last executing test programs: 2m7.469194485s ago: executing program 4 (id=110): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000001400350065727370616e3000000000000000000008000a00", @ANYRES32=r8, @ANYBLOB="44d3157a6c1f9895b3ab3bf7fa2758730cedba8046bdcb956fdd7917f005539c69619af9300edfc5fb71a9b57f31ab160e6e461a89a059cf5aef5db28f36ed7ff1ce7450579a8fc0b80b9dfd2493e6668225f12e7edd61ed7cbb8e467bd35ff437e376c4d2ef6a954aa9269c17c7f92d708d066bff252fba1efb78669c5e38ad47754afd01c0ca1b47e722273e5d39ae1348fb983506ee"], 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x24044800) 2m7.145666184s ago: executing program 4 (id=113): ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEV(0xffffffffffffffff, 0x0, 0x800) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) unshare(0x22020600) pipe(0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) pread64(0xffffffffffffffff, 0x0, 0x0, 0x2df) setsockopt$inet6_int(r1, 0x29, 0xb, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f8480b0000005e140602000000000e0027001000000002800000121f", 0x2e}], 0x1}, 0x0) 2m6.217637375s ago: executing program 4 (id=120): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0)={0x0, r0}, 0x8) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, @void, @value}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x68, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async, rerun: 64) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (rerun: 64) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r3, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x20, 0x140b, 0x200, 0x70bd27, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x2}, 0x4040010) shutdown(r2, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000002c0)='rpm_return_int\x00', r1}, 0x10) (async, rerun: 64) r4 = socket$kcm(0x10, 0x3, 0x10) (rerun: 64) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="1409000000000000005a80648c2594f91124fc60", 0x14}], 0x1}, 0x0) 2m5.981405005s ago: executing program 4 (id=123): r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f0000000080)='cgroup.kill\x00', 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x4000000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000240)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x29, 0xb}], 0x10}}], 0x2, 0x0) socket$inet6(0xa, 0x3, 0x5) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) (async) openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) (async) openat$cgroup_ro(r1, &(0x7f0000000080)='cgroup.kill\x00', 0x0, 0x0) (async) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) (async) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x4000000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000240)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000580)=[{0x10, 0x29, 0xb}], 0x10}}], 0x2, 0x0) (async) 2m5.82464153s ago: executing program 4 (id=126): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00'}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x2, 0x8, 0xd0eb, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e21, 0x4, @mcast2, 0xfcb}, 0xffffffffffffff3a) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) socket$kcm(0x29, 0x5, 0x0) pipe(0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f00000000c0)={0x5, &(0x7f0000000000)=[{0x2d, 0x0, 0x3}, {}, {}, {}, {0x6}]}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0xe, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0x4a, 0x0, &(0x7f0000000140)="d510faffffdb674c5ae4000b0094", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNGETVNETHDRSZ(r4, 0x800454d7, &(0x7f0000000000)) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e20, 0x1, @loopback, 0x2}]}, &(0x7f0000000400)=0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x11, 0x0, 0x802e2e, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x401}}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x36, &(0x7f0000000d00)={@local, @empty, @void, {@ipv6={0x86dd, @generic={0x7, 0x6, "c39338", 0x0, 0x2c, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8924, &(0x7f0000000080)={'bridge_slave_0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) 2m5.665055955s ago: executing program 4 (id=128): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$rxrpc(0x21, 0x2, 0x2) connect$rxrpc(r1, &(0x7f0000000140)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e22, 0x8f8e5738, @private0, 0x5}}, 0x24) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="010000000514010128bd7000fcdbdf253e86746e4f72729bee12e76ff72eab2e7c62104026695fd38425bcba207f9bbf8fa95171d6e2b566098e6f50e8f5e02e21609dabee01b2d987a53eca1fb581e2bc891ef4eb986ff7f0cf3fa1ad67f90e483e0f2d116b2ab84b1a4f29713377781c6cc6a6e5fd1fb6df1c7edd69f5af6da7edef6a526046918c7345a6d17f7ecef827b4d31bd5f256a31724f864720928acdaf00c8ced7384af1335f38a20aa5de4c1bd766143f8eb05e5e6792b8c3c8190c17101b37227b4140fd6c0ebde9dd5727488b43361963550057a24f419168733dd79ef5d5c9c8af1e0440fcda66ef51119"], 0x10}, 0x1, 0x0, 0x0, 0x404c894}, 0x4040800) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="180000002400010325bd7000fcffffff0100040004002d803e72aa4ea8d6ca1835a73f7d275e9f7241fe14a2a94250a141d9ce0d2fa599f1baab420631ce8e874dde64d165597e1795d66f58eef467fcab5de4a922bbeb8127d8b7a1131f88376a256cd75bb98ae7ebd6e1de9be04a20317d12ca5b1e36c28bc3314df82e52a5e1e291be9e0163909351a27d290661c0fb644748606150a390be8bc563ebbad63db83510a496c6317cb78a1522f58859c61fbe6af4bc81b4edef364c6bea1870fe53b1c09a1db9447794c86620c449d5685e171404c8444f5a3c57c39a9df8bb55703fb86807e828ffd6f625155a13a83b16c2ec6d4d65c176ab459088e3862d9c0cd72d1e4afb85999d8f6ff364430d1a6e39a0ce0c920acbb8c0b1f44bbdc4af40710bbafbb09d51d1d629fdb6cec289cf10f5fc81415c39f133dfa79207cb8b2132f36cf1725643443c4ef7d35094ce3f34a60ae69014e64c11f1a1cb58e35cab8176a2c3fa5f7660133f4f17983e924ebaab95423c66"], 0x18}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r5, @ANYBLOB="600030800500020000000000140004"], 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000100), r2) 2m5.055205901s ago: executing program 32 (id=128): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$rxrpc(0x21, 0x2, 0x2) connect$rxrpc(r1, &(0x7f0000000140)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e22, 0x8f8e5738, @private0, 0x5}}, 0x24) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000000)=ANY=[@ANYBLOB="010000000514010128bd7000fcdbdf253e86746e4f72729bee12e76ff72eab2e7c62104026695fd38425bcba207f9bbf8fa95171d6e2b566098e6f50e8f5e02e21609dabee01b2d987a53eca1fb581e2bc891ef4eb986ff7f0cf3fa1ad67f90e483e0f2d116b2ab84b1a4f29713377781c6cc6a6e5fd1fb6df1c7edd69f5af6da7edef6a526046918c7345a6d17f7ecef827b4d31bd5f256a31724f864720928acdaf00c8ced7384af1335f38a20aa5de4c1bd766143f8eb05e5e6792b8c3c8190c17101b37227b4140fd6c0ebde9dd5727488b43361963550057a24f419168733dd79ef5d5c9c8af1e0440fcda66ef51119"], 0x10}, 0x1, 0x0, 0x0, 0x404c894}, 0x4040800) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="180000002400010325bd7000fcffffff0100040004002d803e72aa4ea8d6ca1835a73f7d275e9f7241fe14a2a94250a141d9ce0d2fa599f1baab420631ce8e874dde64d165597e1795d66f58eef467fcab5de4a922bbeb8127d8b7a1131f88376a256cd75bb98ae7ebd6e1de9be04a20317d12ca5b1e36c28bc3314df82e52a5e1e291be9e0163909351a27d290661c0fb644748606150a390be8bc563ebbad63db83510a496c6317cb78a1522f58859c61fbe6af4bc81b4edef364c6bea1870fe53b1c09a1db9447794c86620c449d5685e171404c8444f5a3c57c39a9df8bb55703fb86807e828ffd6f625155a13a83b16c2ec6d4d65c176ab459088e3862d9c0cd72d1e4afb85999d8f6ff364430d1a6e39a0ce0c920acbb8c0b1f44bbdc4af40710bbafbb09d51d1d629fdb6cec289cf10f5fc81415c39f133dfa79207cb8b2132f36cf1725643443c4ef7d35094ce3f34a60ae69014e64c11f1a1cb58e35cab8176a2c3fa5f7660133f4f17983e924ebaab95423c66"], 0x18}, 0x1, 0x0, 0x0, 0x448d3}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r5, @ANYBLOB="600030800500020000000000140004"], 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000100), r2) 1m36.653562948s ago: executing program 3 (id=394): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000200)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1a, 0x13, &(0x7f0000000400)=@raw=[@cb_func={0x18, 0x6, 0x4, 0x0, 0x3}, @map_idx={0x18, 0x5, 0x5, 0x0, 0x10}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x5}, @exit, @map_val={0x18, 0x5, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x24e9}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x101}}], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1m36.477217023s ago: executing program 3 (id=397): r0 = socket$isdn(0x22, 0x2, 0x22) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x13, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000030000006110be000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) close(r0) 1m27.629210055s ago: executing program 3 (id=397): r0 = socket$isdn(0x22, 0x2, 0x22) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x13, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000030000006110be000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) close(r0) 1m16.253156107s ago: executing program 3 (id=397): r0 = socket$isdn(0x22, 0x2, 0x22) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x13, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000030000006110be000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) close(r0) 1m2.562623471s ago: executing program 3 (id=397): r0 = socket$isdn(0x22, 0x2, 0x22) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x13, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000030000006110be000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) close(r0) 48.423066206s ago: executing program 3 (id=397): r0 = socket$isdn(0x22, 0x2, 0x22) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x13, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000030000006110be000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) close(r0) 4.048182868s ago: executing program 0 (id=1141): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) (async, rerun: 64) close(r0) (async, rerun: 64) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000180)=ANY=[@ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x8) (async) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0x0, 0xffff8000, 0x10}, 0xc) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000400)={'ip6tnl0\x00', &(0x7f0000000380)={'ip6tnl0\x00', 0x0, 0x83b7bf624076ac0b, 0x7, 0x80, 0x89, 0x40, @private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x8, 0x8, 0x3, 0x1}}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1e0000000200000004000000000000000000000051dd19006d60f41e6111b82997532fc2f791134945b11b37a5d4727c948b0e95c95180b3f2d776413ed02b09dfb3f75c2cc4f6d8441b2a5c911d866280b461092a1f8a798864c856393dc06e0a7c17aafb33c9f02fd5f8f2e551779ca6786515c69aa06365649994b984342fae7b7c55", @ANYRES32=r2, @ANYBLOB='\a\x00'/20, @ANYRES32=r3, @ANYRES32, @ANYBLOB="0300000005000000030000000300"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) (async) close(r0) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r5}, &(0x7f00000002c0), &(0x7f0000000300)}, 0x20) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x52) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_deliver\x00', r6}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='signal_deliver\x00', r7}, 0x10) (async) close(r6) (async) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 3.954208629s ago: executing program 0 (id=1142): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) unshare(0x62040200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) write$tun(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB="00000000ffffffffffffaaaaaaaaaabb08004500002c00000000002f9078ac1c0001e000000100006558001890780400000000000000be04000000"], 0x3e) (async) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r1, 0x5452, 0x0) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) pselect6(0x40, &(0x7f00000001c0)={0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x5f8, 0x0, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) (async) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (async) write(r3, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x18, 0x14, &(0x7f0000000780)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x1}, [@jmp={0x5, 0x0, 0x9, 0x4, 0x2, 0xfffffffffffffff8}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5e415cf4}}, @map_val={0x18, 0x6, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x5}, @exit]}, &(0x7f00000005c0)='GPL\x00', 0x2, 0x67, &(0x7f0000000840)=""/103, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000008c0)={0x7, 0xffffffff}, 0x8, 0x10, &(0x7f0000000900)={0x2, 0x6, 0xd05, 0x4}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000a00)=[r5, r5, r5, 0xffffffffffffffff, r5, r5, 0xffffffffffffffff, r5, r5, r5], &(0x7f0000000a40)=[{0x4, 0x5, 0xb, 0x2}, {0x4, 0x1, 0xa}], 0x10, 0x7, @void, @value}, 0x94) setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f0000000380)=0x1, 0x4) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYRES32=r6], 0x188}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r7, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) sendmsg$tipc(r8, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) socket$packet(0x11, 0x2, 0x300) (async) socket(0x10, 0x80003, 0x2) (async) socket$inet6(0xa, 0x3, 0x8000000003c) (async) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) (async) syz_80211_join_ibss(0x0, 0x0, 0x0, 0x0) 3.377216272s ago: executing program 1 (id=1146): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x10, 0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r0, &(0x7f00000001c0), &(0x7f0000000180)=@udp6, 0x3}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002640)=@delchain={0x4a0, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x444, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x414, 0x1, [@m_simple={0x1fc, 0x1e, 0x0, 0x0, {{0xb}, {0x1d0, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x142, 0x3, '\xd5\xe9Ji\'\xc9\xb2\xcfE\xcdRO\xbd\xfd\xc8\xbd\x9f\xbb\'q}qqx\xdf\xf8\x82\xfd\x1c(\xafU\n\xeaP\xa1\xf3\x92\xa9\x16)\xb4i\xcf\x81\xb4\x0e\x8a\xa0Ou:\x18z\xad\xb8\x97\x038\xbd\x12lw\xcb\xea\xed\xad\x14E-\x91U\xa5R-\xb5\xb6\x0ehba\ar\xb0N\x9ek\xff}\x00\v\x86\xe8\xd7\xd9\xf4\x1a\a\xb3\xce\x1d\xe3fI\x1f\xdc\xab0G\xc5b\xa3gF\xd5\x9f\xde\t\xcc\xaf*\x90\xea\a\f3l\xf2g?\x9b\x96\xb2\x9b\r\x98\x83\'T\xc4\x810]\xbf4\x8a\x10\x92I\x19\xa5\xa4\x90\xe9u\xc2\xf7\xed\x15\xf9\n6\x98\x85\'\xfb\x00\x00\x00\x00\x00\xe8\xa54*\v&\n\xbb-\x81\xa9\x91E\x94\t\xdew1^hZ\xe5{\x1f\xcb\vzG&\xf1xj\x10\x020\\\xde\\\xdc:\x8aL\xd1\x0e\xbd\xf7F\xce\x88\xd9\xd9\x1a\xc7\vD.\xf9);j}\x8fRY\xae\x01\xeb\xbduw~\xf9\xd1\xd1\x85\xa0\x16%\xb1\x97f\xca\xf2=\'\xb57\x94\xff\x92u\xb8\xa8\xect0\x1d\xb8\xd1\xa6F4\x934M\xe2\x9d\x94I\vf}U\x9f\xbcq\x92\xe8\xd3\xfe\xa3\xd7\xb1\xe3gi<\x00\x98\xaf7,\xec\xca\xfcU\x9f\x83\xb7\xec\'\xde\xb9\x10\x86\x93\x18'}, @TCA_DEF_DATA={0x6, 0x3, '-\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x40, 0x3, 0x20000000, 0x7f7, 0x2}}, @TCA_DEF_PARMS={0x18, 0x2, {0x2, 0x587, 0x5, 0x81, 0xa}}, @TCA_DEF_PARMS={0x18, 0x2, {0x8, 0x2, 0x20000000, 0x8, 0x13b}}, @TCA_DEF_PARMS={0x18, 0x2, {0x3304, 0x7, 0x10000000, 0xf65e, 0x1}}, @TCA_DEF_DATA={0x5, 0x3, '\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x0, 0x1, 0x20000000, 0x2, 0xd}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_simple={0xe8, 0x1e, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x8, 0x3, 'bpf\x00'}]}, {0xb1, 0x6, "9787c29d6ac649e7ec160dfef7c4cea330102e688fe12213d2bf7dae04880a34e7bf775010128401ec7b2a9ceab9c40c5f9bd00ceff17d69ca7a27324ef7a1ad28d4b3c6a826826e9c291c16ab3d13e1f337751959e47bf0fe515b70ea5a3584d9cdba83a705d3257305f931866cf9f1faa34fce0e8a7ee76e20f05d4e1adbee4ba00ddd7b896197ea2a0391ef62c651d59ed7e0e8964192a2c1c29308d03650349840a4d759fc9421e3569c90"}, {0xc, 0x7, {0x0, 0x79d0f023c2b305dd}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0xec, 0x15, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x4, 0x8, 0xc, 0x8}, 0xff21}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x2, 0x20000000, 0x1, 0x6}, 0x8}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x1000, 0x20000000, 0xcdb, 0x305}, 0x5}}]}, {0x65, 0x6, "726786f34dc39a3b098ea66afe225634df06865f963558e69516e656d1b4d3ec4c23aaeded7fbb0c799f243d3827c1ff7060f9d56b77b6373212745232c734d9b45311b3eceeeb16cae2bfd77942d880d60c94991d896d67e1bf08b6ace5ba70ca"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_csum={0x40, 0x8, 0x0, 0x0, {{0x9}, {0x4}, {0x11, 0x6, "4ac6768e05c6ec90b23e3707aa"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_FD={0x8}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x2}}, @filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xca}]}}]}, 0x4a0}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000180)=@name={0x1e, 0x2, 0x0, {{0x40, 0x1}, 0x1}}, 0x10) bind$tipc(r2, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x0, {{0x40, 0x801}}}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000b80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[@rights={{0x1c, 0x1, 0x1, [r4, r3, 0xffffffffffffffff]}}], 0x20, 0x40001}}], 0x2, 0x44000) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000300)={@remote, @empty, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x6, 0x6, 0x3, 0x600, 0x400, 0x2, r7}) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000040)=0x6, 0x8) bind$rose(0xffffffffffffffff, &(0x7f0000000000)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x1, @default}, 0x1c) r8 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r8, &(0x7f0000000000)={0x27}, 0x62) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f0000000100)={r6, 0xc, 0x4c42}, &(0x7f0000000140)=0x8) r10 = socket$inet(0xa, 0x801, 0x84) connect$inet(r10, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r10, 0x8) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000006c0)={r0, &(0x7f0000000880)="02e1ceb5c04128b9aee7acff7172aa9adbcc108c5c2b5fe6a590ac16e04e8ebfe2bcbcbf15ae2e686d0c31133fb802438bc285d7045f4d5e32a57fb663b6fd0c6383a127cd823c2a75df77d3c81ddab1de2f6b48cdb86337dca8255d64cdaf7dfb36a8847fec80c85fb8871dc2ff152d78c8104502cb991551d29e89501a1d534e77b5e0daa527457bca80d39007624961ef0bd6ae5b4a94df74b1c6ea6e1956981225565a982e70efde557d8ea03f295a44722bd41f43798bf3e5ee835efbbc1327ce5b", &(0x7f0000000580)=""/41}, 0x20) r11 = accept4(r10, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x8032, 0xffffffffffffffff, 0xffffd000) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r11, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x8001, 0x10}, &(0x7f0000000100)=0xc) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r11, 0x84, 0x77, &(0x7f0000000540)={r9, 0x4, 0x1, [0x3]}, 0xa) bind$tipc(r2, &(0x7f0000000140)=@name={0x1e, 0x2, 0xfffffffffffffffe, {{0x42, 0x2}}}, 0x10) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 2.479656735s ago: executing program 2 (id=1150): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="95f2ffff1100040028bd7000fedbdf250000000001c818b12a9590d7a54a37e9", @ANYRES32=0x0, @ANYBLOB="c0490000404000000000230007000000"], 0x7c}, 0x1, 0x0, 0x0, 0x880}, 0x80020) r1 = accept(r0, &(0x7f0000000100)=@l2={0x1f, 0x0, @fixed}, &(0x7f0000000000)=0x80) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x88, 0x401, 0x8, 0x3, 0x9, 0x2, 0x9}, 0x1c) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000240)=0xc) sendmsg$nl_xfrm(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)=@newsa={0x100, 0x10, 0x400, 0x70bd29, 0x25dfdbfc, {{@in=@remote, @in=@remote, 0x4e21, 0x6, 0x4e22, 0x5, 0x2, 0x80, 0x0, 0xddac5ffe02521dfa, r2, r3}, {@in6=@loopback, 0x4d4, 0xff}, @in6=@remote, {0x800, 0x9, 0x3, 0x7, 0xd234, 0x8e, 0xfffffffffffffff5, 0x6}, {0x8000000000000000, 0x2, 0x0, 0x9}, {0x9, 0x4}, 0x70bd2d, 0x3504, 0x0, 0x3, 0x5, 0x11}, [@proto={0x5, 0x19, 0x32}, @tfcpad={0x8, 0x16, 0x54f}]}, 0x100}, 0x1, 0x0, 0x0, 0x40}, 0x8000) 2.472448069s ago: executing program 5 (id=1151): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0xf0b, 0x3, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0xfff3, 0x6a9f0eede9332711}, {0xfff3, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_FWMARK={0x8, 0x12, 0x4d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44045}, 0x10) r1 = socket(0x40000000015, 0x5, 0x0) (async, rerun: 32) r2 = socket$rxrpc(0x21, 0x2, 0xa) (rerun: 32) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0xffffd000) (async) socket(0x10, 0x803, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000000c0)='netlink_extack\x00', r3}, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) (async, rerun: 32) socket$inet(0x2, 0x3, 0x2) socket$inet(0x2, 0x3, 0x2) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711231000000000095"], 0x0, 0x7f, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x7, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000160001000000180095000000000000000500feff"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async, rerun: 32) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) (rerun: 32) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r4, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) (async) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000000)='+@%.\x00', 0x5) (async) getsockopt(r1, 0x200000000114, 0x2710, 0x0, &(0x7f0000000040)) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="000000f3000000000000000000", @ANYRES32=0x0, @ANYRES16=r1], 0x50}, 0x1, 0x0, 0x0, 0x20040881}, 0x4000000) 2.4530657s ago: executing program 1 (id=1152): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="34008000184e5ab83fbf04b0166eb1fd75a615684761ade153a4ae796902e9", @ANYRES16=r1, @ANYBLOB="010300000000030000001c0000002000018014000200626f6e6430000000000000000000000008000100", @ANYRES32=r2, @ANYBLOB], 0x34}}, 0x40006) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1e, 0xd, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000085000000a000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 2.305313808s ago: executing program 2 (id=1153): socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000540)) (async) r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newtaction={0xe4, 0x30, 0x51b, 0x2, 0x0, {}, [{0xd0, 0x1, [@m_skbmod={0xcc, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x5a, 0x0, 0x0, 0x40000000}}}, @TCA_SKBMOD_SMAC={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}}, @TCA_SKBMOD_DMAC={0xa}]}, {0x62, 0x14, "1a80743664e934a91271a90b104b19c5e756881b76129c49b9892757646bb4272c05131caa82d0eb7492c48ebef8650b2079fa9ec84038403b84bcc5779ef00e4b67fb5d016c92835cc3834eb646015d26269d00"/94}, {0xc}, {0xc, 0x6}}}]}]}, 0xe4}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'macsec0\x00'}) (async) r1 = socket(0x2a, 0x2, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x31, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0xe0e, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) (async, rerun: 32) ppoll(&(0x7f0000000100)=[{}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 32) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 64) socket$inet_udplite(0x2, 0x2, 0x88) (async, rerun: 64) r5 = socket$inet(0xa, 0x5, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r5, 0x8) (async) r6 = accept4(r5, 0x0, 0x0, 0x80000) setsockopt(r6, 0x84, 0x7f, &(0x7f00000001c0)="020000000980ffff", 0x8) (async) recvmmsg(r6, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000240)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x29, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x15}}}}}) (async) unshare(0x62040200) (async) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) 2.299965194s ago: executing program 1 (id=1154): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x10, 0x12, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x20050800) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004802c0001800b0001006e756d67656e00001c0002800800014000000000080002400000000008000340000000000500074022000000140000001100010000000000000000000000000a9beceae8865c4e77a65dfdcfe8f87829719373fd73cb7e5b5088f7006243630c09bacbe152c5543bcd8f5e38a1e74a4fedd800c0"], 0x8c}}, 0x0) sendto$inet6(r1, &(0x7f0000000640)="9e37", 0x2, 0x4000000, &(0x7f0000000200)={0xa, 0x4e23, 0x800, @loopback, 0xe}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="e6c760ac220a67eccba0d6be975ec6ee6bef366873f70af57628e9d7a2e619a901e0c62a051c05d205a5136bf6b203586d32370bf418bc7974b09ea0d0c61ed6cf6de18a90af4fdb1bcb0c54f02c223162e9177e470f567c673b602f1a56da5f6f07f30d03267b7e054e9dad679d5cb804ea2cf83a01c1848fb8739be8ff33912ade5cbdc75b687318ecaf5ad43c6e3e595501cef3bd6352dad935f0905ef452f424601a4adaf4da30320afc79d5052272cf09d2321c40d585b4bbc5f08415252056c478f95e851ab47a86a39cdff38dc558", 0xd2, 0x4004090, &(0x7f0000000100)={0xa, 0x4e20, 0x5, @empty, 0x7f69}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'gretap0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x8100, r5}, 0x14) writev(r1, &(0x7f00000006c0)=[{&(0x7f00000005c0)='I', 0x1}], 0x1) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x17, 0x0, &(0x7f0000000e80)) 2.212872811s ago: executing program 5 (id=1155): socket$packet(0x11, 0xa, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020000000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @bcast}, [@netrom, @rose, @default, @bcast, @bcast, @netrom, @default, @bcast]}, &(0x7f0000000240)=0x48) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @void, @value}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@RTM_DELMDB={0x58, 0x55, 0x1, 0x0, 0x0, {}, [@MDBA_SET_ENTRY={0x29, 0x1, {0x0, 0x0, 0x0, 0x0, {@in6_addr=@dev}}}, @MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x0, 0x0, 0x0, {@ip4=@broadcast}}}]}, 0x58}}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x11, 0x3, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc}}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r4}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0xa, &(0x7f00000003c0)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @map_val={0x18, 0xb, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x8}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r5, 0x29, 0x33, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000280)=@netrom={'nr', 0x0}, 0x10) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x18, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}}}}, 0x0) 2.191555029s ago: executing program 2 (id=1156): bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x3, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x61, 0x54}}, &(0x7f0000281ffc)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000a40)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b000000000000000000000005000000000000009a339a80f8a02a62b445fe4b55f98831d84311b8d0678e9949d06df4fd9f476683b0d4e9005f09f5d7e225939240b615ea67ba6bf4760d546ad08f24c54abace206b62921c1d28762b01e148076dbd42cfd39b2083a1492b1358d9fc4061f24dd1dca0774380ffda9fc3edaa033e2f3dbf10759bba9c96803e6b172d6cc7ad2077924e1bf3c3c3e732cead2e6fa8b424d6d3dc407be7f63d12cfe127a4659661ef9ae74553328b92f731cc28b28745fc058dcbddf6401d5d67e81ad715d7cb9169dbea29106916571d6489dd9bb7e6704462a3eb78cfa05313140cf2247e27b01dcefe535e10decdb92fac278f779966e7af89497e7c06db58c1b3a04049a31ee42d04b1d79ca31b115d28f4246d08fa42537d12bba3b6c017a593089cf5bea34758c7966ba594b372ee5d59900ca2861dc7b7a6fa01bfbe5cb252", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000050000000300"/28], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000a00)={r0, &(0x7f0000002400), &(0x7f0000000980)=""/114}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0xb, 0x11, &(0x7f00000006c0)=@raw=[@exit, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}], &(0x7f0000000540)='syzkaller\x00', 0x520e854a, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x8, &(0x7f0000000640)={0x1, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x3, 0x3, 0x7, 0x9}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x6, &(0x7f0000000800)=[r0, r0, r0], &(0x7f0000000840)=[{0x0, 0x2, 0x1, 0x1}, {0x4, 0x5, 0x7, 0xb}, {0x1, 0x5, 0x6, 0x8}, {0x4, 0x3, 0x10, 0xd}, {0x5, 0x1, 0xd, 0x9}, {0x0, 0x4, 0x1, 0x9}], 0x10, 0x7, @void, @value}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)={@ifindex, 0xffffffffffffffff, 0x2f, 0x2032, 0xffffffffffffffff, @void, @void, @value}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0xb8}, 0x1, 0x0, 0x0, 0x4000881}, 0x4001841) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x11}, 0x80) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="a800000000010904000500000000000002000000240001801400018008000100e000000108000200ac1e01010c0002800500010000000900240002"], 0xa8}}, 0x0) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a01040000000000000000010000000900030073797a31000000000900010073797a3100000000280004800800014000000005080002401b2fd2e4060003006970"], 0xc4}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000010) syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a00034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x10, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x3, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, 0x0, @loopback, @private}, "c016ea0701001f43"}}}}}, 0x0) 1.880379815s ago: executing program 5 (id=1157): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYRES8=0x0], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x3a) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x680, 0x0) r3 = accept$ax25(0xffffffffffffffff, 0x0, &(0x7f0000000180)) syz_emit_ethernet(0x94, &(0x7f00000003c0)={@empty, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}, @void, {@llc_tr={0x11, {@llc={0x7e, 0xf8, 'R', "6af0bf869eba27eb2e9a39d79c402cdaa7f6f4d139800d4be16aba80ef8e411aed42304a390e3bfb6251f4536dee570036628fea996f16ec611483da7b1c7bd8c8f9038a8ae5e3f98dff49261cbb529ce85f34180ba79e79c52a442be98f8f19809b311b56a23be3302377b89a32ef9eda511e6e2fe216bb6933db1fedcfdb0a3ff9a4"}}}}}, &(0x7f0000000480)={0x0, 0x2, [0xc1c, 0xdf1, 0x3d1, 0xfaf]}) splice(r2, &(0x7f00000000c0)=0xff, r3, &(0x7f00000001c0)=0x100, 0x6, 0x0) sendmmsg$inet6(r1, &(0x7f0000000b80)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x7ffe, @mcast2, 0x4}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="8000102e7577d401e45a6c29", 0xc}], 0x1, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000029000000040000000300000000000000180000000000000029000000040000001d00000000000000"], 0x30}}], 0x1, 0x4000084) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000001000010700000000000000000a000000060001001300000008000a0005"], 0x24}}, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r4, 0x4018f50b, &(0x7f0000000300)={0x1, 0xf5, 0xd3b}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r4) 1.68456031s ago: executing program 2 (id=1158): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES64], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES64=r1, @ANYBLOB="000000001f8133f6dad5c1d800000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0), 0x0, 0x0, 0x0, 0x2663}, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000001c0)={@rand_addr=' \x01\x00', 0x3, 0x1, 0x3, 0xa, 0xb1, 0x66}, 0x20) syz_emit_ethernet(0x0, 0x0, &(0x7f0000000180)={0x1, 0x1, [0xac1, 0xd28, 0xd74, 0x4bd]}) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x2}, 0x2, r6}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) r7 = epoll_create1(0x0) unshare(0x8040480) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2, 0x11, 0xffffffffffffffff, 0x0) epoll_pwait(r7, &(0x7f0000000200)=[{}], 0x1, 0x101, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x8000}, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) socket$packet(0x11, 0xa, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000002000000000000000000001e95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7336b5d, @void, @value}, 0x94) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="7400000010000305000900"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000004c0012800c0001006d6163766c616e003c00028008000100100000001c0005800a000400aaaaaaaaaaaa00000a000400aaaaaaaaaaaa000008000300030000000a000400aaaaaaaaaabb000008000500", @ANYRES32=r9], 0x74}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="f000000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="0008000000020000bc0012800c0001006d6163766c616e00ac000280080003000100000008000100100000000a0004000180c200000300000a00040000000000030000000800070005000000080007000a0000004c0005800a000400aaaaaaaaaabb00000a000400aaaaaaaaaabb00000a0004004ac92f9d35ed00000a000400aaaaaaaaaaaa00000a000400aaaaaaaaaabb00000a000400aaaaaaaaaaaa000006000200010000000a000400aaaaaaaaaabb0000100005800a000400b25b12b8e5000000140035006d6163766c616e30"], 0xf0}, 0x1, 0x0, 0x0, 0x4}, 0x0) 1.668281942s ago: executing program 5 (id=1159): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0xc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'erspan0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=@newqdisc={0x24, 0x25, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xfff8}}}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000003850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r5}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)={0x2c, r7, 0x6a98047402e98331, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8040}, 0x4886) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000003e000701feffffff00000000017c0000100042800c000a8008008d00", @ANYRES32=0x0, @ANYBLOB="d2eb9bee40c06e4b358d13bcc5ad286a0a6c624c3f222cb6d00216b07708a7321fd97dbaed40df5eaf252bbe"], 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) sendmmsg$inet6(r8, &(0x7f00000025c0)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)='P', 0x1}], 0x1}}], 0x1, 0x0) shutdown(r8, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r10, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001, 0x81}, 0x8) connect$inet6(r10, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @loopback={0xff00000000000000}, 0x10000}, 0x1c) sendmmsg$inet6(r10, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xad, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r11}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000073010a000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x34) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r12, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 1.424692905s ago: executing program 5 (id=1160): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x1, 0x8}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x24, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x11}, @TCA_FQ_PLIMIT={0x8}, @TCA_FQ_PLIMIT={0x8, 0x1, 0x1000}, @TCA_FQ_ORPHAN_MASK={0x8, 0xa, 0x13}]}}]}, 0x50}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000036f500000000000000009a00000000000002"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = accept(0xffffffffffffffff, &(0x7f00000000c0)=@pptp={0x18, 0x2, {0x0, @private}}, &(0x7f0000000040)=0x80) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r4, &(0x7f00000000c0), 0x9) sendfile(r4, r3, 0x0, 0x10000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001640)=ANY=[@ANYRES32=r4], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r6, &(0x7f00000007c0)={&(0x7f0000000040)={0xa, 0x4e20, 0x3, @local, 0x2}, 0x1c, 0x0, 0x0, &(0x7f00000009c0)=[@hoplimit={{0x14, 0x29, 0x34, 0xd}}, @pktinfo={{0x24, 0x29, 0x32, {@private2}}}], 0x40}, 0x40001) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x4c}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYRES8=r8, @ANYRES32=0x0, @ANYRES16=r2], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r9 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x68, 0x1407, 0x200, 0x70bd29, 0x25dfdc01, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz2\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r4}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r9}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}]}, 0x68}, 0x1, 0x0, 0x0, 0x20004011}, 0x8000) syz_emit_ethernet(0x66, &(0x7f00000004c0)=ANY=[@ANYBLOB="bbbbbbbbbbbb07a24f79ee3f86dd6020000000302f00fc000000000000000000000000000001ff0200000000000000000000000000010000883e0030907801000000aaf43bba"], 0x0) 1.293557023s ago: executing program 1 (id=1161): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000000780)=0x2, 0x4) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x9c}}, 0x20000040) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0), 0x0, 0x0, 0x0) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, &(0x7f0000000180)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.numa_stat\x00', 0x26e1, 0x0) close(r3) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r4, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001c40)="0349ee47070c03607b5bae292ac8b762044157dd1ea30758ca9a7bfbd23efe5ba3cf173f0478438cbae7a57fe81ae074996dfd64d0c8db1c53c331a33a95a0d2cb94d0cd09f710c11df6be5cc730821bae016a0ea4073e7e4bd62cc1aff09c799d1ebe2a8388a02e50dd19c4b7b1e91a0a1d8904b32b45710d16dc796b719e7adabac89602c834ff01f6b5839643d5a2d8edb9d77af834a7fb82c2fdbdedbab80f961971ed25e2cee13220d342969544a6ce40ead993604e38deb309b330177ed7d23f919596f483ece2d540a95568272a0e879281d83615f589c89e1a7b0cea2a2fac406dbe67256f354a79cb99de0f7e1f4aa617405f284bca8cea6048f1155a89e98746e6912a7509caca768fd2b1ae942cce6a29d848f660b18ca860f9e5f9d95562c4a19fdd9b59932a453a934f0b98fa91129d29dfa2f8f21424c590ed8fe31a79ba09ef72c497ddd5ce7826e096e30746772e34cfc47e9eb5b56187132d87702b56e40d6751a58f9e6aa732d610f7aa631759a3afa266f730a0ee4a8d93555ba710d1bfb9ea4d633faee1529b8565af53eb34cfaca3e31dda587c2be2df3fe5a5a0e2a500eb8cc40db50854a6ec225fca2900148eb7a83c9189cedd69b7eb874f92f00f7635510d2dc062cfcfd8c9a473ac15c7ffbcc56399f6150750d7090917358870f16f684528a9d69bac3046256ad4e101073115712a89b0dd76fe5e8648696ce8dfe82b3220807dd7a446cd158fdf9426b7ddab8584eefb4152d25757e2642b77a21b364327ea38e911f60e6e6718730942c1db47cf80f16aac0950a5c2d412c620b526dca7f601a25b0089f69652889f0ac0667980d074e48dd8d20096097b772317cb8ba11531bd353d584f278e5b2565456f4997f73541add2e336a9beba29baeea7df3bbc5ad5f00c7c6f3c1ba93fbc1dba159497752eefa611d14f26b7c9a07aacda2e9b7572ea3fa66f67c04ee30f0e8f94038c01de81689c12fc44c71ed2b93b31ddc0d9acf62e6e9d71699d0d987ae87c529fcd79ab48433a43ed86d09095bf8d9798f80bbdd36d4ddeb90e752ac9e96079cfa4595daaed34df23e3771b791f3a54f86be3fe4a41f41c8d0f3a28cac2bf926eb95c8badf9fd2d0eb767664872417a08dade17937cadc00a8e3afe349d0e7a3cdfc1b1af108a7a5142a2b5832e99aff5ef27b525d4ea83d1523210c6cc673bcf42cc2e4561d2e8abad128992074d0aaa467eae584f62d347b70fa4f282f463ea0c916ec2e5b8490c87347bc70a11e9748a844d45cc744847e89acbb2e0bc03014c4865d426f52a460b1c0354fb90e4b882e23b674606737e5b878d1f18628f8f2389a071b0d2c64bcdb634b59e2effaabed7ee7812002956e776c039b16bd1cb0b663f4c8a16ad422856f7e6de282b33f268ff11f7972678bd337373b399e514c4dbebfcb812edc05f0e60b68df71682244b458009b85ee038722fc4b6b0c322d6d59ae9d290870d9c86707ad7f080f53d883454526ca942d6b6232cac0b378f0f2bb5209d93e2487a80a9677ac6b850d88cf1f8d47a5f5b534ad4cbf459235fd3662513ac1c53f0ba321b3cf9ede7b9a7e712fc5bf0b17cd164ef34178b3b06ec995106af31c7ffbe5a2bda35a9df9cd31d877d304dd1bd16caf5560ed991dadf378d9deb8f495b0d084ff28f87b305a3a849efcabd48b3e515dc6acd7b61589c10bb0e68dc10eef57e9e59aaba78c04c59c6f8c1d860227133fca4ff352634eb6caad1afbbbfe47fa2646819ec282ca1fb73bcbbc7315782e574b2fb1e842ed83862f9fc380a7e92b3c02af1", 0x50a}, {&(0x7f0000002640)="67bc1270103215f70ba82603356704de3f11", 0xfffffffc}, {&(0x7f0000000200)="8fd26291dc7d67b112d3e8b82fa2c2c44486653b44834d66239fa66393c45a6031f6c1bd07000000000000000903e1c5863cc58490e29936da789cff4b90234d9c63654eaf2fac23d471ffd86e91f5754393f475a5a558936be5c3791a864c78e4a0aad7e6f039a697ab36de627cd7a4cae2743f5cced83b6f2909c5e96c05c85c13169658ad5799404148be9cade82f750069f711a9b715a8277295ed66f89453901389962590d5551afdf10aea56939b89dff5569c1f34c3c03850ec32e3d483cff3bdb845c803e818b44440ba537edd30f57101cfb74cf087c6f5101ef2a328801d60ba54f5e8d807441e03974548c534c99811e95067dc40eaa385d69c74589e33d31e1bcf57c35c2a31f69750f90edb264d6509bd8383f90c004949d8", 0x11f}], 0x3}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000004c0)="3912c1d03d9f66103940872256d8995b00c720af0cfa51b2b3b1448411fe107e64af467c85a200ebafdbee2c35b8ad1677fe7bb27ca22acbe83c449484972354b3baa1809633e690474a9154f95bd6874f20a0b290c590d44a9f5cd01414544ad719b82a550f2a7215e33e2dfdc1ce61a75637323b8828c5e5ef1f77b3d93114d46ceddb9d976eea7e20bb95e24e1e8b9974397bb8d73856a38618eac0ab333267fc833503b4df7838f5e522192252f4fd72ae45d21b55414a82ec84ff620a1ee2fe4691573a8afc79adaac5f0618cb457b14013f9e048cdec329a9e3343140213a41330b43e3290ef836c8839b303f0639a7561361247db2646977014051dcf3dc1246225f9aae3ca02943571bb39ecfdfa5b9ebc30a0476103c6133c7da6313848373c719a1f43ba5a765b8aa97caf7717fa063166951aa4e72d5616e6b42d6866fb308970430b2ff44c25b7dde2494389d1717c83f83ac7a632da0472bd6b0295b9f1fd1fc43099b1062bef744785158264f636cbf13926e7fcde7ebc1560a20961df3286df51b246ee7fe9474a8d51498bd90230bc89ea8dccb85035edd01aa93ed2f82297c3c3703990cb5201c7b92a04ea7abf9a36a488369161a9bfa42664d84860974fddbabed7eb509350917a3bbd427fe226bd1dd34275dfd3882c0a7d711641babb2e36d9637c0b33a41a3578861d75e7e93c22ee94e9594258dc186ec2d749cad6e03b767555610c200efb5f104f91be7fb2513c97f3f279da2baedf7f91ed97ae33edef2ab348dded9df075b1ca5855866843aff902b6678075cb4a3d988ffd8ed61885400d1bcf6dc38c6be9b6428d4eba30711556510eb41b5c04590f11e393317a4fc988b39ecdbe322344c5ec4ed178e1dd35182a00f3ac345bfeea9936b6a015151332962bd28c5e1dbcdd825d51c78ef6db73170d9cfd47f2ca210ce8c103d37be1c61427bd3cf1bb5bcf9888f6e1631f404ea51f9cd8e0725459f9a531af19e2b533532f0b66fb5e9614d0895d35ccda358ac482a824fe67165bdaedcda5ddd86924c4fe5f22a043f92aed7a105fb54ec323273e660c17b8ae89d1546022320711ae0cab37564fc6b394f39e0b216227fa74b76c2a020d42f167891cbaf960fc0288547f2d31dceff3787135659a65878e5df65ce0004104a665098be576ebaf3733b6ba57e40f40ac74aad7d8b41db0f55513389faa84b1ce0fafed7018bcc5a687118bfab115b7a3163fb22af534406206065acf06066a5fb65f0b928cd25838c0c1a7b06bc42e622f502e515b87426b2a184b593bf35a4d454dc56881bbda1b9350f956e086196447a5052288aa0556e638d292bfd1abad58ef5db98f92694b30c3eda5b25a44688b24eadf579616c034ef688fad705c3dc99aafda0f7bbb591fd20e0ff96e8941188b9676b833aa91ba5ab1cf7acbdf16f14c843dd3cfeedf8e7628051f361ba328496c8a05aa68997257cb505dba270e132c437bc6df39134b0807fea53ecb84714ab0d9d8cda271e15bddac37ae4e0534322d649b74c90499919b771679c7211b4df2c80864809991750f966f52d217f63e80b7142b9205576133469a0a950060cd2fa0c25554b89900ebb6a991954990adeee517e55ff3abe4f3f7c07cb735b80be674d53ccc5bef27421c7bb602c7f22dde056ae0c85086f9850fe6a7dd108fd29c7f99f3d1316da10415b2e4e029762a39369cd8738e0a840690c5e2167099a6c1d59a6cc8827630b699da0d592e01c2db8af46daa48575fc2f4eeca2c3abf26ec776906572e712c6f0c57ec39ab4e004d994a341570a6e117edc13626aeaf794266a0f3103c84ae1300e6928b749cce7a1ba4e7609ceca262324cbc503cde9c897848a015c4d7cdb02cfc0c", 0x541}], 0x1}}], 0x4000000000001e5, 0xc010) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100"}) bind$rds(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000000400)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x1000000}, {0x0}, &(0x7f0000000500)=[{&(0x7f0000000100)=""/44, 0x2c}, {&(0x7f0000000380)=""/76, 0x4c}, {&(0x7f0000000800)=""/202, 0xca}, {&(0x7f0000000600)=""/188, 0xbc}], 0x4, 0x10, 0x4}}], 0x48, 0x40014}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x8, 0x3032, 0xffffffffffffffff, 0x54099000) 1.277374168s ago: executing program 2 (id=1162): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="a4010000190a05000000000000000000000000000c0003400000000000000001770007402117a3a0ca6bead4b2affca81cb36d623843a09caac7c60cc10db68f9bd1302e297a212d278947f6c5f84380ea54538713c854eca55bc10a4cbb5c3dc9bdf70600000000000076ed821b47bfbf5ce8d41300b68af5acb031c11fbbadd121be33fad0718050f676454bed7aee1101e5e42c19450008000b4000000002e400048024000180090001006d617371000000001400028008000340000000000800034000000001100001800a000100717565756500000024000180090001006d65746100000000140002800800034000000004080001400000001564000180090001006861736800000000540002800800044000000000080002400000000208000740000000010800054000000800080005400000000508db1ee791a13d7e9f0001400000000b080007400000000008000440000000020800054000000400100001800a00010072616e6765000000"], 0x1a4}}, 0x0) unshare(0x62040200) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffc, 0xff, 0x80000000}, 0x1c) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x0, 0x0, 0x400, 0xc, 0x30, 0x3ff, 0xa3}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r3, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="54000000020603000000000000000000000000000500050002000000050004000100000005000100060000000c00078008000640000000000900020073797a300000000010000300686173683a69702c6d616300a20fe3ecbe014c32"], 0x54}}, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x0) sendmmsg$alg(r8, &(0x7f0000000700)=[{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="c7ed8f769bb970e49d79a77aa58d49b7", 0x10}], 0x1, 0x0, 0x0, 0x4000}], 0x1, 0x800) recvmsg(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000000380)=""/4, 0x4}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x40000000) close(0xffffffffffffffff) socket$kcm(0x11, 0x200000000000002, 0x300) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) 1.132016402s ago: executing program 0 (id=1163): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8}, @CTA_SYNPROXY_ISN={0x8}, @CTA_SYNPROXY_TSOFF={0x8}]}]}, 0x80}}, 0x0) (async, rerun: 32) r1 = socket$netlink(0x10, 0x3, 0x12) (rerun: 32) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) sendfile(r1, r2, 0x0, 0xf03a0005) (async, rerun: 64) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r3, 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (rerun: 64) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async, rerun: 32) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async, rerun: 64) socket$igmp6(0xa, 0x3, 0x2) (rerun: 64) socket$igmp(0x2, 0x3, 0x2) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async, rerun: 32) socket(0x10, 0x80002, 0x0) (rerun: 32) socket$netlink(0x10, 0x3, 0x0) (async) close(0xffffffffffffffff) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) socket$inet_icmp_raw(0x2, 0x3, 0x1) 761.458108ms ago: executing program 0 (id=1164): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f0000000280)=0x1, 0x4) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000000b00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=""/204, 0xcc}, 0xc20b}], 0x1, 0x10122, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x8, &(0x7f0000000000)={&(0x7f0000000200)={{0x14, 0x10, 0xc00e}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x4000000, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWSETELEM={0x78, 0xc, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4c, 0x3, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0xb}, @NFTA_SET_ELEM_EXPRESSIONS={0x3c, 0xb, 0x0, 0x1, [{0x20, 0x7, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}]}}}, {0x18, 0x1, 0x0, 0x1, @connlimit={{0x4, 0x2}, @val={0x4}}}]}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xfc}}, 0x0) 519.99569ms ago: executing program 0 (id=1165): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002abd7000ffdbdf251700000008000300", @ANYRES32=r4, @ANYBLOB="0a00200008021100000100000a0006"], 0x34}, 0x1, 0x0, 0x0, 0x44}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0xfffffefb, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[], 0x159c}}, 0x81) 431.451653ms ago: executing program 5 (id=1166): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000080)={0xe0000000}) socket$inet(0x2, 0x2, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[], 0x7c}}, 0x0) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r4, &(0x7f0000000580)="81", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f0000000080)=0x7ffe, 0x4) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='nr0\x00', 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x14, r6, 0x701, 0x70bd2b, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20004074}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f80)=ANY=[@ANYBLOB="28006345ad32dc50639e25a3e13d42e800003e00070103000000003311da94c9c9017c000004004280100002800c0008000010ea582354a0143d0c525edde6c2bc03ac324882bd8f10caad634dd787ed32b95e24a4636589dcf61f892f3b6b1c2ac74e2a535d998b522830a1aa4825c18472eccef3811005960fea4ce76fa8cffacfc94bb559b6278c16eb5afece13123c8b7a20ab3f4d45f6e68652f4ec4e4f4495e5cb87b6273d44bb2fe5b61a2fd8c2b9d41b4068600fd2dcc2ca476794447973403ea8bffa6d0d60f4eac3d2b45f6bd7464733969eb9696be983269acde590679a5bb2efebb2915ebd4d471f56fed257751106b92c53550033b7372f5db2463fe615ec71a4fe0306c98e6d7176077bd4ae"], 0x28}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmmsg$inet(r3, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)}], 0x1, 0x0, 0x0, 0x2000000}}], 0x1, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000001100), r5) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c00000010001fff00000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8bbfffff420105003b00128009000100626f6e6400000011d57a0eedec3e6dd5288d00"/57], 0x3c}, 0x1, 0x0, 0x0, 0x20048040}, 0x44) bind$alg(r2, &(0x7f0000000040)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0x3, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000003000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r10, 0x27, 0x0, 0x0, &(0x7f00000005c0), 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000006000000bca30000000000002403000020feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000500000000002604fdffff02000014010000033800001d13f8ff000000007a0af0ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xfc, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd27, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r11 = socket(0x848000000015, 0x805, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x4, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x36}}, 0x11}, 0xffffffffffffff63) sendto$inet6(r11, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) 375.878343ms ago: executing program 1 (id=1167): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x870bd2d, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xb}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x8, 0x0, 0x0, 0xfffffffd, 0x80008}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000080)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) pwrite64(r3, &(0x7f0000000380)='k', 0x1, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r4], 0x90}}, 0x0) 293.659261ms ago: executing program 0 (id=1168): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0300000004000000040000000200020000000000c9b38b307b53ea819900180d4022087be38cab68ee574ed8c166dfe22edd81b5038a1517e1689fa25c42653f1acb5a270cbc338e85015307604df8938231bfb826e0400de88c8a1e275e70ef538c1be34e0185a6fa7c7e0e79366893b4c6930729fd7f2d81cafcd29db557a72905787cbe6581e13ce62f19650aef0545eb4bee0b0c557df0e1e523e73481ef80259ea44dbc09b0cd448eaf50889eb9b805954e8c7a3deac8ed", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000200"/28], 0x50) syz_80211_inject_frame(0x0, 0x0, 0xb5) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000005"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="480000001000030500000000fcdbdf2500000001", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800b0001006d61637365630000180002800c0004000200000100c28000050006"], 0x48}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, 0x0, 0x24044884) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELOBJ={0xdc, 0x14, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_OBJ_USERDATA={0xb5, 0x8, "6a688f046c7e3aaa8834405ef045a90b74d872b1d15aa5d80b92a3af5a771a55d84ab6cf34584f6742ecc94bf886fbafef66a1e1655d091922f2f7da1907b5313765137ae7d2029b397144873581bae507d592dff772cfcc044d622a751a43d2e20ad8f5af3f9580f3e23ab2ace84525e8cd0ce50720ebe1d2dc9982dadafd8f1bb717d34a7e8f74507c7ae786773c880b9ba1fa5e409cf5f287b82d91babd0325eb07a086c85cff2fb8ff83d4f8533f8a"}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x9}}}, 0x104}}, 0x10) 62.769686ms ago: executing program 1 (id=1169): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg0\x00'}) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000ac0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000fbdbdf256800000008000300", @ANYRES32=r2, @ANYBLOB="1e00c700090b"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x804) 0s ago: executing program 2 (id=1170): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="18000000041428042dbd3d009429000008000100000000007e3cad44b8220eb638ac27760dc269d78feb3bc60e40b07e0820e366097c168054cba9ffe209b57d90dfc5ab39dfc5b99e23f214349cfe531bb0f4fe192692e9b46553f6b605ab2fdae8a8d41524d88594344cb546d4d29190c02a2697127bea8161eb65533b2d54f897bacf454724392e9273c325692c97bc9e24069c21e7b752bdcad879"], 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x408c090) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'ipvlan0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010000304000000000000000000000400", @ANYRES32=0x0, @ANYBLOB="00010000000000140012800b00010b6d616373b2ff212951017d9d6563080000", @ANYRES32=r2, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x24008000}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="480000000406010200000000000000000200000305000100070000000900020073797a31000000000900020073797a30000000000500010007000000090073797a32000000000000"], 0x48}, 0x1, 0x0, 0x0, 0x2000c000}, 0xc04) kernel console output (not intermixed with test programs): ll_64+0xbe/0x3b0 [ 110.387856][ T6309] do_syscall_64+0xfa/0x3b0 [ 110.387880][ T6309] ? lockdep_hardirqs_on+0x9c/0x150 [ 110.387904][ T6309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.387925][ T6309] ? clear_bhb_loop+0x60/0xb0 [ 110.387950][ T6309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.387970][ T6309] RIP: 0033:0x7f3bd058e969 [ 110.387993][ T6309] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 110.388011][ T6309] RSP: 002b:00007f3bd14a9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 110.388033][ T6309] RAX: ffffffffffffffda RBX: 00007f3bd07b6080 RCX: 00007f3bd058e969 [ 110.388048][ T6309] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000003 [ 110.388061][ T6309] RBP: 00007f3bd14a9090 R08: 0000000000000000 R09: 0000000000000000 [ 110.388074][ T6309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 110.388086][ T6309] R13: 0000000000000000 R14: 00007f3bd07b6080 R15: 00007ffc4c4f9de8 [ 110.388119][ T6309] [ 110.617144][ T6314] netlink: 'syz.2.117': attribute type 10 has an invalid length. [ 110.627678][ T6314] syz_tun: entered promiscuous mode [ 110.641419][ T6314] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 110.669120][ T6314] netlink: 8 bytes leftover after parsing attributes in process `syz.2.117'. [ 110.678063][ T6314] netlink: 8 bytes leftover after parsing attributes in process `syz.2.117'. [ 110.690566][ T6314] netlink: 14 bytes leftover after parsing attributes in process `syz.2.117'. [ 110.912094][ T6314] bond0 (unregistering): (slave syz_tun): Releasing backup interface [ 110.932836][ T6314] bond0 (unregistering): Released all slaves [ 111.078425][ T6319] netlink: 'syz.4.120': attribute type 4 has an invalid length. [ 111.113632][ T6319] netlink: 'syz.4.120': attribute type 4 has an invalid length. [ 111.222540][ T6325] netlink: 12 bytes leftover after parsing attributes in process `syz.2.121'. [ 111.267709][ T6325] netlink: 8 bytes leftover after parsing attributes in process `syz.2.121'. [ 111.320497][ T6332] netlink: 'syz.3.122': attribute type 7 has an invalid length. [ 111.830475][ T49] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.895143][ T6342] netlink: 33 bytes leftover after parsing attributes in process `syz.2.129'. [ 111.951967][ T6342] netlink: 'syz.2.129': attribute type 11 has an invalid length. [ 112.046631][ T6342] netlink: 224 bytes leftover after parsing attributes in process `syz.2.129'. [ 112.075363][ T49] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.178786][ T6346] bridge0: port 1(ipvlan0) entered blocking state [ 112.213657][ T6346] bridge0: port 1(ipvlan0) entered disabled state [ 112.243633][ T6346] ipvlan0: entered allmulticast mode [ 112.252253][ T6346] veth0_vlan: entered allmulticast mode [ 112.285312][ T6346] ipvlan0: left allmulticast mode [ 112.302954][ T6346] veth0_vlan: left allmulticast mode [ 112.340401][ T49] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.400301][ T6353] netlink: 'syz.3.132': attribute type 39 has an invalid length. [ 112.486742][ T49] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.636772][ T6356] lo: entered promiscuous mode [ 112.655126][ T6356] lo: entered allmulticast mode [ 112.696986][ T6356] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 112.963669][ T49] bridge_slave_1: left allmulticast mode [ 112.984617][ T49] bridge_slave_1: left promiscuous mode [ 112.992756][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.064703][ T49] bridge_slave_0: left allmulticast mode [ 113.080136][ T5837] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 113.089134][ T5837] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 113.097651][ T5837] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 113.108161][ T5837] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 113.117043][ T5837] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 113.124151][ T49] bridge_slave_0: left promiscuous mode [ 113.124445][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.519618][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 113.530788][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 113.541117][ T49] bond0 (unregistering): Released all slaves [ 113.749447][ T6381] netlink: 'syz.3.138': attribute type 303 has an invalid length. [ 113.980288][ T6398] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 114.022554][ T6398] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 114.101700][ T6404] tun0: tun_chr_ioctl cmd 1074025675 [ 114.117347][ T6404] tun0: persist enabled [ 114.307998][ T6404] xt_socket: unknown flags 0xfc [ 115.174384][ T5837] Bluetooth: hci4: command tx timeout [ 116.274573][ T49] hsr_slave_0: left promiscuous mode [ 116.309133][ T49] hsr_slave_1: left promiscuous mode [ 116.322055][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 116.329625][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 116.337869][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 116.345593][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 116.373248][ T49] veth1_macvtap: left promiscuous mode [ 116.380516][ T49] veth0_macvtap: left promiscuous mode [ 116.387135][ T49] veth1_vlan: left promiscuous mode [ 116.393146][ T49] veth0_vlan: left promiscuous mode [ 116.820901][ T49] team0 (unregistering): Port device team_slave_1 removed [ 116.857669][ T49] team0 (unregistering): Port device team_slave_0 removed [ 117.221305][ T6400] tun0: tun_chr_ioctl cmd 1074025675 [ 117.231975][ T6400] tun0: persist disabled [ 117.252978][ T5837] Bluetooth: hci4: command tx timeout [ 117.369914][ T6426] netlink: 8 bytes leftover after parsing attributes in process `syz.3.150'. [ 117.457931][ T6429] netlink: 596 bytes leftover after parsing attributes in process `syz.1.151'. [ 117.500731][ T6426] vlan2: entered allmulticast mode [ 117.507615][ T6433] netlink: 596 bytes leftover after parsing attributes in process `syz.1.151'. [ 117.579163][ T6367] chnl_net:caif_netlink_parms(): no params data found [ 117.740737][ T6441] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 117.808810][ T6441] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 118.022512][ T6367] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.154920][ T6367] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.162202][ T6367] bridge_slave_0: entered allmulticast mode [ 118.188457][ T6367] bridge_slave_0: entered promiscuous mode [ 118.231275][ T6367] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.251890][ T6367] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.264537][ T6367] bridge_slave_1: entered allmulticast mode [ 118.274509][ T6367] bridge_slave_1: entered promiscuous mode [ 118.421993][ T6367] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 118.460393][ T6367] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 118.615531][ T6367] team0: Port device team_slave_0 added [ 118.666700][ T6367] team0: Port device team_slave_1 added [ 118.747390][ T6469] netlink: 32 bytes leftover after parsing attributes in process `syz.0.155'. [ 118.873455][ T6367] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 118.880470][ T6367] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 118.948160][ T6367] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 119.071366][ T6367] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 119.091514][ T6367] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 119.129233][ T6367] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 119.333648][ T5837] Bluetooth: hci4: command tx timeout [ 119.454611][ T6367] hsr_slave_0: entered promiscuous mode [ 119.461405][ T6367] hsr_slave_1: entered promiscuous mode [ 119.479153][ T6367] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 119.499942][ T6367] Cannot create hsr debugfs directory [ 120.350286][ T6367] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 120.400213][ T6367] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 120.425642][ T6367] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 120.460758][ T6367] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 120.686141][ T6527] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 120.734398][ T6527] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 120.756270][ T6367] 8021q: adding VLAN 0 to HW filter on device bond0 [ 120.858637][ T6367] 8021q: adding VLAN 0 to HW filter on device team0 [ 120.965469][ T2919] bridge0: port 1(bridge_slave_0) entered blocking state [ 120.972848][ T2919] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.006269][ T2919] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.013500][ T2919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.416909][ T5837] Bluetooth: hci4: command tx timeout [ 121.629694][ T6541] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 122.180935][ T6367] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.191611][ T6550] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.175'. [ 122.211457][ T6553] netlink: 4 bytes leftover after parsing attributes in process `syz.3.174'. [ 122.243732][ T6550] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 122.245836][ T6554] netlink: 4 bytes leftover after parsing attributes in process `syz.3.174'. [ 122.273057][ T6550] openvswitch: netlink: Duplicate key (type 0). [ 122.303423][ T6555] netlink: 96 bytes leftover after parsing attributes in process `syz.3.174'. [ 122.337699][ T6553] netlink: 16 bytes leftover after parsing attributes in process `syz.3.174'. [ 123.150318][ T6579] netlink: 'syz.1.179': attribute type 39 has an invalid length. [ 123.319454][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880321a6c00: rx timeout, send abort [ 123.517629][ T6367] veth0_vlan: entered promiscuous mode [ 123.560006][ T6367] veth1_vlan: entered promiscuous mode [ 123.621082][ T6367] veth0_macvtap: entered promiscuous mode [ 123.712265][ T6367] veth1_macvtap: entered promiscuous mode [ 123.820226][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880294e5000: rx timeout, send abort [ 123.829189][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880321a6c00: abort rx timeout. Force session deactivation [ 123.852231][ T6367] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 123.928350][ T6367] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 123.980535][ T6367] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.998864][ T6367] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.023879][ T6592] netlink: 'syz.1.183': attribute type 1 has an invalid length. [ 124.031579][ T6592] netlink: 784 bytes leftover after parsing attributes in process `syz.1.183'. [ 124.041185][ T6367] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.051173][ T6367] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.069869][ T6595] netlink: 'syz.1.183': attribute type 1 has an invalid length. [ 124.120321][ T6592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.183'. [ 124.127213][ T6595] netlink: 784 bytes leftover after parsing attributes in process `syz.1.183'. [ 124.246354][ T3507] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.273153][ T3507] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.328592][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880294e5000: abort rx timeout. Force session deactivation [ 124.377679][ T6603] bridge_slave_0: left promiscuous mode [ 124.408400][ T6603] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.429227][ T6606] netlink: 'syz.1.188': attribute type 1 has an invalid length. [ 124.439111][ T6606] netlink: 'syz.1.188': attribute type 2 has an invalid length. [ 124.454262][ T6602] netlink: 'syz.3.186': attribute type 10 has an invalid length. [ 124.481957][ T6603] bridge_slave_1: left allmulticast mode [ 124.488481][ T6603] bridge_slave_1: left promiscuous mode [ 124.533790][ T6603] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.584332][ T6603] bond0: (slave bond_slave_0): Releasing backup interface [ 124.602365][ T6603] bond0: (slave bond_slave_1): Releasing backup interface [ 124.629862][ T6603] team0: Port device team_slave_0 removed [ 124.646015][ T6603] team0: Port device team_slave_1 removed [ 124.654096][ T6603] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.661650][ T6603] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 124.675104][ T6603] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 124.683175][ T6603] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 124.778612][ T6602] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 124.869961][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.884733][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.224043][ T6622] netlink: 'syz.5.130': attribute type 39 has an invalid length. [ 125.480953][ T6631] netlink: 24 bytes leftover after parsing attributes in process `syz.2.194'. [ 125.494225][ T6629] netlink: 'syz.3.192': attribute type 39 has an invalid length. [ 125.625689][ T6631] Bluetooth: MGMT ver 1.23 [ 125.641488][ T6631] netlink: 8 bytes leftover after parsing attributes in process `syz.2.194'. [ 125.817433][ T6645] netlink: 60 bytes leftover after parsing attributes in process `syz.5.199'. [ 125.820205][ T6646] netlink: 4 bytes leftover after parsing attributes in process `syz.2.198'. [ 125.831324][ T6645] unsupported nlmsg_type 40 [ 125.990726][ T6652] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 126.346497][ T6666] netlink: 24 bytes leftover after parsing attributes in process `syz.3.202'. [ 126.728536][ T6682] netlink: 44 bytes leftover after parsing attributes in process `syz.1.206'. [ 126.749924][ T6682] batman_adv: batadv0: Adding interface: wlan0 [ 126.760174][ T6682] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 126.786981][ T6682] batman_adv: batadv0: Interface activated: wlan0 [ 126.831419][ T6685] netlink: 12 bytes leftover after parsing attributes in process `syz.2.208'. [ 127.054792][ T6690] bridge_slave_1: left allmulticast mode [ 127.060681][ T6690] bridge_slave_1: left promiscuous mode [ 127.067012][ T6690] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.094340][ T6690] bridge_slave_0: left allmulticast mode [ 127.100202][ T6690] bridge_slave_0: left promiscuous mode [ 127.108639][ T6690] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.227391][ T6697] netlink: 'syz.1.212': attribute type 39 has an invalid length. [ 127.309960][ T6701] netlink: 'syz.0.214': attribute type 18 has an invalid length. [ 127.330048][ T6702] tipc: Started in network mode [ 127.339517][ T6702] tipc: Node identity , cluster identity 4711 [ 127.345936][ T6702] tipc: Failed to obtain node identity [ 127.351844][ T6702] tipc: Enabling of bearer rejected, failed to enable media [ 127.373834][ T6701] workqueue: name exceeds WQ_NAME_LEN. Truncating to: žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»– [ 127.528063][ T6705] syzkaller0: entered promiscuous mode [ 127.545505][ T6705] syzkaller0: entered allmulticast mode [ 128.190565][ T6735] tipc: Trying to set illegal importance in message [ 128.708153][ T6763] netlink: 'syz.3.229': attribute type 10 has an invalid length. [ 128.772902][ T5837] Bluetooth: hci2: command tx timeout [ 128.876187][ T6773] netlink: 'syz.5.232': attribute type 1 has an invalid length. [ 129.180947][ T6785] __nla_validate_parse: 6 callbacks suppressed [ 129.180968][ T6785] netlink: 44 bytes leftover after parsing attributes in process `syz.0.236'. [ 129.274695][ T6791] netlink: 'syz.1.234': attribute type 39 has an invalid length. [ 129.407316][ T6800] netlink: 12 bytes leftover after parsing attributes in process `syz.3.238'. [ 129.941927][ T6824] netlink: 20 bytes leftover after parsing attributes in process `syz.3.248'. [ 129.955420][ T6824] netlink: 20 bytes leftover after parsing attributes in process `syz.3.248'. [ 130.138396][ T6833] netlink: 44 bytes leftover after parsing attributes in process `syz.1.251'. [ 130.435914][ T6848] Illegal XDP return value 8 on prog (id 86) dev N/A, expect packet loss! [ 130.866508][ T6868] netlink: 'syz.2.261': attribute type 39 has an invalid length. [ 130.906685][ T6869] sctp: [Deprecated]: syz.5.260 (pid 6869) Use of int in max_burst socket option deprecated. [ 130.906685][ T6869] Use struct sctp_assoc_value instead [ 131.161067][ T6874] netlink: 'syz.2.263': attribute type 39 has an invalid length. [ 131.267380][ T6881] netlink: 44 bytes leftover after parsing attributes in process `syz.2.265'. [ 131.287066][ T6847] Bluetooth: hci3: Opcode 0x0401 failed: -4 [ 131.342150][ T6883] netlink: 'syz.1.266': attribute type 10 has an invalid length. [ 131.729631][ T6901] netlink: 24 bytes leftover after parsing attributes in process `syz.0.272'. [ 132.020004][ T6920] netlink: 68 bytes leftover after parsing attributes in process `syz.3.277'. [ 132.038588][ T6923] netlink: 44 bytes leftover after parsing attributes in process `syz.1.280'. [ 132.147069][ T6931] netlink: 'syz.3.277': attribute type 39 has an invalid length. [ 132.350736][ T6940] netlink: 'syz.1.282': attribute type 303 has an invalid length. [ 132.381014][ T6941] netlink: 16 bytes leftover after parsing attributes in process `syz.2.284'. [ 132.407069][ T6942] batadv0: entered promiscuous mode [ 132.419950][ T6942] macsec1: entered promiscuous mode [ 132.451636][ T6942] batadv0: left promiscuous mode [ 132.457531][ T5837] Bluetooth: hci3: command 0x0401 tx timeout [ 132.686716][ T6935] syz.1.282 (6935) used greatest stack depth: 17992 bytes left [ 132.939210][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.515011][ T6993] netlink: 'syz.0.297': attribute type 39 has an invalid length. [ 134.465555][ T7035] __nla_validate_parse: 6 callbacks suppressed [ 134.465576][ T7035] netlink: 4 bytes leftover after parsing attributes in process `syz.0.310'. [ 134.686810][ T7040] netlink: 64 bytes leftover after parsing attributes in process `syz.3.311'. [ 134.770456][ T7040] 8021q: adding VLAN 0 to HW filter on device bond2 [ 134.782300][ T7040] team0: Port device bond2 added [ 134.839734][ T7052] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.856421][ T7052] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 135.079124][ T7057] netlink: 44 bytes leftover after parsing attributes in process `syz.3.318'. [ 135.852522][ T7080] netlink: 'syz.0.323': attribute type 10 has an invalid length. [ 136.249489][ T7090] netlink: 28 bytes leftover after parsing attributes in process `syz.1.328'. [ 136.268637][ T7090] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 136.276368][ T7090] IPv6: NLM_F_CREATE should be set when creating new route [ 136.283671][ T7090] IPv6: NLM_F_CREATE should be set when creating new route [ 136.298829][ T5839] Bluetooth: hci4: command 0x0405 tx timeout [ 136.300383][ T7097] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.337976][ T7095] netlink: 44 bytes leftover after parsing attributes in process `syz.2.330'. [ 136.374318][ T7097] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.558152][ T7108] netlink: 4 bytes leftover after parsing attributes in process `syz.5.334'. [ 136.814610][ T1208] IPVS: starting estimator thread 0... [ 136.820419][ T7129] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 136.835789][ T7133] netlink: 32 bytes leftover after parsing attributes in process `syz.5.342'. [ 136.945157][ T7132] IPVS: using max 28 ests per chain, 67200 per kthread [ 137.359287][ T7157] netlink: 'syz.3.349': attribute type 11 has an invalid length. [ 137.503216][ T7167] netlink: 16 bytes leftover after parsing attributes in process `syz.0.350'. [ 137.535017][ T7167] netlink: 16 bytes leftover after parsing attributes in process `syz.0.350'. [ 137.729488][ T7177] vlan3: entered promiscuous mode [ 137.738099][ T7179] netlink: 12 bytes leftover after parsing attributes in process `syz.5.357'. [ 137.747387][ T7177] vlan2: entered promiscuous mode [ 137.752584][ T7177] gretap0: entered promiscuous mode [ 137.935036][ T7184] tipc: Started in network mode [ 137.939972][ T7184] tipc: Node identity 7f000001, cluster identity 4711 [ 137.950410][ T7184] tipc: Enabling of bearer rejected, failed to enable media [ 138.677900][ T7212] netlink: 'syz.5.367': attribute type 1 has an invalid length. [ 139.698073][ T7254] nbd: socks must be embedded in a SOCK_ITEM attr [ 139.709659][ T7254] block nbd0: shutting down sockets [ 139.737221][ T7257] netlink: 'syz.1.382': attribute type 39 has an invalid length. [ 139.747966][ T7257] veth0_macvtap: left promiscuous mode [ 139.780358][ T7254] netlink: 'syz.2.381': attribute type 11 has an invalid length. [ 139.789720][ T7254] __nla_validate_parse: 6 callbacks suppressed [ 139.789745][ T7254] netlink: 224 bytes leftover after parsing attributes in process `syz.2.381'. [ 139.811083][ T7254] netlink: 'syz.2.381': attribute type 39 has an invalid length. [ 140.224925][ T7266] netlink: 16 bytes leftover after parsing attributes in process `syz.0.386'. [ 140.258958][ T7269] netlink: 4 bytes leftover after parsing attributes in process `syz.0.386'. [ 140.437340][ T7277] netlink: 44 bytes leftover after parsing attributes in process `syz.0.391'. [ 140.464674][ T7278] netlink: 'syz.5.390': attribute type 1 has an invalid length. [ 140.601669][ T7282] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 140.673841][ T7283] veth3: entered promiscuous mode [ 140.697239][ T7283] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 140.711245][ T7285] netlink: 12 bytes leftover after parsing attributes in process `syz.0.393'. [ 140.813035][ T7288] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.962639][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.104679][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.205039][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.361014][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.430635][ T7310] ipvlan2: entered promiscuous mode [ 141.453174][ T7310] ipvlan2: entered allmulticast mode [ 141.464222][ T7310] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 141.480093][ T7314] netlink: 44 bytes leftover after parsing attributes in process `syz.5.403'. [ 141.832388][ T7326] netlink: 'syz.5.406': attribute type 39 has an invalid length. [ 142.002031][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 142.013591][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 142.028652][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 142.039262][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 142.051797][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 142.290497][ T13] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 142.303528][ T13] bond0 (unregistering): Released all slaves [ 142.318710][ T13] bond1 (unregistering): Released all slaves [ 142.421105][ T13] team0: Port device bond2 removed [ 142.428623][ T13] bond2 (unregistering): Released all slaves [ 142.447467][ T7322] netem: incorrect gi model size [ 142.452595][ T7322] netem: change failed [ 142.631668][ T7337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 142.680455][ T7337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 142.742574][ T7341] netlink: 5 bytes leftover after parsing attributes in process `syz.2.411'. [ 143.114402][ T7361] netlink: 44 bytes leftover after parsing attributes in process `syz.2.417'. [ 143.159541][ T7363] netlink: 12 bytes leftover after parsing attributes in process `syz.5.418'. [ 143.296421][ T13] hsr_slave_0: left promiscuous mode [ 143.312534][ T13] hsr_slave_1: left promiscuous mode [ 143.336532][ T7371] netlink: 40 bytes leftover after parsing attributes in process `syz.2.421'. [ 143.342137][ T13] veth1_macvtap: left promiscuous mode [ 143.351352][ T13] veth0_macvtap: left promiscuous mode [ 143.357531][ T13] veth1_vlan: left promiscuous mode [ 143.363466][ T13] veth0_vlan: left promiscuous mode [ 143.479579][ T7376] netlink: 'syz.0.422': attribute type 39 has an invalid length. [ 144.136551][ T5837] Bluetooth: hci1: command tx timeout [ 144.459398][ T7332] chnl_net:caif_netlink_parms(): no params data found [ 144.579778][ T7393] netlink: 'syz.0.427': attribute type 1 has an invalid length. [ 144.761781][ T7403] netlink: 'syz.0.430': attribute type 1 has an invalid length. [ 144.782998][ T7332] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.796961][ T7403] netlink: 'syz.0.430': attribute type 2 has an invalid length. [ 144.806084][ T7332] bridge0: port 1(bridge_slave_0) entered disabled state [ 144.823434][ T7332] bridge_slave_0: entered allmulticast mode [ 144.832076][ T7332] bridge_slave_0: entered promiscuous mode [ 144.844607][ T7403] __nla_validate_parse: 3 callbacks suppressed [ 144.844626][ T7403] netlink: 12 bytes leftover after parsing attributes in process `syz.0.430'. [ 144.866797][ T7332] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.879851][ T7332] bridge0: port 2(bridge_slave_1) entered disabled state [ 144.889822][ T7332] bridge_slave_1: entered allmulticast mode [ 144.908513][ T7332] bridge_slave_1: entered promiscuous mode [ 145.019889][ T13] IPVS: stop unused estimator thread 0... [ 145.067760][ T7415] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 145.091072][ T7415] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 145.106259][ T7332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 145.129154][ T7332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 145.226481][ T7332] team0: Port device team_slave_0 added [ 145.239286][ T7332] team0: Port device team_slave_1 added [ 145.246197][ T7419] netlink: 'syz.2.433': attribute type 39 has an invalid length. [ 145.330948][ T7332] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 145.339832][ T7332] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 145.400702][ T7332] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 145.426797][ T7332] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 145.434434][ T7332] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 145.461852][ T7332] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 145.586302][ T7332] hsr_slave_0: entered promiscuous mode [ 145.593076][ T7332] hsr_slave_1: entered promiscuous mode [ 145.919280][ T7442] netlink: 44 bytes leftover after parsing attributes in process `syz.5.443'. [ 146.127248][ T7446] ieee802154 phy0 wpan0: encryption failed: -22 [ 146.189902][ T7450] netlink: 36 bytes leftover after parsing attributes in process `syz.5.447'. [ 146.211567][ T7450] netlink: 'syz.5.447': attribute type 7 has an invalid length. [ 146.220628][ T5837] Bluetooth: hci1: command tx timeout [ 146.237110][ T7450] netlink: 'syz.5.447': attribute type 8 has an invalid length. [ 146.447490][ T7462] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.499455][ T7462] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.511232][ T7332] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 146.553099][ T7467] netlink: 44 bytes leftover after parsing attributes in process `syz.0.454'. [ 146.566521][ T7332] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 146.620646][ T7332] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 146.645228][ T7332] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 146.824362][ T7332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 146.872867][ T7332] 8021q: adding VLAN 0 to HW filter on device team0 [ 146.897969][ T7497] netlink: 'syz.1.456': attribute type 39 has an invalid length. [ 146.930457][ T7332] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 146.942673][ T7332] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 146.964001][ T2919] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.971927][ T2919] bridge0: port 1(bridge_slave_0) entered forwarding state [ 146.985226][ T2919] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.992503][ T2919] bridge0: port 2(bridge_slave_1) entered forwarding state [ 147.323760][ T7332] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 147.400548][ T7332] veth0_vlan: entered promiscuous mode [ 147.432152][ T7332] veth1_vlan: entered promiscuous mode [ 147.526691][ T7332] veth0_macvtap: entered promiscuous mode [ 147.550969][ T7332] veth1_macvtap: entered promiscuous mode [ 147.585216][ T7332] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 147.598807][ T7332] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 147.636440][ T7332] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.658379][ T7332] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.683677][ T7332] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.692434][ T7332] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.782219][ T7519] netlink: 4 bytes leftover after parsing attributes in process `syz.2.459'. [ 148.253266][ T2919] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 148.267386][ T7546] netlink: 44 bytes leftover after parsing attributes in process `syz.0.465'. [ 148.276483][ T2919] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 148.302880][ T5837] Bluetooth: hci1: command tx timeout [ 148.355301][ T7548] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.466'. [ 148.417292][ T7488] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 148.447753][ T7488] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 148.520400][ T7551] IPv6: sit1: Disabled Multicast RS [ 148.541772][ T7551] sit1: entered allmulticast mode [ 148.941171][ T7557] netlink: 'syz.5.469': attribute type 39 has an invalid length. [ 149.116082][ T7566] x_tables: duplicate underflow at hook 1 [ 149.283178][ T7577] netlink: 44 bytes leftover after parsing attributes in process `syz.5.477'. [ 149.287797][ T7575] netlink: 8 bytes leftover after parsing attributes in process `syz.2.475'. [ 149.302887][ T7575] netlink: 76 bytes leftover after parsing attributes in process `syz.2.475'. [ 149.316590][ T7575] Cannot find set identified by id 2 to match [ 149.435051][ T7585] netlink: 'syz.2.480': attribute type 11 has an invalid length. [ 149.474663][ T7583] ip6gretap1: entered promiscuous mode [ 149.670529][ T7492] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.718972][ T7595] netlink: 'syz.0.484': attribute type 39 has an invalid length. [ 150.242005][ T7607] __nla_validate_parse: 3 callbacks suppressed [ 150.242025][ T7607] netlink: 4 bytes leftover after parsing attributes in process `syz.0.485'. [ 150.500878][ T7620] netlink: 'syz.0.492': attribute type 3 has an invalid length. [ 150.542876][ T7620] netlink: 'syz.0.492': attribute type 1 has an invalid length. [ 150.669808][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 150.679558][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 150.689926][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 150.706323][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 150.721705][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 150.819182][ T7492] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.962392][ T7492] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.987084][ T7635] netlink: 22 bytes leftover after parsing attributes in process `syz.5.497'. [ 151.058060][ T7645] xt_l2tp: invalid flags combination: 4 [ 151.078103][ T7640] netlink: 'syz.2.496': attribute type 39 has an invalid length. [ 151.169252][ T7492] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.292381][ T7652] netlink: 12 bytes leftover after parsing attributes in process `syz.1.500'. [ 151.315185][ T7652] netlink: 60 bytes leftover after parsing attributes in process `syz.1.500'. [ 151.349102][ T7652] vlan0: entered promiscuous mode [ 151.605375][ T7663] block nbd0: server does not support multiple connections per device. [ 151.639454][ T7663] block nbd0: shutting down sockets [ 151.698567][ T7492] bridge_slave_1: left allmulticast mode [ 151.713302][ T7492] bridge_slave_1: left promiscuous mode [ 151.719144][ T7492] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.754826][ T7492] bridge_slave_0: left allmulticast mode [ 151.782973][ T7492] bridge_slave_0: left promiscuous mode [ 151.789019][ T7492] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.842177][ T7676] netlink: 4 bytes leftover after parsing attributes in process `syz.2.505'. [ 151.953301][ T7686] netlink: 4 bytes leftover after parsing attributes in process `syz.1.508'. [ 152.404588][ T7492] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 152.417318][ T7492] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 152.430972][ T7492] bond0 (unregistering): Released all slaves [ 152.456138][ T7626] chnl_net:caif_netlink_parms(): no params data found [ 152.591943][ T7675] syzkaller0: entered promiscuous mode [ 152.600991][ T7675] syzkaller0: entered allmulticast mode [ 152.781712][ T5839] Bluetooth: hci1: command tx timeout [ 152.799129][ T7699] netlink: 36 bytes leftover after parsing attributes in process `syz.1.509'. [ 152.876000][ T7701] IPVS: set_ctl: invalid protocol: 22 224.0.0.1:20000 [ 152.884704][ T7702] netlink: 'syz.2.510': attribute type 39 has an invalid length. [ 154.352689][ T7714] netlink: 36 bytes leftover after parsing attributes in process `syz.5.515'. [ 154.451318][ T7721] netlink: 24 bytes leftover after parsing attributes in process `syz.1.517'. [ 154.482667][ T7724] netlink: 'syz.0.516': attribute type 2 has an invalid length. [ 154.490461][ T7724] netlink: 12 bytes leftover after parsing attributes in process `syz.0.516'. [ 154.528302][ T7626] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.541579][ T7626] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.558832][ T7626] bridge_slave_0: entered allmulticast mode [ 154.567551][ T7626] bridge_slave_0: entered promiscuous mode [ 154.604142][ T7492] hsr_slave_0: left promiscuous mode [ 154.610703][ T7492] hsr_slave_1: left promiscuous mode [ 154.628734][ T7492] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 154.640414][ T7492] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 154.653379][ T7492] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 154.661023][ T7492] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 154.726040][ T7492] veth1_macvtap: left promiscuous mode [ 154.736363][ T7492] veth0_macvtap: left promiscuous mode [ 154.747738][ T7492] veth1_vlan: left promiscuous mode [ 154.757154][ T7492] veth0_vlan: left promiscuous mode [ 154.853253][ T5839] Bluetooth: hci1: command tx timeout [ 155.630418][ T7492] team0 (unregistering): Port device team_slave_1 removed [ 155.670075][ T7492] team0 (unregistering): Port device team_slave_0 removed [ 156.088207][ T7626] bridge0: port 2(bridge_slave_1) entered blocking state [ 156.103026][ T7626] bridge0: port 2(bridge_slave_1) entered disabled state [ 156.110787][ T7626] bridge_slave_1: entered allmulticast mode [ 156.125573][ T7626] bridge_slave_1: entered promiscuous mode [ 156.249023][ T7626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 156.291390][ T7626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 156.309325][ T7752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 156.313471][ T7751] netlink: 'syz.2.523': attribute type 4 has an invalid length. [ 156.328806][ T7752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 156.417530][ T7753] __nla_validate_parse: 1 callbacks suppressed [ 156.417550][ T7753] netlink: 4 bytes leftover after parsing attributes in process `syz.2.523'. [ 156.551506][ T7626] team0: Port device team_slave_0 added [ 156.561751][ T7626] team0: Port device team_slave_1 added [ 156.578173][ T7758] netlink: 'syz.0.525': attribute type 39 has an invalid length. [ 156.641601][ T7626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 156.663080][ T7626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 156.691788][ T7626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 156.737442][ T7626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 156.746274][ T7626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 156.774812][ T7626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 156.931458][ T7626] hsr_slave_0: entered promiscuous mode [ 156.938177][ T5839] Bluetooth: hci1: command tx timeout [ 156.958625][ T7626] hsr_slave_1: entered promiscuous mode [ 156.988200][ T7763] netlink: 'syz.2.527': attribute type 1 has an invalid length. [ 157.001527][ T7763] netlink: 1 bytes leftover after parsing attributes in process `syz.2.527'. [ 157.048820][ T7763] netlink: 24 bytes leftover after parsing attributes in process `syz.2.527'. [ 157.061175][ T7763] tipc: Started in network mode [ 157.069603][ T7763] tipc: Node identity 7, cluster identity 3 [ 157.079042][ T7763] tipc: Node number set to 7 [ 157.672620][ T7789] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 157.704718][ T7789] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 157.759224][ T7794] smc: net device bond0 applied user defined pnetid SYZ2 [ 157.769764][ T7794] netlink: 'syz.0.539': attribute type 1 has an invalid length. [ 157.778748][ T7794] netlink: 224 bytes leftover after parsing attributes in process `syz.0.539'. [ 157.895683][ T5914] hid-generic 0005:0C45:0A0F.0001: item fetching failed at offset 0/2 [ 157.908024][ T5914] hid-generic 0005:0C45:0A0F.0001: probe with driver hid-generic failed with error -22 [ 158.142594][ T7626] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 158.158483][ T7626] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 158.186237][ T7626] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 158.210708][ T7626] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 158.330350][ T7816] netlink: 'syz.2.543': attribute type 39 has an invalid length. [ 158.377313][ T7819] netlink: 4 bytes leftover after parsing attributes in process `syz.0.545'. [ 158.395125][ T7626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 158.449845][ T7823] netlink: 4 bytes leftover after parsing attributes in process `syz.1.544'. [ 158.485023][ T7626] 8021q: adding VLAN 0 to HW filter on device team0 [ 158.518412][ T7504] bridge0: port 1(bridge_slave_0) entered blocking state [ 158.525761][ T7504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 158.547896][ T7488] bridge0: port 2(bridge_slave_1) entered blocking state [ 158.555263][ T7488] bridge0: port 2(bridge_slave_1) entered forwarding state [ 158.676554][ T7830] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 158.956554][ T7845] netlink: 'syz.1.549': attribute type 39 has an invalid length. [ 159.014183][ T5839] Bluetooth: hci1: command tx timeout [ 159.023010][ T7849] netlink: 8 bytes leftover after parsing attributes in process `syz.5.551'. [ 159.066672][ T7626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 159.165534][ T7626] veth0_vlan: entered promiscuous mode [ 159.207415][ T7626] veth1_vlan: entered promiscuous mode [ 159.273786][ T7626] veth0_macvtap: entered promiscuous mode [ 159.311397][ T7858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.553'. [ 159.320934][ T7626] veth1_macvtap: entered promiscuous mode [ 159.351956][ T7858] netlink: 48 bytes leftover after parsing attributes in process `syz.2.553'. [ 159.368893][ T7626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 159.371116][ T7858] netlink: 100 bytes leftover after parsing attributes in process `syz.2.553'. [ 159.408436][ T7626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 159.442103][ T7626] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.460529][ T7626] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.469479][ T7626] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.484391][ T7626] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.545786][ T7861] netlink: 'syz.5.555': attribute type 1 has an invalid length. [ 159.555108][ T7863] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 159.564159][ T7863] macvtap1: entered allmulticast mode [ 159.569720][ T7863] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 159.580726][ T7863] batman_adv: batadv0: Adding interface: macvtap1 [ 159.587693][ T7863] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 159.615666][ T7863] batman_adv: batadv0: Interface activated: macvtap1 [ 159.773605][ T7490] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 159.781465][ T7490] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 159.905008][ T7488] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 159.944461][ T7488] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 160.030585][ T7880] vlan2: entered promiscuous mode [ 160.040538][ T7880] bond0: entered promiscuous mode [ 160.047649][ T7880] bond_slave_0: entered promiscuous mode [ 160.054239][ T7880] bond_slave_1: entered promiscuous mode [ 160.068886][ T7880] vlan2: entered allmulticast mode [ 160.082994][ T7880] bond0: entered allmulticast mode [ 160.098851][ T7880] bond_slave_0: entered allmulticast mode [ 160.116105][ T7880] bond_slave_1: entered allmulticast mode [ 160.234097][ T7889] netlink: 'syz.0.564': attribute type 39 has an invalid length. [ 160.541957][ T7902] netlink: 'syz.5.568': attribute type 10 has an invalid length. [ 160.568655][ T7902] mac80211_hwsim hwsim14 wlan1: entered promiscuous mode [ 160.577108][ T7902] mac80211_hwsim hwsim14 wlan1: entered allmulticast mode [ 160.585346][ T7902] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 160.600782][ T7901] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 160.620062][ T7904] dummy0: entered promiscuous mode [ 160.756016][ T7909] netlink: 'syz.1.571': attribute type 1 has an invalid length. [ 160.802168][ T7909] vxcan1: entered allmulticast mode [ 160.862793][ T7910] vxcan1: entered allmulticast mode [ 161.083707][ T7489] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.420622][ T7928] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 161.438299][ T7926] __nla_validate_parse: 8 callbacks suppressed [ 161.438321][ T7926] netlink: 8 bytes leftover after parsing attributes in process `syz.5.576'. [ 161.473091][ T7928] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 161.561837][ T7930] netlink: 'syz.5.577': attribute type 64 has an invalid length. [ 161.574426][ T7930] netlink: 4 bytes leftover after parsing attributes in process `syz.5.577'. [ 161.880935][ T5837] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 161.902670][ T5837] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 161.917203][ T5837] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 161.930256][ T5837] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 161.938552][ T5837] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 161.973912][ T7489] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.991166][ T7939] netlink: 96 bytes leftover after parsing attributes in process `syz.2.579'. [ 162.130768][ T7945] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 162.149124][ T7489] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.157760][ T7946] netlink: 44 bytes leftover after parsing attributes in process `syz.5.580'. [ 162.187798][ T7945] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 162.345951][ T7489] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.380591][ T7953] IPVS: sync thread started: state = BACKUP, mcast_ifn = team0, syncid = 0, id = 0 [ 162.405762][ T7955] netlink: 8 bytes leftover after parsing attributes in process `syz.0.583'. [ 162.414842][ T7955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.583'. [ 162.430939][ T7955] netlink: 'syz.0.583': attribute type 13 has an invalid length. [ 162.485588][ T7951] bridge_slave_0: left allmulticast mode [ 162.491949][ T7951] bridge_slave_0: left promiscuous mode [ 162.499309][ T7951] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.725156][ T7951] bridge_slave_1: left allmulticast mode [ 162.731112][ T7951] bridge_slave_1: left promiscuous mode [ 162.744030][ T7951] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.804823][ T7951] bond0: (slave bond_slave_0): Releasing backup interface [ 162.818329][ T7951] bond_slave_0: left promiscuous mode [ 162.835126][ T7951] bond_slave_0: left allmulticast mode [ 162.863826][ T7951] bond0: (slave bond_slave_1): Releasing backup interface [ 162.899879][ T7951] bond_slave_1: left promiscuous mode [ 162.906930][ T7951] bond_slave_1: left allmulticast mode [ 162.984198][ T7951] team0: Port device team_slave_0 removed [ 163.001573][ T7951] team0: Port device team_slave_1 removed [ 163.014255][ T7951] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 163.026327][ T7951] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 163.035197][ T7965] netlink: 'syz.2.585': attribute type 39 has an invalid length. [ 163.047348][ T7951] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 163.055751][ T7951] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 163.085277][ T7951] bond0: (slave wlan1): Releasing backup interface [ 163.099938][ T7951] mac80211_hwsim hwsim14 wlan1: left promiscuous mode [ 163.119112][ T7951] mac80211_hwsim hwsim14 wlan1: left allmulticast mode [ 163.142164][ T7951] bond1: (slave ip6gretap1): Releasing backup interface [ 163.151270][ T7951] bond1: (slave ip6gretap1): the permanent HWaddr of slave - 62:e7:33:57:89:8d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 163.182283][ T7951] bond1: (slave veth3): Releasing backup interface [ 163.275348][ T7967] netlink: 'syz.1.586': attribute type 30 has an invalid length. [ 163.331673][ T7967] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 163.557411][ T7979] veth0: entered promiscuous mode [ 163.595158][ T7489] bridge_slave_1: left allmulticast mode [ 163.610814][ T7979] netlink: 4 bytes leftover after parsing attributes in process `syz.5.588'. [ 163.627502][ T7489] bridge_slave_1: left promiscuous mode [ 163.637124][ T7489] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.682415][ T7976] netlink: 4 bytes leftover after parsing attributes in process `syz.5.588'. [ 163.701292][ T7489] bridge_slave_0: left allmulticast mode [ 163.712366][ T7489] bridge_slave_0: left promiscuous mode [ 163.749121][ T7489] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.861004][ T7994] netlink: 44 bytes leftover after parsing attributes in process `syz.2.593'. [ 163.974650][ T5839] Bluetooth: hci1: command tx timeout [ 164.034875][ T7998] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 164.112000][ T7998] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 164.221503][ T7989] netlink: 'syz.0.590': attribute type 4 has an invalid length. [ 164.496652][ T7489] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 164.510278][ T7489] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 164.520829][ T7489] bond0 (unregistering): Released all slaves [ 164.614377][ T7940] chnl_net:caif_netlink_parms(): no params data found [ 164.687290][ T8011] sit0: left promiscuous mode [ 164.736627][ T8015] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 164.745352][ T5914] IPVS: starting estimator thread 0... [ 164.842944][ T8017] IPVS: using max 24 ests per chain, 57600 per kthread [ 164.929709][ T8011] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 164.940749][ T8011] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 164.949989][ T8011] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 164.991701][ T8011] ip6gretap1: left promiscuous mode [ 164.998965][ T8011] batman_adv: batadv0: Interface deactivated: macvtap1 [ 165.008465][ T8011] mac80211_hwsim hwsim4 wlan0: left allmulticast mode [ 165.017474][ T8011] macvtap1: left allmulticast mode [ 165.098892][ T8021] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (64) [ 165.155274][ T8021] delete_channel: no stack [ 165.394915][ T7489] hsr_slave_0: left promiscuous mode [ 165.429108][ T7489] hsr_slave_1: left promiscuous mode [ 165.445082][ T7489] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 165.456947][ T7489] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 165.473769][ T7489] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 165.502409][ T7489] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 165.596950][ T8048] netlink: 'syz.1.604': attribute type 4 has an invalid length. [ 165.613650][ T8048] netlink: 24 bytes leftover after parsing attributes in process `syz.1.604'. [ 165.688486][ T7489] veth1_macvtap: left promiscuous mode [ 165.696209][ T7489] veth0_macvtap: left promiscuous mode [ 165.701938][ T7489] veth1_vlan: left promiscuous mode [ 165.707933][ T7489] veth0_vlan: left promiscuous mode [ 166.054201][ T5839] Bluetooth: hci1: command tx timeout [ 166.386901][ T7489] team0 (unregistering): Port device team_slave_1 removed [ 166.435060][ T7489] team0 (unregistering): Port device team_slave_0 removed [ 166.901800][ T7940] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.909298][ T7940] bridge0: port 1(bridge_slave_0) entered disabled state [ 166.916914][ T7940] bridge_slave_0: entered allmulticast mode [ 166.925187][ T7940] bridge_slave_0: entered promiscuous mode [ 166.935745][ T8050] netlink: 16 bytes leftover after parsing attributes in process `syz.2.607'. [ 166.970434][ T7940] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.987682][ T7940] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.023321][ T7940] bridge_slave_1: entered allmulticast mode [ 167.031330][ T7940] bridge_slave_1: entered promiscuous mode [ 167.216020][ T7940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 167.271040][ T7940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 167.474387][ T8068] netlink: 16 bytes leftover after parsing attributes in process `syz.0.612'. [ 167.481635][ T7940] team0: Port device team_slave_0 added [ 167.496561][ T8065] netlink: 56 bytes leftover after parsing attributes in process `syz.1.613'. [ 167.522415][ T7940] team0: Port device team_slave_1 added [ 167.621518][ T8068] netlink: 28 bytes leftover after parsing attributes in process `syz.0.612'. [ 167.660253][ T8068] netlink: 28 bytes leftover after parsing attributes in process `syz.0.612'. [ 167.698671][ T8068] batadv0: entered promiscuous mode [ 167.705542][ T8068] bond0: entered promiscuous mode [ 167.711445][ T8077] xt_TPROXY: Can be used only with -p tcp or -p udp [ 167.718387][ T8068] bond_slave_0: entered promiscuous mode [ 167.730358][ T8068] bond_slave_1: entered promiscuous mode [ 167.741305][ T8068] mac80211_hwsim hwsim8 wlan1: entered promiscuous mode [ 167.751539][ T8068] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 167.769585][ T8068] Cannot create hsr debugfs directory [ 167.781760][ T8068] hsr1: Slave A (batadv0) is not up; please bring it up to get a fully working HSR network [ 167.793067][ T8068] hsr1: Slave B (bond0) is not up; please bring it up to get a fully working HSR network [ 167.804271][ T8068] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 167.847244][ T8091] netlink: 'syz.5.618': attribute type 3 has an invalid length. [ 167.870517][ T7940] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 167.882807][ T7940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 167.911910][ T7940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 167.940051][ T7940] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 167.957765][ T7940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 168.008837][ T7940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 168.063796][ T8091] batadv1: entered promiscuous mode [ 168.070419][ T8091] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 168.085310][ T8088] delete_channel: no stack [ 168.133371][ T5839] Bluetooth: hci1: command tx timeout [ 168.301871][ T7940] hsr_slave_0: entered promiscuous mode [ 168.331547][ T7940] hsr_slave_1: entered promiscuous mode [ 168.626555][ T8117] FAULT_INJECTION: forcing a failure. [ 168.626555][ T8117] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 168.644731][ T8117] CPU: 1 UID: 0 PID: 8117 Comm: syz.5.626 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 168.644762][ T8117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 168.644775][ T8117] Call Trace: [ 168.644783][ T8117] [ 168.644793][ T8117] dump_stack_lvl+0x189/0x250 [ 168.644833][ T8117] ? __pfx____ratelimit+0x10/0x10 [ 168.644868][ T8117] ? __pfx_dump_stack_lvl+0x10/0x10 [ 168.644902][ T8117] ? __pfx__printk+0x10/0x10 [ 168.644925][ T8117] ? __might_fault+0xb0/0x130 [ 168.644969][ T8117] should_fail_ex+0x414/0x560 [ 168.645001][ T8117] _copy_from_user+0x2d/0xb0 [ 168.645024][ T8117] ___sys_sendmsg+0x158/0x2a0 [ 168.645049][ T8117] ? __pfx____sys_sendmsg+0x10/0x10 [ 168.645115][ T8117] ? __fget_files+0x2a/0x420 [ 168.645146][ T8117] ? __fget_files+0x3a0/0x420 [ 168.645190][ T8117] __x64_sys_sendmsg+0x19b/0x260 [ 168.645215][ T8117] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 168.645248][ T8117] ? __pfx_ksys_write+0x10/0x10 [ 168.645273][ T8117] ? rcu_is_watching+0x15/0xb0 [ 168.645309][ T8117] ? do_syscall_64+0xbe/0x3b0 [ 168.645341][ T8117] do_syscall_64+0xfa/0x3b0 [ 168.645366][ T8117] ? lockdep_hardirqs_on+0x9c/0x150 [ 168.645391][ T8117] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.645412][ T8117] ? clear_bhb_loop+0x60/0xb0 [ 168.645438][ T8117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 168.645459][ T8117] RIP: 0033:0x7ff4ceb8e969 [ 168.645478][ T8117] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 168.645495][ T8117] RSP: 002b:00007ff4cf9f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 168.645517][ T8117] RAX: ffffffffffffffda RBX: 00007ff4cedb5fa0 RCX: 00007ff4ceb8e969 [ 168.645533][ T8117] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 168.645545][ T8117] RBP: 00007ff4cf9f0090 R08: 0000000000000000 R09: 0000000000000000 [ 168.645558][ T8117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 168.645570][ T8117] R13: 0000000000000000 R14: 00007ff4cedb5fa0 R15: 00007fff87aee978 [ 168.645604][ T8117] [ 169.227249][ T8133] IPVS: sync thread started: state = BACKUP, mcast_ifn = team0, syncid = 0, id = 0 [ 169.252000][ T8132] netlink: 28 bytes leftover after parsing attributes in process `syz.2.630'. [ 169.291678][ T8135] netlink: 'syz.5.631': attribute type 33 has an invalid length. [ 169.309176][ T8136] netlink: 'syz.5.631': attribute type 33 has an invalid length. [ 169.440491][ T8139] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.471556][ T8138] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.518635][ T8138] netlink: 12 bytes leftover after parsing attributes in process `syz.1.632'. [ 169.570511][ T8145] netlink: 224 bytes leftover after parsing attributes in process `syz.1.632'. [ 169.580611][ T8139] netlink: 224 bytes leftover after parsing attributes in process `syz.1.632'. [ 169.604222][ T8138] netlink: 12 bytes leftover after parsing attributes in process `syz.1.632'. [ 169.961483][ T7940] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 170.006698][ T8164] FAULT_INJECTION: forcing a failure. [ 170.006698][ T8164] name failslab, interval 1, probability 0, space 0, times 1 [ 170.081141][ T8164] CPU: 0 UID: 0 PID: 8164 Comm: syz.5.639 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 170.081175][ T8164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 170.081188][ T8164] Call Trace: [ 170.081199][ T8164] [ 170.081209][ T8164] dump_stack_lvl+0x189/0x250 [ 170.081248][ T8164] ? __pfx____ratelimit+0x10/0x10 [ 170.081275][ T8164] ? __pfx_dump_stack_lvl+0x10/0x10 [ 170.081309][ T8164] ? __pfx__printk+0x10/0x10 [ 170.081338][ T8164] ? __pfx___might_resched+0x10/0x10 [ 170.081375][ T8164] should_fail_ex+0x414/0x560 [ 170.081409][ T8164] should_failslab+0xa8/0x100 [ 170.081443][ T8164] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 170.081476][ T8164] ? __alloc_skb+0x112/0x2d0 [ 170.081511][ T8164] __alloc_skb+0x112/0x2d0 [ 170.081547][ T8164] netlink_sendmsg+0x5c6/0xb30 [ 170.081576][ T8164] ? __pfx_netlink_sendmsg+0x10/0x10 [ 170.081597][ T8164] ? aa_sock_msg_perm+0x94/0x160 [ 170.081625][ T8164] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 170.081649][ T8164] ? __pfx_netlink_sendmsg+0x10/0x10 [ 170.081669][ T8164] __sock_sendmsg+0x219/0x270 [ 170.081699][ T8164] ____sys_sendmsg+0x505/0x830 [ 170.081726][ T8164] ? __pfx_____sys_sendmsg+0x10/0x10 [ 170.081755][ T8164] ? import_iovec+0x74/0xa0 [ 170.081808][ T8164] ___sys_sendmsg+0x21f/0x2a0 [ 170.081969][ T8164] ? __pfx____sys_sendmsg+0x10/0x10 [ 170.082034][ T8164] ? __fget_files+0x2a/0x420 [ 170.082066][ T8164] ? __fget_files+0x3a0/0x420 [ 170.082109][ T8164] __x64_sys_sendmsg+0x19b/0x260 [ 170.082135][ T8164] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 170.082166][ T8164] ? __pfx_ksys_write+0x10/0x10 [ 170.082200][ T8164] ? do_syscall_64+0xbe/0x3b0 [ 170.082232][ T8164] do_syscall_64+0xfa/0x3b0 [ 170.082259][ T8164] ? lockdep_hardirqs_on+0x9c/0x150 [ 170.082283][ T8164] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.082304][ T8164] ? clear_bhb_loop+0x60/0xb0 [ 170.082330][ T8164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.082351][ T8164] RIP: 0033:0x7ff4ceb8e969 [ 170.082371][ T8164] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 170.082389][ T8164] RSP: 002b:00007ff4cf9f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 170.082411][ T8164] RAX: ffffffffffffffda RBX: 00007ff4cedb5fa0 RCX: 00007ff4ceb8e969 [ 170.082427][ T8164] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 170.082441][ T8164] RBP: 00007ff4cf9f0090 R08: 0000000000000000 R09: 0000000000000000 [ 170.082454][ T8164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 170.082466][ T8164] R13: 0000000000000000 R14: 00007ff4cedb5fa0 R15: 00007fff87aee978 [ 170.082499][ T8164] [ 170.377746][ T7940] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 170.394431][ T7940] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 170.431026][ T8144] netlink: 'syz.2.633': attribute type 4 has an invalid length. [ 170.447634][ T7940] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 170.472107][ T5839] Bluetooth: hci1: command tx timeout [ 170.886884][ T8189] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 171.014196][ T7940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 171.121272][ T7940] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.204525][ T7489] bridge0: port 1(bridge_slave_0) entered blocking state [ 171.211721][ T7489] bridge0: port 1(bridge_slave_0) entered forwarding state [ 171.275286][ T8207] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 171.316916][ T7489] bridge0: port 2(bridge_slave_1) entered blocking state [ 171.324173][ T7489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 171.351445][ T8207] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 171.969358][ T8232] team0 (unregistering): Port device team_slave_0 removed [ 171.987136][ T8232] team0 (unregistering): Port device team_slave_1 removed [ 172.069366][ T7940] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 172.157551][ T8249] smc: net device bond0 erased user defined pnetid SYZ2 [ 172.258364][ T8254] IPVS: Unknown mcast interface: vlan0 [ 172.275339][ T7940] veth0_vlan: entered promiscuous mode [ 172.287998][ T8258] FAULT_INJECTION: forcing a failure. [ 172.287998][ T8258] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 172.310826][ T7940] veth1_vlan: entered promiscuous mode [ 172.319099][ T8258] CPU: 0 UID: 0 PID: 8258 Comm: syz.1.664 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 172.319129][ T8258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 172.319140][ T8258] Call Trace: [ 172.319147][ T8258] [ 172.319156][ T8258] dump_stack_lvl+0x189/0x250 [ 172.319194][ T8258] ? __pfx____ratelimit+0x10/0x10 [ 172.319221][ T8258] ? __pfx_dump_stack_lvl+0x10/0x10 [ 172.319254][ T8258] ? __pfx__printk+0x10/0x10 [ 172.319278][ T8258] ? __might_fault+0xb0/0x130 [ 172.319322][ T8258] should_fail_ex+0x414/0x560 [ 172.319353][ T8258] _copy_from_iter+0x1db/0x16f0 [ 172.319388][ T8258] ? rcu_is_watching+0x15/0xb0 [ 172.319418][ T8258] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 172.319449][ T8258] ? __pfx__copy_from_iter+0x10/0x10 [ 172.319480][ T8258] ? __build_skb_around+0x257/0x3e0 [ 172.319522][ T8258] ? netlink_sendmsg+0x642/0xb30 [ 172.319539][ T8258] ? skb_put+0x11b/0x210 [ 172.319573][ T8258] netlink_sendmsg+0x6b2/0xb30 [ 172.319602][ T8258] ? __pfx_netlink_sendmsg+0x10/0x10 [ 172.319623][ T8258] ? aa_sock_msg_perm+0x94/0x160 [ 172.319651][ T8258] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 172.319674][ T8258] ? __pfx_netlink_sendmsg+0x10/0x10 [ 172.319693][ T8258] __sock_sendmsg+0x219/0x270 [ 172.319721][ T8258] ____sys_sendmsg+0x505/0x830 [ 172.319746][ T8258] ? __pfx_____sys_sendmsg+0x10/0x10 [ 172.319784][ T8258] ? import_iovec+0x74/0xa0 [ 172.319807][ T8258] ___sys_sendmsg+0x21f/0x2a0 [ 172.319831][ T8258] ? __pfx____sys_sendmsg+0x10/0x10 [ 172.319894][ T8258] ? __fget_files+0x2a/0x420 [ 172.319925][ T8258] ? __fget_files+0x3a0/0x420 [ 172.319968][ T8258] __x64_sys_sendmsg+0x19b/0x260 [ 172.319993][ T8258] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 172.320026][ T8258] ? __pfx_ksys_write+0x10/0x10 [ 172.320051][ T8258] ? rcu_is_watching+0x15/0xb0 [ 172.320087][ T8258] ? do_syscall_64+0xbe/0x3b0 [ 172.320118][ T8258] do_syscall_64+0xfa/0x3b0 [ 172.320143][ T8258] ? lockdep_hardirqs_on+0x9c/0x150 [ 172.320168][ T8258] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.320188][ T8258] ? clear_bhb_loop+0x60/0xb0 [ 172.320214][ T8258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.320234][ T8258] RIP: 0033:0x7fa23278e969 [ 172.320253][ T8258] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 172.320271][ T8258] RSP: 002b:00007fa233578038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 172.320294][ T8258] RAX: ffffffffffffffda RBX: 00007fa2329b5fa0 RCX: 00007fa23278e969 [ 172.320309][ T8258] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 172.320322][ T8258] RBP: 00007fa233578090 R08: 0000000000000000 R09: 0000000000000000 [ 172.320335][ T8258] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 172.320347][ T8258] R13: 0000000000000000 R14: 00007fa2329b5fa0 R15: 00007fffcd4033d8 [ 172.320380][ T8258] [ 172.321110][ T8254] __nla_validate_parse: 4 callbacks suppressed [ 172.321126][ T8254] netlink: 8 bytes leftover after parsing attributes in process `syz.5.663'. [ 172.619571][ T8266] netlink: 48 bytes leftover after parsing attributes in process `syz.2.665'. [ 172.957681][ T8270] netlink: 4 bytes leftover after parsing attributes in process `syz.0.666'. [ 173.062398][ T7940] veth0_macvtap: entered promiscuous mode [ 173.065344][ T8281] netlink: 8 bytes leftover after parsing attributes in process `syz.5.669'. [ 173.111066][ T7940] veth1_macvtap: entered promiscuous mode [ 173.265145][ T8284] netlink: 'syz.5.670': attribute type 1 has an invalid length. [ 173.276694][ T8284] netlink: 'syz.5.670': attribute type 4 has an invalid length. [ 173.287387][ T8284] netlink: 9462 bytes leftover after parsing attributes in process `syz.5.670'. [ 173.306817][ T7940] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 173.323464][ T8285] netlink: 68 bytes leftover after parsing attributes in process `syz.5.670'. [ 173.345609][ T8287] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 173.367928][ T8287] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 173.379457][ T7940] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 173.408510][ T7940] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.438781][ T7940] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.460751][ T7940] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.481082][ T7940] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.517383][ T8291] netlink: 8 bytes leftover after parsing attributes in process `syz.5.672'. [ 173.848903][ T7490] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.884157][ T7490] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.969340][ T7504] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 174.010327][ T7504] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 174.268060][ T8313] wireguard0: entered promiscuous mode [ 174.296079][ T8313] wireguard0: entered allmulticast mode [ 174.394496][ T8327] netlink: 'syz.5.681': attribute type 39 has an invalid length. [ 174.564239][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 174.600300][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 174.619393][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 174.793641][ T8336] netlink: 4 bytes leftover after parsing attributes in process `syz.2.683'. [ 174.821503][ T7504] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.077278][ T7504] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.185194][ T7504] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.223388][ T8329] infiniband syz2: set down [ 175.227993][ T8329] infiniband syz2: added vxcan1 [ 175.246612][ T10] vxcan1 speed is unknown, defaulting to 1000 [ 175.290618][ T8329] RDS/IB: syz2: added [ 175.300904][ T8329] smc: adding ib device syz2 with port count 1 [ 175.317416][ T8329] smc: ib device syz2 port 1 has pnetid [ 175.329452][ T7504] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.352670][ T10] vxcan1 speed is unknown, defaulting to 1000 [ 175.359526][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 175.593013][ T7504] bridge_slave_1: left allmulticast mode [ 175.598890][ T7504] bridge_slave_1: left promiscuous mode [ 175.619130][ T7504] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.692278][ T7504] bridge_slave_0: left allmulticast mode [ 175.721510][ T7504] bridge_slave_0: left promiscuous mode [ 175.750191][ T7504] bridge0: port 1(bridge_slave_0) entered disabled state [ 175.756900][ T8357] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 175.795587][ T8356] netlink: 8 bytes leftover after parsing attributes in process `syz.5.690'. [ 175.818414][ T8356] netlink: 8 bytes leftover after parsing attributes in process `syz.5.690'. [ 175.870076][ T8355] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 176.156305][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 176.171983][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 176.195700][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 176.205114][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 176.215096][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 176.391772][ T7504] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 176.425973][ T7504] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 176.438844][ T7504] bond0 (unregistering): Released all slaves [ 176.611643][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 176.997515][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 177.224429][ T8372] netlink: 'syz.1.696': attribute type 39 has an invalid length. [ 177.287796][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 177.379423][ T8377] netlink: 'syz.0.698': attribute type 10 has an invalid length. [ 177.450116][ T8381] __nla_validate_parse: 3 callbacks suppressed [ 177.450139][ T8381] netlink: 8 bytes leftover after parsing attributes in process `syz.0.698'. [ 177.488727][ T8381] netlink: 8 bytes leftover after parsing attributes in process `syz.0.698'. [ 177.537471][ T8381] netlink: 14 bytes leftover after parsing attributes in process `syz.0.698'. [ 177.591605][ T8382] netlink: 16 bytes leftover after parsing attributes in process `syz.5.697'. [ 178.081843][ T8381] bond0 (unregistering): left promiscuous mode [ 178.099049][ T8381] bond_slave_0: left promiscuous mode [ 178.113303][ T8381] bond_slave_1: left promiscuous mode [ 178.119057][ T8381] mac80211_hwsim hwsim8 wlan1: left promiscuous mode [ 178.223472][ T8381] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 178.253363][ T8381] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 178.305276][ T8381] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 178.313825][ T5837] Bluetooth: hci1: command tx timeout [ 178.327387][ T8381] bond0 (unregistering): Released all slaves [ 178.374568][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 178.797471][ T8329] vxcan1 speed is unknown, defaulting to 1000 [ 178.927644][ T8394] FAULT_INJECTION: forcing a failure. [ 178.927644][ T8394] name failslab, interval 1, probability 0, space 0, times 0 [ 178.949616][ T8394] CPU: 1 UID: 0 PID: 8394 Comm: syz.1.700 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 178.949649][ T8394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 178.949663][ T8394] Call Trace: [ 178.949671][ T8394] [ 178.949681][ T8394] dump_stack_lvl+0x189/0x250 [ 178.949720][ T8394] ? __pfx____ratelimit+0x10/0x10 [ 178.949747][ T8394] ? __pfx_dump_stack_lvl+0x10/0x10 [ 178.949781][ T8394] ? __pfx__printk+0x10/0x10 [ 178.949812][ T8394] ? __pfx___might_resched+0x10/0x10 [ 178.949841][ T8394] ? fs_reclaim_acquire+0x7d/0x100 [ 178.949870][ T8394] should_fail_ex+0x414/0x560 [ 178.949904][ T8394] should_failslab+0xa8/0x100 [ 178.949938][ T8394] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 178.949969][ T8394] ? __alloc_skb+0x112/0x2d0 [ 178.950005][ T8394] __alloc_skb+0x112/0x2d0 [ 178.950042][ T8394] netlink_ack+0x146/0xa50 [ 178.950071][ T8394] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 178.950100][ T8394] ? ref_tracker_free+0x63a/0x7d0 [ 178.950126][ T8394] ? __copy_skb_header+0xa7/0x550 [ 178.950158][ T8394] ? __pfx_ref_tracker_free+0x10/0x10 [ 178.950186][ T8394] ? __skb_clone+0x63/0x7a0 [ 178.950217][ T8394] netlink_rcv_skb+0x28c/0x470 [ 178.950250][ T8394] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 178.950282][ T8394] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 178.950330][ T8394] ? netlink_deliver_tap+0x2e/0x1b0 [ 178.950361][ T8394] ? netlink_deliver_tap+0x2e/0x1b0 [ 178.950400][ T8394] netlink_unicast+0x758/0x8d0 [ 178.950442][ T8394] netlink_sendmsg+0x805/0xb30 [ 178.950472][ T8394] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.950496][ T8394] ? aa_sock_msg_perm+0x94/0x160 [ 178.950525][ T8394] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 178.950550][ T8394] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.950570][ T8394] __sock_sendmsg+0x219/0x270 [ 178.950600][ T8394] ____sys_sendmsg+0x505/0x830 [ 178.950628][ T8394] ? __pfx_____sys_sendmsg+0x10/0x10 [ 178.950659][ T8394] ? import_iovec+0x74/0xa0 [ 178.950685][ T8394] ___sys_sendmsg+0x21f/0x2a0 [ 178.950708][ T8394] ? __pfx____sys_sendmsg+0x10/0x10 [ 178.950772][ T8394] ? __fget_files+0x2a/0x420 [ 178.950803][ T8394] ? __fget_files+0x3a0/0x420 [ 178.950846][ T8394] __x64_sys_sendmsg+0x19b/0x260 [ 178.950875][ T8394] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 178.950908][ T8394] ? __pfx_ksys_write+0x10/0x10 [ 178.950942][ T8394] ? do_syscall_64+0xbe/0x3b0 [ 178.950974][ T8394] do_syscall_64+0xfa/0x3b0 [ 178.950999][ T8394] ? lockdep_hardirqs_on+0x9c/0x150 [ 178.951023][ T8394] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.951044][ T8394] ? clear_bhb_loop+0x60/0xb0 [ 178.951070][ T8394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.951090][ T8394] RIP: 0033:0x7fa23278e969 [ 178.951109][ T8394] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 178.951127][ T8394] RSP: 002b:00007fa233578038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 178.951158][ T8394] RAX: ffffffffffffffda RBX: 00007fa2329b5fa0 RCX: 00007fa23278e969 [ 178.951174][ T8394] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 178.951187][ T8394] RBP: 00007fa233578090 R08: 0000000000000000 R09: 0000000000000000 [ 178.951200][ T8394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 178.951211][ T8394] R13: 0000000000000000 R14: 00007fa2329b5fa0 R15: 00007fffcd4033d8 [ 178.951245][ T8394] [ 179.291330][ T7490] smc: removing ib device syz2 [ 179.716064][ T8404] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 179.791281][ T8403] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 180.077315][ T8359] chnl_net:caif_netlink_parms(): no params data found [ 180.383135][ T5837] Bluetooth: hci1: command tx timeout [ 180.436210][ T8414] openvswitch: netlink: Flow key attr not present in new flow. [ 180.445177][ T8414] netlink: 356 bytes leftover after parsing attributes in process `syz.0.704'. [ 180.656551][ T8359] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.673003][ T8359] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.680304][ T8359] bridge_slave_0: entered allmulticast mode [ 180.738827][ T8359] bridge_slave_0: entered promiscuous mode [ 180.765888][ T8359] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.800409][ T8359] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.814095][ T8359] bridge_slave_1: entered allmulticast mode [ 180.850256][ T8359] bridge_slave_1: entered promiscuous mode [ 181.287443][ T8421] wireguard0: entered promiscuous mode [ 181.297838][ T8421] wireguard0: entered allmulticast mode [ 181.389282][ T7504] hsr_slave_0: left promiscuous mode [ 181.401321][ T7504] hsr_slave_1: left promiscuous mode [ 181.408434][ T7504] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 181.417970][ T7504] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 181.438761][ T7504] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 181.447489][ T7504] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 181.475156][ T7504] veth1_macvtap: left promiscuous mode [ 181.480886][ T7504] veth0_macvtap: left promiscuous mode [ 181.487805][ T7504] veth1_vlan: left promiscuous mode [ 181.499704][ T7504] veth0_vlan: left promiscuous mode [ 181.982151][ T7504] team0 (unregistering): Port device team_slave_1 removed [ 182.025723][ T7504] team0 (unregistering): Port device team_slave_0 removed [ 182.438845][ T8359] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 182.452511][ T8359] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 182.461707][ T5837] Bluetooth: hci1: command tx timeout [ 182.523656][ T8429] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.613449][ T8359] team0: Port device team_slave_0 added [ 182.675964][ T8429] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.701247][ T8359] team0: Port device team_slave_1 added [ 182.787728][ T8429] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.809663][ T8359] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 182.816883][ T8359] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 182.843552][ T8359] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 182.857009][ T8359] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 182.864682][ T8359] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 182.922747][ T8359] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 182.981911][ T8429] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.084953][ T8440] netlink: 'syz.2.709': attribute type 39 has an invalid length. [ 183.122421][ T8359] hsr_slave_0: entered promiscuous mode [ 183.130343][ T8359] hsr_slave_1: entered promiscuous mode [ 183.269903][ T8429] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 183.318159][ T8429] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 183.356004][ T8429] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 183.377514][ T8429] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 183.632147][ T8455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.664680][ T8454] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.804320][ T8460] pim6reg: entered allmulticast mode [ 183.882687][ T8462] pim6reg: left allmulticast mode [ 183.933665][ T8466] netlink: 'syz.0.717': attribute type 4 has an invalid length. [ 183.967822][ T8466] lo speed is unknown, defaulting to 1000 [ 183.993622][ T8466] lo speed is unknown, defaulting to 1000 [ 184.021709][ T8467] netlink: 16 bytes leftover after parsing attributes in process `syz.0.717'. [ 184.031117][ T8466] lo speed is unknown, defaulting to 1000 [ 184.039671][ T8359] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 184.046353][ T8466] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 184.088299][ T8466] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 184.105666][ T8359] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 184.170385][ T8471] wireguard0: entered promiscuous mode [ 184.192891][ T8471] wireguard0: entered allmulticast mode [ 184.351563][ T8359] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 184.369399][ T8359] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 184.387738][ T8466] lo speed is unknown, defaulting to 1000 [ 184.398211][ T8466] lo speed is unknown, defaulting to 1000 [ 184.421899][ T8466] lo speed is unknown, defaulting to 1000 [ 184.455886][ T8466] lo speed is unknown, defaulting to 1000 [ 184.532987][ T5837] Bluetooth: hci1: command tx timeout [ 184.555898][ T8466] lo speed is unknown, defaulting to 1000 [ 184.567835][ T8489] netlink: 16 bytes leftover after parsing attributes in process `syz.1.721'. [ 184.585462][ T8490] FAULT_INJECTION: forcing a failure. [ 184.585462][ T8490] name failslab, interval 1, probability 0, space 0, times 0 [ 184.613074][ T8490] CPU: 1 UID: 0 PID: 8490 Comm: syz.5.723 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 184.613106][ T8490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 184.613119][ T8490] Call Trace: [ 184.613127][ T8490] [ 184.613136][ T8490] dump_stack_lvl+0x189/0x250 [ 184.613186][ T8490] ? __pfx____ratelimit+0x10/0x10 [ 184.613212][ T8490] ? __pfx_dump_stack_lvl+0x10/0x10 [ 184.613245][ T8490] ? __pfx__printk+0x10/0x10 [ 184.613285][ T8490] should_fail_ex+0x414/0x560 [ 184.613318][ T8490] should_failslab+0xa8/0x100 [ 184.613352][ T8490] kmem_cache_alloc_noprof+0x73/0x3c0 [ 184.613386][ T8490] ? skb_clone+0x212/0x3a0 [ 184.613414][ T8490] skb_clone+0x212/0x3a0 [ 184.613440][ T8490] __netlink_deliver_tap+0x404/0x850 [ 184.613487][ T8490] ? netlink_deliver_tap+0x2e/0x1b0 [ 184.613521][ T8490] netlink_deliver_tap+0x19c/0x1b0 [ 184.613556][ T8490] netlink_sendskb+0x68/0x140 [ 184.613589][ T8490] netlink_rcv_skb+0x28c/0x470 [ 184.613635][ T8490] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 184.613668][ T8490] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 184.613715][ T8490] ? netlink_deliver_tap+0x2e/0x1b0 [ 184.613746][ T8490] ? netlink_deliver_tap+0x2e/0x1b0 [ 184.613785][ T8490] netlink_unicast+0x758/0x8d0 [ 184.613827][ T8490] netlink_sendmsg+0x805/0xb30 [ 184.613857][ T8490] ? __pfx_netlink_sendmsg+0x10/0x10 [ 184.613880][ T8490] ? aa_sock_msg_perm+0x94/0x160 [ 184.613909][ T8490] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 184.613934][ T8490] ? __pfx_netlink_sendmsg+0x10/0x10 [ 184.613955][ T8490] __sock_sendmsg+0x219/0x270 [ 184.613986][ T8490] ____sys_sendmsg+0x505/0x830 [ 184.614012][ T8490] ? __pfx_____sys_sendmsg+0x10/0x10 [ 184.614045][ T8490] ? import_iovec+0x74/0xa0 [ 184.614071][ T8490] ___sys_sendmsg+0x21f/0x2a0 [ 184.614095][ T8490] ? __pfx____sys_sendmsg+0x10/0x10 [ 184.614156][ T8490] ? __fget_files+0x2a/0x420 [ 184.614187][ T8490] ? __fget_files+0x3a0/0x420 [ 184.614229][ T8490] __x64_sys_sendmsg+0x19b/0x260 [ 184.614255][ T8490] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 184.614287][ T8490] ? __pfx_ksys_write+0x10/0x10 [ 184.614312][ T8490] ? rcu_is_watching+0x15/0xb0 [ 184.614347][ T8490] ? do_syscall_64+0xbe/0x3b0 [ 184.614380][ T8490] do_syscall_64+0xfa/0x3b0 [ 184.614404][ T8490] ? lockdep_hardirqs_on+0x9c/0x150 [ 184.614428][ T8490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.614449][ T8490] ? clear_bhb_loop+0x60/0xb0 [ 184.614474][ T8490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.614493][ T8490] RIP: 0033:0x7ff4ceb8e969 [ 184.614522][ T8490] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 184.614540][ T8490] RSP: 002b:00007ff4cf9f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 184.614567][ T8490] RAX: ffffffffffffffda RBX: 00007ff4cedb5fa0 RCX: 00007ff4ceb8e969 [ 184.614583][ T8490] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 184.614602][ T8490] RBP: 00007ff4cf9f0090 R08: 0000000000000000 R09: 0000000000000000 [ 184.614615][ T8490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.614627][ T8490] R13: 0000000000000000 R14: 00007ff4cedb5fa0 R15: 00007fff87aee978 [ 184.614661][ T8490] [ 184.617873][ T8484] lo speed is unknown, defaulting to 1000 [ 184.805897][ T8359] 8021q: adding VLAN 0 to HW filter on device bond0 [ 184.999916][ T8359] 8021q: adding VLAN 0 to HW filter on device team0 [ 185.516654][ T8499] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 185.565286][ T7488] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.580823][ T7488] bridge0: port 1(bridge_slave_0) entered forwarding state [ 185.684299][ T8506] lo speed is unknown, defaulting to 1000 [ 185.860178][ T7490] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.867449][ T7490] bridge0: port 2(bridge_slave_1) entered forwarding state [ 186.343578][ T8520] netlink: 'syz.0.729': attribute type 1 has an invalid length. [ 186.359881][ T8520] nbd: error processing sock list [ 186.377921][ T8520] block nbd0: shutting down sockets [ 186.443189][ T8527] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 186.454497][ T8525] netlink: 'syz.5.730': attribute type 39 has an invalid length. [ 186.484886][ T8527] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 186.564496][ T8536] netlink: 8 bytes leftover after parsing attributes in process `syz.0.733'. [ 186.576932][ T8536] openvswitch: netlink: Unknown nsh attribute 0 [ 186.587178][ T8536] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 186.647286][ T8359] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 186.690708][ T8538] netlink: 4 bytes leftover after parsing attributes in process `syz.5.734'. [ 186.736132][ T8540] netlink: 248 bytes leftover after parsing attributes in process `syz.1.735'. [ 186.803909][ T8359] veth0_vlan: entered promiscuous mode [ 186.843918][ T8542] netlink: 512 bytes leftover after parsing attributes in process `syz.0.736'. [ 186.849398][ T8359] veth1_vlan: entered promiscuous mode [ 186.896985][ T8546] FAULT_INJECTION: forcing a failure. [ 186.896985][ T8546] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 186.931280][ T8546] CPU: 0 UID: 0 PID: 8546 Comm: syz.5.737 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 186.931310][ T8546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 186.931323][ T8546] Call Trace: [ 186.931331][ T8546] [ 186.931340][ T8546] dump_stack_lvl+0x189/0x250 [ 186.931379][ T8546] ? __pfx____ratelimit+0x10/0x10 [ 186.931406][ T8546] ? __pfx_dump_stack_lvl+0x10/0x10 [ 186.931438][ T8546] ? __pfx__printk+0x10/0x10 [ 186.931475][ T8546] should_fail_ex+0x414/0x560 [ 186.931509][ T8546] _copy_to_user+0x31/0xb0 [ 186.931532][ T8546] simple_read_from_buffer+0xe1/0x170 [ 186.931568][ T8546] proc_fail_nth_read+0x1df/0x250 [ 186.931593][ T8546] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 186.931619][ T8546] ? rw_verify_area+0x258/0x650 [ 186.931646][ T8546] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 186.931669][ T8546] vfs_read+0x200/0x980 [ 186.931703][ T8546] ? __pfx___mutex_lock+0x10/0x10 [ 186.931731][ T8546] ? __pfx_vfs_read+0x10/0x10 [ 186.931761][ T8546] ? __fget_files+0x2a/0x420 [ 186.931798][ T8546] ? __fget_files+0x3a0/0x420 [ 186.931829][ T8546] ? __fget_files+0x2a/0x420 [ 186.931872][ T8546] ksys_read+0x145/0x250 [ 186.931903][ T8546] ? __pfx_ksys_read+0x10/0x10 [ 186.931933][ T8546] ? rcu_is_watching+0x15/0xb0 [ 186.931970][ T8546] ? do_syscall_64+0xbe/0x3b0 [ 186.932001][ T8546] do_syscall_64+0xfa/0x3b0 [ 186.932031][ T8546] ? lockdep_hardirqs_on+0x9c/0x150 [ 186.932056][ T8546] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.932077][ T8546] ? clear_bhb_loop+0x60/0xb0 [ 186.932103][ T8546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.932124][ T8546] RIP: 0033:0x7ff4ceb8d37c [ 186.932150][ T8546] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 186.932168][ T8546] RSP: 002b:00007ff4cf9f0030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 186.932190][ T8546] RAX: ffffffffffffffda RBX: 00007ff4cedb5fa0 RCX: 00007ff4ceb8d37c [ 186.932205][ T8546] RDX: 000000000000000f RSI: 00007ff4cf9f00a0 RDI: 0000000000000004 [ 186.932219][ T8546] RBP: 00007ff4cf9f0090 R08: 0000000000000000 R09: 0000000000000000 [ 186.932232][ T8546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 186.932244][ T8546] R13: 0000000000000000 R14: 00007ff4cedb5fa0 R15: 00007fff87aee978 [ 186.932278][ T8546] [ 187.175383][ T8359] veth0_macvtap: entered promiscuous mode [ 187.206454][ T8359] veth1_macvtap: entered promiscuous mode [ 187.294524][ T8547] netlink: 8 bytes leftover after parsing attributes in process `syz.1.738'. [ 187.345848][ T8359] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 187.359512][ T8359] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 187.449633][ T8359] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.462734][ T8359] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.471496][ T8359] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.493196][ T8359] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 187.624606][ T8562] netlink: 12 bytes leftover after parsing attributes in process `syz.1.742'. [ 187.664989][ T8562] 8021q: VLANs not supported on nlmon0 [ 187.702598][ T8566] netlink: 8 bytes leftover after parsing attributes in process `syz.5.744'. [ 187.799996][ T7489] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.846079][ T7489] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 187.938221][ T8575] netlink: 'syz.0.745': attribute type 39 has an invalid length. [ 187.949249][ T7488] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 187.977913][ T7488] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 188.024580][ T8584] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 188.240596][ T8589] netlink: 'syz.2.750': attribute type 7 has an invalid length. [ 188.256329][ T8592] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 188.272503][ T8592] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 188.885197][ T1151] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.390711][ T1151] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.692622][ T1151] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.869785][ T1151] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 189.953113][ T8612] lo speed is unknown, defaulting to 1000 [ 189.959472][ T8628] netlink: 'syz.2.761': attribute type 15 has an invalid length. [ 190.359368][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 190.382666][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 190.406254][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 190.440218][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 190.475554][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 190.798136][ T8635] lo speed is unknown, defaulting to 1000 [ 190.860758][ T1151] bridge_slave_1: left allmulticast mode [ 190.876935][ T1151] bridge_slave_1: left promiscuous mode [ 190.883167][ T1151] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.919601][ T1151] bridge_slave_0: left allmulticast mode [ 190.935416][ T1151] bridge_slave_0: left promiscuous mode [ 190.951149][ T1151] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.044448][ T8648] netlink: 'syz.5.764': attribute type 39 has an invalid length. [ 191.359286][ T8659] netlink: 28 bytes leftover after parsing attributes in process `syz.0.766'. [ 191.552668][ T1151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 191.567044][ T1151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 191.579685][ T1151] bond0 (unregistering): Released all slaves [ 191.670303][ T8663] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 191.715205][ T8663] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 192.007807][ T8668] syzkaller1: entered promiscuous mode [ 192.013674][ T8668] syzkaller1: entered allmulticast mode [ 192.110996][ T8674] lo speed is unknown, defaulting to 1000 [ 192.142061][ T1151] hsr_slave_0: left promiscuous mode [ 192.171675][ T1151] hsr_slave_1: left promiscuous mode [ 192.183590][ T1151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 192.200488][ T1151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 192.221227][ T1151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 192.231102][ T1151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 192.263127][ T8682] netlink: 44 bytes leftover after parsing attributes in process `syz.1.774'. [ 192.281060][ T1151] veth1_macvtap: left promiscuous mode [ 192.297438][ T1151] veth0_macvtap: left promiscuous mode [ 192.307852][ T1151] veth1_vlan: left promiscuous mode [ 192.319030][ T1151] veth0_vlan: left promiscuous mode [ 192.458277][ T8689] Bluetooth: MGMT ver 1.23 [ 192.628299][ T5837] Bluetooth: hci1: command tx timeout [ 192.879134][ T1151] team0 (unregistering): Port device team_slave_1 removed [ 192.928434][ T1151] team0 (unregistering): Port device team_slave_0 removed [ 193.366806][ T8635] chnl_net:caif_netlink_parms(): no params data found [ 193.448171][ T8685] : entered promiscuous mode [ 193.546490][ T8694] !: renamed from dummy0 (while UP) [ 193.555165][ T8697] netlink: 12 bytes leftover after parsing attributes in process `syz.5.780'. [ 193.569013][ T8697] netlink: 4 bytes leftover after parsing attributes in process `syz.5.780'. [ 193.578095][ T8696] tipc: Enabling of bearer rejected, failed to enable media [ 193.980024][ T8722] netlink: 'syz.2.783': attribute type 39 has an invalid length. [ 194.082230][ T8635] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.100759][ T8635] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.119851][ T8635] bridge_slave_0: entered allmulticast mode [ 194.135222][ T8635] bridge_slave_0: entered promiscuous mode [ 194.218994][ T8710] lo speed is unknown, defaulting to 1000 [ 194.219167][ T8635] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.252009][ T8635] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.261501][ T8635] bridge_slave_1: entered allmulticast mode [ 194.275185][ T8635] bridge_slave_1: entered promiscuous mode [ 194.330698][ T8715] lo speed is unknown, defaulting to 1000 [ 194.381524][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.543880][ T8635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 194.615501][ T8635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 194.692910][ T5837] Bluetooth: hci1: command tx timeout [ 194.777462][ T8732] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 194.845748][ T8740] netlink: 44 bytes leftover after parsing attributes in process `syz.5.787'. [ 195.010881][ T8635] team0: Port device team_slave_0 added [ 195.067134][ T8635] team0: Port device team_slave_1 added [ 195.157987][ T8752] netlink: 8 bytes leftover after parsing attributes in process `syz.5.792'. [ 195.177129][ T8635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 195.192831][ T8635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 195.228143][ T8635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 195.269973][ T8635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 195.281695][ T8635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 195.312625][ T8635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 195.325115][ T8755] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.793'. [ 195.365120][ T8755] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.793'. [ 195.385607][ T8755] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.793'. [ 195.435801][ T8755] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.793'. [ 195.483502][ T8635] hsr_slave_0: entered promiscuous mode [ 195.490082][ T8635] hsr_slave_1: entered promiscuous mode [ 195.859747][ T8775] netlink: 'syz.0.799': attribute type 39 has an invalid length. [ 196.142835][ T8796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 196.167027][ T8796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 196.349201][ T8635] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 196.366840][ T8635] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 196.385056][ T8635] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 196.404075][ T8635] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 196.529014][ T8635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.559982][ T8635] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.580005][ T7504] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.587319][ T7504] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.632212][ T7504] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.639462][ T7504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.773661][ T5837] Bluetooth: hci1: command tx timeout [ 196.873010][ T8822] __nla_validate_parse: 63 callbacks suppressed [ 196.873033][ T8822] netlink: 44 bytes leftover after parsing attributes in process `syz.1.813'. [ 197.391070][ T8635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 197.454649][ T8844] netlink: 'syz.1.818': attribute type 1 has an invalid length. [ 197.559647][ T8849] geneve2: entered promiscuous mode [ 197.627004][ T8850] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 197.675344][ T8846] netlink: 'syz.2.819': attribute type 303 has an invalid length. [ 197.690934][ T8635] veth0_vlan: entered promiscuous mode [ 197.727298][ T8846] netlink: 8 bytes leftover after parsing attributes in process `syz.2.819'. [ 197.771998][ T8844] veth5: entered promiscuous mode [ 197.788837][ T8844] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 197.815885][ T8635] veth1_vlan: entered promiscuous mode [ 197.958602][ T8858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 197.961097][ T8635] veth0_macvtap: entered promiscuous mode [ 198.004887][ T8858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 198.008195][ T8635] veth1_macvtap: entered promiscuous mode [ 198.074698][ T8635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 198.094287][ T8635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 198.129137][ T8635] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.162093][ T8635] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.184029][ T8635] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.196728][ T8635] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.227827][ T8867] netlink: 44 bytes leftover after parsing attributes in process `syz.0.826'. [ 198.252671][ T8864] nbd: socks must be embedded in a SOCK_ITEM attr [ 198.286697][ T8864] block nbd0: shutting down sockets [ 198.439225][ T8862] netlink: 'syz.1.825': attribute type 11 has an invalid length. [ 198.440963][ T8864] netlink: 'syz.1.825': attribute type 39 has an invalid length. [ 198.466268][ T7490] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 198.474544][ T7490] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 198.491656][ T8862] netlink: 224 bytes leftover after parsing attributes in process `syz.1.825'. [ 198.551273][ T8875] netlink: 4 bytes leftover after parsing attributes in process `syz.2.828'. [ 198.551857][ T7504] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 198.574110][ T7504] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 198.840263][ T8884] xt_hashlimit: overflow, try lower: 18446744073709551615/7 [ 198.862866][ T5839] Bluetooth: hci1: command tx timeout [ 199.120733][ T8888] netlink: 'syz.0.834': attribute type 2 has an invalid length. [ 199.437520][ T8905] Cannot find map_set index 0 as target [ 199.684788][ T8910] netlink: 44 bytes leftover after parsing attributes in process `syz.5.839'. [ 199.779198][ T8914] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 199.800867][ T8914] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 200.174876][ T8926] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.221605][ T8933] lo speed is unknown, defaulting to 1000 [ 200.277888][ T8931] netlink: 4 bytes leftover after parsing attributes in process `syz.1.842'. [ 200.350220][ T8939] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 200.357825][ T8939] IPv6: NLM_F_CREATE should be set when creating new route [ 200.365200][ T8939] IPv6: NLM_F_CREATE should be set when creating new route [ 200.803334][ T8960] netlink: 44 bytes leftover after parsing attributes in process `syz.0.851'. [ 200.938813][ T8962] netlink: 'syz.2.850': attribute type 39 has an invalid length. [ 200.947846][ T8968] veth1_virt_wifi: entered promiscuous mode [ 200.977635][ T8968] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.075716][ T8973] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 201.145699][ T8973] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 201.409638][ T8987] lo speed is unknown, defaulting to 1000 [ 201.538418][ T8991] netlink: 24 bytes leftover after parsing attributes in process `syz.1.863'. [ 201.567442][ T8990] No such timeout policy "syz0" [ 201.576838][ T8990] netlink: 8 bytes leftover after parsing attributes in process `syz.1.863'. [ 201.816769][ T8996] netlink: 'syz.1.865': attribute type 4 has an invalid length. [ 201.857600][ T9003] lo: entered allmulticast mode [ 201.942073][ T9003] lo: left allmulticast mode [ 202.000262][ T8988] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.024209][ T8988] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.032626][ T8988] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.056410][ T8988] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 202.069378][ T8988] geneve2: entered promiscuous mode [ 202.075989][ T8988] geneve2: entered allmulticast mode [ 202.104360][ T9016] __nla_validate_parse: 5 callbacks suppressed [ 202.104384][ T9016] netlink: 48 bytes leftover after parsing attributes in process `syz.5.869'. [ 202.601058][ T9038] netlink: 44 bytes leftover after parsing attributes in process `syz.5.875'. [ 202.712940][ T9046] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.739480][ T9046] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.764199][ T9045] netlink: 'syz.5.878': attribute type 39 has an invalid length. [ 203.237554][ T9067] lo speed is unknown, defaulting to 1000 [ 204.045104][ T9103] netlink: 44 bytes leftover after parsing attributes in process `syz.0.889'. [ 204.327954][ T9111] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 204.348742][ T9113] netlink: 'syz.2.892': attribute type 39 has an invalid length. [ 204.370886][ T9111] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 204.527570][ T9105] infiniband syz1: set down [ 204.533336][ T9105] infiniband syz1: added bond0 [ 204.569595][ T9105] RDS/IB: syz1: added [ 204.573741][ T9105] smc: adding ib device syz1 with port count 1 [ 204.579911][ T9105] smc: ib device syz1 port 1 has pnetid [ 205.067560][ T9123] netlink: 4 bytes leftover after parsing attributes in process `syz.0.896'. [ 205.068476][ T9122] sctp: [Deprecated]: syz.0.896 (pid 9122) Use of struct sctp_assoc_value in delayed_ack socket option. [ 205.068476][ T9122] Use struct sctp_sack_info instead [ 205.406649][ T9131] lo speed is unknown, defaulting to 1000 [ 205.446693][ T9138] netlink: 44 bytes leftover after parsing attributes in process `syz.0.901'. [ 205.624858][ T9142] netlink: 32 bytes leftover after parsing attributes in process `syz.0.903'. [ 205.690537][ T9144] netlink: 20 bytes leftover after parsing attributes in process `syz.0.903'. [ 205.862549][ T9148] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 205.888903][ T9148] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 206.606642][ T9156] netlink: 'syz.0.908': attribute type 39 has an invalid length. [ 206.805594][ T9158] xt_hashlimit: max too large, truncated to 1048576 [ 206.812534][ T9158] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 207.233080][ T9173] netlink: 8 bytes leftover after parsing attributes in process `syz.5.912'. [ 207.242316][ T9173] netlink: 24 bytes leftover after parsing attributes in process `syz.5.912'. [ 207.269047][ T9175] IPv6: Can't replace route, no match found [ 207.377505][ T9179] netlink: 44 bytes leftover after parsing attributes in process `syz.5.913'. [ 207.489776][ T9185] netlink: 20 bytes leftover after parsing attributes in process `syz.0.915'. [ 207.568515][ T9187] netlink: 56 bytes leftover after parsing attributes in process `syz.5.916'. [ 207.590247][ T9187] xt_CT: You must specify a L4 protocol and not use inversions on it [ 207.688699][ T9195] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 207.706241][ T9195] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 207.780252][ T9198] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 207.881306][ T9205] netlink: 'syz.5.921': attribute type 3 has an invalid length. [ 207.904738][ T9205] netlink: 'syz.5.921': attribute type 3 has an invalid length. [ 207.918664][ T9205] netlink: 'syz.5.921': attribute type 3 has an invalid length. [ 207.928255][ T9205] netlink: 64 bytes leftover after parsing attributes in process `syz.5.921'. [ 208.011505][ T9205] netlink: 64 bytes leftover after parsing attributes in process `syz.5.921'. [ 208.031366][ T9212] netlink: 12 bytes leftover after parsing attributes in process `syz.2.923'. [ 208.116498][ T9205] netlink: 64 bytes leftover after parsing attributes in process `syz.5.921'. [ 208.194391][ T9205] netlink: 64 bytes leftover after parsing attributes in process `syz.5.921'. [ 208.336356][ T9228] netlink: 'syz.2.925': attribute type 39 has an invalid length. [ 208.677104][ T9245] batman_adv: batadv0: Adding interface: ip6gretap2 [ 208.685039][ T9245] batman_adv: batadv0: The MTU of interface ip6gretap2 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 208.721234][ T9245] batman_adv: batadv0: Interface activated: ip6gretap2 [ 208.963336][ T9254] lo speed is unknown, defaulting to 1000 [ 209.289484][ T9273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 209.350652][ T9273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 209.647912][ T9279] lo speed is unknown, defaulting to 1000 [ 210.867526][ T9308] batadv_slave_1: entered promiscuous mode [ 210.924021][ T9308] batadv_slave_1: left promiscuous mode [ 211.308675][ T9316] lo speed is unknown, defaulting to 1000 [ 211.424864][ T9327] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 211.474834][ T9327] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 211.633987][ T9334] netlink: 'syz.2.953': attribute type 1 has an invalid length. [ 211.813155][ T5839] Bluetooth: hci3: command 0x0401 tx timeout [ 211.813362][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 212.151022][ T9346] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 212.259805][ T9348] __nla_validate_parse: 13 callbacks suppressed [ 212.259825][ T9348] netlink: 8 bytes leftover after parsing attributes in process `syz.1.958'. [ 212.291199][ T9348] netlink: 4 bytes leftover after parsing attributes in process `syz.1.958'. [ 212.441662][ T9333] infiniband syz!: set down [ 212.459293][ T9333] infiniband syz!: added team_slave_0 [ 212.499288][ T9333] syz!: rxe_create_cq: returned err = -12 [ 212.512080][ T9333] infiniband syz!: Couldn't create ib_mad CQ [ 212.531331][ T9333] infiniband syz!: Couldn't open port 1 [ 212.597759][ T9333] RDS/IB: syz!: added [ 212.602046][ T9333] smc: adding ib device syz! with port count 1 [ 212.609060][ T9333] smc: ib device syz! port 1 has pnetid [ 212.686847][ T9353] netlink: 'syz.1.959': attribute type 39 has an invalid length. [ 214.385607][ T9360] netlink: 72 bytes leftover after parsing attributes in process `syz.0.961'. [ 214.526551][ T9365] syzkaller1: entered promiscuous mode [ 214.535623][ T9365] syzkaller1: entered allmulticast mode [ 215.246004][ T9375] netlink: 44 bytes leftover after parsing attributes in process `syz.5.965'. [ 215.482337][ T9387] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 215.540583][ T9387] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 215.782381][ T9393] netlink: 'syz.1.970': attribute type 39 has an invalid length. [ 216.181239][ T9396] netlink: 8 bytes leftover after parsing attributes in process `syz.2.972'. [ 216.193919][ T9396] netlink: 32 bytes leftover after parsing attributes in process `syz.2.972'. [ 216.337231][ T9403] netlink: 12 bytes leftover after parsing attributes in process `syz.5.973'. [ 216.438137][ T9410] netlink: 'syz.2.975': attribute type 1 has an invalid length. [ 216.465541][ T9410] netlink: 224 bytes leftover after parsing attributes in process `syz.2.975'. [ 216.484923][ T9410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.975'. [ 216.540335][ T9415] netlink: 'syz.0.977': attribute type 1 has an invalid length. [ 216.568323][ T9415] netlink: 'syz.0.977': attribute type 3 has an invalid length. [ 216.596030][ T9415] netlink: 224 bytes leftover after parsing attributes in process `syz.0.977'. [ 216.742588][ T9424] macsec1: entered allmulticast mode [ 216.748231][ T9424] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 216.758696][ T9424] batman_adv: batadv0: Adding interface: macsec1 [ 216.765131][ T9424] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 216.818488][ T9424] batman_adv: batadv0: Interface activated: macsec1 [ 217.904835][ T9459] netlink: 'syz.1.992': attribute type 39 has an invalid length. [ 217.909973][ T9461] __nla_validate_parse: 3 callbacks suppressed [ 217.909995][ T9461] netlink: 44 bytes leftover after parsing attributes in process `syz.5.993'. [ 218.056476][ T9470] xt_hashlimit: size too large, truncated to 1048576 [ 218.411930][ T9485] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 218.442921][ T9485] netlink: 'syz.0.1000': attribute type 1 has an invalid length. [ 218.570737][ T9488] veth5: entered promiscuous mode [ 218.576710][ T9488] veth5: entered allmulticast mode [ 218.586653][ T9488] bond0: (slave veth5): Enslaving as an active interface with a down link [ 218.608395][ T9491] pimreg: entered allmulticast mode [ 218.754747][ T9499] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1004'. [ 219.266621][ T9524] openvswitch: netlink: Actions may not be safe on all matching packets [ 219.745744][ T9543] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1017'. [ 219.844307][ T9550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1020'. [ 220.061820][ T9564] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1023'. [ 220.484677][ T9581] batadv_slave_1: entered promiscuous mode [ 220.496002][ T9581] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 220.525742][ T9580] batadv_slave_1: left promiscuous mode [ 220.668986][ T9587] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1031'. [ 220.678153][ T9586] lo speed is unknown, defaulting to 1000 [ 220.857969][ T9600] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1032'. [ 220.887462][ T9600] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1032'. [ 220.893566][ T9601] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1033'. [ 220.905800][ T9601] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1033'. [ 221.004572][ T9590] lo speed is unknown, defaulting to 1000 [ 221.070273][ T9606] netlink: 'syz.0.1035': attribute type 10 has an invalid length. [ 221.084055][ T9606] openvswitch: netlink: Flow key attr not present in new flow. [ 221.152876][ T9606] sctp: [Deprecated]: syz.0.1035 (pid 9606) Use of int in max_burst socket option deprecated. [ 221.152876][ T9606] Use struct sctp_assoc_value instead [ 221.536138][ T9616] netlink: 'syz.0.1039': attribute type 11 has an invalid length. [ 221.812169][ T9623] geneve3: entered promiscuous mode [ 221.823948][ T9623] geneve3: entered allmulticast mode [ 221.989799][ T9630] Unsupported ieee802154 address type: 0 [ 222.964877][ T9655] __nla_validate_parse: 5 callbacks suppressed [ 222.964906][ T9655] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1049'. [ 223.073629][ T9657] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 223.087542][ T9658] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 223.183576][ T9662] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1051'. [ 223.192504][ T9662] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1051'. [ 224.005825][ T9677] netlink: 'syz.5.1056': attribute type 39 has an invalid length. [ 224.178626][ T9679] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 224.536796][ T9688] 8021q: adding VLAN 0 to HW filter on device bond2 [ 224.545275][ T9688] bridge0: port 1(bond2) entered blocking state [ 224.551809][ T9688] bridge0: port 1(bond2) entered disabled state [ 224.558923][ T9688] bond2: entered allmulticast mode [ 224.571515][ T9688] bond2: entered promiscuous mode [ 224.579290][ T9688] bridge0: port 1(bond2) entered blocking state [ 224.585799][ T9688] bridge0: port 1(bond2) entered forwarding state [ 224.612163][ T5830] Bluetooth: hci4: link tx timeout [ 224.619248][ T5830] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 224.647727][ T7490] bridge0: port 1(bond2) entered disabled state [ 224.812331][ T9706] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1066'. [ 224.848971][ T9706] geneve4: entered promiscuous mode [ 225.097835][ T9712] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1067'. [ 225.201806][ T9714] netlink: 'syz.0.1068': attribute type 5 has an invalid length. [ 225.209831][ T9714] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1068'. [ 225.241309][ T9714] lo speed is unknown, defaulting to 1000 [ 225.475742][ T9722] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1070'. [ 225.720083][ T9723] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 225.818573][ T9727] netlink: 92 bytes leftover after parsing attributes in process `syz.5.1072'. [ 225.869536][ T9730] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1074'. [ 226.044593][ T9739] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1077'. [ 226.057249][ T9737] batman_adv: batadv0: Adding interface: dummy0 [ 226.074206][ T9737] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 226.112928][ T9737] batman_adv: batadv0: Interface activated: dummy0 [ 226.208486][ T9741] batadv0: mtu less than device minimum [ 226.245955][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.258269][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.270295][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.282390][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.294864][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.306990][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.319134][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.331208][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.343502][ T9741] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 226.693244][ T5835] Bluetooth: hci4: command 0x0405 tx timeout [ 226.730032][ T5907] IPVS: starting estimator thread 0... [ 226.832901][ T9759] IPVS: using max 24 ests per chain, 57600 per kthread [ 227.405068][ T9781] tipc: Enabling of bearer rejected, failed to enable media [ 227.560241][ T9790] IPVS: set_ctl: invalid protocol: 22 224.0.0.1:20000 [ 227.608558][ T9792] lo speed is unknown, defaulting to 1000 [ 227.972400][ T9801] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 228.145719][ T9808] xt_hashlimit: overflow, rate too high: 1125899906842624 [ 228.786503][ T9825] sctp: [Deprecated]: syz.2.1101 (pid 9825) Use of struct sctp_assoc_value in delayed_ack socket option. [ 228.786503][ T9825] Use struct sctp_sack_info instead [ 228.955229][ T9828] __nla_validate_parse: 9 callbacks suppressed [ 228.955249][ T9828] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1102'. [ 229.002653][ T9834] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1104'. [ 229.297251][ T9849] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1108'. [ 229.365698][ T9852] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1109'. [ 229.431885][ T9854] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1110'. [ 229.604090][ T9852] lo speed is unknown, defaulting to 1000 [ 229.610147][ T9859] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1112'. [ 229.973442][ T5830] Bluetooth: hci0: command tx timeout [ 230.242814][ T9870] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1116'. [ 230.587919][ T9882] batman_adv: batadv0: Interface deactivated: dummy0 [ 230.616488][ T9882] batman_adv: batadv0: Removing interface: dummy0 [ 230.635246][ T9883] netlink: 'syz.5.1118': attribute type 10 has an invalid length. [ 230.726810][ T9882] bond2: left allmulticast mode [ 230.731888][ T9882] bond2: left promiscuous mode [ 230.740704][ T9882] bridge0: port 1(bond2) entered disabled state [ 230.779202][ T9883] bond0: (slave wlan1): refused to change device type [ 231.105589][ T9898] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1122'. [ 231.139518][ T9898] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1122'. [ 231.410780][ T9907] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1126'. [ 231.484805][ T9907] syzkaller1: entered promiscuous mode [ 231.509821][ T9907] syzkaller1: entered allmulticast mode [ 231.616757][ T9912] netlink: 'syz.0.1128': attribute type 5 has an invalid length. [ 231.648669][ T9912] netlink: 'syz.0.1128': attribute type 6 has an invalid length. [ 232.688210][ T9940] tipc: Enabled bearer , priority 0 [ 232.707610][ T9940] bond_slave_1: entered promiscuous mode [ 232.722874][ T9940] bond_slave_1: entered allmulticast mode [ 232.744603][ T9938] tipc: Disabling bearer [ 232.980284][ T9945] bond1: entered allmulticast mode [ 232.998454][ T9945] 8021q: adding VLAN 0 to HW filter on device bond1 [ 233.046585][ T9945] batadv_slave_0: entered promiscuous mode [ 233.054490][ T9945] batadv_slave_0: entered allmulticast mode [ 233.060637][ T9945] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 233.099972][ T9945] bond1: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 233.383121][ T9973] x_tables: duplicate underflow at hook 1 [ 233.460273][ T9969] lo speed is unknown, defaulting to 1000 [ 233.525543][ T9970] net_ratelimit: 11 callbacks suppressed [ 233.525567][ T9970] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 233.968308][ T9991] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 235.154255][T10033] __nla_validate_parse: 10 callbacks suppressed [ 235.154275][T10033] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1156'. [ 235.642612][T10044] netlink: 'syz.5.1159': attribute type 10 has an invalid length. [ 235.656944][T10044] openvswitch: netlink: Flow key attr not present in new flow. [ 235.702020][T10046] netlink: 'syz.2.1158': attribute type 4 has an invalid length. [ 235.999171][T10053] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1162'. [ 236.058521][T10053] lo speed is unknown, defaulting to 1000 [ 236.173781][T10055] af_packet: tpacket_rcv: packet too big, clamped from 3954 to 3710. macoff=82 [ 236.493276][T10065] netlink: 'syz.0.1164': attribute type 3 has an invalid length. [ 236.521958][T10065] netlink: 'syz.0.1164': attribute type 3 has an invalid length. [ 236.607862][T10065] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1164'. [ 236.925724][T10071] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1167'. [ 236.945832][T10073] netlink: 'syz.0.1168': attribute type 10 has an invalid length. [ 236.959063][T10071] netlink: 'syz.1.1167': attribute type 7 has an invalid length. [ 236.971647][T10072] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 236.983115][T10071] netlink: 'syz.1.1167': attribute type 8 has an invalid length. [ 236.999538][T10071] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1167'. [ 237.032199][T10075] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1166'. [ 237.243168][T10081] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1170'. [ 237.265664][ T10] ------------[ cut here ]------------ [ 237.271694][ T10] workqueue: cannot queue hci_conn_timeout on wq hci1 [ 237.278621][ T10] WARNING: CPU: 0 PID: 10 at kernel/workqueue.c:2258 __queue_work+0xd62/0xfe0 [ 237.287537][ T10] Modules linked in: [ 237.291734][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 237.303317][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 237.313608][ T10] Workqueue: events l2cap_chan_timeout [ 237.319133][ T10] RIP: 0010:__queue_work+0xd62/0xfe0 [ 237.324490][ T10] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 09 71 98 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 80 da 89 8b 4c 89 fa e8 af 3f f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 40 53 35 00 90 0f 0b 90 e9 dd fc ff [ 237.344932][ T10] RSP: 0018:ffffc900000f77a8 EFLAGS: 00010046 [ 237.351145][ T10] RAX: 236be7e0956fdb00 RBX: 0000000000000020 RCX: ffff88801ceb9e00 [ 237.359164][ T10] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 237.367185][ T10] RBP: 1ffff110048d8338 R08: 0000000000000003 R09: 0000000000000004 [ 237.375202][ T10] R10: dffffc0000000000 R11: fffffbfff1bfa66c R12: dffffc0000000000 [ 237.383225][ T10] R13: ffff8880284a8960 R14: ffff88801a494008 R15: ffff8880246c1978 [ 237.391333][ T10] FS: 0000000000000000(0000) GS:ffff888125c66000(0000) knlGS:0000000000000000 [ 237.400394][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 237.407022][ T10] CR2: 00007fa232774420 CR3: 000000005eb70000 CR4: 00000000003526f0 [ 237.415040][ T10] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 237.423315][ T10] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 237.431333][ T10] Call Trace: [ 237.434655][ T10] [ 237.437676][ T10] ? __queue_delayed_work+0xe1/0x2d0 [ 237.443034][ T10] queue_delayed_work_on+0x18b/0x280 [ 237.448384][ T10] ? __pfx___cancel_work+0x10/0x10 [ 237.453555][ T10] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 237.459446][ T10] ? hci_conn_drop+0x14d/0x280 [ 237.464269][ T10] l2cap_chan_del+0x285/0x5e0 [ 237.469003][ T10] l2cap_chan_close+0x597/0x980 [ 237.473921][ T10] ? __pfx_l2cap_chan_close+0x10/0x10 [ 237.479349][ T10] ? process_scheduled_works+0x9ef/0x17b0 [ 237.485163][ T10] l2cap_chan_timeout+0x158/0x390 [ 237.490240][ T10] ? process_scheduled_works+0x9ef/0x17b0 [ 237.496289][ T10] process_scheduled_works+0xae1/0x17b0 [ 237.501984][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 237.508215][ T10] worker_thread+0x8a0/0xda0 [ 237.512893][ T10] kthread+0x70e/0x8a0 [ 237.517020][ T10] ? __pfx_worker_thread+0x10/0x10 [ 237.522268][ T10] ? __pfx_kthread+0x10/0x10 [ 237.526890][ T10] ? _raw_spin_unlock_irq+0x23/0x50 [ 237.532107][ T10] ? lockdep_hardirqs_on+0x9c/0x150 [ 237.537322][ T10] ? __pfx_kthread+0x10/0x10 [ 237.541929][ T10] ret_from_fork+0x3fc/0x770 [ 237.546543][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 237.551713][ T10] ? __switch_to_asm+0x39/0x70 [ 237.556519][ T10] ? __switch_to_asm+0x33/0x70 [ 237.561295][ T10] ? __pfx_kthread+0x10/0x10 [ 237.565911][ T10] ret_from_fork_asm+0x1a/0x30 [ 237.570830][ T10] [ 237.573879][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 237.581173][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full) [ 237.592745][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 237.602834][ T10] Workqueue: events l2cap_chan_timeout [ 237.608321][ T10] Call Trace: [ 237.611605][ T10] [ 237.614637][ T10] dump_stack_lvl+0x99/0x250 [ 237.619248][ T10] ? __asan_memcpy+0x40/0x70 [ 237.623857][ T10] ? __pfx_dump_stack_lvl+0x10/0x10 [ 237.629077][ T10] ? __pfx__printk+0x10/0x10 [ 237.633704][ T10] panic+0x2db/0x790 [ 237.637666][ T10] ? __pfx_panic+0x10/0x10 [ 237.642094][ T10] ? show_trace_log_lvl+0x4fb/0x550 [ 237.647324][ T10] ? ret_from_fork_asm+0x1a/0x30 [ 237.652279][ T10] __warn+0x31b/0x4b0 [ 237.656275][ T10] ? __queue_work+0xd62/0xfe0 [ 237.660982][ T10] ? __queue_work+0xd62/0xfe0 [ 237.665676][ T10] report_bug+0x2be/0x4f0 [ 237.670018][ T10] ? __queue_work+0xd62/0xfe0 [ 237.674713][ T10] ? __queue_work+0xd62/0xfe0 [ 237.679406][ T10] ? __queue_work+0xd64/0xfe0 [ 237.684102][ T10] handle_bug+0x84/0x160 [ 237.688359][ T10] exc_invalid_op+0x1a/0x50 [ 237.692888][ T10] asm_exc_invalid_op+0x1a/0x20 [ 237.697747][ T10] RIP: 0010:__queue_work+0xd62/0xfe0 [ 237.703052][ T10] Code: 42 80 3c 20 00 74 08 4c 89 ef e8 09 71 98 00 49 8b 75 00 49 81 c7 78 01 00 00 48 c7 c7 80 da 89 8b 4c 89 fa e8 af 3f f9 ff 90 <0f> 0b 90 90 e9 f1 f4 ff ff e8 40 53 35 00 90 0f 0b 90 e9 dd fc ff [ 237.722728][ T10] RSP: 0018:ffffc900000f77a8 EFLAGS: 00010046 [ 237.728833][ T10] RAX: 236be7e0956fdb00 RBX: 0000000000000020 RCX: ffff88801ceb9e00 [ 237.736873][ T10] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 237.744875][ T10] RBP: 1ffff110048d8338 R08: 0000000000000003 R09: 0000000000000004 [ 237.752953][ T10] R10: dffffc0000000000 R11: fffffbfff1bfa66c R12: dffffc0000000000 [ 237.760941][ T10] R13: ffff8880284a8960 R14: ffff88801a494008 R15: ffff8880246c1978 [ 237.769046][ T10] ? __queue_work+0xd61/0xfe0 [ 237.773973][ T10] ? __queue_delayed_work+0xe1/0x2d0 [ 237.779300][ T10] queue_delayed_work_on+0x18b/0x280 [ 237.784636][ T10] ? __pfx___cancel_work+0x10/0x10 [ 237.789785][ T10] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 237.795700][ T10] ? hci_conn_drop+0x14d/0x280 [ 237.800503][ T10] l2cap_chan_del+0x285/0x5e0 [ 237.805217][ T10] l2cap_chan_close+0x597/0x980 [ 237.810176][ T10] ? __pfx_l2cap_chan_close+0x10/0x10 [ 237.815561][ T10] ? process_scheduled_works+0x9ef/0x17b0 [ 237.821340][ T10] l2cap_chan_timeout+0x158/0x390 [ 237.826410][ T10] ? process_scheduled_works+0x9ef/0x17b0 [ 237.832169][ T10] process_scheduled_works+0xae1/0x17b0 [ 237.837767][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 237.843786][ T10] worker_thread+0x8a0/0xda0 [ 237.848450][ T10] kthread+0x70e/0x8a0 [ 237.852560][ T10] ? __pfx_worker_thread+0x10/0x10 [ 237.857712][ T10] ? __pfx_kthread+0x10/0x10 [ 237.862329][ T10] ? _raw_spin_unlock_irq+0x23/0x50 [ 237.867669][ T10] ? lockdep_hardirqs_on+0x9c/0x150 [ 237.872881][ T10] ? __pfx_kthread+0x10/0x10 [ 237.877496][ T10] ret_from_fork+0x3fc/0x770 [ 237.882108][ T10] ? __pfx_ret_from_fork+0x10/0x10 [ 237.887329][ T10] ? __switch_to_asm+0x39/0x70 [ 237.892275][ T10] ? __switch_to_asm+0x33/0x70 [ 237.897057][ T10] ? __pfx_kthread+0x10/0x10 [ 237.901661][ T10] ret_from_fork_asm+0x1a/0x30 [ 237.906720][ T10] [ 237.910037][ T10] Kernel Offset: disabled [ 237.914372][ T10] Rebooting in 86400 seconds..