last executing test programs: 2.997443222s ago: executing program 2 (id=3908): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)='%-5lx \x00'}, 0x20) r2 = socket(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000600), 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000009c0)={0xffffffffffffffff, 0xe0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000700)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x6, &(0x7f0000000740)=[0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa9, &(0x7f00000007c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000800), &(0x7f0000000840), 0x8, 0xf2, 0x8, 0x8, &(0x7f0000000880)}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a40)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3}, [@map_idx={0x18, 0x0, 0x5, 0x0, 0x2}]}, &(0x7f0000000500)='GPL\x00', 0x2, 0x29, &(0x7f0000000540)=""/41, 0x41100, 0x18, '\x00', r8, 0x1b, r7, 0x8, &(0x7f0000000640)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000006c0)={0x0, 0x3, 0x469, 0x5}, 0x10, r9, 0x0, 0x1, 0x0, &(0x7f0000000a00)=[{0x3, 0x1, 0xc, 0xa}], 0x10, 0x9}, 0x94) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001300)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}, @TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0xc854}, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@delchain={0x2c, 0x66, 0x221, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff2}, {}, {0xb, 0xfff3}}, [@TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004800) syz_genetlink_get_family_id$tipc2(&(0x7f0000000680), r10) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="20000000720033030600fd0004000000070000007c22ed16135e2bfc46b1f84840f1408807468edb63726ad002bd5e4dd9a53961e7416e897da0705ba58f351f65157b5e9fb8c23c49d877dfa7fb8dd88002583a51a4023fcca6148e2862ecd9b5e028ec7e14669c83053f37ca49d259c9670b2f39a7dc9bf180ca11857b7e4c3956a639accc03ce75d3436d488c613883f56571ee2dbcbf2df0aed6a713615dac72ecd846eba4b566a53a493932ab30f37e38aa2e69d0791c0d7b6099425c8fd8bf3e63c7d4e2db4e313dd9150092f3882b78f13fa1fb38de8482739268", @ANYRES32=0x0, @ANYBLOB="08000100feffff7f"], 0x20}}, 0x20000050) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r14, &(0x7f0000000000)=[{&(0x7f0000000200)="db", 0x1}], 0x1, 0x8840000, 0x0) ioctl$TUNGETFILTER(r14, 0x801054db, &(0x7f0000000000)=""/163) r15 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r15, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r16 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r16, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r15, &(0x7f0000000b00)=ANY=[], 0x4b) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r13, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b91f04076003008cb89e00f086dd", 0x0, 0x1, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 2.690071526s ago: executing program 2 (id=3912): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_int(r1, 0x0, 0x12, &(0x7f00000000c0)=0x5, 0x17) sendmmsg$inet(r1, &(0x7f0000000100)=[{{&(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)='\b\x00\x00\x00(\x00\x00\x00', 0x8}], 0x1}}], 0x1, 0x4800) (async) recvmsg(r1, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x10020) (async) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r1], 0x20}, 0x1, 0x0, 0x0, 0x20008061}, 0x4004812) 1.742936519s ago: executing program 2 (id=3928): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000180)=@in4={0x21, 0x0, 0x2, 0x0, {0x2, 0x4e21, @local}}, 0x24) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) sendmmsg$nfc_llcp(0xffffffffffffffff, 0x0, 0x0, 0x41) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) write$tun(r1, &(0x7f0000000440)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0xfdef) r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @loopback}, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff00000000017c0000040042800c0001802000060090390000100002"], 0x34}, 0x1, 0x0, 0x0, 0x4000895}, 0xc000) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000180)=ANY=[@ANYBLOB="e0000002ac1414aa0100000002"], 0x18) syz_emit_ethernet(0x2a, &(0x7f0000001800)={@random="976048cf8812", @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x8, 0x2, 0x0, @rand_addr=0x64010100, @multicast2}, @address_request={0x11, 0x0, 0x0, 0x6}}}}}, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x3c}, 0x2, @in6=@mcast2, 0x6, 0x4, 0x3}]}]}, 0xfc}}, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20004048, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @empty, 0x4}, 0x1c) getsockopt$inet_int(r6, 0x0, 0xe, 0x0, &(0x7f0000000500)=0x3) socket$inet_tcp(0x2, 0x1, 0x0) r7 = accept4$inet(r2, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000600)=0x10, 0x80000) getsockopt$inet_mreqsrc(r7, 0x0, 0x25, &(0x7f0000000400)={@dev, @initdev, @multicast1}, &(0x7f0000000080)=0xc) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000010400004000fedbdf2501f80000", @ANYRES32=0x0, @ANYBLOB="01020400000000002800128008000100736974001c00028008000200c6120001060008001900000005000a00fd000000080004000100010008000a00fa"], 0x58}}, 0x0) getsockopt$X25_QBITINCL(r4, 0x106, 0x1, 0x0, &(0x7f0000000040)=0x13fe4c102fd7fdb3) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r10, 0x89f4, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000380)={@empty, 0x0, 0x0, 0x30, 0x0, [{@initdev}, {@initdev}, {@dev}]}}) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f00000041c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_GET(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000006c0)={0x14, r11, 0x1, 0x70bd28}, 0x14}}, 0x4000080) 1.398894592s ago: executing program 4 (id=3932): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f00000000c0)={'wlan0\x00'}) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x401, 0x1000004, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x20000}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x1}, @IFLA_OPERSTATE={0x5, 0x10, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac141400340008"], 0x2c}}, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 1.341495045s ago: executing program 2 (id=3933): r0 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="18220000009500"/24], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x40, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xc}, {0x0, 0x9}, {0xffff, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x8, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x4}}, @TCA_FLOWER_KEY_MPLS_LABEL={0x8, 0x46, 0x5e41}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}}, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', r1}, 0x94) 1.131382851s ago: executing program 1 (id=3937): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) 1.116327661s ago: executing program 4 (id=3938): pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, 0x0, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010004b836e4f7096ad98000000000000d6ce6e1b95c001cc6e5f31b8d9", @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100626f6e64000000000c00028008000200", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x0) 990.209706ms ago: executing program 3 (id=3940): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r0, @ANYRES32=0x0, @ANYRESDEC=r0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000437d8c6b0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) unshare(0x24020400) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000580)={r3, 0x0, 0x0}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001a000100000000000000000081"], 0x1c}}, 0x0) r5 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r5, &(0x7f0000000240)={&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7, @local, 0x0, 0x3}, 0x80, 0x0}, 0x20000810) ioctl$EXT4_IOC_CHECKPOINT(r5, 0x4004662b, &(0x7f0000000000)=0x1) 973.392408ms ago: executing program 1 (id=3941): r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) socketpair(0x10, 0x3, 0x4, &(0x7f0000000000)) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000080)={r4, @in6={{0xa, 0x4e23, 0x4004, @empty, 0xc}}, 0x9, 0xb73}, 0x90) (async) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sm3)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) (async) r5 = accept4(r1, 0x0, 0x0, 0x80800) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x4c, 0x12, 0x400, 0x70bd2c, 0x25dfdbfb, {0x11, 0x6, 0x10, 0x0, {0x4e23, 0x4e23, [0x0, 0x5, 0x3, 0xd21], [0x0, 0xd, 0x7, 0xff], 0x0, [0x1ff, 0x1ff]}, 0x2}}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x40) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x140a, 0x4, 0x70bd2c, 0x25dfdbfc}, 0x10}, 0x1, 0x0, 0x0, 0x20040000}, 0x4020) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="00012cbd7000fddbdf252e00000008000300", @ANYRES32=r8, @ANYBLOB="bb7f679790437613f8a5d3f256f196b7f48032b03b94de53267dd2d2e3ad94afc4e9c71cef4c19772107c913ce5f68f1a69b675ad78b9cab15171d34ac85b8d85ea652f086479f6fc249a3ff8d6c334b47aa4c951711a7465b1d8780469f0acbe67a50ba042a41197904c6cc68580f0e84923d0214043b7007d36cc07619bc8640553c56de2be70577cafe9339261abad9f124a5b5d08498c9f3f4c095a4b441fd3a67eece409dfbaad39a820ae3b224fed337d45cd26b451690d8636ba84b6576e43e88ef2da3b43a4d72cc50ca7cd6e4b6abbd93ebfab3522184b717c713a3ad43de4703b129e22e47f2f0ffe2100f4366018486304af3d4b3abfbefe5867985a21649f53770e55ffb4d69eebe826fc55927205e90901721b3d2bc14d88e9440c7c675b76bb9c1b2f917b0085f77f6acddb49e6aae85600ad3"], 0x1c}, 0x1, 0x0, 0x0, 0x84}, 0x9810) (async) r9 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) bind$can_j1939(r9, &(0x7f0000000340)={0x1d, r10, 0x2, {0x2, 0x0, 0x6}, 0xfe}, 0x18) (async) r11 = syz_init_net_socket$ax25(0x3, 0x5, 0xcb) ioctl$SIOCAX25ADDFWD(r11, 0x89ea, &(0x7f0000002940)={@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}) (async, rerun: 32) connect$can_j1939(r9, &(0x7f0000000180)={0x1d, r10, 0xc, {0x0, 0x0, 0x4}, 0xff}, 0x18) (async, rerun: 32) r12 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r12, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) sendto$packet(r12, &(0x7f0000000080)="18", 0x10, 0x0, &(0x7f00000000c0)={0x11, 0xe, r13, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vxcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f0000000140)={0x1d, r14}, 0x10) (async, rerun: 32) sendmsg$can_bcm(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0500000003"], 0x48}}, 0x0) (async, rerun: 32) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r15, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001080)=ANY=[@ANYBLOB="3000000040000701feffffff00000000047c0000040042801400018006000600800a000008001c00", @ANYRES16=r15, @ANYRES8=r0], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 951.975422ms ago: executing program 2 (id=3942): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}]}}]}, 0x8c}}, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000", @ANYRES32, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@o_path={0x0, 0x0, 0x18}, 0x18) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c000100000000000000000002"], 0x114}], 0x1}, 0x0) socket$inet(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}]}}]}, 0x8c}}, 0x0) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000", @ANYRES32, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@o_path={0x0, 0x0, 0x18}, 0x18) (async) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c000100000000000000000002"], 0x114}], 0x1}, 0x0) (async) 835.504601ms ago: executing program 0 (id=3943): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000007c0)={0x788, 0x29, 0x10, 0x70bd2b, 0x25dfdbfc, {0x11}, [@typed={0x8, 0x12b, 0x0, 0x0, @u32=0xe}, @generic="5f4775053b3ac2fb63fe846390a9dd9691d0ae4e", @generic="7c499f02af0edb680f43ec483dd0444a850bf6e36cd86d3c64e0fe82acc30eb3c940dc21db014bd268a38fcc2a7c62e0f33872e1686e17e6d0b84032494eb4baf6817ecb93a3739f6dd6cda94b72e6d3d772e953fd9870a4e2c5a4b59155dad4e04abdd30b7f626d21a16c2fd03e1aea77028ed95942ed536697e42b70da31e8f54a6cbb891ba262469b2c265201f7c785173f776e797de117f026eddf74b567e44a1946edfd587bfa03c7fc60f3ba939ef1dc9528fc9c9ed7cc2dbdb472a8825266ff005905c1d8197f3b9e288a4d02457b4424f8dde41d0878e23fe2ab6f1aae45a75e0b9b1fb733f12ae3bfff2d5f946fe83eda6f30a42ad8a73f8951efc437ae02f9fa0d8c51018953ef22077c95478c96580b5de1deee77e74166477edabaed21a3a85fe3217bbb40232205353805bd23503d6751d8feec26d86c966692e4689c39d47806157f0bd89a2edbc79a6f371142f594a64de2d5d115b07ea28db1ebf47128e30968a31fa6471688df4d95d1b3228c402f781b0b66a05fe103b355462fd10042726ac8caafdf8b135d4b3f93c1986cfa5f98ddea30e7e2fabe7b8b6d02d5395855001ce1106a79af4a754493bf6f5c02165bd0db58e5bda002ac87e5030c8f9caade14f6ce6b0558cd5baa0607fe7d057ddc572c65adc540cb1d9ef32ffb1bfa98a9d8d7b3ea731e52181c5879f396babfe754b7160606218173f11a06ab92a2faca95a7f3616a0ea07046448040184e043b1db9c4e9967d5df2125f4ecb396379b52c80b769d1a4050c4d608c91659098f04691a70a480f51563a0f6b67e8ce40653746622b13a75862f5e2ed00c97e559ca64fba277c789844e30f39c150d1fcb690ce1d0ee5f4c92799a7ce6149961f6d48a2a1520a253ba88e71f28f23d713981cabd7901cc2c2f7ecc82798401728432208fcf82e40ce54cdbe5e543cdf9acd6fab947c5ac8cd95ee74c1ff6daafd37c5c197a1bf54832bc00167caefbe7037fc3c0a2824d88b7aae16bf5c4e7cf01176f8213f453740c2a617c291192067c3788353b7afbc075034de6b9e7599dcaf9afec4935e28863662359f67f1ef36baeb1cb376f9c0b52064ceb02ea82e41d297c364a7d41390f2d64545da45da271ebb5957ed74e37fa36e568347a91e80822d0ec0991540bfb451f4bf972c8547cbe27074660a756ee6c5224e45d718726a3ede86eb7d026c9011f8dce70d56cf5625fa3edc2ff90edfd17a67441e32afeb2d7810835564cf8415bb4b76c02db89b2989c5c4573f5d4165b1c230f674af1284428344278254a65f8801fb10462da74efba32bd4f6da3e8bde0054e9e22c7da340c044fafc567f81e3e6eae27712a0576c08ae299fa119fc7323f30b1f378b4362dc6a0a278be1c0dee7bf9fc1e7b8dc25d8ad52a383805667af2e8c79b944aea86b35b26d3892be37b4a5f7cb99f891aa683e42a89ecaca21a5fb6a084a069543017117fc6c3c0667db3fcb520d55c8652e6a00a16e3af8de43c3dfc2b77e4a20061d2d3f011e979e529f4142c75859e1f833b86758db0ccbe85652ec6d9c82f9767b888ce96001cbcde0e8d1e308123140f1f91d72b2d49138f5361292ed10eae3d55a8deb203e1f46a0a898e7db6be5e1e1285b701de4a14db106581efe2cd0940ed3a9959751d119aaff37dae758e66d96ec7fe44a894c89cb7a65e2d4f708231fa36c3abd4dc59f5126e599bc4bc14fa639c424ef264f442f8102e45b42f8bf12d36547308bef0347ca1eb753371af3f92ccc1e77a9e77627d6c7040ac1d91e07ed21f8503fb5bceb0d264729ef4224c5fe800327077f37224ff4035fb9284c2893c6d35ecc31ec94b9db404743a06c2649a3761b52c5c429bbbb64834deaa473a141641551ba6f5de346862f029ed8b5da358f36fd023cc8381ef261561e75575c3f9ebb11ac33d94588a659b83670703b3dad4d2fb1f9750f29a37acb76d914048a0f48f81a6b7ecf5d304d4667d758b9d9305a76c167efbf281a15ea2b7ff722e70fc212a43979364e24006ea1379f83428f5abaa017f0c371a119c5dfd2eb985810f5436534962149bc08ce36e55218b14c0c38b40abe84d5d0c6355c45a50b084839ab72c6045d399e0ee508bd165231a7ade14d1ff9bb7a303b95ba5e1a7c81737e00abe3876d046f53056404f2fdc85f832e4009a5ce39a3ea6ab0871fc254ff850aed6a1a9962955acbc2d675c735dfd0d2ef24f7b3f06683a9200a764dd48436f93a8463eba37440a92697f71724c1ba7d01e8fbd79d8b35d76ed38b2312c74d6db1a73394d116830bbf5db7fffa0a68dcb7a79de2908e3c9dbaa7876ca87ab3b50af0c4c81c7e6ce0f9e0d9b673c408273cdd4b4186dc7b6e4d840597baf8c8f8c961a932868174f7e35f385e7ac31c8dfafa8b66a4eba7fae51cc02b6ca390268781ffc2a77ab34b05d0cc080b0be5877b5a6ba9b337ccf3b10b3fe004d18b2c7e55b2576cb13cab173e6e007b262ddbf823cd5d7b37cade7a1690c0e8c9f87ffaf81e309661892203504a9960cbfccb89765ded50d8675c2984a75f3886ac48ce922f8b67f6efabb957c0e3e64325d54f1deb1c7ebdd8538ad5aadb0f656abfd537ef166b449e9d9c1937436c4c2e1e6f615b2bf0ad36"]}, 0x788}, 0x1, 0x0, 0x0, 0x20000000}, 0x810) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = accept4(r0, &(0x7f0000000000), &(0x7f0000000080)=0x80, 0x800) bind$netrom(r1, &(0x7f0000000f40)={{0x6, @rose}, [@default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast]}, 0x48) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYBLOB="3800000003010102000000000000000002000009100001800c0002800500010001000000140019800800010088000000080002"], 0x38}, 0x1, 0x0, 0x0, 0x8010}, 0x40004) setsockopt$PNPIPE_HANDLE(r2, 0x113, 0x3, 0x0, 0x0) connect$phonet_pipe(r2, &(0x7f0000001200)={0x23, 0x2, 0xc, 0x21}, 0x10) 824.489035ms ago: executing program 1 (id=3944): sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="9000000020001f", 0x7, 0x0, 0x0, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f00000001c0)=0x18091, 0x4) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14004000250000022abd7000fcdbdf25f9ffffff"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='.', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000140)={'ah\x00'}, &(0x7f0000000180)=0x1e) 746.21485ms ago: executing program 1 (id=3945): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="e000000015000000000000000000000061656769733132382d67656e6572696300"], 0xe0}}, 0x0) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8000000100001"], 0xe8}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f00000000c0)=0x6) syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1) r3 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0080bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x40305839, &(0x7f0000000540)={'\x00', @link_local={0x1, 0x80, 0xc2, 0x5}}) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xa, 0x23, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xebf2, 0x0, 0x0, 0x0, 0x94}, [@jmp={0x5, 0x0, 0x8, 0xa, 0x3, 0xfffffffffffffff4, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x5}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0x3ff}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x8}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x6}, @exit]}, 0x0, 0x101, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4d0}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc020000000000000000000000000000ac1e000100000000000000000000000000000000000000000a00008088000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fdffffffffffffffffffffffffffffff00000000000000004fc4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000020000000000000000000000000000000000000000000000000000000000000084010500ac1414bb000000000000000000000000000000006c0000000a0000007f0000010000000000000000000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb000004d63200000000000000200100000000000000000000000000000000000000000000000000000700000000000000fc020000000000000000000000000001000000003c00000002000000ac141425000000000000000000000000043500000100000000000000000000000000000000000000000000000000000000000000000000003300000002000000fe8000000000000000000000000000000400000000000f00000000000000000000000000ac1414bb000000000000000000000000000000003200000002"], 0x23c}}, 0x4004000) write(r3, &(0x7f0000000040)="1c00000021002551071c0165ff00fc020200000003100f000ee1000c", 0x1c) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18020000ff07000000000000000000008500000036000000850000001100000095"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000680)={r9, r8, 0x25, 0x2, @val=@kprobe_multi=@syms={0x1, 0x0, 0x0, 0x0, 0x9}}, 0x30) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000080)=ANY=[], 0x16) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES8], 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x8, 0x6, 0xc, 0x1, 0x2, 0x7, 0x3, 0x4, 0xe, 0x5, 0x1c, 0x63, 0x6, 0x2}, 0xe) 745.595757ms ago: executing program 3 (id=3946): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @local}}}}, &(0x7f0000000080)=0x80, 0x400) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000100)={@dev, 0x0}, &(0x7f0000000140)=0x14) recvfrom(r2, &(0x7f00000000c0)=""/23, 0x17, 0x12103, &(0x7f0000000180)=@can={0x1d, r3}, 0x80) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r4 = accept4(r1, &(0x7f0000000200)=@sco, &(0x7f0000000280)=0x80, 0x800) setsockopt$MRT6_DEL_MFC(r4, 0x29, 0xcd, &(0x7f00000002c0)={{0xa, 0x4e22, 0x0, @private1, 0x3}, {0xa, 0x4e21, 0x8, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}, 0x1, {[0x4, 0x6, 0x800, 0x5, 0x10, 0x3, 0x1200000, 0x21]}}, 0x5c) connect$rds(r1, &(0x7f0000000340)={0x2, 0x4e22, @local}, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f00000006c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f0000000440)={0x22c, r6, 0x800, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME={0x204, 0x33, @reassoc_req={{{0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_a, @device_a, @random="289c850bbfa9", {0x2, 0xff8}, @value=@ver_80211n={0x0, 0x6, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0x8008, 0x967, @device_b, {0x0, 0x6, @default_ibss_ssid}, @void, @val={0x2d, 0x1a, {0x1, 0x0, 0x0, 0x0, {0xfffffffffffffffc, 0x5, 0x0, 0x15c, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x1, 0x92ca}}, [{0xdd, 0x7e, "cca45e86bd2eb650234f25895bf94e35b495d091bc44c9e8a44ec1cf7228be9ba574c1f780c266e07f9eec80b315e38b3ce6a77719b4995c62f97b90e31fa59637961bb1de2ae27ba983c0f24b8b9ab15c67e340c55dd7fdcc23cd4032a4a42a5b29325e1e395df1e1eeac1efdf208fca4121e7ca26e30a03b77991bcb9d"}, {0xdd, 0x8d, "49d837d5f05d4bc094eec30929c68e5af518747894aaa525ce8339b93f4c96eeafc89c395c7dae4d8728028bba6a0d20ebb30643c35af727b16078ee5484a8bd98991f43375d1074405ea1bd5d0bbc7ad216f1f95e1e80acb8ffb57f55eed891da036da3b4a2d9dce822cec8910397051e813705002a541a0b8fad51dbbfc29e09c09b749e2963cc14708479c3"}, {0xdd, 0x54, "8c9f71bcafa63a925a46c1c0b1b2e1db1fece6c12a63d9d8c341f399f204dd36c07039974f89ffdd19faa81a126e789c6308dda551fa25c1d8a9700793fc5bdbeacaf92917cf3a7ff3d3c03cd34fe11a3b715068"}, {0xdd, 0x2e, "0cc1470d8596ab0cf07822be0c350be44655e49fdeacf85f72f6c5f8d3aa6b80901cd90d33c49bc11750905952c9"}, {0xdd, 0x1f, "c37f622312f245956169ef5090cae4772c7438066bf2990a7da5d66922b823"}]}}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x2e0}]}, 0x22c}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) sendmsg$DCCPDIAG_GETSOCK(r4, &(0x7f0000000980)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000740)={0x1e8, 0x13, 0x200, 0x70bd26, 0x25dfdbfe, {0xa, 0x5, 0x0, 0xd8, {0x4e22, 0x4e23, [0xb804, 0xd, 0x1ff, 0x9], [0x2, 0x8, 0x7, 0x26], 0x0, [0x400]}, 0xcc07, 0x5}, [@INET_DIAG_REQ_BYTECODE={0xb1, 0x1, "6c06ce7a0cacbc2dd95bd25832016e8335447f8c0bb5caeebdc34fad78a12e4d288e9607456da6ddaa954ec23cdcc30fc7139a1199e3232468fdfac842d5383097f3ea26e56671809920f7f326a38be1edb3923792c71ad6484a3fc69114eecfee1e38a6a1e01bfd74d653f90f56b0e5f512aaed6300375090c260a4c46edff8545c7feb67939f5351cc73d84c36f0074de63292367291da53f677d148d95f4ab20fbfe46330b22a1406be9c4f"}, @INET_DIAG_REQ_BYTECODE={0xe2, 0x1, "3e4dcfb4a77ef577d1618425ecc9c1e73b39495c33323c39bdacf4539d07c06dc632926b4416761e559faa2d37cd1afa4dd0653de06c6ce42363d18e58f70bbbb51ac129ac3a216712f1eb08f20b72f4a47edaefaa233ad3994df71330a892c8a6237cb44f293436bc232b2b865270c47260ccf29e3e9fde8a1fc909299ab39a574e52f23d89b686c7e5fbe9f81bac5aeff639c2cf1cc86ff18e3ba8e39b178407fff39a351b5b37478480f654b6f6ff56b6f5ea2dc98edfa03080647f9ad295641adae687ef0ee1d19ee5c0d29e18ff7012946137a747e6b93b86d533a7"}, @INET_DIAG_REQ_BYTECODE={0x4}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x880}, 0x80) sendmsg$nl_route(r2, &(0x7f0000000a80)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)=@ipmr_getroute={0x1c, 0x1a, 0x10, 0x70bd2d, 0x25dfdbfc, {0x80, 0x0, 0x10, 0x9, 0xfd, 0x0, 0xc8, 0x5, 0x400}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x48810}, 0x20004080) (async) connect$bt_l2cap(r2, &(0x7f0000000ac0)={0x1f, 0x8, @none, 0x200, 0x2}, 0xe) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000b00)={0x0, 0x0, {}, {}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000f00), r2) (async) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000f40)={@private2={0xfc, 0x2, '\x00', 0x1}, @empty, @empty, 0x8, 0x8001, 0xf, 0x100, 0xf, 0x5a400f1, r3}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000001040)={'erspan0\x00', &(0x7f0000000fc0)={'erspan0\x00', r3, 0x80, 0x7, 0xcd80, 0x200, {{0x9, 0x4, 0x2, 0x2d, 0x24, 0x66, 0x0, 0xa, 0x29, 0x0, @empty, @remote, {[@noop, @lsrr={0x83, 0xf, 0x1e, [@rand_addr=0x64010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) sendmsg$ETHTOOL_MSG_EEE_SET(r5, &(0x7f0000001140)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001100)={&(0x7f00000010c0)={0x24, r8, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0x2}, @ETHTOOL_A_EEE_ENABLED={0x5, 0x5, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x20004050) (async) sendmsg$IPCTNL_MSG_CT_GET_STATS(r2, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x14, 0x5, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x4}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40) (async) ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f0000001280)) (async) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r4, 0x8002f515, &(0x7f00000012c0)) (async, rerun: 32) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000001300)={'ipvlan1\x00', {0x2, 0x0, @empty}}) (async, rerun: 32) write$nbd(r1, &(0x7f0000001340)={0x67446698, 0x0, 0x3, 0x3, 0x3, "81bfc0f382742cfbb7e20e56fdaa648def8af4f396cfff4f03f44636c87cb93643a92c128428016059182d19a55d12715b967d20a1e750286ced00a37e83e2d8669ad3af5a8a1e05aeb43bc3eb92f984b41e7feae40763a857e46eeafb88a85af4cc103bdd37d982e87f689b98c597745e7bc6655e98faa77f8894f4cd107031b5fa6d1c7fdb3d3f96f369b662ccedaec19a0c27a02ef30c4c4c41bd163c4de5a23fc7d5c128dd66c5a7060b2d17ce5ef791dc9a06cfe37a4f1ec21eb766cd0d63bd084cacc9625737177a959778cb3e3e098e7ede3b918d0890a6c9011dc0804362782c52a7c2f49900c0cc46b5c44c6ae00f493d0cfd62c906e7caaacab68723c9f0425719159f9ef5020b73d7f4999e07eb09d04cc3788b8bc9d2442c3ff01857d6533ed3565bd43303d521962ce4c17045e6f776071b3649e437f689024541fc0749eba82aa5d2e0473931030e38b12017686dbfc276cf02eae23b416a048e34c4fe7fb7272e923514ad0a82f2ac44f2a83381b252356508a5522d6394c3e4506551ccd932e14dd4cf5b35743a83e677524308a8ff7cba1dc36c011033a3e8d459e713fbb066a9ddf4f4cecc4ab5f1ebe78e8098be51e01c4463b311efcc7d1ad9ac3d60f02f03b75f6aa6e093910ca505ab5263e2f9b2474abbbdb74be144149b33127d9fc8e55b1452622a9f8cb72a7036c0c6693d626fa9cd8f23c8ad37ecab86ea588d8e17b7e372c6f675e27132a49bf74c5ba533fa62e2817c5d33f37bd6fe0be99de6f9c3625961c2a6eee2f8ba3c91194da30f33539c9cb047d05d0bc251b725ec020d6bc4dea81b8eff6ba0fbc48fc788ccc8d75d2e50a86c8ff8721399dc99ba7a58dd59e78c9fce5a8f82285ace7f072a23d96bdd2ac4b9365570042c5c8312ab4d93214bb040d5ef5a617106391d019fce4d784dde174ca01db926adcd26aead31f5e1affffa94e7c167be3dee76a4084a18c7ef7c77273e810126c4c55a1ba6d149b8dc284b854d474480384438086fb897ac2c7b1712488b79c185878fa278ed1cfead87ab660d7c503b3c620689ec1526192b8eaf1041cc7eff325f9e2d2ee4697bd7e45d81bf3f1487b255cdd3ddacd9d59bd89303d8a0797f516459a492bcae90f95b4cba9b3d82fab4399c76a577a08c63772243ea515b250de4540ee7a3d000995260fdb1b16c55ff5db587b508f4366fa85ea2b1c85be352dea46627c1cbe2d10645420b97e47be4e69f12460622af9e14cc8fe6b165d5672d24dadb5e27ae8d7457a97aa69b56fca3639f49f531ca18d4b28516eb61ab5caf64c2d47f1687a950ed50fdc13421936c909d7db01bd81cf06aff231c86663df515a5373d5fc6d2726f236b312a35a877188f80af779ce53fbd0e699ead954c127719564487f3e1a1b59bf9c0debcca2d860c5d96b088ffbeba4e4ee1d5384f37136c33c9091ae7f7d864012db30d80cb1df00d4b28cd2ee8d32affda18c0c51346fdd7950c447c7b6c240f7ea525d1b4475356da07694db1a62effafd9b60d32d9655b018bf2ee8e17affa14c192e6d34d9171574d9d8fbd1b0e359e5df33f58eb439f6cec67fc651e4114e46df7db9f394a9a2124ad644d637936866de287cd83860b09687c1161babb72df6ba267807bc8ea0fb1c34a3ebb28068669ec0e218f65adb5ba10723362b2f0b7e6263b2438308babdd45d852bd7c4870d5cefe2d270af55b090365bcbec48fa544e134bdfc40c810a93df1962ca579db3556912c89c4dd13d1c24c2515ac69cb0fb4cf6a1316e8a4bdd5d2f9ed56b9b3e68c8af0db333d52785f87fa53a210b6a01326c5dc1cb74b91f9975e1e17e6035478d3dae6c4c1570304f67a6e2172445b5004fd1cb5b56e4139c0948eb5b088402aac6157c04172d8b5f1f917b4ab50eb151913bbc57b821ab7819e9e587b7813f4f184007c75dad22482ec3fdb4d49260f480d2cc8f07942873f8f69f7e18d63be5c3443cc0749b11e09b108ffb6b880221b244329fdab96ccf333a4a50ccd047986bb8e636bbb0f4b16ab3b6dda73db6949c3a9456ea1eb29b9d1d6147b4c9b3905e08b5ff1578eaf4b1d95c8142cebb9b49e406e10180aa718324ca575f47bab0f5998d89fefbf36b1483fa74c143231faf4cbd3b90fdee997ffab2b97ca776c63332de796fe2c6726bf4aeb17edd57af91a8d59e3592b9450f1f976bf971dde093c6a13591712636c07818a491038fcefeb6a677338f3e944b388d8bf1fdaa8627c1672fa3d6222da762f87758e450a58336db556f2fbd874ac48669581883a4d2c80ef8f859d01af5a039f862f8693bf0e740ec79da8010d56173eb5660aeb238e0b035dfdbdbf03acb3787587b33573a3889aa60fb3ffcfb0df07af8f6e8e54f58a9f2a899e855b0ae39eb9ce5fea4cd34c00bbb9599f0832ba700c37661ac2350748b25b08e78fd712eaf9e84476d83e2a25811505f3fcaf96cb4e810f738638244c7879941c08d3edbe85e097e32c8b2182e851b30a746d70452db6014053895a7888731f511dfab19ce37df1b2909c63b893734304bae43c925bedbcd3a7212583b4ed5d90500fb5881c0479519b057d3323035503fa98acfb667e67ca2979af477b44fb3f0f595ff1a3cfd3a9127692fe16b713341cc8cce83a5b1bcffb3467ab08ce5183d2c74f581d3695af002948373b217e3560ce71e9a3daa8596da5d23566caa29e7b7b77898210b70ee83f44c1729f367d5392616301b5b16096cb63c90d7ec4a4f9e7648a579aa587a110ba052144401f23f9635f17ccc2516e4d4fc1da8ddedb8b470d07ba3247af28effdf8c1f4e34877f8cef4775da6a0ab1c0a316f33330ea405ae4c84cfa42b98ca6121f70e468750ac78fa8c89591d9fbbef8d3ef89ccab6b0db4ab8081f4a04fccfc81a749dd922f30f2ce97eb7f6921cfc551022228f214fac50bf47a67171e88f359cbf9475c29db52b7d98af88aa33dd1c23e33a064b393ff90f98b061bff44d69575a2e933fba85f6bc1b3b37dd3f5e28fd431f3af366b4e4d610d514ea898d4a053363a275cc3d0ef03a149eeb6b3da24f4d85eb3ce258bafadcd79844d80c466e5ab3e651045337a85db91a8affb13effd4c210f48319d7f247bf0a930480babb09563951414efa0cdfd5f2b42100498bbf46ef792699e98e9d5f8160e35c175f838feb32a386c36ec41e6a3d33f35bf57fb4e6f42b70447b2b931a4333b7b140223303be830c5edcf35df920226a8cab9693a192334b31c9ec74a6f1ebbbaa469897a5fc7021e7821f23e27f0b458124235c2cb035dd08142df48f35bd427d6b15151f3fb81bfbd2cebb2da9963407af30db9d48b05b3a0b157bdc14cbb6c56dd7edaf74bc7e6daf10d903eb196dd5dc76ab4c8df0566874aecdccd340f8f29c4147d91e30f90fd193e37d350f0c423862c4b4b12b545912698cb0a3699f61a5a4507f83e9ddbe3962a60011f420888a6a9ac240b1f6f7067c06cb911dfdc8f61209ded9c06b54330d16bb3efaaf88890d8d2900a09a6b30a18fd51bfd593b6a09f4a6bdeb103cc437f6cd273319c3e101210b66aa2c09d425d307aa82f566fa2bfd0778568f72fa2d8b29e5a7fdc42f05c72cea220e64f8817afe0ada288bd0ecb5b79bf69262fd8b3de3f441ad9638247423ed0a77db1acace4cd17d040676076bd3247f295565bbcd9fac40eeb1b09f24b924ee049fca76f953f80bb82c15f5b82b4ac0abe7c365321a970359f5bd0aa2a45f4f063775cf5bde00bae2874a7a4fce3f9d1d3fe62ba460e8cf960815bfd06929ca80b85778045565c545a901cdd787516656d2f1c2f236e38185c244dfab9cb8c3e2ed57eac365f55f5d77e2b9fed97dc5a7b31242b3e30aef45fb0b164dfc458da5426408220044cb45b4bbedaf02f53eaf8aa6443f7a41599fa888eff4308816a60b189ccf3aa63479871d95e87310bae1d4668d405e065bc1f43abc3cf18a922d81b9b9371e2e6561b9ce863f196d381d1a44ce742f200a24b34b17db2ede34e021ff5d0d9dc651580d19c70fa6c673cde69f38350b80c4d9f9852aed60fe95c3a580f8d510d363f12fd4e3a2e23d314ce19228701976629763c2a9974a5f95f274d4380c240652ad9f8d55af9f148037895699b1dbe9453c06aba6a600041da5326cdbbbda1d2a4d011e2bde102145c5538712a5adeb99ccf4d9dd6a2037ada062e76d9e06029a46f39a328e2058373192fe30edaf7f62353aee8e058bcad42d1c61df0e862403e2e23c53ef6b2d3e9d76d548865810510e7d177fa1602e4a97c2f432f5e2e4e0ba444dd96e781a65d4df6dbf9ce12ec6bc04f2b758282406b1e7516d58d17b0424b807439b15b1f6e6618fcf747519deedebc65baf3fb907a44dbbd3a4902c79458ebd3fbd991aee71a458f62b34d0df143a0e3ad37650f27da20b733fdf8e752ad324833266b78e07bdd20c22bbb8d02721359c0f8d054c9645630d277af49eee684f77603241f2f7f000111b0165b4e8e5c401789da98c5c515424e58259ee4cb20d1679ca802d720bee3a7a671a0bdcfea042e503fe26e490c980669db8a4c6e2ea9108b4e1e29564c81a8836095b8f04fe3cd6ee6f5f6fa762590eee6a61ea7fb43e5c4529e7131448063ff756ba0bf7a10dbc1936adf7f4eed99dec1d55fa0f4aee06f3c6841c8984e669d8636aa2fe24f975273cfd522bc9312592408c3e9ebdf091d5edccbac429045163c1c1ff2fce5440e0a357394b69b2d0b9415e93a9d8765da47e68924a92fa4ee5e9cb22ce7eb27046b0c0fa8a402830d169496732cff6ade33131c7e42f4cd1463a4f6965906174bdf8e50fc0770a2b51201a8af6a774b57dc62366da13d73c47841852397f2ba63e672113f74d0daee152bec101add4a73e107772fc8a8930654732e7d2ddfb77786043d3f304c34b4eca0b3bb0e1432522354b0777b9399adcff4f08888b81dc684ad356699cd43e8f88b6fb1d59addbea6fa7e9c5401335f833a66895255a3f6062ce1980ef03e05d22a3bc2923801ddd5efc017e0794878986ea49d3edb50f3ea067e704f723ec6b73aa5d3d31b319ce5e6d8f505cb7e1a4f475c62d2cc37c5ba91be81ba4388b7566a3a33b83bec06e1e40cd0e93f00ae10a4fdcaa297ad78bef152b867d87dd32c5a3106fa7ed2b8aac84a06849dd095f98254e59ea281ed2e9e3191851881d4c4a5f0770a92b7726b3df469f90ec7f442f0e05515157b46f846a7021aeb86769c1c9a60f783dc5c12dd8c56ced79427ec067f8d03c804bf8318e197e6fca68bedb72050c550f622e076701a5ff277f031ff22c714df1d02b6ecb906a84e0b48e7bedb857ffebb41d5a42c4567ab7d5a443709cbf1ed24a8576cbf93dea26968ee6805976ac9f25bf8ed5da07ba6a6afa69fea15d6c08831c03438dcbff6e313f2d4ccc3465f66af12136cbaf1e7f59f5c703af5b7a07a1892ecd14f1aa6ba64b06dff47a6b8908a543bd2f3022e42fe130729b44483fd7f71c1635bce830dc2836045f2799306d9e100b9faf6ce660419d68a235681d146787ffb06a9a6e6f4aebd6c40b4a7bfe0c9ea3a7421ca2ebde0e4a8fd5c5ea0b1a7dec2ab05161a6c1a3c2b7ddc7affc32d816b5031cfd9d5035e39825c2e9837581276306951e4aabc8279ac8c7ea637c29f87248ca4011a30d44d7956dc9cd5b14162879af2a789f1da9e8d4e6026f964ed5a6a441c12838a6cd273783a62a1b3f6e3912642999286205724993c6105bfce9c784c6"}, 0x1010) (async) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000002400)={{&(0x7f0000002380)=""/5, 0x5}, &(0x7f00000023c0), 0x8}, 0x20) (async) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0x2, &(0x7f0000002440)=0x5, 0x4) r9 = accept(r1, 0x0, &(0x7f0000002480)) sendmsg$NFT_BATCH(r9, &(0x7f0000002680)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000002640)={&(0x7f0000002500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWOBJ={0x104, 0x12, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0xa}, @NFT_OBJECT_SECMARK=@NFTA_OBJ_DATA={0xf0, 0x4, 0x0, 0x1, [@NFTA_SECMARK_CTX={0x28, 0x1, 'system_u:object_r:modules_conf_t:s0\x00'}, @NFTA_SECMARK_CTX={0x1f, 0x1, 'system_u:object_r:lib_t:s0\x00'}, @NFTA_SECMARK_CTX={0x28, 0x1, 'system_u:object_r:crontab_exec_t:s0\x00'}, @NFTA_SECMARK_CTX={0x26, 0x1, 'system_u:object_r:system_map_t:s0\x00'}, @NFTA_SECMARK_CTX={0x29, 0x1, 'system_u:object_r:iptables_conf_t:s0\x00'}, @NFTA_SECMARK_CTX={0x28, 0x1, 'system_u:object_r:useradd_exec_t:s0\x00'}]}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x12c}, 0x1, 0x0, 0x0, 0x4004}, 0x4000) (async, rerun: 64) sendmsg$AUDIT_TRIM(r1, &(0x7f0000002780)={&(0x7f00000026c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002740)={&(0x7f0000002700)={0x10, 0x3f6, 0x20, 0x70bd29, 0x25dfdbfd, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4008050}, 0x90) (rerun: 64) 691.515794ms ago: executing program 2 (id=3947): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xd, 0x0, 0x9, 0x3}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20048081}, 0xc0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r10 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r11, 0x3e}, 0x80, &(0x7f0000000480)=[{&(0x7f00000002c0)='\x00', 0x1}], 0x1}, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg$unix(r13, &(0x7f0000003380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012000, 0x0) sendto$unix(r12, &(0x7f0000000000)="ba", 0x1, 0x48005, 0x0, 0x0) r14 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r14, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="020a0509090000002adf250500190000000092e08a2522ac1e010100000078cc409f4adde94d22ac141429000000000000000002001300020000002bbd7000003500000000000000"], 0x48}}, 0x850) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="440000001000030404001a27f1d117811ec17c8b0000fedbff2500000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b00010062726964676500001400028005002500000000000500260000000000"], 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'sit0\x00'}) 685.25706ms ago: executing program 0 (id=3948): syz_emit_ethernet(0x4a, &(0x7f0000000680)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010102, @local}, {{0x4001, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x10, 0x0, 0x0, 0x4, {[@md5sig={0x13, 0x12, "623eebe039a1f617fd02722e3486ebd9"}]}}}}}}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) connect$unix(r0, 0x0, 0x0) (async) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000000)=0x7) (async) syz_emit_ethernet(0x22, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaa04aaaaaa0180b2783688000000007fffffff450000140000000000899078ac141400ac1414aa"], 0x0) 647.060445ms ago: executing program 3 (id=3949): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1e, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000611210000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="5800000010000300"/20, @ANYRES32=r1, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028005000c00010000001c001a8018000a8014000700fc"], 0x58}, 0x1, 0x2}, 0x0) 632.072187ms ago: executing program 0 (id=3950): r0 = socket(0xa, 0x3, 0x3a) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000140)=@ethtool_wolinfo={0x5, 0x0, 0x10000000, "c8119df9ba26"}}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6tnl0\x00', 0x0, 0xcf5ce5d5dec8dab6, 0x10, 0x2, 0x8, 0x8, @empty, @mcast2, 0x40, 0x7, 0x4, 0x7}}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_pauseparam={0x13}}) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000180)={@loopback, @broadcast, 0x0}, &(0x7f00000001c0)=0xc) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r5, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, r6}, 0x10, &(0x7f0000000280)={&(0x7f0000000900)=@canfd={{0x1, 0x0, 0x1}, 0x2e, 0x2, 0x0, 0x0, "2e5d3ba2c0b2566ca7a04ba70b489293b9192f1b9244b3f9e1751dbe7130703d77b5ba6da2fd06934bde8984666d957ecc19d6d0249355eb17b55f00"}, 0x48}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000200)={@private1, 0x0}, &(0x7f0000000240)=0x14) connect$packet(r0, &(0x7f0000000080)={0x11, 0x8, r4, 0x1, 0x7f, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@mpls_newroute={0x15c, 0x18, 0x800, 0x70bd2d, 0x25dfdbfd, {0x1c, 0x80, 0x10, 0x9, 0x0, 0x4, 0xfd, 0x5, 0xb00}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_NEWDST={0x84, 0x13, [{0x7, 0x0, 0x1}, {0x2, 0x0, 0x1}, {0x5, 0x0, 0x1}, {0x8, 0x0, 0x1}, {0x5}, {0x5}, {0xf4, 0x0, 0x1}, {0xe, 0x0, 0x1}, {0x4}, {0x3130}, {0x1eb9}, {0x9}, {0xe953}, {0x7}, {0x0, 0x0, 0x1}, {0xff001, 0x0, 0x1}, {0x800, 0x0, 0x1}, {0x4}, {0x18, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0xaf1}, {0x7ff}, {0xffffb, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x7}, {0x1, 0x0, 0x1}, {0x8001, 0x0, 0x1}, {0x8, 0x0, 0x1}, {0x2}, {0x6}, {0xed}, {0x5, 0x0, 0x1}]}, @RTA_MULTIPATH={0xc, 0x9, {0x5, 0x20, 0x1, r4}}, @RTA_NEWDST={0x84, 0x13, [{0xcde9}, {0x1}, {0x2}, {0xfc6, 0x0, 0x1}, {0x2}, {0x44b}, {0x5, 0x0, 0x1}, {0xffff, 0x0, 0x1}, {0x0, 0x0, 0x1}, {0x81}, {0x9, 0x0, 0x1}, {0xffffa}, {0x3}, {0x2, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x4}, {0x3}, {0x7, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0xbe0}, {0x10}, {0x8001, 0x0, 0x1}, {0x7, 0x0, 0x1}, {0xffff8}, {0x4, 0x0, 0x1}, {0x3ae1}, {0x5}, {0xf3, 0x0, 0x1}, {0x8, 0x0, 0x1}, {0x4, 0x0, 0x1}, {0x94fc, 0x0, 0x1}, {0x9, 0x0, 0x1}]}, @RTA_OIF={0x8, 0x4, r6}, @RTA_OIF={0x8, 0x4, r7}, @RTA_VIA={0x14, 0x12, {0x8091eb47674d5e63, "3e41da8c155c7d53ad25d9094281"}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 543.439107ms ago: executing program 4 (id=3951): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x5c, 0x10, 0x503, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4840}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @dev}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x4}]}}}]}, 0x5c}}, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000080)={'bond_slave_0\x00', 0x3}) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x5c, 0x10, 0x503, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4840}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @dev}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x4}]}}}]}, 0x5c}}, 0x0) (async) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000080)={'bond_slave_0\x00', 0x3}) (async) 501.159648ms ago: executing program 3 (id=3952): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x0, 0x1}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) (async) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r6, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) (async) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) (async) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) connect$inet6(r9, &(0x7f0000000240)={0xa, 0x4e21, 0x3, @mcast2, 0xffff}, 0x1c) (async) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0x0, r8}, 0x10) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0x7}}}, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newtfilter={0xb0, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_u32={{0x8}, {0x7c, 0x2, [@TCA_U32_ACT={0x54, 0x7, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xf, 0x3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x6, 0x9, 0x20000000, 0x1, 0xd6}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}, @TCA_U32_SEL={0x24, 0x5, {0x8, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x2, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x1}, 0x24040084) 371.045873ms ago: executing program 3 (id=3953): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000002340)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='O', 0x1}], 0x1}}], 0x1, 0x0) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000000)={0x0, 0xbd}, &(0x7f0000000040)=0x8) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "0200", 0x8, 0x0, 0x0, @local, @local, {[@srh={0x32}]}}}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000014001280090001007663616e000000000400028008000a"], 0x3c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x4008840) 299.626692ms ago: executing program 4 (id=3954): r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000100)=@phonet={0x23, 0xff, 0x0, 0x38}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000840)="27050200d40f00000600002f88a8080088a8", 0x12}], 0x1}, 0x20000014) 294.089401ms ago: executing program 0 (id=3955): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) r3 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000000100)={0x3, 'macvlan0\x00', {0x7}, 0x1}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c0000555c0eed0500000000010000000000000007fa2fdfddb46ecc67c88b1c43c05ce0f4219b1e8f8bfcfe840642c0c7b66dcf6a5ca5f173c41fb82da2217aedd1593dee959031e110f7d21fffe3e2b303d7ac6eb01f0a764faf31c292b71b9241a10fbbf4d6213b1ff34776871165e6145d64ee85de020c0c34b99b2c53341626", @ANYRES32=0x0, @ANYBLOB="44280000b5280500240012800c0001006d6163766c616e00140002800800010010000000080003000200000008000500", @ANYRES32=r2, @ANYBLOB="6c525b294029b7660eed561bd77cb1123e7e33a8f626d79ed3fc081cde5f6c42c886d27a280daa2d2a0d14d3451aca89"], 0x4c}}, 0x4000040) 262.272116ms ago: executing program 4 (id=3956): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x1a, 0xf, &(0x7f0000000440)=@ringbuf, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3c, '\x00', 0x0, 0x1c}, 0x90) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@newlink={0x48, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x5}, @IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local}]}}}]}, 0x48}}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000740)=ANY=[@ANYBLOB="14020000140001002dbd7000000000000a"], 0x214}], 0x1}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x10, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0xb, 0x20}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x90, '\x00', 0x0, 0x8}, 0x94) 215.08865ms ago: executing program 1 (id=3957): syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @private, @multicast1}, @address_request={0x11, 0x2}}}}}, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)=0x1) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) r4 = getpid() write$cgroup_pid(r3, &(0x7f0000000880)=r4, 0x12) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000180)=0xc) r6 = getgid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={r4, r5, r6}, 0xc) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001000030400000000000000000000000009456c48cbd99aececce18dccb93b02dde3fe52833c5a5aaf395ea14a4cef8d8389d7539d1d19b76ec928548f7892e082e67d8008297accbd4077098f307fa8456118a3f26a3b8768167fe64265be1093b3b3f129e65884830529f292a5262f2ab39cf3c07a6dc6f4027e8efae73407e4714f57f8f1ac39d9f6e87e70cc1c9acdd03", @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB], 0x38}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b7000000ff00001fbfa300000000000007030000f0ffffff6a0af0fff8ffffff61a4f0ff0000000066040200000000001d400200000000004704000001ed00006203000000ffffffcf440000000000007a0a00ff00ffffffc30300fff1000000b4000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebaa0f040000c72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204ab3949006c3172171652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d156ae8383117c039862198899b212c55318294270a1ad10c80fef7c247afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15f279b513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aa0000000000000000832371fe5bc621426d1ed0a4a99702cc1b692c3f0b15629eaf4c12a1e717d29135753208165b9cdbae2ed9dc7358f0e3adde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbad937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594807031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac42738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca9be8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998802008f0232b39578052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91ed92cac7c2ccd17d338bbda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922928e000000ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abb8a9982ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139566fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe6290421338ef8f6d27117cd1471bf3c0b64416fbbe955da0281e7ef7f7d5176150e86cda98d07f7de2088cb2ffd1d4c71097635c2bb3d9a0b01e757256ee427f0a244d48682bf89e2279b383b616b40f116172bc1b995eb2c1220597af8df52646f1f0cb65cfa7e038e8bb5d4d52b86a61d82dc14a4f5cc7e6061c65ccdbc2afc3f363ecf34ad0b227687c3ea8d63683ddd5914116edd9e075da9e3638647188bc8f95107c9250995eb6cadcd0f65b8504ff10304f2ceba275f9d485ed5554d64005db877f0fbb3beba59666ff66f132d5077835823592d6d392f5ff62f6f876eb10d8cbf0a73f8421b74c8916e4077b8866c95ad88bc7130244183ed216210f10f69b3e0ee13d06e4eb240cce5ec1c3b1defe4c0f8b83a34ef4f5f8f9ceefb678ad29d3683e3c44a01549e55ffca41c0b06e013f054257646c58b667ec0701004c239589b3e64ef5e1d5ed22b5fd5a90fe3453327c3652d5c9762428f0bd0178d1b80a60f64343ab77d8baa0a388711c8d2d6d3e9049814b15b6ea21387040989d69c3aa27256c55780f33d20823d8e2eb6e56850162969bf4c6c9632a55cf5be00"/2944], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x4a) 160.05488ms ago: executing program 3 (id=3958): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@ipmr_delroute={0x1c, 0x19, 0x1, 0x0, 0x25dfdbfe, {0x80, 0x20, 0x0, 0x0, 0x0, 0x1, 0x0, 0xc, 0x2400}}, 0x1c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'netdevsim0\x00', 0x0}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r3, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305829, &(0x7f0000000240)={0x1100, 0x2, 0x80000008, 0x10003}) sendmsg$NL80211_CMD_SET_MPATH(r3, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000640)={&(0x7f0000000500)={0x98, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x738, 0x22}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x98}, 0x1, 0x0, 0x0, 0x50}, 0x8000) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_rr={{0x7}, {0x18, 0x2, {0x7, "bf32568d2fd41b329a5f8a92fc91d2ff"}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44000800}, 0x4000010) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r4, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x20, 0x8, 0x6, 0x401, 0x0, 0x0, {0x3, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x200400a0}, 0x20004041) r5 = socket$kcm(0x2, 0x5, 0x84) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r5, 0x84, 0x78, &(0x7f0000000040)=r6, 0x4) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="58000000020605000000000000000000000000001400078005001400090000000800124008001f000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x58}}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f00000006c0), 0x80, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e21, 0x40, @mcast1, 0x6}}, 0x401, 0x5, 0x4, 0x3f8b5946, 0x80000001}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r8, 0x84, 0x10, &(0x7f0000000180)=@sack_info={r9, 0x8, 0xf7}, 0xc) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r8, 0x84, 0x7, 0x0, 0x0) r10 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x303, 0x70bd2d, 0xfffffffd, {0x0, 0x4, 0x2, 0x0, {0x4e22, 0x4e23, [0x4, 0x7, 0xfffffffa, 0x4000000], [0x2, 0x80, 0xfff], 0x0, [0x7]}, 0x2, 0x2}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "11000000"}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040849}, 0x8004) socket$nl_route(0x10, 0x3, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f0000000a00)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000780)={0x230, 0x14, 0x100, 0x70bd2c, 0x8, {0x11, 0x80}, [@INET_DIAG_REQ_BYTECODE={0x76, 0x1, "108d718756113ff192dd0029daf6414e05dfddc78407f8ac8f743beaea005432e8e359a8b326cd086c29e61d722ccce484d8de97e72e262953298330e6b2301dd272873a623f6ba9c177199071b618090b58040a76d150a7ac6e2d20ebd9371af2971d01fa09da3a5f1fb3a993a9340d31e5"}, @INET_DIAG_REQ_BYTECODE={0xa9, 0x1, "ffbe61c89a68cb6fa844b0900160754c2f82e4890e4875fbc70cb573864c8916c11e46f0b59116cc11e65808ffe5b97ee876abc55481883b26ad31127dcaea71cb8f887770927a965c99fe6287cde05dcf0c9db6146733b27f8a638d03d0a27c80e216ad7ed995d38b5b19a976c290c6537c5e337737c79e6d2e13aae09bc79651b199dba2f79c30531fb4c7973ca488f6985b7ea65c518df4fd6d6b7734cc9d836dfd737f"}, @INET_DIAG_REQ_BYTECODE={0x55, 0x1, "c40b0202f5aaa9243fb284696ead6f8dff61e50e80ef520e8cabc659ce7022f608c57dcf1b0b00a6a5ce72e56b1785de99f0a3deb9b6df75b773a173c1435efa4ce6aada268f745b639f8b1da6ac04e98b"}, @INET_DIAG_REQ_BYTECODE={0x9f, 0x1, "b8deac7051b062825a624e8351c9c55b30bee83ff1a05a60e5cf64e0e4a9fd7090109c8838c836334774b498efdf2ff55772b76e1f0177823058b5f03ce280b7916a4f68bbe45707ee875b978a884f7b55bd0253976eeaeed2e1741f3b4333fca48c86885f3c2c51ba7b729c1cac9df660ae4845909dd492b7a9730890914beb7b3f35582806eab738d2e4fe74f0dbc848113562b317adea0f6232"}]}, 0x230}, 0x1, 0x0, 0x0, 0x40}, 0x4044015) r11 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$SIOCNRDECOBS(r11, 0x89e2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[], 0x18}}, 0x20008800) getsockopt$rose(r6, 0x104, 0x4, &(0x7f00000001c0), &(0x7f0000000480)=0x4) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000001e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) 145.530081ms ago: executing program 0 (id=3959): r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000000)={@empty, 0x0}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@ipv4_newaddr={0x3c, 0x14, 0x2, 0x70bd28, 0x25dfdbfd, {0x2, 0x0, 0x4, 0xfe, r1}, [@IFA_FLAGS={0x8, 0x8, 0x2d5}, @IFA_ADDRESS={0x8, 0x1, @loopback}, @IFA_LABEL={0x14, 0x3, 'netpci0\x00'}]}, 0x3c}}, 0x90) 58.783339ms ago: executing program 4 (id=3960): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) readv(r5, &(0x7f0000000200)=[{&(0x7f0000000400)=""/210, 0xd2}], 0x1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r1) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r7, 0x1, 0x70bd2e, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x1c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x6}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x20004000) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x81}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00'}) (async) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) (async) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) readv(r5, &(0x7f0000000200)=[{&(0x7f0000000400)=""/210, 0xd2}], 0x1) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ec0)={'wpan0\x00'}) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r1) (async) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r7, 0x1, 0x70bd2e, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_LEVEL={0x1c, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x6}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x20004000) (async) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x81}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) (async) 47.670966ms ago: executing program 0 (id=3961): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x2, 0x3, 0x100000001) setsockopt(r1, 0xff, 0x1, &(0x7f0000000100)='O', 0x1) syz_emit_ethernet(0x3e, &(0x7f00000007c0)={@link_local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x0, 0x3f18, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty}}}}}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000c40)=@raw={'raw\x00', 0x8, 0x3, 0x4b0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3e0, 0xffffffff, 0xffffffff, 0x3e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x160, 0x188, 0x0, {}, [@common=@srh1={{0x90}, {0x2c, 0x56, 0x81, 0xa, 0x41, @private2, @local, @private1, [0xffffffff, 0x0, 0xffffff00, 0xff], [0xffffff00, 0x0, 0xffffffff, 0xff], [0x0, 0xffffffff, 0xff, 0xff000000], 0xb8f4757fc1e05f28, 0x180}}, @common=@hl={{0x28}, {0x1, 0x7}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @local, [], [], 'wg1\x00', 'veth1_to_batadv\x00', {}, {}, 0x62}, 0x0, 0x228, 0x258, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x6, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3, 0x0, 0x40}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x6}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x510) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, 0xb, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0xb}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0x4040000) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket(0x2, 0x3, 0x100000001) (async) setsockopt(r1, 0xff, 0x1, &(0x7f0000000100)='O', 0x1) (async) syz_emit_ethernet(0x3e, &(0x7f00000007c0)={@link_local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x0, 0x3f18, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty}}}}}}, 0x0) (async) socket$inet6(0xa, 0x3, 0x8000000003c) (async) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000c40)=@raw={'raw\x00', 0x8, 0x3, 0x4b0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3e0, 0xffffffff, 0xffffffff, 0x3e0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x160, 0x188, 0x0, {}, [@common=@srh1={{0x90}, {0x2c, 0x56, 0x81, 0xa, 0x41, @private2, @local, @private1, [0xffffffff, 0x0, 0xffffff00, 0xff], [0xffffff00, 0x0, 0xffffffff, 0xff], [0x0, 0xffffffff, 0xff, 0xff000000], 0xb8f4757fc1e05f28, 0x180}}, @common=@hl={{0x28}, {0x1, 0x7}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @local, [], [], 'wg1\x00', 'veth1_to_batadv\x00', {}, {}, 0x62}, 0x0, 0x228, 0x258, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x6, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3, 0x0, 0x40}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x6}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x510) (async) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x28, 0xb, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0xb}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8080}, 0x4040000) (async) 0s ago: executing program 1 (id=3962): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x0, @rand_addr=0x64010102}], 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x1, 0x1, 0x10}, &(0x7f0000000140)=0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_INTERFACE(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x4040041) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="150e2bbd7000fb0100ad0900000014000300", @ANYRES32=r5, @ANYBLOB="0800010002000000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x10) sendmsg$NL80211_CMD_GET_MPATH(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x2c, r4, 0x100, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24008000}, 0x20040050) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x2c, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x15}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000011c0)=@newtaction={0x98, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x84, 0x1, [@m_tunnel_key={0x80, 0x1, 0x0, 0x0, {{0xf}, {0x50, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @private}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @remote}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) kernel console output (not intermixed with test programs): B implementation [ 398.316665][T13602] netlink: 'syz.2.2244': attribute type 1 has an invalid length. [ 398.325796][T13602] netlink: 'syz.2.2244': attribute type 4 has an invalid length. [ 398.454066][T13614] netlink: 'syz.3.2245': attribute type 17 has an invalid length. [ 398.535477][T13614] gretap0: entered promiscuous mode [ 398.561519][T13614] gretap0: left promiscuous mode [ 398.749009][T13627] __nla_validate_parse: 13 callbacks suppressed [ 398.749032][T13627] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2249'. [ 398.893626][T13637] netlink: 'syz.2.2251': attribute type 11 has an invalid length. [ 398.985153][T13637] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2251'. [ 399.086061][T13637] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2251'. [ 399.177840][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 399.186036][ C1] lec:lec_tx_timeout: lec0 [ 399.190853][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 399.387230][T12717] udevd[12717]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 399.463511][T12717] udevd[12717]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 399.647308][T13674] netem: change failed [ 399.830985][T13682] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2260'. [ 399.891294][T13682] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2260'. [ 400.126833][T13707] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2265'. [ 400.142528][T13710] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2265'. [ 400.385888][T13724] netlink: 'syz.4.2272': attribute type 83 has an invalid length. [ 400.417000][T13724] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2272'. [ 400.544192][T13735] macvlan3: entered promiscuous mode [ 400.550118][T13735] macvlan3: entered allmulticast mode [ 400.556504][T13735] bond0: (slave macvlan3): Error -98 calling set_mac_address [ 400.821537][T13751] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2277'. [ 400.842599][T13751] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2277'. [ 401.325070][T13761] syzkaller0: entered promiscuous mode [ 401.397746][T13761] syzkaller0: entered allmulticast mode [ 403.419563][T13800] netlink: 'syz.2.2286': attribute type 5 has an invalid length. [ 403.575330][T13825] bond0 (unregistering): Released all slaves [ 403.878690][T13843] syzkaller0: entered promiscuous mode [ 403.894708][T13843] syzkaller0: entered allmulticast mode [ 403.972596][T13853] __nla_validate_parse: 2 callbacks suppressed [ 403.972617][T13853] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2296'. [ 404.197581][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 404.205764][ C1] lec:lec_tx_timeout: lec0 [ 404.210717][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 404.703046][T13890] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2310'. [ 404.973006][T13910] netlink: 4096 bytes leftover after parsing attributes in process `syz.1.2315'. [ 404.986965][T13910] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2315'. [ 405.005240][T13912] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2318'. [ 405.129884][T13921] netlink: 'syz.4.2319': attribute type 7 has an invalid length. [ 405.235967][T13921] netlink: 'syz.4.2319': attribute type 7 has an invalid length. [ 405.294512][T13931] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2322'. [ 405.372687][T10135] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.389258][T10135] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.428151][T10135] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.458783][T10135] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 405.646931][T13946] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 405.675598][T13946] netlink: 'syz.4.2326': attribute type 24 has an invalid length. [ 405.709464][T13950] netlink: 'syz.3.2325': attribute type 39 has an invalid length. [ 406.011919][T13973] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2332'. [ 406.130660][T13982] netlink: 'syz.2.2334': attribute type 16 has an invalid length. [ 406.153090][T13982] netlink: 'syz.2.2334': attribute type 17 has an invalid length. [ 406.240763][T13988] netlink: 'syz.1.2337': attribute type 10 has an invalid length. [ 406.292621][T13990] netlink: 'syz.0.2338': attribute type 4 has an invalid length. [ 406.302243][T13990] netlink: 'syz.0.2338': attribute type 1 has an invalid length. [ 406.313049][T13990] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2338'. [ 406.344406][T10139] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 406.364227][T10139] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 406.416387][T10139] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 406.450591][T10139] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 406.478400][ T36] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 406.525808][ T36] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 406.548180][ T36] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 406.580416][ T36] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 406.870825][T14023] syzkaller0: entered allmulticast mode [ 406.959081][T14025] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2350'. [ 407.108210][T14040] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 407.139942][T14040] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 407.150079][ T30] audit: type=1107 audit(1770428553.410:6): pid=14043 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 407.499674][T14058] netlink: 1044 bytes leftover after parsing attributes in process `syz.2.2359'. [ 407.562633][T14060] syzkaller0: entered promiscuous mode [ 407.577622][T14060] syzkaller0: entered allmulticast mode [ 407.644590][T14060] tipc: Enabled bearer , priority 0 [ 407.702035][T14059] tipc: Resetting bearer [ 407.751711][T14059] tipc: Disabling bearer [ 407.979549][T14077] netlink: 'syz.3.2365': attribute type 13 has an invalid length. [ 408.304521][T14104] netlink: 'syz.0.2371': attribute type 1 has an invalid length. [ 408.574361][T14118] team0: Port device ip6gre1 added [ 408.905009][T14136] netlink: 'syz.0.2379': attribute type 1 has an invalid length. [ 409.296340][T14147] gretap1: entered promiscuous mode [ 409.311170][T14163] __nla_validate_parse: 6 callbacks suppressed [ 409.311192][T14163] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2387'. [ 409.350446][T14170] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2387'. [ 409.403930][T14170] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2387'. [ 409.624954][T14177] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2390'. [ 409.768715][T14186] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2392'. [ 409.843226][T14188] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2393'. [ 409.931016][T14189] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2393'. [ 409.979577][T14188] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2393'. [ 410.593117][T14205] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2398'. [ 410.634160][T14203] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2398'. [ 410.807251][T14220] validate_nla: 2 callbacks suppressed [ 410.807274][T14220] netlink: 'syz.4.2403': attribute type 2 has an invalid length. [ 410.955558][T14225] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 410.986694][T14231] veth0: entered promiscuous mode [ 410.995021][T14230] veth0: left promiscuous mode [ 410.996263][T14234] netlink: zone id is out of range [ 411.007951][T14234] netlink: zone id is out of range [ 411.013282][T14234] netlink: zone id is out of range [ 411.019839][T14234] netlink: zone id is out of range [ 411.025166][T14234] netlink: zone id is out of range [ 411.032655][T14234] netlink: zone id is out of range [ 411.038334][T14234] netlink: zone id is out of range [ 411.043877][T14234] netlink: zone id is out of range [ 411.049711][T14234] netlink: zone id is out of range [ 411.197198][T14241] netlink: 'syz.3.2410': attribute type 1 has an invalid length. [ 411.242657][T14241] 8021q: adding VLAN 0 to HW filter on device bond6 [ 411.284875][T14241] bond6: (slave veth7): Enslaving as an active interface with a down link [ 411.321982][T14241] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 411.330723][T14241] bond6: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 411.462399][T14246] tipc: Enabling of bearer rejected, failed to enable media [ 411.951604][T14269] netlink: 'syz.1.2420': attribute type 23 has an invalid length. [ 412.085210][T14269] netlink: 'syz.1.2420': attribute type 21 has an invalid length. [ 412.545297][T14310] netlink: 'syz.4.2429': attribute type 10 has an invalid length. [ 412.555837][T14311] sctp: [Deprecated]: syz.2.2427 (pid 14311) Use of int in max_burst socket option. [ 412.555837][T14311] Use struct sctp_assoc_value instead [ 412.715173][T14319] netlink: 'syz.4.2430': attribute type 4 has an invalid length. [ 412.740284][T14321] netlink: 'syz.4.2430': attribute type 4 has an invalid length. [ 413.017535][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 413.025844][ C1] lec:lec_tx_timeout: lec0 [ 413.031120][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 413.118420][T14343] net_ratelimit: 134 callbacks suppressed [ 413.118442][T14343] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 413.676595][T14373] netlink: 'syz.3.2442': attribute type 10 has an invalid length. [ 414.043146][T14387] netlink: 'syz.2.2445': attribute type 2 has an invalid length. [ 414.088432][T14387] netlink: 'syz.2.2445': attribute type 11 has an invalid length. [ 414.222456][T14389] bond7: Invalid ad_actor_system MAC address. [ 414.243940][T14389] bond7: option ad_actor_system: invalid value (1) [ 414.264486][T14389] bond7 (unregistering): Released all slaves [ 414.365363][T14396] __nla_validate_parse: 14 callbacks suppressed [ 414.365385][T14396] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2448'. [ 414.387796][T14396] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2448'. [ 414.514078][T14398] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2449'. [ 414.649461][T14402] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2454'. [ 414.676877][T14404] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2451'. [ 414.746575][T14410] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2452'. [ 414.958390][T14421] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2456'. [ 415.095110][T14431] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2458'. [ 415.148855][T14432] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2458'. [ 415.149450][T14431] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2458'. [ 415.549380][T14455] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 415.767732][T14464] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 415.886154][T14455] tipc: Enabled bearer , priority 0 [ 415.911694][T14462] netlink: 'syz.2.2466': attribute type 2 has an invalid length. [ 415.978902][T14441] syzkaller0: entered promiscuous mode [ 415.985515][T14441] syzkaller0: entered allmulticast mode [ 416.012298][T14441] tipc: Resetting bearer [ 416.124960][T14440] tipc: Resetting bearer [ 416.466208][T14488] netlink: 'syz.3.2470': attribute type 1 has an invalid length. [ 416.506742][T14488] netlink: 'syz.3.2470': attribute type 1 has an invalid length. [ 416.526850][T14488] netlink: 'syz.3.2470': attribute type 8 has an invalid length. [ 416.580776][T14495] openvswitch: netlink: IP tunnel dst address not specified [ 418.042420][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 418.050622][ C1] lec:lec_tx_timeout: lec0 [ 418.108207][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 418.558138][T14440] tipc: Disabling bearer [ 418.752058][T14521] xt_ecn: cannot match TCP bits for non-tcp packets [ 419.113173][T14533] IPVS: set_ctl: invalid protocol: 108 100.1.1.2:20004 [ 419.443235][T14555] __nla_validate_parse: 13 callbacks suppressed [ 419.443254][T14555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2489'. [ 419.488180][T14546] syzkaller0: entered promiscuous mode [ 419.493717][T14546] syzkaller0: entered allmulticast mode [ 419.506736][T14549] tipc: Enabling of bearer rejected, failed to enable media [ 419.663663][T14559] delete_channel: no stack [ 419.973949][T14571] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2495'. [ 420.092773][T14576] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2495'. [ 420.275096][T14580] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2495'. [ 421.590864][T14584] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2497'. [ 421.656301][T14588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2497'. [ 421.815995][T14596] netlink: 'syz.3.2499': attribute type 21 has an invalid length. [ 421.887110][T14596] bond7: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 421.900849][T14596] bond7 (unregistering): Released all slaves [ 422.238560][T14623] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2509'. [ 422.293425][T14623] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2509'. [ 422.358686][T14633] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2513'. [ 422.515573][T14635] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2514'. [ 422.552811][T14646] bridge0: port 3(team0) entered blocking state [ 422.575894][T14646] bridge0: port 3(team0) entered disabled state [ 422.592492][T14646] team0: entered allmulticast mode [ 422.615097][T14646] team_slave_0: entered allmulticast mode [ 422.637062][T14646] team_slave_1: entered allmulticast mode [ 422.682040][T14646] team0: entered promiscuous mode [ 422.706011][T14646] team_slave_0: entered promiscuous mode [ 422.731499][T14646] team_slave_1: entered promiscuous mode [ 422.770352][T14646] bridge0: port 3(team0) entered blocking state [ 422.776775][T14646] bridge0: port 3(team0) entered forwarding state [ 422.929672][T14666] SET target dimension over the limit! [ 423.117584][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 423.125897][ C1] lec:lec_tx_timeout: lec0 [ 423.149204][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 423.505940][T14691] sctp: [Deprecated]: syz.2.2527 (pid 14691) Use of int in max_burst socket option. [ 423.505940][T14691] Use struct sctp_assoc_value instead [ 424.030554][T14714] netlink: 'syz.2.2537': attribute type 10 has an invalid length. [ 424.097938][T14716] 8021q: adding VLAN 0 to HW filter on device bond9 [ 424.123686][T14722] netlink: 'syz.1.2539': attribute type 16 has an invalid length. [ 424.131915][T14722] netlink: 'syz.1.2539': attribute type 17 has an invalid length. [ 424.323496][T14735] IPv6: NLM_F_CREATE should be specified when creating new route [ 424.430146][T14722] tipc: Resetting bearer [ 424.588698][ T144] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.616642][ T144] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.646184][ T144] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.668167][ T144] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.677062][ T144] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.694923][ T144] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.713955][ T144] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.742054][ T144] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.779284][T14756] netlink: 'syz.3.2547': attribute type 13 has an invalid length. [ 425.018774][T14756] tipc: Resetting bearer [ 425.259785][T14790] __nla_validate_parse: 7 callbacks suppressed [ 425.259805][T14790] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2554'. [ 425.983104][T14828] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2568'. [ 425.995832][T14828] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2568'. [ 426.382956][T14842] openvswitch: netlink: IP tunnel dst address not specified [ 426.424327][T14847] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2573'. [ 426.664744][T14858] netlink: 'syz.3.2576': attribute type 24 has an invalid length. [ 426.850734][T14865] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2578'. [ 426.889197][T14865] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2578'. [ 427.058252][T14871] tipc: Enabled bearer , priority 0 [ 427.084556][T14881] bond0: option ad_select: unable to set because the bond device is up [ 427.123261][T14871] tipc: Enabling of bearer rejected, failed to enable media [ 427.134938][T14881] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 427.180873][T14884] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2582'. [ 427.207216][T14871] syzkaller0: entered promiscuous mode [ 427.237671][T14871] syzkaller0: entered allmulticast mode [ 427.249862][T14871] tipc: Resetting bearer [ 427.274753][T14883] : entered promiscuous mode [ 427.290980][T14868] tipc: Resetting bearer [ 427.333002][T14889] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2587'. [ 427.383676][T14889] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2587'. [ 427.471259][T14900] xt_hashlimit: overflow, try lower: 3/0 [ 428.167539][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 428.176257][ C1] lec:lec_tx_timeout: lec0 [ 428.198294][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 429.106282][T14868] tipc: Disabling bearer [ 429.200465][T14911] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2591'. [ 429.288834][T14911] block nbd0: server does not support multiple connections per device. [ 429.316043][T14911] block nbd0: shutting down sockets [ 429.485383][T14924] netlink: 'syz.3.2594': attribute type 4 has an invalid length. [ 429.964702][T14959] netlink: 'syz.1.2604': attribute type 1 has an invalid length. [ 430.354510][T14979] __nla_validate_parse: 4 callbacks suppressed [ 430.354534][T14979] netlink: 252 bytes leftover after parsing attributes in process `syz.1.2611'. [ 430.379753][T14978] netlink: 'syz.3.2609': attribute type 10 has an invalid length. [ 430.382266][T14979] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2611'. [ 430.400467][T14979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2611'. [ 430.445947][T14978] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2609'. [ 430.582294][T14986] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2613'. [ 430.623847][T14986] openvswitch: netlink: IPv6 tunnel dst address is zero [ 430.637193][T14988] bond7 (unregistering): Released all slaves [ 430.646018][T14992] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2614'. [ 430.655634][T14986] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2613'. [ 430.656731][T14992] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2614'. [ 430.675577][T14986] netlink: 'syz.3.2613': attribute type 6 has an invalid length. [ 430.683799][T14986] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2613'. [ 430.700987][T14992] netlink: 'syz.0.2614': attribute type 1 has an invalid length. [ 430.717753][T14992] netlink: 'syz.0.2614': attribute type 2 has an invalid length. [ 430.726689][T14986] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2613'. [ 430.749023][T14986] netlink: 'syz.3.2613': attribute type 6 has an invalid length. [ 430.830230][T14995] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 430.913852][T14999] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 431.427195][T15020] IPVS: length: 147 != 24 [ 431.724144][T14999] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 432.270993][T15065] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 432.751976][T15088] lo speed is unknown, defaulting to 1000 [ 432.767788][T15088] lo speed is unknown, defaulting to 1000 [ 432.784824][T15088] lo speed is unknown, defaulting to 1000 [ 432.804003][T15088] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 432.881189][T15088] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 433.032956][T15088] lo speed is unknown, defaulting to 1000 [ 433.055590][T15088] lo speed is unknown, defaulting to 1000 [ 433.100908][T15088] lo speed is unknown, defaulting to 1000 [ 433.121262][T15088] lo speed is unknown, defaulting to 1000 [ 433.160062][T15088] lo speed is unknown, defaulting to 1000 [ 433.207557][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 433.215647][ C1] lec:lec_tx_timeout: lec0 [ 433.227802][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 433.507008][T15069] netlink: 'syz.3.2638': attribute type 9 has an invalid length. [ 433.784869][T15143] 8021q: VLANs not supported on ip6_vti0 [ 433.800857][T15142] sit0: left promiscuous mode [ 434.474017][T15184] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 434.512612][T15184] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 434.578950][T15184] netlink: 'syz.4.2668': attribute type 6 has an invalid length. [ 434.595680][T15184] netlink: 'syz.4.2668': attribute type 5 has an invalid length. [ 434.610053][T15185] netlink: 'syz.4.2668': attribute type 6 has an invalid length. [ 434.639020][T15185] netlink: 'syz.4.2668': attribute type 5 has an invalid length. [ 434.864045][T15216] ipt_REJECT: TCP_RESET invalid for non-tcp [ 434.887382][T15216] openvswitch: netlink: Flow actions attr not present in new flow. [ 435.428808][T15251] netlink: 'syz.1.2686': attribute type 2 has an invalid length. [ 435.482773][T15251] 9: entered promiscuous mode [ 435.689195][T15267] netlink: 'syz.0.2691': attribute type 10 has an invalid length. [ 435.746477][T15272] : renamed from veth1_vlan [ 435.762151][T15267] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 436.065166][T15296] netlink: 'syz.3.2699': attribute type 10 has an invalid length. [ 436.106322][T15296] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 436.434074][T15238] lo speed is unknown, defaulting to 1000 [ 436.655603][T15327] __nla_validate_parse: 23 callbacks suppressed [ 436.655625][T15327] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2707'. [ 436.986270][T15338] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 437.151620][T15343] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 437.176289][T15343] ipt_REJECT: ECHOREPLY no longer supported. [ 437.475219][T15365] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2720'. [ 437.594118][T15358] erspan0: entered promiscuous mode [ 437.610160][T15358] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2716'. [ 437.623577][T15362] bridge_slave_1: entered allmulticast mode [ 438.441649][T15419] netlink: 'syz.3.2733': attribute type 1 has an invalid length. [ 438.476076][T15412] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2733'. [ 438.541880][T15412] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2733'. [ 438.589750][T15433] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2734'. [ 438.686695][T15435] block nbd0: Unsupported socket: should be TCP or UNIX. [ 438.949281][T15455] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2742'. [ 439.002205][T15459] ip6gre1: entered allmulticast mode [ 439.019714][T15461] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2744'. [ 439.115489][T15459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2740'. [ 439.149758][T15459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2740'. [ 439.547640][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6320 ms [ 439.555878][ C1] lec:lec_tx_timeout: lec0 [ 439.560830][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 439.755540][T15505] ipt_REJECT: TCP_RESET invalid for non-tcp [ 440.204530][ T1302] aoe: packet could not be sent on lec0. consider increasing tx_queue_len [ 441.110315][T15492] syzkaller0: left promiscuous mode [ 441.115724][T15492] syzkaller0: left allmulticast mode [ 441.268793][T15512] netlink: 'syz.1.2754': attribute type 1 has an invalid length. [ 441.656725][T15534] netlink: 'syz.1.2761': attribute type 16 has an invalid length. [ 441.669126][T15534] netlink: 'syz.1.2761': attribute type 17 has an invalid length. [ 441.761830][T15534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.780666][T15534] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.807872][T15534] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 441.845018][T15494] lo speed is unknown, defaulting to 1000 [ 441.895495][T15534] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2761'. [ 441.912154][T15534] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2761'. [ 441.966824][T15540] syzkaller0: entered promiscuous mode [ 441.972641][T15540] syzkaller0: entered allmulticast mode [ 442.289677][T15569] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 442.304185][T15568] pim6reg1: entered promiscuous mode [ 442.316213][T15568] pim6reg1: entered allmulticast mode [ 442.584118][T15567] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 442.723416][T15593] netlink: 'syz.0.2775': attribute type 1 has an invalid length. [ 442.808841][T15593] 8021q: adding VLAN 0 to HW filter on device bond10 [ 442.892536][T15592] bond10: (slave geneve2): making interface the new active one [ 442.902981][T15592] bond10: (slave geneve2): Enslaving as an active interface with an up link [ 442.918126][T10158] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.948171][T10158] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.978001][T10158] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.012000][T10158] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.380310][T15633] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 443.391501][T15635] syzkaller0: entered promiscuous mode [ 443.398905][T15639] SET target dimension over the limit! [ 443.411332][T15635] syzkaller0: entered allmulticast mode [ 443.423494][T15637] Bluetooth: MGMT ver 1.23 [ 443.492690][T15635] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.2788'. [ 443.531623][T15644] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2792'. [ 443.645414][T15637] syz.3.2786 (15637) used greatest stack depth: 17088 bytes left [ 443.767813][T15659] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2796'. [ 444.041046][T15675] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2799'. [ 444.193887][T15681] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2802'. [ 444.205745][T15681] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2802'. [ 444.236900][T15684] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2803'. [ 444.246604][T15681] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2802'. [ 444.390842][T15692] lo: Caught tx_queue_len zero misconfig [ 444.404315][T15692] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 444.561133][T15706] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 444.734644][T15707] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 444.773341][T15720] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 2, id = 0 [ 444.901437][T15724] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 444.932636][T15724] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 444.987111][T15724] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 445.103386][T15739] netlink: 'syz.1.2821': attribute type 10 has an invalid length. [ 445.110626][T15742] syzkaller1: entered promiscuous mode [ 445.117988][T15742] syzkaller1: entered allmulticast mode [ 445.140090][T15745] netlink: 'syz.2.2823': attribute type 9 has an invalid length. [ 445.161358][T15739] team0 (unregistering): Port device team_slave_0 removed [ 445.171516][T15739] team0 (unregistering): Port device team_slave_1 removed [ 445.307526][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 445.315718][ C1] lec:lec_tx_timeout: lec0 [ 446.416063][T15796] netlink: 'syz.4.2839': attribute type 6 has an invalid length. [ 446.502334][T15806] netlink: 'syz.1.2842': attribute type 13 has an invalid length. [ 446.520780][T15796] netlink: 'syz.4.2839': attribute type 6 has an invalid length. [ 446.540156][T15806] gretap0: refused to change device tx_queue_len [ 446.547264][T15806] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 446.922086][T15826] vlan3: entered promiscuous mode [ 446.928870][T15826] vlan3: entered allmulticast mode [ 447.031445][T15826] __nla_validate_parse: 80 callbacks suppressed [ 447.031470][T15826] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2849'. [ 447.087976][T15840] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 447.162092][T15826] bond7: option xmit_hash_policy: invalid value (64) [ 447.192898][T15826] bond7 (unregistering): Released all slaves [ 447.607555][T15858] erspan0: entered promiscuous mode [ 447.623860][T15858] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2856'. [ 448.177874][T15892] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2868'. [ 448.260595][T15896] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2869'. [ 448.280616][T15899] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2865'. [ 448.306061][T15899] 8021q: VLANs not supported on ip6gre0 [ 448.348262][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 448.541196][T15915] netlink: 'syz.3.2875': attribute type 1 has an invalid length. [ 449.070698][T15947] IPVS: set_ctl: invalid protocol: 58 10.1.1.2:20001 [ 449.177430][T15952] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2887'. [ 449.198968][T15952] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2887'. [ 449.539101][T15965] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2889'. [ 449.574086][T15968] netlink: 'syz.3.2890': attribute type 2 has an invalid length. [ 449.855198][T15986] FAULT_INJECTION: forcing a failure. [ 449.855198][T15986] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 449.917724][T15986] CPU: 1 UID: 0 PID: 15986 Comm: syz.2.2894 Not tainted syzkaller #0 PREEMPT(full) [ 449.917754][T15986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 449.917765][T15986] Call Trace: [ 449.917773][T15986] [ 449.917782][T15986] dump_stack_lvl+0xe8/0x150 [ 449.917813][T15986] should_fail_ex+0x412/0x560 [ 449.917841][T15986] _copy_to_iter+0x589/0x17d0 [ 449.917882][T15986] ? __pfx__copy_to_iter+0x10/0x10 [ 449.917906][T15986] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 449.917925][T15986] ? lockdep_hardirqs_on+0x7a/0x110 [ 449.917945][T15986] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 449.917963][T15986] ? __skb_try_recv_datagram+0x3d4/0x4d0 [ 449.917997][T15986] __skb_datagram_iter+0xf8/0x980 [ 449.918030][T15986] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 449.918066][T15986] skb_copy_datagram_iter+0xb5/0x210 [ 449.918099][T15986] netlink_recvmsg+0x2c3/0xa50 [ 449.918132][T15986] ? __pfx_netlink_recvmsg+0x10/0x10 [ 449.918156][T15986] ? aa_sock_msg_perm+0xf1/0x1b0 [ 449.918182][T15986] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 449.918202][T15986] ? security_socket_recvmsg+0x7e/0x2c0 [ 449.918231][T15986] ? __pfx_netlink_recvmsg+0x10/0x10 [ 449.918251][T15986] sock_recvmsg+0x22c/0x270 [ 449.918276][T15986] sock_read_iter+0x251/0x320 [ 449.918307][T15986] ? __pfx_sock_read_iter+0x10/0x10 [ 449.918360][T15986] do_iter_readv_writev+0x619/0x8c0 [ 449.918383][T15986] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 449.918414][T15986] ? bpf_lsm_file_permission+0x9/0x20 [ 449.918434][T15986] ? security_file_permission+0x75/0x260 [ 449.918454][T15986] ? rw_verify_area+0x2a6/0x4d0 [ 449.918484][T15986] vfs_readv+0x288/0x840 [ 449.918514][T15986] ? __pfx_vfs_readv+0x10/0x10 [ 449.918549][T15986] ? __fget_files+0x2a/0x420 [ 449.918575][T15986] ? __fget_files+0x3a0/0x420 [ 449.918593][T15986] ? __fget_files+0x2a/0x420 [ 449.918623][T15986] do_readv+0x154/0x2e0 [ 449.918645][T15986] ? __pfx_do_readv+0x10/0x10 [ 449.918677][T15986] do_syscall_64+0xe2/0xf80 [ 449.918696][T15986] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.918714][T15986] ? trace_irq_disable+0x37/0x100 [ 449.918731][T15986] ? clear_bhb_loop+0x60/0xb0 [ 449.918754][T15986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.918771][T15986] RIP: 0033:0x7f7c3a59aeb9 [ 449.918788][T15986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 449.918803][T15986] RSP: 002b:00007f7c3b4c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 449.918824][T15986] RAX: ffffffffffffffda RBX: 00007f7c3a816090 RCX: 00007f7c3a59aeb9 [ 449.918837][T15986] RDX: 0000000000000007 RSI: 0000200000000b40 RDI: 0000000000000004 [ 449.918850][T15986] RBP: 00007f7c3b4c1090 R08: 0000000000000000 R09: 0000000000000000 [ 449.918862][T15986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 449.918873][T15986] R13: 00007f7c3a816128 R14: 00007f7c3a816090 R15: 00007ffc1a5b2228 [ 449.918907][T15986] [ 450.260242][T15998] netlink: 'syz.3.2901': attribute type 4 has an invalid length. [ 450.306409][T15998] netlink: 'syz.3.2901': attribute type 4 has an invalid length. [ 450.392726][T15997] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2900'. [ 450.633417][T16021] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2903'. [ 450.900664][T16037] xt_connbytes: Forcing CT accounting to be enabled [ 450.962253][T16042] netem: change failed [ 450.979976][T16043] ip6tnl0: Caught tx_queue_len zero misconfig [ 450.989793][T16043] sch_fq: defrate 0 ignored. [ 451.012123][T16044] IPv6: addrconf: prefix option has invalid lifetime [ 451.089780][T16046] FAULT_INJECTION: forcing a failure. [ 451.089780][T16046] name failslab, interval 1, probability 0, space 0, times 0 [ 451.105619][T16046] CPU: 1 UID: 0 PID: 16046 Comm: syz.4.2912 Not tainted syzkaller #0 PREEMPT(full) [ 451.105649][T16046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 451.105660][T16046] Call Trace: [ 451.105668][T16046] [ 451.105677][T16046] dump_stack_lvl+0xe8/0x150 [ 451.105707][T16046] should_fail_ex+0x412/0x560 [ 451.105737][T16046] should_failslab+0xa8/0x100 [ 451.105762][T16046] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 451.105793][T16046] ? __alloc_skb+0x1d7/0x390 [ 451.105814][T16046] ? __local_bh_enable_ip+0xd0/0x130 [ 451.105833][T16046] ? __alloc_skb+0x193/0x390 [ 451.105856][T16046] __alloc_skb+0x1d7/0x390 [ 451.105883][T16046] netlink_dump+0x1ef/0xe80 [ 451.105917][T16046] ? __pfx_netlink_dump+0x10/0x10 [ 451.105964][T16046] ? kmem_cache_free+0x195/0x610 [ 451.105982][T16046] ? netlink_recvmsg+0x5d6/0xa50 [ 451.106009][T16046] netlink_recvmsg+0x690/0xa50 [ 451.106041][T16046] ? __pfx_netlink_recvmsg+0x10/0x10 [ 451.106068][T16046] ? aa_sock_msg_perm+0xf1/0x1b0 [ 451.106096][T16046] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 451.106115][T16046] ? security_socket_recvmsg+0x7e/0x2c0 [ 451.106143][T16046] ? __pfx_netlink_recvmsg+0x10/0x10 [ 451.106165][T16046] sock_recvmsg+0x22c/0x270 [ 451.106189][T16046] sock_read_iter+0x251/0x320 [ 451.106218][T16046] ? __pfx_sock_read_iter+0x10/0x10 [ 451.106268][T16046] do_iter_readv_writev+0x619/0x8c0 [ 451.106291][T16046] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 451.106315][T16046] ? bpf_lsm_file_permission+0x9/0x20 [ 451.106335][T16046] ? security_file_permission+0x75/0x260 [ 451.106356][T16046] ? rw_verify_area+0x2a6/0x4d0 [ 451.106387][T16046] vfs_readv+0x288/0x840 [ 451.106419][T16046] ? __pfx_vfs_readv+0x10/0x10 [ 451.106465][T16046] ? __fget_files+0x2a/0x420 [ 451.106493][T16046] ? __fget_files+0x3a0/0x420 [ 451.106512][T16046] ? __fget_files+0x2a/0x420 [ 451.106542][T16046] do_readv+0x154/0x2e0 [ 451.106566][T16046] ? __pfx_do_readv+0x10/0x10 [ 451.106599][T16046] do_syscall_64+0xe2/0xf80 [ 451.106620][T16046] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.106644][T16046] ? trace_irq_disable+0x37/0x100 [ 451.106663][T16046] ? clear_bhb_loop+0x60/0xb0 [ 451.106687][T16046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.106705][T16046] RIP: 0033:0x7f2dc8f9aeb9 [ 451.106722][T16046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.106739][T16046] RSP: 002b:00007f2dc9e8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 451.106761][T16046] RAX: ffffffffffffffda RBX: 00007f2dc9216090 RCX: 00007f2dc8f9aeb9 [ 451.106775][T16046] RDX: 0000000000000007 RSI: 0000200000000b40 RDI: 0000000000000004 [ 451.106787][T16046] RBP: 00007f2dc9e8e090 R08: 0000000000000000 R09: 0000000000000000 [ 451.106799][T16046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 451.106810][T16046] R13: 00007f2dc9216128 R14: 00007f2dc9216090 R15: 00007ffe7cf985c8 [ 451.106846][T16046] [ 451.417763][T16052] xt_limit: Overflow, try lower: 271964/0 [ 451.441206][T16053] netlink: 'syz.3.2916': attribute type 1 has an invalid length. [ 451.449237][T16053] netlink: 'syz.3.2916': attribute type 2 has an invalid length. [ 451.622457][T16059] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 451.644043][T16059] netlink: 'syz.4.2921': attribute type 1 has an invalid length. [ 451.680460][T16064] netlink: 'syz.3.2922': attribute type 12 has an invalid length. [ 451.761815][T16067] bond7: Invalid ad_actor_system MAC address. [ 451.771976][T16067] bond7: option ad_actor_system: invalid value (1) [ 451.810464][T16067] bond7 (unregistering): Released all slaves [ 451.982170][T16079] gretap0: entered promiscuous mode [ 452.053097][T16082] gretap0: left promiscuous mode [ 452.159979][T16082] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 452.215495][ T53] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 452.236233][ T53] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 452.245613][ T53] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 452.263495][ T53] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 452.274849][ T53] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 452.821267][T16118] __nla_validate_parse: 10 callbacks suppressed [ 452.821291][T16118] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2938'. [ 453.093777][T16128] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2942'. [ 453.110420][T16129] xt_bpf: check failed: parse error [ 453.163542][T16132] netlink: 'syz.4.2941': attribute type 1 has an invalid length. [ 453.242730][T16087] lo speed is unknown, defaulting to 1000 [ 453.299687][T16128] bond7: (slave veth7): Enslaving as an active interface with a down link [ 453.353361][T16131] bond7: (slave veth9): Enslaving as an active interface with a down link [ 453.409077][T16128] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2942'. [ 453.661400][T16087] chnl_net:caif_netlink_parms(): no params data found [ 453.897334][T16169] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2950'. [ 453.915533][T16087] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.934807][T16087] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.977821][T16087] bridge_slave_0: entered allmulticast mode [ 453.998128][T16087] bridge_slave_0: entered promiscuous mode [ 454.011868][T16087] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.013853][T16163] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2950'. [ 454.028553][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5680 ms [ 454.028587][ C1] lec:lec_tx_timeout: lec0 [ 454.038684][T16087] bridge0: port 2(bridge_slave_1) entered disabled state [ 454.041671][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 454.069999][T16087] bridge_slave_1: entered allmulticast mode [ 454.082504][T16087] bridge_slave_1: entered promiscuous mode [ 454.100651][T16176] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2953'. [ 454.129610][T16178] netlink: 232 bytes leftover after parsing attributes in process `syz.4.2954'. [ 454.199153][T16087] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 454.242020][T16087] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 454.273931][T16185] netlink: 140 bytes leftover after parsing attributes in process `syz.4.2956'. [ 454.331153][T16087] team0: Port device team_slave_0 added [ 454.342711][T16087] team0: Port device team_slave_1 added [ 454.355723][ T53] Bluetooth: hci5: command tx timeout [ 454.418693][T16087] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 454.425816][T16087] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 454.453597][T16087] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 454.467110][T16087] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 454.474425][T16087] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 454.501393][T16087] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 454.675064][T16087] hsr_slave_0: entered promiscuous mode [ 454.682906][T16087] hsr_slave_1: entered promiscuous mode [ 454.692224][T16087] debugfs: 'hsr0' already exists in 'hsr' [ 454.699924][T16087] Cannot create hsr debugfs directory [ 455.275755][T16087] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 455.295390][T16222] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2969'. [ 455.305114][T16087] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 455.316255][T16087] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.327919][T16087] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 455.366017][T16222] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2969'. [ 455.525257][T16087] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 455.588315][T16087] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 455.633079][T16087] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.665417][T16087] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 455.959881][T16263] netlink: 'syz.1.2979': attribute type 6 has an invalid length. [ 455.968275][T16264] netlink: 'syz.1.2979': attribute type 6 has an invalid length. [ 456.064589][T16087] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 456.092573][T16087] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 456.104692][T16087] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.116060][T16087] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 456.157178][T16267] gre2: entered promiscuous mode [ 456.167779][T16267] gre2: entered allmulticast mode [ 456.330422][T16087] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 456.381557][T16087] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 256 - 0 [ 456.421935][T16087] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.435020][ T53] Bluetooth: hci5: command tx timeout [ 456.441829][T16087] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 456.502643][T16284] netlink: 'syz.1.2984': attribute type 3 has an invalid length. [ 456.777894][T16087] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 456.803202][T16087] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 456.822958][T16087] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 456.873916][T16087] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 457.101652][T16087] 8021q: adding VLAN 0 to HW filter on device bond0 [ 457.176618][T16087] 8021q: adding VLAN 0 to HW filter on device team0 [ 457.199256][T16321] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 457.240632][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 457.247888][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 457.323179][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 457.330545][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 457.482817][T16342] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 457.535342][T16342] syzkaller1: Linktype set failed because interface is up [ 457.661222][T16344] netlink: 'syz.2.2999': attribute type 3 has an invalid length. [ 457.958653][T16358] __nla_validate_parse: 10 callbacks suppressed [ 457.958675][T16358] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3002'. [ 458.002635][T16366] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3002'. [ 458.036453][T16366] openvswitch: netlink: Flow actions attr not present in new flow. [ 458.053774][T16369] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.3006'. [ 458.072599][T16369] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.3006'. [ 458.146621][T16372] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3007'. [ 458.195456][T16087] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 458.300815][T16087] veth0_vlan: entered promiscuous mode [ 458.330732][T16379] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3010'. [ 458.333167][T16087] veth1_vlan: entered promiscuous mode [ 458.345827][T16379] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3010'. [ 458.422714][T16384] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3008'. [ 458.482479][T16087] veth0_macvtap: entered promiscuous mode [ 458.514946][ T53] Bluetooth: hci5: command tx timeout [ 458.515917][T16087] veth1_macvtap: entered promiscuous mode [ 458.583474][T16087] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 458.609159][T16087] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 458.631153][T10151] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.641570][T10151] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.660373][T10151] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.671595][T10151] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 458.773101][T16393] No such timeout policy "syz0" [ 458.841651][T10158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.855378][T10158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.950518][T16397] bond8: option resend_igmp: invalid value (32767) [ 458.957284][T16397] bond8: option resend_igmp: allowed values 0 - 255 [ 458.972878][T16397] bond8 (unregistering): Released all slaves [ 459.019193][T16401] netlink: 'syz.4.3017': attribute type 29 has an invalid length. [ 459.030613][T10131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 459.040620][T10131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 459.046676][T16401] netlink: 'syz.4.3017': attribute type 29 has an invalid length. [ 459.057546][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 459.065660][ C1] lec:lec_tx_timeout: lec0 [ 459.098995][T16401] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3017'. [ 459.484829][T16423] syzkaller0: entered promiscuous mode [ 459.490498][T16423] syzkaller0: entered allmulticast mode [ 459.498825][T16425] sctp: [Deprecated]: syz.3.3024 (pid 16425) Use of int in maxseg socket option. [ 459.498825][T16425] Use struct sctp_assoc_value instead [ 459.580885][ T5145] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 459.591261][ T5145] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 459.602093][ T5145] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 459.612329][ T5145] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 459.620850][ T5145] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 459.674949][T16425] bond1 (unregistering): Released all slaves [ 459.731780][T16436] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3026'. [ 459.746819][T16432] tipc: Started in network mode [ 459.754099][T16432] tipc: Node identity ac14140f, cluster identity 4711 [ 459.782875][T16432] tipc: New replicast peer: 255.255.255.255 [ 459.799555][T16432] tipc: Enabled bearer , priority 10 [ 460.504720][T16430] lo speed is unknown, defaulting to 1000 [ 460.602128][ T5145] Bluetooth: hci5: command tx timeout [ 460.677623][T16491] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_vlan, syncid = 2, id = 0 [ 460.727198][T16485] IPVS: stopping master sync thread 16491 ... [ 460.966888][T10149] tipc: Node number set to 2886997007 [ 461.171136][T16430] chnl_net:caif_netlink_parms(): no params data found [ 461.219016][T16525] netlink: 'syz.1.3048': attribute type 2 has an invalid length. [ 461.453023][T16430] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.492580][T16430] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.512521][T16430] bridge_slave_0: entered allmulticast mode [ 461.571091][T16430] bridge_slave_0: entered promiscuous mode [ 461.622462][T16430] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.630131][T16430] bridge0: port 2(bridge_slave_1) entered disabled state [ 461.637854][T16430] bridge_slave_1: entered allmulticast mode [ 461.646117][T16430] bridge_slave_1: entered promiscuous mode [ 461.677443][T16544] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 461.716364][T16430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 461.717836][ T5145] Bluetooth: hci1: command tx timeout [ 461.763480][T16430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 461.899871][T16430] team0: Port device team_slave_0 added [ 461.923476][T16430] team0: Port device team_slave_1 added [ 461.958166][T16551] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 462.021711][T16430] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 462.030642][T16430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.049647][T16561] netlink: 'syz.1.3057': attribute type 3 has an invalid length. [ 462.058032][T16430] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 462.082814][T16559] only policy match revision 0 supported [ 462.082838][T16559] unable to load match [ 462.096422][T16561] netlink: 'syz.1.3057': attribute type 1 has an invalid length. [ 462.122966][T16561] NCSI netlink: No device for ifindex 813332851 [ 462.139708][T16430] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 462.146794][T16430] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.179969][T16430] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 462.201414][T16561] netlink: 'syz.1.3057': attribute type 12 has an invalid length. [ 462.379570][T16430] hsr_slave_0: entered promiscuous mode [ 462.388572][T16430] hsr_slave_1: entered promiscuous mode [ 462.395227][T16430] debugfs: 'hsr0' already exists in 'hsr' [ 462.417042][T16430] Cannot create hsr debugfs directory [ 462.443691][T16578] netlink: 'syz.3.3060': attribute type 33 has an invalid length. [ 462.825521][T16595] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 463.108326][T16614] netlink: 'syz.1.3072': attribute type 1 has an invalid length. [ 463.190921][T16614] bond8: entered promiscuous mode [ 463.211242][T16614] 8021q: adding VLAN 0 to HW filter on device bond8 [ 463.253625][T16430] netdevsim netdevsim2 netdevsim0 (unregistering): left allmulticast mode [ 463.333466][T16628] gtp0: entered promiscuous mode [ 463.339172][T16628] gtp0: entered allmulticast mode [ 463.468095][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 463.544545][T16430] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 463.555649][T16639] Cannot find set identified by id 3 to match [ 463.575496][T16430] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 463.625511][T16430] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 463.662898][T16430] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 463.788797][ T5145] Bluetooth: hci1: command tx timeout [ 463.792583][T16663] __nla_validate_parse: 46 callbacks suppressed [ 463.792602][T16663] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3085'. [ 463.885800][T16430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 463.914983][T16430] 8021q: adding VLAN 0 to HW filter on device team0 [ 463.935640][T10131] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.943039][T10131] bridge0: port 1(bridge_slave_0) entered forwarding state [ 463.973229][T10151] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.980682][T10151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 463.997271][T16666] netlink: 92 bytes leftover after parsing attributes in process `syz.4.3086'. [ 464.218554][T16676] gre0: entered promiscuous mode [ 464.223942][T16676] gre0: entered allmulticast mode [ 464.366724][T16430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 464.377437][T16682] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3091'. [ 464.400559][T16682] ip6erspan0: entered promiscuous mode [ 464.471411][T16430] veth0_vlan: entered promiscuous mode [ 464.495049][T16430] veth1_vlan: entered promiscuous mode [ 464.505410][T16684] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3092'. [ 464.536991][T16684] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 464.546535][T16684] tipc: Enabled bearer , priority 10 [ 464.557331][T16430] veth0_macvtap: entered promiscuous mode [ 464.584544][T16430] veth1_macvtap: entered promiscuous mode [ 464.613449][T16430] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 464.637124][T16430] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 464.659044][ T60] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.684265][ T60] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.712497][ T60] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.725346][ T60] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.867927][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 464.887241][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 465.054538][T16712] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3100'. [ 465.361305][T16735] openvswitch: netlink: Unexpected mask (mask=2020040, allowed=2010048) [ 465.677928][T10138] tipc: Node number set to 3880390285 [ 465.868799][ T5145] Bluetooth: hci1: command tx timeout [ 467.699930][T16687] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 467.760001][T10131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.789353][T10131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.949979][ T5145] Bluetooth: hci1: command tx timeout [ 468.000797][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 468.047591][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 468.050819][T16768] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.055794][T16764] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.120909][T16772] openvswitch: netlink: IP tunnel dst address not specified [ 468.175009][T16764] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.421668][ T53] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 468.433668][ T53] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 468.443714][ T53] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 468.455265][T16784] syzkaller1: entered promiscuous mode [ 468.456878][ T53] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 468.469909][ T53] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 468.470609][T16784] syzkaller1: entered allmulticast mode [ 468.531219][T16784] netlink: 'syz.2.3118': attribute type 11 has an invalid length. [ 468.836958][T16789] openvswitch: netlink: Tunnel attr 24 out of range max 16 [ 468.989865][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5520 ms [ 468.998067][ C1] lec:lec_tx_timeout: lec0 [ 469.002890][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 469.057357][T16796] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3123'. [ 469.166080][T16802] IPVS: set_ctl: invalid protocol: 181 127.0.0.1:20002 [ 469.186590][T16781] lo speed is unknown, defaulting to 1000 [ 469.252248][T16806] netlink: 'syz.1.3126': attribute type 3 has an invalid length. [ 469.322154][T16808] ip6t_srh: unknown srh invflags 4000 [ 469.346573][T16808] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3128'. [ 469.349253][T16812] syzkaller0: entered promiscuous mode [ 469.361710][T16808] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3128'. [ 469.372864][T16812] syzkaller0: entered allmulticast mode [ 469.384595][T16806] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3126'. [ 469.504776][T16812] tipc: Started in network mode [ 469.510383][T16812] tipc: Node identity 9ab377f7dd65, cluster identity 4711 [ 469.531546][T16812] tipc: Enabled bearer , priority 0 [ 469.617774][T16818] tipc: Resetting bearer [ 469.653307][T16818] tipc: Disabling bearer [ 469.691084][T16835] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3130'. [ 469.806538][T16781] chnl_net:caif_netlink_parms(): no params data found [ 469.830785][T16843] netlink: 'syz.2.3135': attribute type 1 has an invalid length. [ 469.860535][T16843] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3135'. [ 469.868334][T16844] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3135'. [ 470.344447][T16874] xt_TPROXY: Can be used only with -p tcp or -p udp [ 470.512320][ T53] Bluetooth: hci2: command tx timeout [ 470.575722][T16781] bridge0: port 1(bridge_slave_0) entered blocking state [ 470.614453][T16781] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.622907][T16781] bridge_slave_0: entered allmulticast mode [ 470.636776][T16781] bridge_slave_0: entered promiscuous mode [ 470.669507][T16781] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.718208][T16781] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.733968][T16781] bridge_slave_1: entered allmulticast mode [ 470.772703][T16781] bridge_slave_1: entered promiscuous mode [ 470.929070][T16781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 470.971471][T16781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 471.115119][T16781] team0: Port device team_slave_0 added [ 471.130925][T16898] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3148'. [ 471.153880][T16781] team0: Port device team_slave_1 added [ 471.192851][T16902] netlink: 'syz.1.3149': attribute type 16 has an invalid length. [ 471.208506][T16902] netlink: 'syz.1.3149': attribute type 3 has an invalid length. [ 471.219526][T16902] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3149'. [ 471.271331][T16905] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3150'. [ 471.318536][T16781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 471.348701][T16781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 471.389265][T16781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 471.403005][T16781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 471.410670][T16781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 471.440339][T16781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 471.440612][T16911] netlink: 'syz.4.3150': attribute type 33 has an invalid length. [ 471.561709][T16907] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 471.593494][T16912] bridge5: port 1(veth11) entered blocking state [ 471.601271][T16912] bridge5: port 1(veth11) entered disabled state [ 471.609038][T16912] veth11: entered allmulticast mode [ 471.616888][T16912] veth11: entered promiscuous mode [ 471.684687][ T60] bridge0: port 3(team0) entered disabled state [ 471.705988][T16909] bridge5: port 2(veth0_to_bond) entered blocking state [ 471.716575][T16909] bridge5: port 2(veth0_to_bond) entered disabled state [ 471.725607][T16909] veth0_to_bond: entered allmulticast mode [ 471.734522][T16909] veth0_to_bond: entered promiscuous mode [ 471.813522][T16781] hsr_slave_0: entered promiscuous mode [ 471.850809][T16781] hsr_slave_1: entered promiscuous mode [ 471.878623][T16781] debugfs: 'hsr0' already exists in 'hsr' [ 471.887661][T16781] Cannot create hsr debugfs directory [ 472.102653][T16937] netlink: 'syz.4.3160': attribute type 1 has an invalid length. [ 472.356107][T16781] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.448920][T16955] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 472.562753][T16781] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.588754][ T53] Bluetooth: hci2: command tx timeout [ 472.666297][T16781] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.811630][T16781] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.989166][T16979] 8021q: adding VLAN 0 to HW filter on device bond1 [ 473.042591][T16984] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 473.161901][T16992] netlink: 'syz.3.3173': attribute type 1 has an invalid length. [ 473.185117][T16781] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 473.243945][T16781] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 473.305477][T16781] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 473.391218][T16781] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 473.430126][T17008] netlink: 'syz.3.3177': attribute type 10 has an invalid length. [ 473.454186][T17007] bond0: entered promiscuous mode [ 473.460577][T17007] bond_slave_0: entered promiscuous mode [ 473.467135][T17007] bond_slave_1: entered promiscuous mode [ 473.487520][T17007] bond0: left promiscuous mode [ 473.498290][T17007] bond_slave_0: left promiscuous mode [ 473.503929][T17007] bond_slave_1: left promiscuous mode [ 473.721409][T16781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 473.793136][T16781] 8021q: adding VLAN 0 to HW filter on device team0 [ 473.829064][T17034] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 473.884311][T10158] bridge0: port 1(bridge_slave_0) entered blocking state [ 473.901054][T10158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 473.950840][T17041] veth5: entered allmulticast mode [ 473.959432][T10158] bridge0: port 2(bridge_slave_1) entered blocking state [ 473.966653][T10158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 473.986459][T17046] netlink: 'syz.1.3185': attribute type 1 has an invalid length. [ 474.027555][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 474.035673][ C1] lec:lec_tx_timeout: lec0 [ 474.136892][T17052] __nla_validate_parse: 15 callbacks suppressed [ 474.136914][T17052] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3188'. [ 474.196433][T17059] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3190'. [ 474.522547][T16781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 474.564806][T17073] netlink: 'syz.4.3195': attribute type 1 has an invalid length. [ 474.573359][T17073] netlink: 280 bytes leftover after parsing attributes in process `syz.4.3195'. [ 474.633202][T16781] veth0_vlan: entered promiscuous mode [ 474.669417][ T53] Bluetooth: hci2: command tx timeout [ 474.800420][T16781] veth1_vlan: entered promiscuous mode [ 474.899140][T16781] veth0_macvtap: entered promiscuous mode [ 474.927153][T16781] veth1_macvtap: entered promiscuous mode [ 474.983253][T16781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 475.013760][T16781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 475.041691][T17087] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3199'. [ 475.070766][T10158] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.090963][T10158] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.125237][T10158] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.155016][T10158] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 475.244370][T17098] mac80211_hwsim hwsim30 : renamed from wlan1 (while UP) [ 475.436397][T10125] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.487417][T10125] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.610871][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.637263][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.711908][T17123] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3207'. [ 475.785361][T17125] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3208'. [ 475.820362][T17119] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3207'. [ 475.898852][T17129] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3115'. [ 475.958681][T17134] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3115'. [ 475.994484][T17134] xfrm1: entered promiscuous mode [ 475.999967][T17134] xfrm1: entered allmulticast mode [ 476.011427][T17137] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3210'. [ 476.018417][T17136] syzkaller0: entered promiscuous mode [ 476.026130][T17136] syzkaller0: entered allmulticast mode [ 476.332297][T16749] udevd[16749]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 476.421761][ T5145] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 476.444743][ T5145] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 476.453147][ T5145] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 476.462111][ T5145] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 476.470943][ T5145] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 476.748854][ T5145] Bluetooth: hci2: command tx timeout [ 476.760473][T17156] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 476.792381][T10635] IPVS: starting estimator thread 0... [ 476.897722][T17164] IPVS: using max 23 ests per chain, 55200 per kthread [ 477.432178][T17182] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.440364][T17182] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.585016][T17182] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 477.613602][T17182] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 477.773903][T17148] lo speed is unknown, defaulting to 1000 [ 477.787033][T17193] veth0: entered promiscuous mode [ 477.793678][T17193] veth0: left promiscuous mode [ 477.936401][T10144] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.947010][T10144] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.089463][T10144] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.112018][T10144] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.305817][T17222] syzkaller0: entered promiscuous mode [ 478.312403][T17222] syzkaller0: entered allmulticast mode [ 478.354205][T17220] netlink: 'syz.2.3234': attribute type 1 has an invalid length. [ 478.386473][T17220] netlink: 'syz.2.3234': attribute type 1 has an invalid length. [ 478.592836][ T5145] Bluetooth: hci0: command tx timeout [ 478.599728][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 478.792296][T10137] IPVS: starting estimator thread 0... [ 478.830232][ T5145] Bluetooth: hci2: command tx timeout [ 478.854240][ T50] veth0_to_bond: left allmulticast mode [ 478.879529][ T50] veth0_to_bond: left promiscuous mode [ 478.887358][ T50] bridge5: port 2(veth0_to_bond) entered disabled state [ 478.897777][T17252] IPVS: using max 33 ests per chain, 79200 per kthread [ 478.932094][ T50] veth11: left allmulticast mode [ 478.937127][ T50] veth11: left promiscuous mode [ 478.955905][ T50] bridge5: port 1(veth11) entered disabled state [ 479.224601][T17272] __nla_validate_parse: 7 callbacks suppressed [ 479.224622][T17272] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3243'. [ 479.809975][ T50] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 479.821350][ T50] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 479.831090][ T50] bond0 (unregistering): Released all slaves [ 479.842204][ T50] bond1 (unregistering): Released all slaves [ 479.968728][ T50] bond2 (unregistering): (slave veth1): Releasing active interface [ 479.977804][ T50] bond2 (unregistering): Released all slaves [ 479.990920][ T50] bond3 (unregistering): Released all slaves [ 480.004278][ T50] bond4 (unregistering): Released all slaves [ 480.130832][ T50] bond5 (unregistering): Released all slaves [ 480.144029][ T50] bond6 (unregistering): Released all slaves [ 480.159251][ T50] bond7 (unregistering): (slave veth7): Releasing active interface [ 480.169959][ T50] bond7 (unregistering): (slave veth9): Releasing active interface [ 480.184941][ T50] bond7 (unregistering): Released all slaves [ 480.302931][ T50] bond8 (unregistering): Released all slaves [ 480.323309][T17148] chnl_net:caif_netlink_parms(): no params data found [ 480.351859][T17259] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 480.366791][T17259] bond1 (unregistering): Released all slaves [ 480.550693][T17270] team0 (unregistering): Port device team_slave_0 removed [ 480.581241][T17270] team0 (unregistering): Port device team_slave_1 removed [ 480.612772][T17276] vlan1: entered allmulticast mode [ 480.618127][T17276] veth0_vlan: entered allmulticast mode [ 480.632084][ T50] : left promiscuous mode [ 480.667610][ T5145] Bluetooth: hci0: command tx timeout [ 480.753911][ T50] 9: left promiscuous mode [ 480.910921][T17294] netlink: 'syz.2.3249': attribute type 21 has an invalid length. [ 480.996587][ T50] tipc: Disabling bearer [ 481.020441][ T50] tipc: Left network mode [ 481.062862][T17306] openvswitch: netlink: Flow key attr not present in new flow. [ 481.347396][T17148] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.348980][T17320] Bluetooth: MGMT ver 1.23 [ 481.362312][T17148] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.399969][T17148] bridge_slave_0: entered allmulticast mode [ 481.411788][T17148] bridge_slave_0: entered promiscuous mode [ 481.442799][T17325] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 481.490885][T17148] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.515777][T17148] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.548072][T17148] bridge_slave_1: entered allmulticast mode [ 481.566716][T17148] bridge_slave_1: entered promiscuous mode [ 481.995437][T17148] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 482.048489][T17354] openvswitch: netlink: Duplicate or invalid key (type 0). [ 482.054105][T17148] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 482.059482][T17354] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 482.356583][T17148] team0: Port device team_slave_0 added [ 482.370664][T17370] netlink: 208240 bytes leftover after parsing attributes in process `syz.3.3266'. [ 482.466033][T17148] team0: Port device team_slave_1 added [ 482.570590][T17365] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3265'. [ 482.609282][T17379] netlink: 'syz.3.3267': attribute type 11 has an invalid length. [ 482.747672][ T5145] Bluetooth: hci0: command tx timeout [ 482.802545][T17148] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 482.809706][T17148] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 482.837725][T17148] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 482.881080][T17148] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 482.900203][T17148] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 482.976948][T17148] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 483.082895][T17388] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3270'. [ 483.267239][T17148] hsr_slave_0: entered promiscuous mode [ 483.282412][T17148] hsr_slave_1: entered promiscuous mode [ 483.300388][T17148] debugfs: 'hsr0' already exists in 'hsr' [ 483.317580][T17148] Cannot create hsr debugfs directory [ 483.371557][ T50] hsr_slave_0: left promiscuous mode [ 483.392700][ T50] hsr_slave_1: left promiscuous mode [ 483.644960][T17414] netlink: 716 bytes leftover after parsing attributes in process `syz.4.3274'. [ 483.785053][T17418] netlink: 'syz.2.3276': attribute type 2 has an invalid length. [ 483.795146][T17418] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3276'. [ 484.035220][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5430 ms [ 484.043329][ C1] lec:lec_tx_timeout: lec0 [ 484.049098][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 484.308200][ T50] batadv_slave_1 (unregistering): left allmulticast mode [ 484.828448][ T5145] Bluetooth: hci0: command tx timeout [ 484.926917][T17434] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 484.966747][T17439] netlink: 'syz.0.3280': attribute type 17 has an invalid length. [ 484.999366][T17439] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3280'. [ 485.050743][T17439] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3280'. [ 485.537309][T17466] s5: renamed from vlan1 (while UP) [ 485.914872][T17478] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 486.420552][ T50] IPVS: stop unused estimator thread 0... [ 486.468821][T17506] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3295'. [ 486.587282][T17512] x_tables: duplicate underflow at hook 1 [ 486.620046][T17506] bond2 (unregistering): Released all slaves [ 486.677660][T17518] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 486.772799][T17518] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3299'. [ 486.870144][T17518] xt_hashlimit: size too large, truncated to 1048576 [ 487.002171][T17148] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 487.118256][T17148] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 487.155889][T17148] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 487.224835][T17148] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 487.431835][T17556] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3305'. [ 487.593101][T17148] 8021q: adding VLAN 0 to HW filter on device bond0 [ 487.661080][T17148] 8021q: adding VLAN 0 to HW filter on device team0 [ 487.738688][T10139] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.745940][T10139] bridge0: port 1(bridge_slave_0) entered forwarding state [ 487.792816][T10139] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.800121][T10139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 488.109715][T17580] syzkaller0: entered promiscuous mode [ 488.133585][T17580] syzkaller0: entered allmulticast mode [ 489.057489][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 489.065589][ C1] lec:lec_tx_timeout: lec0 [ 490.904231][T17661] 8021q: VLANs not supported on gre0 [ 490.952849][T17148] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 491.032053][T17148] veth0_vlan: entered promiscuous mode [ 491.051929][T17148] veth1_vlan: entered promiscuous mode [ 491.113353][T17148] veth0_macvtap: entered promiscuous mode [ 491.134180][T17148] veth1_macvtap: entered promiscuous mode [ 491.163195][T17148] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 491.185259][T17148] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 491.207430][T10151] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.222625][T10151] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.265789][T10151] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.299771][T10151] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.381194][T10151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.386833][T17683] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 491.406905][T10151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.411091][T17682] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 491.492992][T10125] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.494059][T17687] netlink: 'syz.2.3325': attribute type 16 has an invalid length. [ 491.510175][T17687] netlink: 'syz.2.3325': attribute type 17 has an invalid length. [ 491.512833][T10125] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 491.737399][T17687] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.745287][T17687] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.124233][ T53] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 492.137361][ T53] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 492.147297][ T53] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 492.157204][ T53] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 492.169677][ T53] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 492.299965][T17687] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 492.318977][T17687] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 492.604112][ T5837] bridge0: port 2(syz_tun) entered disabled state [ 492.634707][T17722] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3330'. [ 492.643980][T17722] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3330'. [ 492.677017][ T5837] syz_tun (unregistering): left allmulticast mode [ 492.706885][ T5837] syz_tun (unregistering): left promiscuous mode [ 492.715995][ T5837] bridge0: port 2(syz_tun) entered disabled state [ 492.733784][ T50] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 492.744497][ T50] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 492.761660][T17721] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 492.802621][ T50] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 492.848301][ T50] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 492.988660][T17747] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 493.045151][T17750] 8021q: adding VLAN 0 to HW filter on device bond0 [ 493.078627][T17750] bond0: (slave gre0): The slave device specified does not support setting the MAC address [ 493.104637][T17750] bond0: (slave gre0): Error -95 calling set_mac_address [ 493.115918][T17756] netlink: 'syz.0.3339': attribute type 2 has an invalid length. [ 493.138276][T17753] bpq0: left allmulticast mode [ 493.145013][T17756] netlink: 'syz.0.3339': attribute type 2 has an invalid length. [ 493.478692][T17778] syzkaller1: entered promiscuous mode [ 493.484590][T17778] syzkaller1: entered allmulticast mode [ 493.559373][T17717] lo speed is unknown, defaulting to 1000 [ 493.707865][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 493.900720][T17717] chnl_net:caif_netlink_parms(): no params data found [ 493.975900][T17758] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 494.003164][T17799] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 494.054520][T17799] netlink: 'syz.2.3349': attribute type 12 has an invalid length. [ 494.204117][T17717] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.224466][T17717] bridge0: port 1(bridge_slave_0) entered disabled state [ 494.232435][T17717] bridge_slave_0: entered allmulticast mode [ 494.241574][T17717] bridge_slave_0: entered promiscuous mode [ 494.252285][T17717] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.263072][T17808] netlink: 'syz.2.3351': attribute type 10 has an invalid length. [ 494.278374][ T53] Bluetooth: hci3: command tx timeout [ 494.278787][T17717] bridge0: port 2(bridge_slave_1) entered disabled state [ 494.309975][T17717] bridge_slave_1: entered allmulticast mode [ 494.319976][T17814] netlink: 'syz.3.3353': attribute type 10 has an invalid length. [ 494.331941][T17717] bridge_slave_1: entered promiscuous mode [ 494.340462][T17808] veth0_macvtap: left promiscuous mode [ 494.350433][T17808] team0: Device veth0_macvtap failed to register rx_handler [ 494.546379][T17717] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 494.607381][T17717] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 494.850736][T17717] team0: Port device team_slave_0 added [ 494.880929][T17717] team0: Port device team_slave_1 added [ 495.061944][T17717] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 495.087735][T17717] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 495.132951][T17717] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 495.150670][ T53] Bluetooth: hci0: command 0x0c1a tx timeout [ 495.159918][T17717] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 495.167095][T17717] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 495.207394][T17717] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 495.510641][T17717] hsr_slave_0: entered promiscuous mode [ 495.527096][T17717] hsr_slave_1: entered promiscuous mode [ 495.558076][T17717] debugfs: 'hsr0' already exists in 'hsr' [ 495.566915][T17717] Cannot create hsr debugfs directory [ 495.856559][T17891] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3367'. [ 495.957363][T17898] netlink: 'syz.3.3369': attribute type 12 has an invalid length. [ 495.975660][T17898] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3369'. [ 496.115415][T17903] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 496.225135][T17913] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3373'. [ 496.276816][T17717] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 496.297063][T17717] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.363002][ T53] Bluetooth: hci3: command tx timeout [ 496.375737][T17913] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3373'. [ 496.407956][T17717] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 496.427224][T17717] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.501332][T17717] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 496.512810][T17717] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.576120][T17717] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 496.590176][T17717] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.655829][T17931] 8021q: VLANs not supported on lo [ 496.664231][T17931] netlink: 16215 bytes leftover after parsing attributes in process `syz.2.3379'. [ 496.774427][T17934] netlink: 'syz.2.3380': attribute type 4 has an invalid length. [ 496.793149][T17934] netlink: 'syz.2.3380': attribute type 4 has an invalid length. [ 496.816593][T17717] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 496.828977][T17717] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 496.841616][T17717] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 496.866657][T17717] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 497.000285][T17717] 8021q: adding VLAN 0 to HW filter on device bond0 [ 497.034228][T17717] 8021q: adding VLAN 0 to HW filter on device team0 [ 497.066008][T10131] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.073560][T10131] bridge0: port 1(bridge_slave_0) entered forwarding state [ 497.093761][T17947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3383'. [ 497.134580][T10144] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.141829][T10144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 497.283624][T17951] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3385'. [ 497.286564][T17953] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 497.317659][T17951] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3385'. [ 497.341435][T17953] netlink: 'syz.0.3384': attribute type 11 has an invalid length. [ 497.351061][T17953] netlink: 'syz.0.3384': attribute type 11 has an invalid length. [ 497.395880][T17957] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 497.489254][T17955] sctp: [Deprecated]: syz.2.3385 (pid 17955) Use of int in maxseg socket option. [ 497.489254][T17955] Use struct sctp_assoc_value instead [ 497.718951][T17970] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 497.885126][T17979] __nla_validate_parse: 3 callbacks suppressed [ 497.885148][T17979] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3389'. [ 497.910618][T17717] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 498.433300][ T53] Bluetooth: hci3: command tx timeout [ 498.548650][T18016] netlink: 'syz.2.3395': attribute type 1 has an invalid length. [ 498.580633][T18016] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 498.872723][T18028] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3398'. [ 498.894068][T18028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3398'. [ 498.985296][T17717] veth0_vlan: entered promiscuous mode [ 498.992560][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5280 ms [ 499.000648][ C1] lec:lec_tx_timeout: lec0 [ 499.005816][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 499.212103][T17717] veth1_vlan: entered promiscuous mode [ 499.405844][T18059] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3404'. [ 499.522134][T17717] veth0_macvtap: entered promiscuous mode [ 499.523254][T18064] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3406'. [ 499.576279][T17717] veth1_macvtap: entered promiscuous mode [ 499.640735][T18072] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3408'. [ 499.649918][T18072] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3408'. [ 499.679507][T18072] gtp0: entered promiscuous mode [ 499.687753][T18072] gtp0: entered allmulticast mode [ 499.704454][T17717] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 499.775652][T17717] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 499.807211][T18082] openvswitch: netlink: Unexpected mask (mask=201040, allowed=10048) [ 499.843404][T10131] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.884990][T10131] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.948128][T10131] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.980111][T10131] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 500.077986][T18093] netlink: 'syz.3.3412': attribute type 23 has an invalid length. [ 500.100976][T18092] netlink: 'syz.3.3412': attribute type 23 has an invalid length. [ 500.125870][T18095] bridge_slave_0: left allmulticast mode [ 500.151694][T18095] bridge_slave_0: left promiscuous mode [ 500.168880][T18095] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.213901][T18095] bridge_slave_1: left allmulticast mode [ 500.219948][T18095] bridge_slave_1: left promiscuous mode [ 500.226387][T18095] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.248933][T18095] bond0: (slave bond_slave_0): Releasing backup interface [ 500.283235][T18095] bond0: (slave bond_slave_1): Releasing backup interface [ 500.336055][T18095] team0: Port device team_slave_0 removed [ 500.370954][T18095] team0: Port device team_slave_1 removed [ 500.391104][T18095] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 500.396380][T18112] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3415'. [ 500.411196][T18095] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 500.440357][T18095] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 500.450752][T18095] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 500.461970][T18095] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 500.508699][ T53] Bluetooth: hci3: command tx timeout [ 500.791241][T18122] sock: sock_set_timeout: `syz.3.3417' (pid 18122) tries to set negative timeout [ 500.870191][T10131] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 500.891725][T10131] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 501.018617][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 501.026497][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 501.086123][T18136] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3422'. [ 501.225963][T18148] tipc: Can't bind to reserved service type 1 [ 501.314589][T18156] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3328'. [ 501.405254][T18150] syzkaller0: entered promiscuous mode [ 501.423963][T18150] syzkaller0: entered allmulticast mode [ 501.481825][T10131] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 501.494102][T10131] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 501.527826][T10131] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 501.556769][T18170] netlink: 'syz.2.3430': attribute type 1 has an invalid length. [ 501.605330][T18165] xt_CT: No such helper "snmp_trap" [ 501.635353][ T1302] aoe: packet could not be sent on lec0. consider increasing tx_queue_len [ 501.766101][T18180] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 503.833969][T10131] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 503.899730][T18203] : renamed from bond0 [ 504.027631][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 504.036018][ C1] lec:lec_tx_timeout: lec0 [ 504.145867][T18213] __nla_validate_parse: 7 callbacks suppressed [ 504.145889][T18213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3443'. [ 504.636619][T18247] netlink: 'syz.1.3452': attribute type 1 has an invalid length. [ 504.651448][T18251] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3455'. [ 504.663715][T18247] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3452'. [ 504.687760][T18247] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3452'. [ 504.874681][T18264] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 505.311247][T18293] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 505.442278][T18298] syzkaller0: entered promiscuous mode [ 505.449583][T18298] syzkaller0: entered allmulticast mode [ 505.506800][T18305] bond1: entered promiscuous mode [ 505.512556][T18305] bond1: entered allmulticast mode [ 505.518906][T18305] 8021q: adding VLAN 0 to HW filter on device bond1 [ 505.663702][T18313] netlink: 212336 bytes leftover after parsing attributes in process `syz.1.3469'. [ 505.725023][T18315] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3470'. [ 505.992512][T18332] netlink: 'syz.2.3475': attribute type 1 has an invalid length. [ 505.993240][T18334] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3474'. [ 506.054547][T18332] 8021q: adding VLAN 0 to HW filter on device bond2 [ 506.190996][T18332] vlan1: entered promiscuous mode [ 506.217622][T18332] bond2: entered promiscuous mode [ 506.236630][T18332] vlan1: entered allmulticast mode [ 506.270302][T18353] IPVS: set_ctl: invalid protocol: 108 172.20.20.24:20004 [ 506.289686][T18332] bond2: entered allmulticast mode [ 506.796090][T18390] openvswitch: netlink: Actions may not be safe on all matching packets [ 507.091579][T18405] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 507.331836][T18422] openvswitch: netlink: IP tunnel dst address not specified [ 507.411648][T18425] xt_hashlimit: size too large, truncated to 1048576 [ 507.480393][T18428] ip6gre1: entered promiscuous mode [ 507.488748][T18428] ip6gre1: entered allmulticast mode [ 507.866701][T18450] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3503'. [ 507.921232][T18452] : renamed from bond0 (while UP) [ 508.152793][T18466] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 508.279413][T18472] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3510'. [ 508.540287][T18493] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3516'. [ 508.619841][T18496] netlink: 'syz.3.3517': attribute type 10 has an invalid length. [ 508.828247][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 510.492862][T18496] : (slave wlan1): Enslaving as an active interface with an up link [ 510.658107][T18507] __nla_validate_parse: 3 callbacks suppressed [ 510.658128][T18507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3521'. [ 510.679618][T18507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3521'. [ 510.711417][T18511] netlink: 'syz.4.3523': attribute type 9 has an invalid length. [ 511.002223][T18533] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3530'. [ 511.013981][T18529] syzkaller1: entered promiscuous mode [ 511.015705][T18533] netlink: 'syz.0.3530': attribute type 7 has an invalid length. [ 511.029871][T18529] syzkaller1: entered allmulticast mode [ 511.044107][T18533] netlink: 'syz.0.3530': attribute type 8 has an invalid length. [ 511.063604][T18533] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3530'. [ 511.302397][T18544] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3533'. [ 511.444007][T18549] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3534'. [ 511.454515][T18549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3534'. [ 511.465379][T18549] netlink: 'syz.1.3534': attribute type 12 has an invalid length. [ 511.475794][T18549] netlink: 'syz.1.3534': attribute type 11 has an invalid length. [ 511.502982][T18555] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.3535'. [ 511.671826][T18568] netlink: 'syz.0.3539': attribute type 23 has an invalid length. [ 511.765124][T18577] xt_addrtype: ipv6 does not support BROADCAST matching [ 511.828042][T18582] netlink: 67 bytes leftover after parsing attributes in process `syz.4.3540'. [ 511.902831][T18579] bond0: entered allmulticast mode [ 511.944520][T18583] bridge3: entered promiscuous mode [ 511.976447][T18583] bridge3: entered allmulticast mode [ 512.166174][T18601] netlink: 596 bytes leftover after parsing attributes in process `syz.2.3549'. [ 512.261200][T18610] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0xc9 [ 512.345742][T18613] xt_bpf: check failed: parse error [ 512.767233][T18643] netlink: 'syz.1.3559': attribute type 1 has an invalid length. [ 513.517381][T18692] syz_tun: entered allmulticast mode [ 513.728630][T18707] netlink: 'syz.0.3575': attribute type 3 has an invalid length. [ 514.027589][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5200 ms [ 514.035772][ C1] lec:lec_tx_timeout: lec0 [ 514.063839][T18727] veth1_macvtap: left promiscuous mode [ 514.103168][T18729] delete_channel: no stack [ 514.201000][T18736] netlink: 'syz.3.3584': attribute type 4 has an invalid length. [ 514.201415][T18738] netlink: 'syz.3.3584': attribute type 4 has an invalid length. [ 514.756442][T18774] 8021q: adding VLAN 0 to HW filter on device bond1 [ 514.823956][T18768] vlan2: entered promiscuous mode [ 514.869813][T18768] bond1: entered promiscuous mode [ 514.875364][T18768] vlan2: entered allmulticast mode [ 514.886154][T18768] bond1: entered allmulticast mode [ 515.030529][T18786] ip6tnl1: entered promiscuous mode [ 515.050951][T18784] syzkaller0: entered promiscuous mode [ 515.058653][T18784] syzkaller0: entered allmulticast mode [ 515.066658][T18786] only policy match revision 0 supported [ 515.066680][T18786] unable to load match [ 515.156520][T18784] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 515.822109][T18836] __nla_validate_parse: 15 callbacks suppressed [ 515.822132][T18836] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3609'. [ 515.909701][T18842] validate_nla: 4 callbacks suppressed [ 515.909722][T18842] netlink: 'syz.0.3612': attribute type 29 has an invalid length. [ 515.926073][T18842] netlink: 'syz.0.3612': attribute type 29 has an invalid length. [ 515.935809][T18842] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3612'. [ 515.995673][T18849] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3615'. [ 516.106632][T18847] netlink: 'syz.1.3614': attribute type 83 has an invalid length. [ 516.128586][T18856] netlink: 252 bytes leftover after parsing attributes in process `syz.2.3613'. [ 516.166073][T18858] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3613'. [ 516.594523][T18889] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.3621'. [ 516.636889][T18889] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 516.665389][T18892] bridge_slave_0: left allmulticast mode [ 516.703328][T18892] bridge_slave_0: left promiscuous mode [ 516.720271][T18892] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.762688][T18892] bridge_slave_1: left allmulticast mode [ 516.783728][T18892] bridge_slave_1: left promiscuous mode [ 516.798203][T18892] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.864700][T18892] bond0: (slave bond_slave_0): Releasing backup interface [ 516.887225][T18909] netlink: 'syz.4.3627': attribute type 13 has an invalid length. [ 516.921965][T18892] bond0: (slave bond_slave_1): Releasing backup interface [ 517.026469][T18892] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 517.041843][T18901] netlink: 'syz.4.3627': attribute type 13 has an invalid length. [ 517.067912][T18892] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 517.077957][T18901] netlink: 164 bytes leftover after parsing attributes in process `syz.4.3627'. [ 517.122771][T18892] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 517.145507][T18892] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 517.170175][T18892] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 517.251286][T18909] veth0_macvtap: left promiscuous mode [ 517.278915][T18909] macvtap0: entered allmulticast mode [ 517.305943][T18909] macvtap0: refused to change device tx_queue_len [ 517.347415][T18917] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3629'. [ 517.367259][T18901] syz_tun: refused to change device tx_queue_len [ 517.575459][T18930] netlink: 'syz.3.3633': attribute type 16 has an invalid length. [ 517.621024][T18930] netlink: 'syz.3.3633': attribute type 17 has an invalid length. [ 517.653834][T18935] netlink: 'syz.3.3633': attribute type 16 has an invalid length. [ 517.733387][T18935] netlink: 'syz.3.3633': attribute type 17 has an invalid length. [ 517.780510][T18939] Bluetooth: MGMT ver 1.23 [ 517.860213][T18930] 8021q: adding VLAN 0 to HW filter on device  [ 517.876487][T18930] 8021q: adding VLAN 0 to HW filter on device team0 [ 517.896923][T18930] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 517.967381][T18930] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 517.980413][T18930] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 518.002104][T18930] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 518.013308][T18930] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 518.048379][T18930] veth1_vlan: left promiscuous mode [ 518.057289][T18930] veth0_vlan: left promiscuous mode [ 518.067218][T18930] veth0_vlan: entered promiscuous mode [ 518.079947][T18930] veth1_vlan: entered promiscuous mode [ 518.099500][T18930] veth1_macvtap: left promiscuous mode [ 518.108147][T18930] veth0_macvtap: left promiscuous mode [ 518.115863][T18930] veth0_macvtap: entered promiscuous mode [ 518.125735][T18930] veth1_macvtap: entered promiscuous mode [ 518.166923][T18930] 8021q: adding VLAN 0 to HW filter on device bond1 [ 518.274013][T10139] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.281447][T10139] bridge0: port 1(bridge_slave_0) entered forwarding state [ 518.341897][T10139] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.349204][T10139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 518.441799][T10125] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.454211][T10125] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.463703][T18960] netlink: 'syz.4.3637': attribute type 10 has an invalid length. [ 518.499072][T18963] bond3: Removing last ns target with arp_interval on [ 518.507059][T18971] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0xc9 [ 518.513927][T10125] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.527285][T10125] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.546087][T18960] team0: Port device dummy0 added [ 518.552505][T18969] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 518.711123][T18977] tipc: Enabled bearer , priority 0 [ 518.764087][T18981] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3643'. [ 518.941534][T18977] tipc: Disabling bearer [ 518.999157][T18996] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3647'. [ 519.000049][T18994] IPv6: sit1: Disabled Multicast RS [ 519.084952][T18996] bridge0: port 2(bridge_slave_1) entered disabled state [ 519.794126][T19036] s5: renamed from vlan1 (while UP) [ 520.013615][T19048] syz.3.3660: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 520.045390][T19048] CPU: 1 UID: 0 PID: 19048 Comm: syz.3.3660 Not tainted syzkaller #0 PREEMPT(full) [ 520.045420][T19048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 520.045432][T19048] Call Trace: [ 520.045439][T19048] [ 520.045447][T19048] dump_stack_lvl+0xe8/0x150 [ 520.045479][T19048] warn_alloc+0x249/0x340 [ 520.045502][T19048] ? stack_trace_save+0xa9/0x100 [ 520.045530][T19048] ? __pfx_warn_alloc+0x10/0x10 [ 520.045569][T19048] ? kasan_save_track+0x4f/0x80 [ 520.045585][T19048] ? kasan_save_track+0x3e/0x80 [ 520.045600][T19048] ? __kasan_kmalloc+0x93/0xb0 [ 520.045617][T19048] ? __kmalloc_cache_noprof+0x3d1/0x6e0 [ 520.045635][T19048] ? xskq_create+0x56/0x170 [ 520.045653][T19048] ? xsk_setsockopt+0x54c/0x990 [ 520.045678][T19048] ? do_sock_setsockopt+0x17c/0x1b0 [ 520.045700][T19048] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 520.045723][T19048] ? do_syscall_64+0xe2/0xf80 [ 520.045748][T19048] __vmalloc_node_range_noprof+0x132/0x1730 [ 520.045804][T19048] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 520.045830][T19048] ? __kasan_kmalloc+0x93/0xb0 [ 520.045857][T19048] vmalloc_user_noprof+0xad/0xe0 [ 520.045876][T19048] ? xskq_create+0xbf/0x170 [ 520.045895][T19048] xskq_create+0xbf/0x170 [ 520.045915][T19048] xsk_init_queue+0xad/0x110 [ 520.045944][T19048] xsk_setsockopt+0x54c/0x990 [ 520.045975][T19048] ? __pfx_xsk_setsockopt+0x10/0x10 [ 520.046001][T19048] ? __pfx_aa_sk_perm+0x10/0x10 [ 520.046028][T19048] ? aa_sock_opt_perm+0xff/0x1a0 [ 520.046056][T19048] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 520.046076][T19048] ? __pfx_xsk_setsockopt+0x10/0x10 [ 520.046104][T19048] do_sock_setsockopt+0x17c/0x1b0 [ 520.046134][T19048] __x64_sys_setsockopt+0x13d/0x1b0 [ 520.046164][T19048] do_syscall_64+0xe2/0xf80 [ 520.046183][T19048] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.046201][T19048] ? trace_irq_disable+0x37/0x100 [ 520.046219][T19048] ? clear_bhb_loop+0x60/0xb0 [ 520.046242][T19048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.046261][T19048] RIP: 0033:0x7fd19a19aeb9 [ 520.046279][T19048] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.046295][T19048] RSP: 002b:00007fd19b000028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 520.046316][T19048] RAX: ffffffffffffffda RBX: 00007fd19a415fa0 RCX: 00007fd19a19aeb9 [ 520.046330][T19048] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 520.046341][T19048] RBP: 00007fd19a208c1f R08: 0000000000000004 R09: 0000000000000000 [ 520.046352][T19048] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 520.046363][T19048] R13: 00007fd19a416038 R14: 00007fd19a415fa0 R15: 00007ffd5050a758 [ 520.046397][T19048] [ 520.046404][T19048] Mem-Info: [ 520.337067][T19048] active_anon:6198 inactive_anon:0 isolated_anon:0 [ 520.337067][T19048] active_file:2966 inactive_file:40434 isolated_file:0 [ 520.337067][T19048] unevictable:768 dirty:97 writeback:0 [ 520.337067][T19048] slab_reclaimable:12683 slab_unreclaimable:120883 [ 520.337067][T19048] mapped:29408 shmem:1389 pagetables:1289 [ 520.337067][T19048] sec_pagetables:0 bounce:0 [ 520.337067][T19048] kernel_misc_reclaimable:0 [ 520.337067][T19048] free:1295683 free_pcp:16615 free_cma:0 [ 520.406563][T19048] Node 0 active_anon:24892kB inactive_anon:0kB active_file:11864kB inactive_file:161536kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117632kB dirty:384kB writeback:0kB shmem:4020kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15348kB pagetables:5120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 520.465026][T19048] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 520.505205][T19048] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 520.538715][T19048] lowmem_reserve[]: 0 2494 2495 2495 2495 [ 520.544568][T19048] Node 0 DMA32 free:1258776kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25092kB inactive_anon:0kB active_file:11864kB inactive_file:161536kB unevictable:1536kB writepending:384kB zspages:0kB present:3129332kB managed:2554116kB mlocked:0kB bounce:0kB free_pcp:51868kB local_pcp:30432kB free_cma:0kB [ 520.584621][T19048] lowmem_reserve[]: 0 0 1 1 1 [ 520.595124][T19048] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 520.668034][T19048] lowmem_reserve[]: 0 0 0 0 0 [ 520.682475][T19048] Node 1 Normal free:3908596kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:15008kB local_pcp:6624kB free_cma:0kB [ 520.726953][T19048] lowmem_reserve[]: 0 0 0 0 0 [ 520.732220][T19048] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 520.748852][T19048] Node 0 DMA32: 6616*4kB (UME) 4234*8kB (UM) 1436*16kB (UME) 210*32kB (UME) 433*64kB (UM) 498*128kB (UME) 296*256kB (UME) 162*512kB (UM) 101*1024kB (UM) 38*2048kB (UM) 180*4096kB (M) = 1258736kB [ 520.786509][T19048] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 520.799018][T19048] Node 1 Normal: 167*4kB (UME) 53*8kB (UME) 51*16kB (UME) 152*32kB (UME) 56*64kB (UME) 11*128kB (UME) 4*256kB (UM) 3*512kB (ME) 3*1024kB (UME) 2*2048kB (UE) 949*4096kB (M) = 3908596kB [ 520.820753][T19048] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 520.840230][T19048] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 520.852268][T19048] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 520.884206][T19081] __nla_validate_parse: 11 callbacks suppressed [ 520.884240][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 520.888200][T19048] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 520.918783][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 520.930683][T19048] 44785 total pagecache pages [ 520.931181][T19083] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 520.935397][T19048] 0 pages in swap cache [ 520.935410][T19048] Free swap = 124996kB [ 520.935419][T19048] Total swap = 124996kB [ 520.935429][T19048] 2097051 pages RAM [ 520.935437][T19048] 0 pages HighMem/MovableOnly [ 520.935445][T19048] 426624 pages reserved [ 520.935453][T19048] 0 pages cma reserved [ 520.979381][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 520.989109][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 521.022707][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 521.064470][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 521.097144][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 521.127410][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 521.163630][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 521.180467][T19081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3668'. [ 521.383015][T19102] validate_nla: 2 callbacks suppressed [ 521.383038][T19102] netlink: 'syz.1.3673': attribute type 1 has an invalid length. [ 522.303336][T19155] sctp: [Deprecated]: syz.0.3694 (pid 19155) Use of int in maxseg socket option. [ 522.303336][T19155] Use struct sctp_assoc_value instead [ 523.001328][T19184] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 523.196305][T19194] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 523.369228][T19200] netlink: 'syz.3.3708': attribute type 10 has an invalid length. [ 523.406922][T19200] team0: Port device dummy0 added [ 523.545112][T10144] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x6c [ 523.559907][T19213] netlink: 'syz.0.3714': attribute type 10 has an invalid length. [ 523.729928][T19226] tc_dump_action: action bad kind [ 523.841504][T19231] IPVS: ip_vs_add_dest(): server weight less than zero [ 523.848944][T10143] IPVS: starting estimator thread 0... [ 523.948321][T19232] IPVS: using max 29 ests per chain, 69600 per kthread [ 524.792133][T19304] netlink: 'syz.2.3739': attribute type 1 has an invalid length. [ 525.223147][T19335] netlink: 'syz.0.3749': attribute type 1 has an invalid length. [ 525.223147][T19332] netlink: 'syz.0.3749': attribute type 1 has an invalid length. [ 526.444686][T19404] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 526.526263][T19408] netlink: 'syz.1.3769': attribute type 11 has an invalid length. [ 526.612091][T19411] __nla_validate_parse: 80 callbacks suppressed [ 526.612117][T19411] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3770'. [ 526.912343][T19425] netlink: 'syz.0.3776': attribute type 1 has an invalid length. [ 526.954486][T19425] 8021q: adding VLAN 0 to HW filter on device bond2 [ 527.017409][T19425] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 527.046601][T19425] bridge0: the hash_elasticity option has been deprecated and is always 16 [ 527.091800][T19425] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3776'. [ 527.290020][T19445] bond0: entered promiscuous mode [ 527.307153][T19445] macvlan2: entered promiscuous mode [ 527.312908][T19445] macvlan2: entered allmulticast mode [ 527.320508][T19445] bond0: (slave macvlan2): Opening slave failed [ 527.371935][T19448] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.520192][T19448] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.622879][T19448] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.653341][T19457] syzkaller1: entered promiscuous mode [ 527.659354][T19457] syzkaller1: entered allmulticast mode [ 527.690541][T19461] bond2: option all_slaves_active: invalid value (222) [ 527.700069][T19461] bond2 (unregistering): Released all slaves [ 527.790442][T19448] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 527.937798][T19464] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3788'. [ 527.978658][T19464] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3788'. [ 528.026368][ T50] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.111900][ T50] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.166067][ T50] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.229984][ T50] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 528.388904][T19494] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3798'. [ 528.496219][T19503] ipt_REJECT: TCP_RESET invalid for non-tcp [ 528.745265][T19517] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3805'. [ 528.762991][T19523] netlink: 'syz.3.3806': attribute type 1 has an invalid length. [ 528.776056][T19517] xt_l2tp: v2 tid > 0xffff: 1114244 [ 528.963584][T19528] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.3807'. [ 528.990659][T19531] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3808'. [ 529.000873][T19531] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3808'. [ 529.015280][T19531] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3808'. [ 529.275133][T19552] netlink: 'syz.0.3813': attribute type 4 has an invalid length. [ 529.321866][T19552] netlink: 'syz.0.3813': attribute type 1 has an invalid length. [ 529.781485][T19574] netlink: zone id is out of range [ 529.793529][T19574] netlink: get zone limit has 4 unknown bytes [ 530.245185][T19601] netlink: 'syz.3.3831': attribute type 1 has an invalid length. [ 530.335127][T19601] 8021q: adding VLAN 0 to HW filter on device bond3 [ 530.360405][T19602] bond3: (slave veth0_to_bond): making interface the new active one [ 530.399505][T19602] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 530.446701][T19609] bond3: entered promiscuous mode [ 530.457278][T19609] veth0_to_bond: entered promiscuous mode [ 530.487871][T19609] bond3: entered allmulticast mode [ 530.508176][T19609] veth0_to_bond: entered allmulticast mode [ 530.559697][T19620] netlink: 'syz.4.3835': attribute type 3 has an invalid length. [ 530.632803][T19626] netlink: 'syz.1.3836': attribute type 11 has an invalid length. [ 531.125435][T19655] netlink: 'syz.4.3841': attribute type 4 has an invalid length. [ 531.536082][T19681] netlink: 'syz.4.3851': attribute type 23 has an invalid length. [ 531.641285][T19686] netlink: 'syz.4.3851': attribute type 23 has an invalid length. [ 531.776481][T19698] __nla_validate_parse: 14 callbacks suppressed [ 531.776501][T19698] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3857'. [ 531.892123][T19707] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3858'. [ 532.145498][T19716] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3861'. [ 532.330857][T19728] netlink: 112 bytes leftover after parsing attributes in process `syz.1.3866'. [ 532.442474][T19735] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.3868'. [ 532.453453][T19735] netlink: Conntrack attr has 4 unknown bytes [ 532.725483][T19752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3876'. [ 532.761080][T19752] 8021q: adding VLAN 0 to HW filter on device bond4 [ 532.899154][T19759] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3879'. [ 532.994195][T19768] nbd: socks must be embedded in a SOCK_ITEM attr [ 533.009782][T19768] netlink: 'syz.3.3883': attribute type 18 has an invalid length. [ 533.035046][T10139] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.047285][T10139] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.064961][T10139] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.076379][T19770] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3884'. [ 533.083354][T10139] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 533.162417][T19774] xt_hashlimit: size too large, truncated to 1048576 [ 533.214905][T19777] : renamed from vxcan1 (while UP) [ 533.430591][T19784] sctp: [Deprecated]: syz.4.3887 (pid 19784) Use of struct sctp_assoc_value in delayed_ack socket option. [ 533.430591][T19784] Use struct sctp_sack_info instead [ 533.451576][T19785] sctp: [Deprecated]: syz.4.3887 (pid 19785) Use of struct sctp_assoc_value in delayed_ack socket option. [ 533.451576][T19785] Use struct sctp_sack_info instead [ 533.528940][T19789] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 533.556570][T19790] team0: Device gtp0 is up. Set it down before adding it as a team port [ 533.618876][T19798] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 533.743838][T19802] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3892'. [ 534.044107][T19824] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3900'. [ 534.771753][T19865] syzkaller0: entered promiscuous mode [ 534.781571][T19865] syzkaller0: entered allmulticast mode [ 535.160922][T19889] openvswitch: netlink: IPv4 tunnel dst address is zero [ 535.288562][T19892] netlink: 'syz.4.3923': attribute type 10 has an invalid length. [ 535.296743][T19892] dummy0: entered promiscuous mode [ 535.325092][T19892] team0: Port device dummy0 removed [ 535.340276][T19892] bridge0: port 3(dummy0) entered blocking state [ 535.348518][T19892] bridge0: port 3(dummy0) entered disabled state [ 535.355410][T19892] dummy0: entered allmulticast mode [ 535.572502][T19907] openvswitch: netlink: IP tunnel dst address not specified [ 535.632034][T19915] netlink: 'syz.2.3928': attribute type 2 has an invalid length. [ 536.410646][T19968] netlink: 'syz.2.3942': attribute type 1 has an invalid length. [ 536.425891][T19968] netlink: 'syz.2.3942': attribute type 1 has an invalid length. [ 536.460845][T19968] netlink: 'syz.2.3942': attribute type 1 has an invalid length. [ 536.471921][T19968] netlink: 'syz.2.3942': attribute type 1 has an invalid length. [ 536.630678][T19981] netlink: 'syz.1.3945': attribute type 4 has an invalid length. [ 537.032020][T20009] __nla_validate_parse: 19 callbacks suppressed [ 537.032045][T20009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3953'. [ 537.065077][T20009] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3953'. [ 537.082093][T20013] netlink: 512 bytes leftover after parsing attributes in process `syz.4.3956'. [ 537.143274][T20017] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3957'. [ 537.272711][T20025] [ 537.275112][T20025] ====================================================== [ 537.283201][T20025] WARNING: possible circular locking dependency detected [ 537.290622][T20025] syzkaller #0 Not tainted [ 537.295512][T20025] ------------------------------------------------------ [ 537.301815][T20027] ip6t_srh: unknown srh match flags 5F28 [ 537.302994][T20025] syz.3.3958/20025 is trying to acquire lock: [ 537.303011][T20025] ffffffff8fb284d8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x40c/0xf90 [ 537.324736][T20025] [ 537.324736][T20025] but task is already holding lock: [ 537.332196][T20025] ffff88814535b470 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x215/0xf90 [ 537.341435][T20025] [ 537.341435][T20025] which lock already depends on the new lock. [ 537.341435][T20025] [ 537.352096][T20025] [ 537.352096][T20025] the existing dependency chain (in reverse order) is: [ 537.361284][T20025] [ 537.361284][T20025] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 537.369309][T20025] _raw_spin_lock_bh+0x36/0x50 [ 537.374690][T20025] nr_rt_ioctl+0x215/0xf90 [ 537.379630][T20025] sock_do_ioctl+0x101/0x320 [ 537.384746][T20025] sock_ioctl+0x5c6/0x7f0 [ 537.389615][T20025] __se_sys_ioctl+0xfc/0x170 [ 537.394748][T20025] do_syscall_64+0xe2/0xf80 [ 537.399775][T20025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.406333][T20025] [ 537.406333][T20025] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 537.414326][T20025] _raw_spin_lock_bh+0x36/0x50 [ 537.419719][T20025] nr_rt_device_down+0xbe/0x860 [ 537.425099][T20025] nr_device_event+0x137/0x150 [ 537.430480][T20025] notifier_call_chain+0x19d/0x3a0 [ 537.436214][T20025] __dev_notify_flags+0x16d/0x310 [ 537.441853][T20025] netif_change_flags+0xe8/0x1a0 [ 537.447587][T20025] dev_change_flags+0x130/0x260 [ 537.453009][T20025] dev_ioctl+0x7b4/0x1150 [ 537.458250][T20025] sock_do_ioctl+0x23e/0x320 [ 537.463474][T20025] sock_ioctl+0x5c6/0x7f0 [ 537.468482][T20025] __se_sys_ioctl+0xfc/0x170 [ 537.473697][T20025] do_syscall_64+0xe2/0xf80 [ 537.478846][T20025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.485273][T20025] [ 537.485273][T20025] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 537.493213][T20025] __lock_acquire+0x15a5/0x2cf0 [ 537.498613][T20025] lock_acquire+0x106/0x330 [ 537.503648][T20025] _raw_spin_lock_bh+0x36/0x50 [ 537.508954][T20025] nr_rt_ioctl+0x40c/0xf90 [ 537.513915][T20025] sock_do_ioctl+0x101/0x320 [ 537.519293][T20025] sock_ioctl+0x5c6/0x7f0 [ 537.524597][T20025] __se_sys_ioctl+0xfc/0x170 [ 537.529897][T20025] do_syscall_64+0xe2/0xf80 [ 537.535020][T20025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.541799][T20025] [ 537.541799][T20025] other info that might help us debug this: [ 537.541799][T20025] [ 537.552212][T20025] Chain exists of: [ 537.552212][T20025] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 537.552212][T20025] [ 537.566677][T20025] Possible unsafe locking scenario: [ 537.566677][T20025] [ 537.574319][T20025] CPU0 CPU1 [ 537.580328][T20025] ---- ---- [ 537.585889][T20025] lock(&nr_node->node_lock); [ 537.590916][T20025] lock(nr_node_list_lock); [ 537.598379][T20025] lock(&nr_node->node_lock); [ 537.605766][T20025] lock(nr_neigh_list_lock); [ 537.610535][T20025] [ 537.610535][T20025] *** DEADLOCK *** [ 537.610535][T20025] [ 537.619375][T20025] 2 locks held by syz.3.3958/20025: [ 537.624794][T20025] #0: ffffffff8fb28538 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x15f/0xf90 [ 537.634931][T20025] #1: ffff88814535b470 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x215/0xf90 [ 537.644939][T20025] [ 537.644939][T20025] stack backtrace: [ 537.651017][T20025] CPU: 1 UID: 0 PID: 20025 Comm: syz.3.3958 Not tainted syzkaller #0 PREEMPT(full) [ 537.651040][T20025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 537.651049][T20025] Call Trace: [ 537.651058][T20025] [ 537.651066][T20025] dump_stack_lvl+0xe8/0x150 [ 537.651089][T20025] print_circular_bug+0x2e1/0x300 [ 537.651107][T20025] check_noncircular+0x12e/0x150 [ 537.651125][T20025] __lock_acquire+0x15a5/0x2cf0 [ 537.651155][T20025] ? nr_rt_ioctl+0x40c/0xf90 [ 537.651174][T20025] lock_acquire+0x106/0x330 [ 537.651192][T20025] ? nr_rt_ioctl+0x40c/0xf90 [ 537.651224][T20025] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 537.651248][T20025] ? nr_rt_ioctl+0x40c/0xf90 [ 537.651267][T20025] _raw_spin_lock_bh+0x36/0x50 [ 537.651299][T20025] ? nr_rt_ioctl+0x40c/0xf90 [ 537.651317][T20025] nr_rt_ioctl+0x40c/0xf90 [ 537.651341][T20025] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 537.651402][T20025] ? apparmor_capable+0x137/0x1a0 [ 537.651434][T20025] ? capable+0x88/0xe0 [ 537.651458][T20025] ? nr_ioctl+0x1b1/0x3b0 [ 537.651475][T20025] sock_do_ioctl+0x101/0x320 [ 537.651491][T20025] ? __pfx_sock_do_ioctl+0x10/0x10 [ 537.651505][T20025] ? do_futex+0x333/0x420 [ 537.651532][T20025] sock_ioctl+0x5c6/0x7f0 [ 537.651562][T20025] ? __pfx_sock_ioctl+0x10/0x10 [ 537.651583][T20025] ? __fget_files+0x2a/0x420 [ 537.651600][T20025] ? __fget_files+0x3a0/0x420 [ 537.651614][T20025] ? __fget_files+0x2a/0x420 [ 537.651631][T20025] ? bpf_lsm_file_ioctl+0x9/0x20 [ 537.651650][T20025] ? __pfx_sock_ioctl+0x10/0x10 [ 537.651672][T20025] __se_sys_ioctl+0xfc/0x170 [ 537.651694][T20025] do_syscall_64+0xe2/0xf80 [ 537.651709][T20025] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.651724][T20025] ? trace_irq_disable+0x37/0x100 [ 537.651764][T20025] ? clear_bhb_loop+0x60/0xb0 [ 537.651781][T20025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.651796][T20025] RIP: 0033:0x7fd19a19aeb9 [ 537.651812][T20025] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 537.651826][T20025] RSP: 002b:00007fd19afdf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 537.651843][T20025] RAX: ffffffffffffffda RBX: 00007fd19a416090 RCX: 00007fd19a19aeb9 [ 537.651855][T20025] RDX: 0000000000000000 RSI: 00000000000089e2 RDI: 000000000000000f [ 537.651865][T20025] RBP: 00007fd19a208c1f R08: 0000000000000000 R09: 0000000000000000 [ 537.651875][T20025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 537.651885][T20025] R13: 00007fd19a416128 R14: 00007fd19a416090 R15: 00007ffd5050a758 [ 537.651902][T20025] [ 537.718394][T20030] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3962'. [ 537.829109][T20034] openvswitch: netlink: Flow actions may not be safe on all matching packets.