169806][T23046] 8021q: VLANs not supported on sit0 [ 702.302546][T23053] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4505'. [ 702.353470][T23054] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4505'. [ 702.454224][T23061] netlink: 'syz.0.4508': attribute type 1 has an invalid length. [ 702.460668][T23053] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 702.634649][T23061] 8021q: adding VLAN 0 to HW filter on device bond4 [ 702.708270][T23079] netlink: 'syz.3.4512': attribute type 4 has an invalid length. [ 702.716422][T23061] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4508'. [ 702.754745][T23069] bond4: (slave veth3): Enslaving as an active interface with a down link [ 702.772553][T23082] netlink: 'syz.3.4512': attribute type 4 has an invalid length. [ 702.993781][T23094] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 702.995622][T23096] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4517'. [ 703.258375][T23107] syzkaller0: entered promiscuous mode [ 703.271591][T23107] syzkaller0: entered allmulticast mode [ 703.519781][T23120] netlink: 'syz.3.4526': attribute type 10 has an invalid length. [ 703.631993][T23128] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4529'. [ 703.726882][T23128] team_slave_0 (unregistering): left promiscuous mode [ 703.744323][T23128] team_slave_0 (unregistering): left allmulticast mode [ 703.757836][T23128] team0: Port device team_slave_0 removed [ 703.919779][T23139] netlink: 'syz.2.4534': attribute type 1 has an invalid length. [ 704.047522][T23149] netlink: 'syz.2.4534': attribute type 1 has an invalid length. [ 704.091830][T23139] 8021q: adding VLAN 0 to HW filter on device bond6 [ 704.115959][T23139] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4534'. [ 704.153673][T23141] bond2: (slave veth0_to_bond): Releasing backup interface [ 704.191353][T23141] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 704.536498][T23176] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4543'. [ 704.590702][T23181] netlink: 'syz.3.4544': attribute type 11 has an invalid length. [ 704.638772][T23184] syzkaller0: entered promiscuous mode [ 704.653234][T23184] syzkaller0: entered allmulticast mode [ 704.774603][T23191] netlink: 'syz.3.4546': attribute type 11 has an invalid length. [ 704.797220][T23190] netlink: 'syz.3.4546': attribute type 11 has an invalid length. [ 704.820596][T23191] netlink: 'syz.3.4546': attribute type 1 has an invalid length. [ 705.343768][T23226] __nla_validate_parse: 3 callbacks suppressed [ 705.343790][T23226] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4558'. [ 705.558544][T23231] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4559'. [ 705.628605][T23231] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap2 [ 705.833821][T23023] udevd[23023]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 705.987842][T23243] syzkaller1: entered promiscuous mode [ 706.751990][T23293] netlink: 'syz.1.4574': attribute type 13 has an invalid length. [ 706.763480][T23292] vcan1: entered promiscuous mode [ 706.775811][T23292] vcan1: entered allmulticast mode [ 706.799719][T23297] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4575'. [ 706.853234][T23293] gretap0: refused to change device tx_queue_len [ 706.858156][T23298] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4578'. [ 706.862343][T23293] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 706.923189][T23298] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4578'. [ 706.994497][T23312] tipc: Enabling of bearer rejected, failed to enable media [ 707.044049][T23308] netlink: 'syz.4.4580': attribute type 1 has an invalid length. [ 707.162265][T23317] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4580'. [ 707.209424][T23314] bond3: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 707.238240][T23321] vlan2: entered allmulticast mode [ 707.247884][T23321] bond0: entered allmulticast mode [ 707.253733][T23308] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4580'. [ 707.263991][T23321] bond_slave_0: entered allmulticast mode [ 707.282846][T23320] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4583'. [ 707.283444][T23308] 8021q: adding VLAN 0 to HW filter on device bond3 [ 707.308578][ T12] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 707.322237][T23328] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4585'. [ 707.465805][T15224] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 707.929223][T23350] team0: Device veth1_to_batadv is up. Set it down before adding it as a team port [ 708.143490][T23359] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 708.430716][T23389] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4602'. [ 708.540176][T23396] netdevsim netdevsim0: Direct firmware load for . failed with error -2 [ 708.594635][T23401] bridge0: port 3(bond0) entered blocking state [ 708.607117][T23403] netlink: 'syz.0.4605': attribute type 10 has an invalid length. [ 708.619722][T23401] bridge0: port 3(bond0) entered disabled state [ 708.636465][T23401] bond0: entered allmulticast mode [ 708.640005][T23396] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 708.646683][T23401] bond_slave_0: entered allmulticast mode [ 708.676774][T23401] bond_slave_1: entered allmulticast mode [ 708.692249][T23401] bond3: entered allmulticast mode [ 708.721694][T23401] bond0: entered promiscuous mode [ 708.739220][T23401] bond_slave_0: entered promiscuous mode [ 708.757990][T23401] bond_slave_1: entered promiscuous mode [ 708.770524][T23401] bond3: entered promiscuous mode [ 708.908492][T23417] veth0_to_batadv: Caught tx_queue_len zero misconfig [ 709.299314][T23442] netlink: 'syz.2.4616': attribute type 1 has an invalid length. [ 709.408638][T23442] bond7: entered promiscuous mode [ 709.442554][T23442] bond7: entered allmulticast mode [ 709.490686][T23442] 8021q: adding VLAN 0 to HW filter on device bond7 [ 709.532790][T23460] Cannot find add_set index 65532 as target [ 709.578682][T23442] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 709.639370][T23466] netlink: 'syz.0.4621': attribute type 1 has an invalid length. [ 709.885565][T23467] bond5: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 709.939065][T23470] veth7: entered promiscuous mode [ 709.952661][T23470] bond5: (slave veth7): Enslaving as a backup interface with a down link [ 710.654780][T23519] __nla_validate_parse: 4 callbacks suppressed [ 710.654801][T23519] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4635'. [ 710.801298][T23529] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4637'. [ 711.180944][T23542] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4640'. [ 711.229868][T23542] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4640'. [ 711.272950][T23554] x_tables: unsorted underflow at hook 4 [ 711.436609][T23568] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4647'. [ 711.566093][T15221] bond0: left allmulticast mode [ 711.571073][T15221] bond_slave_0: left allmulticast mode [ 711.586215][T15221] bond_slave_1: left allmulticast mode [ 711.599484][T15221] bond0: left promiscuous mode [ 711.604443][T15221] bond_slave_0: left promiscuous mode [ 711.610928][T15221] bond_slave_1: left promiscuous mode [ 711.617708][T23572] netlink: 6212 bytes leftover after parsing attributes in process `syz.1.4650'. [ 711.624404][T15221] bridge0: port 1(bond0) entered disabled state [ 711.629106][T23575] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4651'. [ 711.646877][T23575] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4651'. [ 711.656820][T23575] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4651'. [ 711.713809][T23575] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4651'. [ 712.163293][T15221] bond3 (unregistering): (slave ip6gre1): Releasing backup interface [ 712.190806][T15221] ip6gre1 (unregistering): left promiscuous mode [ 712.246615][T15221] bond4 (unregistering): (slave ip6gretap0): Releasing active interface [ 712.703727][T15221] erspan0 (unregistering): left promiscuous mode [ 712.939409][T15221] bond12 (unregistering): (slave gretap1): Releasing active interface [ 713.062765][T15221] bond5 (unregistering): (slave geneve3): Releasing active interface [ 713.082048][T15221] bond2 (unregistering): (slave geneve2): Releasing active interface [ 713.213451][T15221] bond9 (unregistering): (slave bridge3): Releasing backup interface [ 713.222828][T15221] bridge3 (unregistering): left promiscuous mode [ 713.323931][T15221] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 713.340257][T15221] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 713.352707][T15221] bond0 (unregistering): Released all slaves [ 713.393372][T15221] bond1 (unregistering): Released all slaves [ 713.462100][T15221] bond2 (unregistering): Released all slaves [ 713.528474][T15221] bond3 (unregistering): Released all slaves [ 713.586819][T15221] bond4 (unregistering): Released all slaves [ 713.610794][T15221] bond5 (unregistering): Released all slaves [ 713.633459][T15221] bond6 (unregistering): Released all slaves [ 713.671835][T15221] bond7 (unregistering): Released all slaves [ 713.698950][T15221] bond8 (unregistering): Released all slaves [ 713.740135][T15221] bond9 (unregistering): Released all slaves [ 713.782082][T15221] bond10 (unregistering): Released all slaves [ 713.814688][T15221] bond11 (unregistering): Released all slaves [ 713.842960][T15221] bond12 (unregistering): Released all slaves [ 713.869167][T15221] bond13 (unregistering): Released all slaves [ 713.899225][T15221] bond14 (unregistering): Released all slaves [ 714.103682][T23643] syzkaller1: entered promiscuous mode [ 714.125695][T23643] syzkaller1: entered allmulticast mode [ 714.407170][T23670] vlan2: entered allmulticast mode [ 714.536865][T23672] gretap2: entered promiscuous mode [ 714.555656][T23672] gretap2: entered allmulticast mode [ 714.586859][T15221] tipc: Disabling bearer [ 714.602813][T15221] tipc: Left network mode [ 714.897653][T15221] IPVS: stopping backup sync thread 8789 ... [ 715.216272][T23721] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 715.624750][T23733] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 715.682541][T23741] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 716.128661][T15221] hsr_slave_0: left promiscuous mode [ 716.179604][T15221] hsr_slave_1: left promiscuous mode [ 716.212922][T15221] veth0_macvtap: left promiscuous mode [ 716.221358][T15221] veth1_vlan: left promiscuous mode [ 716.228097][T15221] veth0_vlan: left promiscuous mode [ 717.439549][T23810] __nla_validate_parse: 10 callbacks suppressed [ 717.439571][T23810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4693'. [ 717.487177][T23810] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4693'. [ 718.100460][T23828] netlink: 'syz.1.4697': attribute type 2 has an invalid length. [ 718.114688][T23828] netlink: 'syz.1.4697': attribute type 11 has an invalid length. [ 718.174315][T23828] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4697'. [ 718.400423][T23844] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4699'. [ 718.422286][T15221] IPVS: stop unused estimator thread 0... [ 718.545361][T23847] tc_dump_action: action bad kind [ 719.905723][T23897] veth0: entered promiscuous mode [ 719.922691][T23895] veth0: left promiscuous mode [ 720.214671][T23915] netlink: 'syz.3.4714': attribute type 11 has an invalid length. [ 720.226126][T23918] netlink: 'syz.3.4714': attribute type 11 has an invalid length. [ 720.248767][T23912] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4713'. [ 720.524161][T23928] netlink: 'syz.1.4715': attribute type 1 has an invalid length. [ 720.551129][T23929] netlink: 'syz.1.4715': attribute type 1 has an invalid length. [ 720.628322][T23934] netlink: 'syz.0.4716': attribute type 14 has an invalid length. [ 720.906444][T23949] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 720.907895][T23950] netlink: 'syz.0.4723': attribute type 2 has an invalid length. [ 720.965124][T23950] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4723'. [ 721.203749][T23967] IPVS: set_ctl: invalid protocol: 46 0.0.0.0:20000 [ 721.244108][T23973] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 721.291859][T23973] batman_adv: batadv0: Adding interface: gretap1 [ 721.314456][T23973] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 721.324866][T23983] IPVS: set_ctl: invalid protocol: 92 224.0.0.2:20001 [ 721.392639][T23973] batman_adv: batadv0: Interface activated: gretap1 [ 721.921666][T24020] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4732'. [ 722.566060][T24039] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4736'. [ 722.829016][T24049] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4737'. [ 723.172753][T24067] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4739'. [ 723.302299][T24070] syzkaller0: entered promiscuous mode [ 723.308041][T24070] syzkaller0: entered allmulticast mode [ 724.272213][T23993] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 724.298795][T24077] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4741'. [ 724.339897][T24077] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4741'. [ 724.614337][T24087] netlink: 'syz.3.4746': attribute type 8 has an invalid length. [ 724.648797][T24087] sch_fq: defrate 0 ignored. [ 724.650893][T24090] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4747'. [ 724.693249][T24090] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4747'. [ 724.716526][T24090] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4747'. [ 724.913184][T24107] xt_CT: You must specify a L4 protocol and not use inversions on it [ 724.982742][T24103] syzkaller0: entered promiscuous mode [ 725.003335][T24103] syzkaller0: entered allmulticast mode [ 725.104801][T24123] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4755'. [ 725.182104][T24123] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4755'. [ 725.443606][T24156] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 725.453311][T24157] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 725.541478][T24159] netlink: 'syz.3.4763': attribute type 39 has an invalid length. [ 727.898450][T24116] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 728.358842][T24226] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 728.621912][T24236] netlink: 'syz.2.4777': attribute type 1 has an invalid length. [ 728.773244][T24236] 8021q: adding VLAN 0 to HW filter on device bond8 [ 728.832655][T24239] vlan3: entered promiscuous mode [ 728.851213][T24239] bond8: entered promiscuous mode [ 728.873472][T24239] vlan3: entered allmulticast mode [ 728.901340][T24239] bond8: entered allmulticast mode [ 728.911615][T24253] IPv6: NLM_F_CREATE should be specified when creating new route [ 728.988223][T24245] bond8: (slave bridge5): making interface the new active one [ 729.008665][T24245] bridge5: entered promiscuous mode [ 729.026927][T24246] __nla_validate_parse: 2 callbacks suppressed [ 729.026947][T24246] netlink: 212 bytes leftover after parsing attributes in process `syz.3.4779'. [ 729.032834][T24245] bridge5: entered allmulticast mode [ 729.059491][T24245] bond8: (slave bridge5): Enslaving as an active interface with an up link [ 729.329886][T24260] team0: Port device syz_tun added [ 729.385468][T24276] netlink: 'syz.2.4786': attribute type 1 has an invalid length. [ 729.543839][T24286] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4790'. [ 729.558526][T24276] 8021q: adding VLAN 0 to HW filter on device bond9 [ 729.584611][T24288] netlink: 'syz.4.4791': attribute type 1 has an invalid length. [ 729.599864][T24282] vlan4: entered allmulticast mode [ 729.607437][T24282] bond9: entered allmulticast mode [ 729.668455][T24286] bond5: entered promiscuous mode [ 729.673883][T24286] 8021q: adding VLAN 0 to HW filter on device bond5 [ 729.694198][T24285] bond9: (slave geneve2): making interface the new active one [ 729.702652][T24285] geneve2: entered allmulticast mode [ 729.713426][T24299] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4791'. [ 729.725948][T24285] bond9: (slave geneve2): Enslaving as an active interface with an up link [ 729.791871][T24288] bond4: entered promiscuous mode [ 729.801976][T24288] 8021q: adding VLAN 0 to HW filter on device bond4 [ 729.919888][T24286] 8021q: adding VLAN 0 to HW filter on device bond5 [ 729.977440][T24286] bond5: (slave sit2): The slave device specified does not support setting the MAC address [ 730.031336][T24286] bond5: (slave sit2): Error -95 calling set_mac_address [ 730.116267][T24320] netlink: 7 bytes leftover after parsing attributes in process `syz.2.4794'. [ 730.625286][T24299] syzkaller1: entered promiscuous mode [ 730.631154][T24299] syzkaller1: entered allmulticast mode [ 730.702529][T24295] 8021q: adding VLAN 0 to HW filter on device bond4 [ 730.727319][T24295] bond4: (slave vti0): The slave device specified does not support setting the MAC address [ 730.749060][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 730.756397][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 730.763501][T24295] bond4: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 730.782781][T24295] bond4: (slave vti0): making interface the new active one [ 730.790515][T24295] vti0: entered promiscuous mode [ 730.799330][T24295] vti0: left promiscuous mode [ 730.851554][T24334] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4799'. [ 731.037348][ T5898] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 731.100643][T24334] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 731.146806][T24335] syzkaller0: entered promiscuous mode [ 731.152536][T24335] syzkaller0: entered allmulticast mode [ 731.361445][T24361] netlink: 'syz.2.4805': attribute type 2 has an invalid length. [ 731.474324][T24364] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4807'. [ 731.519432][T24369] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4807'. [ 731.769089][T24383] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4811'. [ 731.922166][T24392] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4814'. [ 732.149947][T24402] SET target dimension over the limit! [ 732.419666][T24418] netlink: 'syz.3.4824': attribute type 15 has an invalid length. [ 732.502396][T24422] netlink: 576 bytes leftover after parsing attributes in process `syz.3.4824'. [ 732.541482][T24421] syz_tun: refused to change device tx_queue_len [ 733.613894][T24481] syz_tun: entered promiscuous mode [ 733.633645][T24481] syz_tun: entered allmulticast mode [ 733.655990][T24481] team0: Port device syz_tun added [ 734.243287][T24517] netlink: 'syz.0.4855': attribute type 83 has an invalid length. [ 734.385983][T24515] netlink: 'syz.1.4857': attribute type 4 has an invalid length. [ 734.396020][T24519] __nla_validate_parse: 4 callbacks suppressed [ 734.396040][T24519] netlink: 288 bytes leftover after parsing attributes in process `syz.2.4856'. [ 734.478408][T24527] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4860'. [ 734.593720][T24533] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4860'. [ 734.663550][T24536] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 734.701598][T24532] syzkaller1: entered promiscuous mode [ 734.737738][T24532] syzkaller1: entered allmulticast mode [ 734.809168][T24539] netlink: 'syz.2.4864': attribute type 3 has an invalid length. [ 734.901134][T24541] netlink: 'syz.3.4863': attribute type 29 has an invalid length. [ 734.995876][T24551] batman_adv: batadv0: Interface deactivated: wlan0 [ 735.012633][T24551] batman_adv: batadv0: Removing interface: wlan0 [ 735.132033][T24559] syz_tun: entered allmulticast mode [ 735.148617][T24558] netlink: 'syz.3.4868': attribute type 1 has an invalid length. [ 735.183462][T24558] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4868'. [ 735.230655][T24558] 8021q: adding VLAN 0 to HW filter on device bond5 [ 735.244232][T24558] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4868'. [ 735.322342][T24572] netlink: 'syz.4.4873': attribute type 1 has an invalid length. [ 735.634000][T24588] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4876'. [ 735.681897][T24592] netlink: 'syz.0.4877': attribute type 10 has an invalid length. [ 735.692302][T24592] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4877'. [ 735.746532][ T30] audit: type=1107 audit(1783053459.001:23): pid=24595 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='|^Tyϖmj-'/Y6z}lLYAm_C~1Gz4i|6Ypj' [ 735.871872][T24588] bond6: Invalid ad_actor_system MAC address. [ 735.900981][T24588] bond6: option ad_actor_system: invalid value (1) [ 735.952179][T24616] netlink: 'syz.2.4881': attribute type 21 has an invalid length. [ 735.967304][T24588] bond6 (unregistering): Released all slaves [ 736.082382][T24592] team0: entered allmulticast mode [ 736.092077][T24592] team_slave_0: entered allmulticast mode [ 736.107450][T24592] team_slave_1: entered allmulticast mode [ 736.114149][T24592] bridge0: port 3(team0) entered blocking state [ 736.122372][T24592] bridge0: port 3(team0) entered disabled state [ 736.131751][T24592] team0: entered promiscuous mode [ 736.138289][T24592] team_slave_0: entered promiscuous mode [ 736.144202][T24592] team_slave_1: entered promiscuous mode [ 736.329651][T24629] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4883'. [ 736.382043][T24633] openvswitch: netlink: Key type 12294 is out of range max 32 [ 736.411439][T24633] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4885'. [ 736.447716][T24633] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4885'. [ 736.546727][T24641] validate_nla: 1 callbacks suppressed [ 736.546747][T24641] netlink: 'syz.2.4888': attribute type 2 has an invalid length. [ 736.614382][T24638] netlink: 'syz.4.4886': attribute type 16 has an invalid length. [ 736.642903][T24638] netlink: 'syz.4.4886': attribute type 17 has an invalid length. [ 736.651393][T24645] IPVS: set_ctl: invalid protocol: 98 255.255.255.255:20004 [ 736.659243][T24643] tipc: Resetting bearer [ 736.669306][T24643] tipc: Resetting bearer [ 736.680923][T24645] IPVS: set_ctl: invalid protocol: 50 172.20.20.36:20002 [ 736.905884][T15208] bond3: (slave ip6gretap1): link status up again after 0 ms [ 736.929783][T24648] syzkaller1: entered promiscuous mode [ 736.950961][T24648] syzkaller1: entered allmulticast mode [ 736.955074][T15208] bond3: (slave ip6gretap1): link status up again after 0 ms [ 736.992367][T15208] bond3: (slave ip6gretap1): link status up again after 0 ms [ 737.025224][ T5889] bond3: (slave ip6gretap1): link status up again after 0 ms [ 737.065269][T15212] bond3: (slave ip6gretap1): link status up again after 0 ms [ 737.089095][T24663] openvswitch: netlink: Message has 1 unknown bytes. [ 737.101843][T24663] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 737.114734][T15212] bond3: (slave ip6gretap1): link status up again after 0 ms [ 737.152206][T15212] bond3: (slave ip6gretap1): link status up again after 0 ms [ 737.640866][T24677] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 737.892047][T24701] Unsupported ieee802154 address type: 0 [ 737.910604][T24697] 8021q: adding VLAN 0 to HW filter on device bond5 [ 737.921818][T24697] bond0: (slave bond5): Enslaving as an active interface with an up link [ 738.139024][T24710] IPVS: set_ctl: invalid protocol: 51 0.0.0.0:20002 [ 738.600700][T24735] netlink: 'syz.0.4911': attribute type 11 has an invalid length. [ 739.233596][T24755] netlink: 'syz.1.4919': attribute type 21 has an invalid length. [ 739.661438][T24769] netlink: 'syz.2.4923': attribute type 10 has an invalid length. [ 739.689659][T24769] __nla_validate_parse: 11 callbacks suppressed [ 739.689682][T24769] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4923'. [ 739.839754][T24777] Cannot find add_set index 4 as target [ 740.401215][T24802] netlink: 'syz.0.4935': attribute type 1 has an invalid length. [ 740.422375][T24802] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4935'. [ 740.950200][T24835] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4943'. [ 740.977853][T24837] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4944'. [ 740.989416][T24837] netlink: 'syz.1.4944': attribute type 1 has an invalid length. [ 741.157104][T24842] netlink: 'syz.1.4945': attribute type 28 has an invalid length. [ 741.169649][T24842] netlink: 'syz.1.4945': attribute type 3 has an invalid length. [ 741.202116][T24842] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4945'. [ 741.241767][T24850] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4946'. [ 741.252332][T24849] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4947'. [ 741.262490][T24850] netlink: 84 bytes leftover after parsing attributes in process `syz.4.4946'. [ 741.412471][T24857] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4949'. [ 741.425230][ T5898] net_ratelimit: 35 callbacks suppressed [ 741.425251][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 741.654427][T24875] veth0: entered promiscuous mode [ 741.664424][T24872] sctp: [Deprecated]: syz.0.4955 (pid 24872) Use of struct sctp_assoc_value in delayed_ack socket option. [ 741.664424][T24872] Use struct sctp_sack_info instead [ 741.749592][T24875] veth0: left promiscuous mode [ 741.775268][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 741.905191][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 741.959438][ T30] audit: type=1804 audit(1783053465.221:24): pid=24888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4958" name="/newroot/318/cgroup.controllers" dev="tmpfs" ino=1632 res=1 errno=0 [ 742.009255][T24885] netlink: 'syz.2.4957': attribute type 3 has an invalid length. [ 742.035662][ T30] audit: type=1800 audit(1783053465.221:25): pid=24888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4958" name="cgroup.controllers" dev="tmpfs" ino=1632 res=0 errno=0 [ 742.062471][T24885] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4957'. [ 742.087630][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 742.207639][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 742.336259][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 742.477596][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 742.530338][T24915] ip6tnl0: Master is either lo or non-ether device [ 742.535671][T24920] netlink: 'syz.1.4965': attribute type 9 has an invalid length. [ 742.580707][T24925] netlink: 'syz.0.4967': attribute type 33 has an invalid length. [ 742.631507][T24927] geneve3: entered promiscuous mode [ 742.867207][T24925] bond6: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 742.923687][T24925] bond6 (unregistering): Released all slaves [ 743.044947][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 743.175720][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 743.315298][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 743.513178][T24966] syzkaller0: entered promiscuous mode [ 743.534234][T24966] syzkaller0: entered allmulticast mode [ 744.122411][T24989] syzkaller0: entered promiscuous mode [ 744.139600][T24989] syzkaller0: entered allmulticast mode [ 745.002592][T25036] __nla_validate_parse: 2 callbacks suppressed [ 745.002613][T25036] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4991'. [ 745.338317][T25050] bond6: option tlb_dynamic_lb: invalid value (7) [ 745.393289][T25050] bond6 (unregistering): Released all slaves [ 745.401040][T25060] netlink: 'syz.2.4997': attribute type 17 has an invalid length. [ 745.519808][T25060] netlink: 'syz.2.4997': attribute type 2 has an invalid length. [ 745.555484][T25060] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4997'. [ 745.875690][T25076] dvmrp0: left allmulticast mode [ 745.992703][T25079] netlink: 'syz.3.5001': attribute type 1 has an invalid length. [ 746.093104][T25085] netlink: 'syz.1.5002': attribute type 8 has an invalid length. [ 746.133708][T25079] 8021q: adding VLAN 0 to HW filter on device bond6 [ 746.142559][T25081] bond0: Device is already in use. [ 746.178405][T25084] bond6: (slave geneve3): making interface the new active one [ 746.203879][T25084] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 746.459730][T25092] netlink: 1 bytes leftover after parsing attributes in process `syz.4.5004'. [ 746.495657][T15208] net_ratelimit: 16 callbacks suppressed [ 746.495680][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 746.635699][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.035085][ T12] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.083496][T25116] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5010'. [ 747.103380][T25131] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5011'. [ 747.194477][T25116] netlink: 'syz.3.5010': attribute type 4 has an invalid length. [ 747.289402][ T12] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.379353][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.389097][ T1315] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 747.399718][T25143] netlink: 'syz.0.5013': attribute type 10 has an invalid length. [ 747.417742][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.442195][T25146] tipc: Enabling of bearer rejected, media not registered [ 747.452202][T25143] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 747.496063][T25143] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 747.517778][T25143] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 747.529122][T25143] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 747.565338][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.695879][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.836547][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.875578][T25165] netlink: 'syz.0.5022': attribute type 4 has an invalid length. [ 747.965123][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 747.989631][T25174] netlink: 256 bytes leftover after parsing attributes in process `syz.3.5025'. [ 747.999443][T25172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5026'. [ 748.325056][T25188] syzkaller0: entered promiscuous mode [ 748.344384][T25188] syzkaller0: entered allmulticast mode [ 748.378272][T25192] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5031'. [ 748.419770][T25192] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5031'. [ 748.487519][T25199] netlink: 'syz.0.5032': attribute type 16 has an invalid length. [ 748.520083][T25199] netlink: 'syz.0.5032': attribute type 17 has an invalid length. [ 748.615373][T25204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5035'. [ 748.741500][T25199] bridge2: port 1(erspan0) entered blocking state [ 748.748208][T25199] bridge2: port 1(erspan0) entered forwarding state [ 748.877170][T25199] 8021q: adding VLAN 0 to HW filter on device team0 [ 749.014392][ T5889] bridge0: port 1(bridge_slave_0) entered blocking state [ 749.021687][ T5889] bridge0: port 1(bridge_slave_0) entered listening state [ 749.032672][ T5889] bridge0: port 2(bridge_slave_1) entered blocking state [ 749.039814][ T5889] bridge0: port 2(bridge_slave_1) entered listening state [ 749.052247][ T5889] bridge0: port 3(team0) entered blocking state [ 749.058634][ T5889] bridge0: port 3(team0) entered listening state [ 749.785499][T25243] netlink: 'syz.1.5045': attribute type 3 has an invalid length. [ 750.294116][T25285] netlink: 'syz.0.5054': attribute type 1 has an invalid length. [ 750.334613][T25285] netlink: 'syz.0.5054': attribute type 2 has an invalid length. [ 750.390486][T25287] netlink: 'syz.4.5056': attribute type 1 has an invalid length. [ 750.416950][T25291] syzkaller1: entered promiscuous mode [ 750.436820][T25287] netlink: 'syz.4.5056': attribute type 3 has an invalid length. [ 750.444728][T25291] syzkaller1: entered allmulticast mode [ 750.452134][T25287] __nla_validate_parse: 3 callbacks suppressed [ 750.452150][T25287] netlink: 184 bytes leftover after parsing attributes in process `syz.4.5056'. [ 750.480085][T25287] NCSI netlink: No device for ifindex 131092 [ 750.480407][T25291] 8021q: VLANs not supported on sit0 [ 750.535065][T25291] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5057'. [ 750.587364][ T5639] Bluetooth: hci2: command 0x0406 tx timeout [ 750.625789][T25296] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5059'. [ 750.626142][T25294] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5058'. [ 750.636244][T25296] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5059'. [ 750.637877][T25296] veth0: entered promiscuous mode [ 750.679911][T25296] veth0: left promiscuous mode [ 750.841560][T25303] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5061'. [ 751.173448][T25316] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5065'. [ 751.250384][T25316] xfrm0: entered promiscuous mode [ 751.267842][T25316] xfrm0: entered allmulticast mode [ 751.306181][T25318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5066'. [ 751.316984][T25322] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5067'. [ 751.410180][T25324] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5068'. [ 751.538284][T15212] net_ratelimit: 20 callbacks suppressed [ 751.538306][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 751.741430][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 751.877575][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 752.005038][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 752.135501][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 752.275176][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 752.317911][T25382] validate_nla: 4 callbacks suppressed [ 752.317931][T25382] netlink: 'syz.0.5084': attribute type 1 has an invalid length. [ 752.501632][T25382] bond6: entered promiscuous mode [ 752.511994][T25382] 8021q: adding VLAN 0 to HW filter on device bond6 [ 752.575902][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 752.840728][T25395] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 752.999589][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 753.010469][T25403] ip6tnl0: Caught tx_queue_len zero misconfig [ 753.144052][T25395] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.196112][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 753.317489][T25395] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.356000][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 753.573768][T25395] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 754.055319][ T5898] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.160332][ T12] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.276830][ T12] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.287483][T25485] syzkaller1: entered promiscuous mode [ 754.294412][T25485] syzkaller1: entered allmulticast mode [ 754.400604][ T5898] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.436618][T25497] veth0: entered promiscuous mode [ 754.451195][T25490] veth0: left promiscuous mode [ 755.024268][T25517] bond7: (slave ip6_vti0): Device is not bonding slave [ 755.031451][T25517] bond7: option active_slave: invalid value (ip6_vti0) [ 755.067856][T25517] bond7 (unregistering): Released all slaves [ 755.159314][T25520] bridge_slave_0: invalid flags given to default FDB implementation [ 755.468146][T25542] netlink: 'syz.3.5124': attribute type 13 has an invalid length. [ 755.986248][T25562] netlink: 'syz.3.5129': attribute type 2 has an invalid length. [ 756.008525][T25562] __nla_validate_parse: 36 callbacks suppressed [ 756.008546][T25562] netlink: 244 bytes leftover after parsing attributes in process `syz.3.5129'. [ 756.038404][T25560] netlink: 'syz.3.5129': attribute type 2 has an invalid length. [ 756.041332][T25567] netlink: 204 bytes leftover after parsing attributes in process `syz.1.5130'. [ 756.048218][T25560] netlink: 244 bytes leftover after parsing attributes in process `syz.3.5129'. [ 756.716298][T15208] net_ratelimit: 17 callbacks suppressed [ 756.716319][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 756.766732][T25599] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5140'. [ 756.833982][T25602] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5141'. [ 756.856352][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 756.913100][T25606] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5141'. [ 756.975713][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 757.095281][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 757.119241][T25613] netlink: 256 bytes leftover after parsing attributes in process `syz.0.5144'. [ 757.225386][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 757.300461][T25602] netlink: 240 bytes leftover after parsing attributes in process `syz.1.5141'. [ 757.358371][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 757.499807][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 757.633282][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 757.754933][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 757.895491][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 758.034096][T25644] netlink: 'syz.2.5153': attribute type 1 has an invalid length. [ 758.047847][T25647] netlink: 666 bytes leftover after parsing attributes in process `syz.0.5155'. [ 758.157252][T25644] bond10: entered promiscuous mode [ 758.163586][T25644] 8021q: adding VLAN 0 to HW filter on device bond10 [ 758.215772][T25657] netlink: 'syz.1.5158': attribute type 7 has an invalid length. [ 758.238495][T25642] 8021q: adding VLAN 0 to HW filter on device bond10 [ 758.249882][T25642] bond10: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 758.260777][T25642] bond10: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 758.275972][T25642] bond10: (slave ip6gre1): making interface the new active one [ 758.283828][T25642] ip6gre1: entered promiscuous mode [ 758.292395][T25642] bond10: (slave ip6gre1): Enslaving as an active interface with an up link [ 758.302868][T25657] netlink: 'syz.1.5158': attribute type 7 has an invalid length. [ 758.686803][T25676] netlink: 240 bytes leftover after parsing attributes in process `syz.1.5164'. [ 759.299710][T25702] macvtap1: entered promiscuous mode [ 759.318656][T25702] vlan0: entered promiscuous mode [ 759.338133][T25702] macvtap1: entered allmulticast mode [ 759.358094][T25702] vlan0: entered allmulticast mode [ 759.373405][T25702] veth0_vlan: entered allmulticast mode [ 759.971735][T25745] sctp: [Deprecated]: syz.1.5186 (pid 25745) Use of struct sctp_assoc_value in delayed_ack socket option. [ 759.971735][T25745] Use struct sctp_sack_info instead [ 760.733649][T25787] erspan1: entered allmulticast mode [ 760.816152][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 760.823473][ C0] bridge0: topology change detected, propagating [ 760.830430][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 760.837936][ C0] bridge0: topology change detected, propagating [ 761.766368][ T5889] net_ratelimit: 23 callbacks suppressed [ 761.766393][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 761.885916][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.006203][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.115036][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.225066][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.355070][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.475075][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.595012][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.705093][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 762.814983][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 763.791802][T25793] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 763.979107][T25817] __nla_validate_parse: 5 callbacks suppressed [ 763.979128][T25817] netlink: 72 bytes leftover after parsing attributes in process `syz.3.5204'. [ 764.046191][T25822] netlink: 'syz.1.5207': attribute type 1 has an invalid length. [ 764.075993][T25822] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5207'. [ 764.280624][T25834] xt_hashlimit: overflow, try lower: 3/0 [ 764.327279][T25836] ieee802154 phy0 wpan0: encryption failed: -22 [ 764.490334][T25846] netlink: 'syz.4.5213': attribute type 1 has an invalid length. [ 764.791320][T25849] bond6: (slave geneve2): making interface the new active one [ 764.819730][T25849] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 764.903879][T25857] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5216'. [ 764.920548][ T5889] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 20000 - 0 [ 764.936202][T15208] bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex [ 764.967005][T25862] netlink: 14 bytes leftover after parsing attributes in process `syz.3.5217'. [ 764.978279][ T5889] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 20000 - 0 [ 764.996459][ T5889] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 20000 - 0 [ 765.018108][ T5889] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 20000 - 0 [ 765.219885][T25870] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5219'. [ 765.414444][T25885] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5224'. [ 765.972997][T25912] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5233'. [ 766.008094][T25910] bond11: invalid ARP target 0.0.0.0 specified for addition [ 766.017589][T25910] bond11: option arp_ip_target: invalid value (0) [ 766.027669][T25910] bond11 (unregistering): Released all slaves [ 766.278241][T25921] netlink: 'syz.2.5237': attribute type 1 has an invalid length. [ 766.322993][T25921] 8021q: adding VLAN 0 to HW filter on device bond11 [ 766.351499][T25921] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5237'. [ 766.479307][T25921] veth3: entered promiscuous mode [ 766.519300][T25921] bond11: (slave veth3): Enslaving as an active interface with a down link [ 766.610161][T25931] bond11: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 766.611024][T25941] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5243'. [ 766.651137][T25941] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5243'. [ 766.778490][ T5898] net_ratelimit: 30 callbacks suppressed [ 766.778605][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 766.860820][T25950] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 766.868136][T25950] IPv6: NLM_F_CREATE should be set when creating new route [ 766.935618][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 767.070450][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 767.153309][T25968] xt_TCPMSS: Only works on TCP SYN packets [ 767.207452][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 767.346859][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 767.475949][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 767.616209][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 767.736971][T26002] bond7: Unable to set up delay as MII monitoring is disabled [ 767.751866][T26002] bond7 (unregistering): Released all slaves [ 767.875107][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 767.999620][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 768.079986][T26016] openvswitch: netlink: Message has 4 unknown bytes. [ 768.136051][T26020] netlink: 'syz.2.5270': attribute type 1 has an invalid length. [ 768.150524][T26020] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 768.797079][T26070] bridge6: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 768.842796][T26072] sctp: [Deprecated]: syz.1.5282 (pid 26072) Use of struct sctp_assoc_value in delayed_ack socket option. [ 768.842796][T26072] Use struct sctp_sack_info instead [ 769.048664][T26087] __nla_validate_parse: 6 callbacks suppressed [ 769.048687][T26087] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5287'. [ 769.124609][T26087] smc: net device team0 applied user defined pnetid SYZ2 [ 769.396276][T26095] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5288'. [ 769.439676][T26095] bridge0: port 3(team0) entered disabled state [ 769.489017][T26095] team0 (unregistering): left allmulticast mode [ 769.505033][T26095] team_slave_0: left allmulticast mode [ 769.521849][T26095] team_slave_1: left allmulticast mode [ 769.538003][T26095] team0 (unregistering): left promiscuous mode [ 769.566550][T26095] team_slave_0: left promiscuous mode [ 769.574375][T26095] team_slave_1: left promiscuous mode [ 769.595284][T26095] bridge0: port 3(team0) entered disabled state [ 769.653843][T26095] team0 (unregistering): Port device team_slave_0 removed [ 769.684374][T26095] team0 (unregistering): Port device team_slave_1 removed [ 772.484302][ T5889] net_ratelimit: 10 callbacks suppressed [ 772.484326][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 772.715473][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 772.826963][T26144] netlink: 'syz.0.5301': attribute type 83 has an invalid length. [ 772.836407][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 772.853854][T26144] netlink: 'syz.0.5301': attribute type 27 has an invalid length. [ 772.879674][T26144] netlink: 'syz.0.5301': attribute type 4 has an invalid length. [ 772.914126][T26144] netlink: 144 bytes leftover after parsing attributes in process `syz.0.5301'. [ 773.005891][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 773.145136][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 773.255288][T26170] netlink: 'syz.4.5311': attribute type 21 has an invalid length. [ 773.290295][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 773.293248][T26170] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5311'. [ 773.368298][T26170] netlink: 'syz.4.5311': attribute type 21 has an invalid length. [ 773.399121][T26170] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5311'. [ 773.415275][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 773.526854][T26184] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5317'. [ 773.535141][T11625] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 773.620917][T26193] netlink: 'syz.0.5320': attribute type 21 has an invalid length. [ 773.645308][T26193] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5320'. [ 773.664942][T26197] openvswitch: netlink: Unexpected mask (mask=8000, allowed=10048) [ 773.685272][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 773.962089][T26211] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5325'. [ 774.016418][T26215] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5325'. [ 774.038974][T26215] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5325'. [ 774.121136][ T5889] bond1: (slave bridge0): link status definitely down, disabling slave [ 774.168485][ T5889] bond1: now running without any active interface! [ 774.224155][T26226] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5330'. [ 774.260163][T26226] block nbd0: reconnected socket [ 774.272590][T26226] netlink: 'syz.4.5330': attribute type 1 has an invalid length. [ 774.296104][T26226] nbd: error processing sock list [ 774.332628][T26229] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5331'. [ 774.342463][T26232] syz_tun: left allmulticast mode [ 774.598274][T26248] batadv0: Caught tx_queue_len zero misconfig [ 774.803414][T26256] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5337'. [ 774.815606][T26253] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5336'. [ 774.852239][T26253] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5336'. [ 774.861593][T26257] tunl0: entered promiscuous mode [ 774.890993][T26257] netlink: 'syz.0.5337': attribute type 3 has an invalid length. [ 774.908193][T26257] netlink: 9 bytes leftover after parsing attributes in process `syz.0.5337'. [ 774.921684][T26261] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5340'. [ 774.931981][T26257] netlink: 'syz.0.5337': attribute type 3 has an invalid length. [ 774.956561][T26257] netlink: 9 bytes leftover after parsing attributes in process `syz.0.5337'. [ 774.987097][T26256] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5337'. [ 775.003910][T26261] netlink: 136 bytes leftover after parsing attributes in process `syz.2.5340'. [ 775.003956][T26257] netlink: 'syz.0.5337': attribute type 3 has an invalid length. [ 775.062143][ T5637] block nbd0: Receive control failed (result -32) [ 775.164126][T26268] 8021q: adding VLAN 0 to HW filter on device bond7 [ 775.175344][T26275] nbd: must specify a device to reconfigure [ 775.254776][T26270] bond7: (slave gretap2): making interface the new active one [ 775.269420][T26270] bond7: (slave gretap2): Enslaving as an active interface with an up link [ 776.033957][T26317] bond6: entered promiscuous mode [ 776.056092][T26317] bond6: entered allmulticast mode [ 776.072992][T26317] 8021q: adding VLAN 0 to HW filter on device bond6 [ 776.136747][T26333] atomic_op ffff88807efb9998 conn xmit_atomic 0000000000000000 [ 777.311164][T26393] bond8: entered promiscuous mode [ 777.317545][T26393] 8021q: adding VLAN 0 to HW filter on device bond8 [ 777.396531][T26393] bond8: (slave bridge4): making interface the new active one [ 777.404168][T26393] bridge4: entered promiscuous mode [ 777.414667][T26393] bond8: (slave bridge4): Enslaving as an active interface with an up link [ 777.508463][T15212] net_ratelimit: 23 callbacks suppressed [ 777.508484][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 777.643442][T26408] xt_hashlimit: size too large, truncated to 1048576 [ 777.650326][T26412] xt_hashlimit: size too large, truncated to 1048576 [ 777.667385][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 777.709457][T26416] 0XD: renamed from gretap0 (while UP) [ 777.731080][T26416] 0XD: entered allmulticast mode [ 777.807499][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 777.939024][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 778.065525][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 778.242574][T26433] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 778.315529][T26430] bond7: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 778.378847][T26430] bond7 (unregistering): Released all slaves [ 778.516291][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 778.545238][T26447] smc: net device vlan1 applied user defined pnetid SYZ2 [ 778.562391][T26447] validate_nla: 34 callbacks suppressed [ 778.562414][T26447] netlink: 'syz.1.5390': attribute type 83 has an invalid length. [ 778.646856][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 778.698818][T26453] netlink: 'syz.1.5392': attribute type 2 has an invalid length. [ 778.756266][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 778.925632][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 779.010879][T26465] netlink: 'syz.3.5395': attribute type 1 has an invalid length. [ 779.045102][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 779.318461][T26478] __nla_validate_parse: 72 callbacks suppressed [ 779.318483][T26478] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5399'. [ 779.376356][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 779.383813][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 779.491597][T26491] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5403'. [ 779.880811][T15224] [ 779.883243][T15224] ====================================================== [ 779.890346][T15224] WARNING: possible circular locking dependency detected [ 779.897427][T15224] syzkaller #0 Not tainted [ 779.901865][T15224] ------------------------------------------------------ [ 779.908961][T15224] kworker/u8:28/15224 is trying to acquire lock: [ 779.915312][T15224] ffffffff8ec5eb20 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x231/0x1900 [ 779.925024][T15224] [ 779.925024][T15224] but task is already holding lock: [ 779.932421][T15224] ffffffff8e9f6cc0 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0xa9c/0x2060 [ 779.941810][T15224] [ 779.941810][T15224] which lock already depends on the new lock. [ 779.941810][T15224] [ 779.952236][T15224] [ 779.952236][T15224] the existing dependency chain (in reverse order) is: [ 779.961449][T15224] [ 779.961449][T15224] -> #8 (wq_pool_mutex){+.+.}-{4:4}: [ 779.969074][T15224] __mutex_lock+0x19d/0x1550 [ 779.974239][T15224] __alloc_workqueue+0xa9c/0x2060 [ 779.979850][T15224] alloc_workqueue_noprof+0xe3/0x210 [ 779.985708][T15224] padata_alloc+0xbe/0x360 [ 779.990687][T15224] pcrypt_init_padata+0x27/0x100 [ 779.996257][T15224] pcrypt_init+0x60/0xc0 [ 780.001171][T15224] do_one_initcall+0x250/0x870 [ 780.005668][T26524] veth1_to_bond: entered allmulticast mode [ 780.006495][T15224] do_initcall_level+0x10a/0x1a0 [ 780.017777][T15224] do_initcalls+0x59/0xa0 [ 780.022668][T15224] kernel_init_freeable+0x29d/0x3e0 [ 780.028429][T15224] kernel_init+0x1d/0x1d0 [ 780.033323][T15224] ret_from_fork+0x514/0xb70 [ 780.038509][T15224] ret_from_fork_asm+0x1a/0x30 [ 780.043831][T15224] [ 780.043831][T15224] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 780.051623][T15224] cpus_read_lock+0x42/0x160 [ 780.056779][T15224] static_key_slow_inc+0x12/0x30 [ 780.062793][T15224] nbd_genl_reconfigure+0x1301/0x1e80 [ 780.068843][T15224] genl_family_rcv_msg_doit+0x233/0x340 [ 780.075068][T15224] genl_rcv_msg+0x614/0x7a0 [ 780.080267][T15224] netlink_rcv_skb+0x226/0x4a0 [ 780.085586][T15224] genl_rcv+0x28/0x40 [ 780.090135][T15224] netlink_unicast+0x7bb/0x940 [ 780.095554][T15224] netlink_sendmsg+0x813/0xb40 [ 780.100919][T15224] sock_sendmsg_nosec+0x13a/0x180 [ 780.106517][T15224] ____sys_sendmsg+0x54e/0x850 [ 780.111860][T15224] ___sys_sendmsg+0x2a5/0x360 [ 780.117146][T15224] __x64_sys_sendmsg+0x1b1/0x290 [ 780.122646][T15224] do_syscall_64+0x174/0x580 [ 780.127792][T15224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 780.134251][T15224] [ 780.134251][T15224] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 780.141941][T15224] __mutex_lock+0x19d/0x1550 [ 780.147098][T15224] nbd_queue_rq+0x373/0x1150 [ 780.152260][T15224] blk_mq_dispatch_rq_list+0x499/0x1990 [ 780.158397][T15224] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 780.165314][T15224] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 780.171826][T15224] blk_mq_run_work_fn+0x16c/0x300 [ 780.174980][T26512] can: request_module (can-proto-0) failed. [ 780.177403][T15224] process_scheduled_works+0xa8e/0x14e0 [ 780.189378][T15224] worker_thread+0xa47/0xfb0 [ 780.194515][T15224] kthread+0x388/0x470 [ 780.199127][T15224] ret_from_fork+0x514/0xb70 [ 780.204287][T15224] ret_from_fork_asm+0x1a/0x30 [ 780.209578][T15224] [ 780.209578][T15224] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 780.216808][T15224] __mutex_lock+0x19d/0x1550 [ 780.221934][T15224] nbd_queue_rq+0xc1/0x1150 [ 780.226997][T15224] blk_mq_dispatch_rq_list+0x499/0x1990 [ 780.233071][T15224] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 780.239926][T15224] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 780.246438][T15224] blk_mq_run_work_fn+0x16c/0x300 [ 780.252044][T15224] process_scheduled_works+0xa8e/0x14e0 [ 780.258222][T15224] worker_thread+0xa47/0xfb0 [ 780.263341][T15224] kthread+0x388/0x470 [ 780.267939][T15224] ret_from_fork+0x514/0xb70 [ 780.273059][T15224] ret_from_fork_asm+0x1a/0x30 [ 780.278345][T15224] [ 780.278345][T15224] -> #4 (set->srcu){.+.+}-{0:0}: [ 780.285476][T15224] __synchronize_srcu+0xc9/0x2f0 [ 780.290962][T15224] elevator_switch+0x1e8/0x7b0 [ 780.296293][T15224] elevator_change+0x2fa/0x480 [ 780.301575][T15224] elevator_set_default+0x375/0x440 [ 780.307295][T15224] blk_register_queue+0x3f3/0x4e0 [ 780.312905][T15224] __add_disk+0x6cb/0xe30 [ 780.317809][T15224] add_disk_fwnode+0xfb/0x4b0 [ 780.323037][T15224] nbd_dev_add+0x733/0xb60 [ 780.328006][T15224] nbd_init+0x15f/0x1e0 [ 780.332778][T15224] do_one_initcall+0x250/0x870 [ 780.338081][T15224] do_initcall_level+0x10a/0x1a0 [ 780.343548][T15224] do_initcalls+0x59/0xa0 [ 780.348415][T15224] kernel_init_freeable+0x29d/0x3e0 [ 780.354144][T15224] kernel_init+0x1d/0x1d0 [ 780.359000][T15224] ret_from_fork+0x514/0xb70 [ 780.364122][T15224] ret_from_fork_asm+0x1a/0x30 [ 780.369406][T15224] [ 780.369406][T15224] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 780.377232][T15224] __mutex_lock+0x19d/0x1550 [ 780.382346][T15224] elevator_change+0x1af/0x480 [ 780.387682][T15224] elevator_set_none+0xb5/0x140 [ 780.393088][T15224] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 780.399439][T15224] nbd_start_device+0x189/0xb30 [ 780.404822][T15224] nbd_genl_connect+0x1597/0x1c10 [ 780.410390][T15224] genl_family_rcv_msg_doit+0x233/0x340 [ 780.416461][T15224] genl_rcv_msg+0x614/0x7a0 [ 780.421495][T15224] netlink_rcv_skb+0x226/0x4a0 [ 780.426804][T15224] genl_rcv+0x28/0x40 [ 780.431334][T15224] netlink_unicast+0x7bb/0x940 [ 780.436620][T15224] netlink_sendmsg+0x813/0xb40 [ 780.442311][T15224] sock_sendmsg_nosec+0x13a/0x180 [ 780.447912][T15224] ____sys_sendmsg+0x54e/0x850 [ 780.453204][T15224] ___sys_sendmsg+0x2a5/0x360 [ 780.458410][T15224] __x64_sys_sendmsg+0x1b1/0x290 [ 780.463880][T15224] do_syscall_64+0x174/0x580 [ 780.469017][T15224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 780.475438][T15224] [ 780.475438][T15224] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 780.484053][T15224] blk_alloc_queue+0x544/0x690 [ 780.489342][T15224] __blk_mq_alloc_disk+0x194/0x390 [ 780.494986][T15224] nbd_dev_add+0x494/0xb60 [ 780.499930][T15224] nbd_init+0x15f/0x1e0 [ 780.504605][T15224] do_one_initcall+0x250/0x870 [ 780.509905][T15224] do_initcall_level+0x10a/0x1a0 [ 780.515383][T15224] do_initcalls+0x59/0xa0 [ 780.520284][T15224] kernel_init_freeable+0x29d/0x3e0 [ 780.526018][T15224] kernel_init+0x1d/0x1d0 [ 780.530915][T15224] ret_from_fork+0x514/0xb70 [ 780.536037][T15224] ret_from_fork_asm+0x1a/0x30 [ 780.541343][T15224] [ 780.541343][T15224] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 780.548578][T15224] fs_reclaim_acquire+0x71/0x100 [ 780.554073][T15224] prepare_alloc_pages+0x15b/0x650 [ 780.559727][T15224] __alloc_frozen_pages_noprof+0x12f/0x380 [ 780.566062][T15224] __alloc_pages_noprof+0x10/0x100 [ 780.571703][T15224] pcpu_populate_chunk+0x181/0xb30 [ 780.577361][T15224] pcpu_alloc_noprof+0xbca/0x1900 [ 780.582972][T15224] xt_percpu_counter_alloc+0x145/0x1e0 [ 780.589059][T15224] translate_table+0x1311/0x2040 [ 780.594594][T15224] ip6t_register_table+0x112/0x320 [ 780.600235][T15224] ip6table_security_table_init+0x41/0x70 [ 780.606506][T15224] xt_find_table_lock+0x311/0x400 [ 780.612057][T15224] xt_request_find_table_lock+0x26/0x100 [ 780.618214][T15224] do_ip6t_get_ctl+0x77b/0x12f0 [ 780.623594][T15224] nf_getsockopt+0x26e/0x290 [ 780.628789][T15224] ipv6_getsockopt+0x213/0x2c0 [ 780.634107][T15224] do_sock_getsockopt+0x51d/0x7e0 [ 780.639656][T15224] __x64_sys_getsockopt+0x1a4/0x240 [ 780.645382][T15224] do_syscall_64+0x174/0x580 [ 780.650495][T15224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 780.656936][T15224] [ 780.656936][T15224] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 780.664714][T15224] __lock_acquire+0x1520/0x2cf0 [ 780.670113][T15224] lock_acquire+0x106/0x350 [ 780.675146][T15224] __mutex_lock+0x19d/0x1550 [ 780.680259][T15224] pcpu_alloc_noprof+0x231/0x1900 [ 780.685807][T15224] __alloc_workqueue+0xb2c/0x2060 [ 780.694745][T15224] alloc_workqueue_noprof+0xe3/0x210 [ 780.700559][T15224] __rds_conn_create+0x130d/0x2250 [ 780.706265][T15224] rds_conn_create+0x43/0x60 [ 780.711404][T15224] rds_tcp_accept_one+0x44f/0xd40 [ 780.717013][T15224] rds_tcp_accept_worker+0x1d/0x70 [ 780.722671][T15224] process_scheduled_works+0xa8e/0x14e0 [ 780.728798][T15224] worker_thread+0xa47/0xfb0 [ 780.733914][T15224] kthread+0x388/0x470 [ 780.738537][T15224] ret_from_fork+0x514/0xb70 [ 780.743678][T15224] ret_from_fork_asm+0x1a/0x30 [ 780.748964][T15224] [ 780.748964][T15224] other info that might help us debug this: [ 780.748964][T15224] [ 780.759192][T15224] Chain exists of: [ 780.759192][T15224] pcpu_alloc_mutex --> cpu_hotplug_lock --> wq_pool_mutex [ 780.759192][T15224] [ 780.772301][T15224] Possible unsafe locking scenario: [ 780.772301][T15224] [ 780.779766][T15224] CPU0 CPU1 [ 780.785173][T15224] ---- ---- [ 780.790540][T15224] lock(wq_pool_mutex); [ 780.794808][T15224] lock(cpu_hotplug_lock); [ 780.801841][T15224] lock(wq_pool_mutex); [ 780.808619][T15224] lock(pcpu_alloc_mutex); [ 780.813149][T15224] [ 780.813149][T15224] *** DEADLOCK *** [ 780.813149][T15224] [ 780.821303][T15224] 4 locks held by kworker/u8:28/15224: [ 780.826780][T15224] #0: ffff8880329eb940 ((wq_completion)krdsd){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 780.837735][T15224] #1: ffffc90010017c40 ((work_completion)(&rtn->rds_tcp_accept_w)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 780.850439][T15224] #2: ffff888077ff4a60 (&rtn->rds_tcp_accept_lock){+.+.}-{4:4}, at: rds_tcp_accept_one+0xb3/0xd40 [ 780.861175][T15224] #3: ffffffff8e9f6cc0 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0xa9c/0x2060 [ 780.870939][T15224] [ 780.870939][T15224] stack backtrace: [ 780.876831][T15224] CPU: 0 UID: 0 PID: 15224 Comm: kworker/u8:28 Not tainted syzkaller #0 PREEMPT(full) [ 780.876851][T15224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 780.876862][T15224] Workqueue: krdsd rds_tcp_accept_worker [ 780.876885][T15224] Call Trace: [ 780.876893][T15224] [ 780.876900][T15224] dump_stack_lvl+0xe8/0x150 [ 780.876923][T15224] print_circular_bug+0x2e1/0x300 [ 780.876940][T15224] check_noncircular+0x12e/0x150 [ 780.876966][T15224] __lock_acquire+0x1520/0x2cf0 [ 780.876987][T15224] ? check_path+0x21/0x40 [ 780.877008][T15224] ? check_noncircular+0xda/0x150 [ 780.877031][T15224] ? add_lock_to_list+0xc7/0x100 [ 780.877054][T15224] ? lockdep_unlock+0x5d/0xd0 [ 780.877070][T15224] ? __lock_acquire+0x13e8/0x2cf0 [ 780.877091][T15224] ? pcpu_alloc_noprof+0x231/0x1900 [ 780.877108][T15224] lock_acquire+0x106/0x350 [ 780.877126][T15224] ? pcpu_alloc_noprof+0x231/0x1900 [ 780.877148][T15224] __mutex_lock+0x19d/0x1550 [ 780.877164][T15224] ? pcpu_alloc_noprof+0x231/0x1900 [ 780.877181][T15224] ? __pfx___mutex_trylock_common+0x10/0x10 [ 780.877197][T15224] ? pcpu_alloc_noprof+0x231/0x1900 [ 780.877212][T15224] ? trace_contention_end+0x3d/0x140 [ 780.877227][T15224] ? __pfx___mutex_lock+0x10/0x10 [ 780.877242][T15224] ? __mutex_lock+0x30d/0x1550 [ 780.877262][T15224] ? __pfx___mutex_lock+0x10/0x10 [ 780.877278][T15224] pcpu_alloc_noprof+0x231/0x1900 [ 780.877296][T15224] ? __kmalloc_cache_node_noprof+0x3ce/0x630 [ 780.877319][T15224] __alloc_workqueue+0xb2c/0x2060 [ 780.877345][T15224] alloc_workqueue_noprof+0xe3/0x210 [ 780.877368][T15224] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 780.877391][T15224] ? mutex_init_lockdep+0xdf/0x110 [ 780.877414][T15224] __rds_conn_create+0x130d/0x2250 [ 780.877434][T15224] ? __rds_conn_create+0x2d2/0x2250 [ 780.877457][T15224] ? __pfx___rds_conn_create+0x10/0x10 [ 780.877477][T15224] ? __ipv6_chk_addr_and_flags+0x688/0x7e0 [ 780.877546][T15224] ? __ipv6_chk_addr_and_flags+0x184/0x7e0 [ 780.877567][T15224] rds_conn_create+0x43/0x60 [ 780.877588][T15224] rds_tcp_accept_one+0x44f/0xd40 [ 780.877610][T15224] ? __pfx_rds_tcp_accept_one+0x10/0x10 [ 780.877633][T15224] ? rcu_is_watching+0x15/0xb0 [ 780.877655][T15224] ? process_scheduled_works+0xa20/0x14e0 [ 780.877671][T15224] rds_tcp_accept_worker+0x1d/0x70 [ 780.877690][T15224] process_scheduled_works+0xa8e/0x14e0 [ 780.877716][T15224] ? __pfx_process_scheduled_works+0x10/0x10 [ 780.877734][T15224] ? assign_work+0x3cf/0x5d0 [ 780.877751][T15224] worker_thread+0xa47/0xfb0 [ 780.877773][T15224] ? __kthread_parkme+0x71/0x1f0 [ 780.877794][T15224] kthread+0x388/0x470 [ 780.877815][T15224] ? __pfx_worker_thread+0x10/0x10 [ 780.877830][T15224] ? __pfx_kthread+0x10/0x10 [ 780.877851][T15224] ret_from_fork+0x514/0xb70 [ 780.877872][T15224] ? __pfx_ret_from_fork+0x10/0x10 [ 780.877892][T15224] ? __switch_to+0xc89/0x1420 [ 780.877910][T15224] ? __pfx_kthread+0x10/0x10 [ 780.877930][T15224] ret_from_fork_asm+0x1a/0x30 [ 780.877950][T15224] [ 780.878153][T26522] veth1_to_bond: left allmulticast mode [ 781.200145][T26512] netlink: 'syz.4.5407': attribute type 21 has an invalid length. [ 781.208370][T26512] netlink: 'syz.4.5407': attribute type 22 has an invalid length. [ 781.223703][T26512] netlink: 'syz.4.5407': attribute type 23 has an invalid length. [ 781.232492][T26512] netlink: 'syz.4.5407': attribute type 25 has an invalid length. [ 781.241502][T26512] netlink: 'syz.4.5407': attribute type 26 has an invalid length. [ 781.250298][T26512] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5407'. [ 781.269227][T26523] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 782.545285][T15224] net_ratelimit: 19 callbacks suppressed [ 782.545310][T15224] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 782.675357][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 782.784989][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 782.895627][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 783.004989][T15224] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 783.115329][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 783.235007][T15224] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 783.344916][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 783.454993][T15208] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 783.564925][T15212] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 787.554999][ T5889] net_ratelimit: 35 callbacks suppressed [ 787.555024][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 787.675214][ T5898] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 787.785361][T15224] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 787.895077][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 788.005086][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 788.115375][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 788.224997][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 788.346644][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 788.455295][ T5889] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 788.564940][T15214] bond3: (slave ip6gretap1): failed to get link speed/duplex