last executing test programs: 2.553447418s ago: executing program 2 (id=4661): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket(0x10, 0x80003, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000010}, 0x40000) sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=ANY=[], 0x78}}, 0x0) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r1, 0x2, {0x3}, 0xff}, 0x18) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_GET_POWER_SAVE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r5, 0x20, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffff9, 0x7f}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000040}, 0x40400c0) socket(0x1d, 0x2, 0x6) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket(0x10, 0x80003, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'lo\x00'}) (async) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000010}, 0x40000) (async) sendmsg$nl_generic(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=ANY=[], 0x78}}, 0x0) (async) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r1, 0x2, {0x3}, 0xff}, 0x18) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) (async) sendmsg$NL80211_CMD_GET_POWER_SAVE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r5, 0x20, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffff9, 0x7f}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000040}, 0x40400c0) (async) 1.367522817s ago: executing program 4 (id=4681): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020205d0af8ff00000000bea100000000000007010000f8ffffffb702000008000000b7030000ffee0000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x74, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x12, 0x4, 0x8, 0xe}, 0x50) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)=ANY=[], 0x14}], 0x1, 0x0, 0x0, 0x4000080}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000340)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_CCA_ED_LEVEL(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000380)={0x58, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0xe}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0xa}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_CCA_ED_LEVEL={0x8, 0xe, 0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x200000c0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001206", 0x2e}], 0x1}, 0x48000) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="34010000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000400048008000200010000000800010000000000080108805400078008000500000000000800050000000000080005009d2c690d08000500000000000800050000000000080005000000000008000500"], 0x134}}, 0x4048014) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x11, 0x4, 0x4, 0x1000ff, 0x4}, 0x50) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$netrom_NETROM_T4(r4, 0x103, 0x4, 0x0, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYRESHEX=r4, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.359790398s ago: executing program 2 (id=4682): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x400}) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000140)=ANY=[@ANYBLOB="d2e6725d5a247c3375665f1451949cc0010b176ef3809d61ad2274871c22ce161543c7f570b8da73c2f78b97b8f3c5eba999144be36a42aac7cf35"]) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x2005, 0x4) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000240)={{0xffffffffffffffff, &(0x7f0000000040)='syzkaller0\x00', 0x14001, &(0x7f0000000080)={@align=0x2, {0x235a, 0x3, 0x80000000, 0x2}}, 0x459, &(0x7f00000000c0), &(0x7f0000000100)=0x8}, {[0xb, 0x7f, 0x4, 0x6]}, 0xc, 0xa3, &(0x7f0000000180)=""/163}) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f00000002c0)) socket$kcm(0x29, 0x0, 0x0) 1.272034749s ago: executing program 1 (id=4683): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000000)={0xfffffffd, 0xffffffffffffffff, 0x5b0f9f04, 0xffffffffffffffff}) r1 = socket$kcm(0xa, 0x3, 0x73) sendmsg$inet(r1, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @multicast2}, 0x3c, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c068c0a7d2eaebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838029f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000010c0)=[@ip_tos_int={{0x14, 0x29, 0x3e}}, @ip_tos_u8={{0x14, 0x29, 0x43}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}], 0x50}, 0x9fc) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc804}, 0x2) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r4, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r4, 0x89f0, &(0x7f0000000000)) 1.260263569s ago: executing program 2 (id=4685): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000073016200000000009500000000000000a6692aae1a43fa0bf68bbf0c19b1e9020b3ed65b5d9fdfc2ca5fe8966d8b6e8212a5c72a2c32d3e821d446355e043be398137c9733d3925e4280e1224bd05ba6f04f93f5ac29bc54caed1fc7f417b74304197b062f10950ce043bf3bddf4d824304dbe407b281b030f592f85bc23d29dd493b9003386"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7}, 0x48) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x1412, 0x1, 0x0, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x18}}, 0x0) 1.167418388s ago: executing program 0 (id=4686): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002900)=ANY=[@ANYBLOB="140000002a000b0000000000fcdbdf250100002c"], 0x14}, 0x1, 0x3000000, 0x0, 0x800}, 0x8080) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r4, &(0x7f0000000280)="ca", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r4, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)=@generic={&(0x7f0000000080)='./file0\x00', 0x0, 0x8}, 0x18) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r4, &(0x7f0000000100), &(0x7f0000000000), 0x2}, 0x20) r5 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000040)={0x1d, r6, 0x8000000000000003}, 0x18) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000980)={0x1000, 0x19, 0x1, 0x70bd2d, 0x25dfdbfb, {0x2}, [@typed={0xc, 0x10c, 0x0, 0x0, @u64=0x9}, @typed={0x8, 0x131, 0x0, 0x0, @pid}, @generic="370d48c9e014c4eab253acdb44eec50c36c7e17b07295dd8eb3a1433826470c351fa6c59d27578e3992c6233c81337e96ea7c3aadd0dca65a5cb41df5f2230587dcde161e75e19c950120193a7e2c49d1d5e93711854d429fa5c8b0932401005b46af44b4ebc5b0782c5459789c3bf203bbb2b1cb5ce9d627c6d0c7990e6dcefc32ce42848f99250559f27dff14149117b32cb931c472b8ec0e9376be8c9d35c099b3292af4e74673284343a6e2d578f19a243062dd1a06f42294e0cd66df9215bb2fd1182026f5e6d5fa44bc5458fce0bc0ead03cba8540a9348d85c93e9eca27120c97b54b8900ab5b0ee4b308e430f527af7a03243db25c59f62505", @nested={0xed5, 0x96, 0x0, 0x1, [@typed={0x8, 0x60, 0x0, 0x0, @u32=0x3}, @generic="b5590be9f7b7f3244954dc1c4230b5e98945713f024bfff823b6dd7485e97e5db1c6918ebfab87f4afa21b29edff60bf700a7f5a8c3dd6f76385f3bd222f2ad57bb66ff614bfd399d4975a191fa738e197967bfefe3cda70d41a18d64044e199e1db8e7917d76550191e4da5f8c2f9330f3919ccb11d8e15430776acd182754bb16b1c86dc066da1d38ceb4f2035edc1f0dd5835d748944ce21f80ceb828fc728261be3e1f7773c3f85151000c25065c894b69760969e56b1962992b95c22b95b4f33a6c420fc3b00f90f586550621a4e5febab342cedee046e3cac2ade1242ba875f3330ff629f7b4d297d5d6a6bf2c518bd3ff119afef5c7104fd650336c890c2889dbb40942af46bef457e23c0076d07d15e228a67390289133e212cb7566944042d42e0999fc5aa3b5982396968935513482adee78936a891cc137b97d5ef67d53483aa001c1aab731ce0211f4370c4398eafe3e1cab840eab8d9b8317fb339103d5d074b4bd09017c4c9f537cca08889e395724a1cbf6e45f2c041bf351b0dc1b7ab40f36576555080a53b447126910fe8e9e31db979b2f17f5816045f3765bd1a48393a39bcea86517577ce71dad3d8cdbf3ed15d640655dca90f202f61fb63091be03fc35c0b88a781dd60b3d11e7bfcd88893b5271f9c8606f1ed97eae80314d6291434513cb170531db39b3444bb9f961e097983add21a3ab439fe1870489e482140a5c6227b49b9b95c23a95cd1359186e8f82587b4c7a2121daca9de389ac987330743b83a017951aafa55cbbf0bdd852474b58b49ada9d1ab7f20220a1a9fd8e700b43e603f375270e8e721610e676d08301971a720b90bfc9a991182d90a2f16266ff602aeebe516da141a4d00520d06cd873e77502351eb02d9099175de5df19516d110e4d2b64da635c2f37a7b78a0799dc58132b397e89c3c9d807134d72cbaf2ef549379cba42dd8af159d0e05d0378b6e77ea55c3815c8f83cb7a3b2583e2ff58d0a568d892511303882e1af4c193f3d36645cfb9222bda82e6d9bd4f52a0ede5c48e8965de0ca5b07b60895f7de26659399d02d2e4ebb140389d871d5a48fea8bde2dc9b29f282df17b934e677f23bffc53495dc72b772ecf395569dc1f9e134e01a28143c6bfc95897cc7b7654765806464df9b946581b4fef00b3014afb1df08a71815d47097ed520b343fc83381b92bc5427e1b11bb7fcf2c4efb97fcac08c72554790359a26a6fa553716818bf833433cb933b701e28479ff0eb9ccc77c297f9899cba7e67fc51cc44c5d7284da8ad24506a9c3d1e0b0787248b94bb2500e27163c2db5960662c305516a1d4fbdd983e5bab3b5756f8dc72a44951b0d7932331df8d8031e5197760ec85423341454b90f7180dbd6ed4bb337f1e5a47e954541b81043a58bcea7bc0ccdaf8dc63ef651ca49db5057252dab399b3992accecbabf04c154bfbf9a1df7dc687abe5f447566e1fcba9bfdf5d8339974a9d3fdb4a74702069053d5eed9dc1dfa42e9097dbae70c15ac17440faa6f95ebfbc6742700b7828336d8aa3d44950e14b9985d93f9435b4203fce0d07baa3c74e58e65fcf2e58eae91c47e8ca560a337e3bd7450c069376215ad37db05393c9678abd0f984bd85769d914bdd34251515505257b16041db350beaa07206f1a52bd68b56ade7d486d153735e7f096ee42cbbbe3cdc319b7d506d747ae34f265f7b4d01db0e8c841362755f71a4093e7fbb16d8ff4ee35693ca90594b768f55bede1a5914522a1e5734ce3380524f36bc1f97f81d7a9717a369a066e64d5bb0a7e985ebbbc872dee848bb9db487ffd8c979fb149934c70072962de4338b04491d604b6a072ff9de3f845ddd9f8623f3286b089da763fa670034226ae6ccb8972b70ab30ceddfc445cda1251c7cf6033cf13ce521fadb4138a676ee828e2dadbb2586da8410b76c5de854496cc0889b080a467118e2b2188b1f15604a162220bfe7521d4f2647ae87d63de0242c147ccf091ddee2c356e544929dc1f563acd3f5529c5122150687857afa593c7f28d3b316d6f583482732a52a1f30ee32dab586a8c1967b703f1960470ba0fdeda9892a7b7840c950f3258175ee29377c933fa1a0c878e9b87487ce35e3908559d42c42b96066801c1868a88e361dc4e87e963b250dacd08ffebfaea8ec300dd027db0c749be81c953f6de8a23a01286910a94221b2ad2a7cc76a69df2c802fdbaebf0de6fa39caf52c0e0f63d31bca24ab9930182b2f1f20b7f7b7b4a8cef45529d7572144d0f1033fa90e201ef84a4928309f7584e8b3eda6cb8d4df272e7236daa7342d16bcecb66268c29911428c943c23253a7854c62572339f42553bf38b4e4ff6415e3b42bd5b76fe298b2211ed20eda8ec6842053cecf0e77002865c9adfdb541ec212a62a93c3ca6bac967443acb9a016ebc5553767f1d8e466619b988e5e905e499db8777d39082a2df1ead413c529106354f619bcc7ceb4e02e60bbee591f7a5edf4ffbc913a1ff38e98a5c8ee7fff2115d05f9a61d5bdc56c05b47f6dd807e0f17994a9b695b47f33df41c38dd2c145b899045d81a310f7311b68fcf7a5f38f41a119b130a613e5c03897d00aadef8b8b7fed9712825c470b21ef17165b2a97ac06c891322e51bb1732ca103356f07f008c79302d2e9adaf941c947b4c73e27cd7c005dadf4f02c36ab9868ff8177f972decd694a1ed1066a0c8b087649e2dc81fc8c09c7267c1bd3bf8ac2269b0a1722d094f01a851107b42e17220fff1673e87ffb940775856682b6937768233b1b7032e2ce072491ef2789efdf42d6e172869e076b019f32ef917d3bd948cc3b2233bf2236ffaacd63c60b332a1046706fe9f9a647e05f1aad446693deb4382d48c803fa87420c34782f0ec0797c0455f4a55ef8923f8bf4edb49fdf6a06159a9d5b61b9ad0afda0557d2188cbed094a010e098d29dff692392faeafa79d976d6c78fa16a080658aa36b1a0cc412c30d550ca8975540a0b87a0bf4a086533b69d6683b05873fda1b82c8e85aa51da8f1d89c95cce619cf689b026251738ad679eb5249436bc78d21705b115a5776e57bb0c4680bdc79aef2edd18fb824398e7411fca1b384c07ccf4b1028e9621948e0da09250f3efe3ba30a52fe5647c18483ff27d525c7225568f84da6243eeaaaf5a7e93c99085a31b6a518f0cdb211957d67bfe9f62ba5f6c486aec9311fd9ace11fd65f94daa6e1427f84e5de42049f0cf48f3cc87556585f42130e139194f5254f732aad36c3e8c7fedf73488b147d731149f8d477afcdd15a066d27c5530bf93378e3d88c3d8ca07f742b63c51d7f0f805170a459a6ca4594203a6c9439953d5b6178b7a8db9f58183b11e3fa4311e523266b42f92bfd66257fc0740d5f5a1c5a50fce4bb1df35a4e610aabe777deeeaa72a0f34d8a29c79ab76b5f48187e65bb8d6bfa7312da73e1a9f3e164046571072fb1001d5ed5f5fe0fc1a7cf8064262018c433e5b31237e67dda391cb809c8e06782563d6c98159d4c1c460b0e00ab517b2732d3bc12819ea4e50f23bf62a46886b7a6e3272c3821b2a4f943fbf472ff634cf3bd5122119746398b58bbe3c403ef6b4fae5fb8e9f7ae9c07ed421b12f4738bd1cfebdbbee2f9a6857bb4d010968155f9b55b54d8ee87cf528b62f5f0fab05164d617e2bd63d842476f918f2d2df39b1ad7360af0678ba855730b8eeef97af7b785b9c07789fab41920cc66dd065e5cfff9b40f178727fc8a5fff99068b811efd818420eb1bc45f2a7a22f9f877bc09a9efb9bd49d770ead599f0c2e0fdb4ffcad3441c62f6486613fde086ebdeb5a40c7ad89c7edefbb5b8f42812ba7dafc70740be174f01f2af47fa0be93b8e5c1d4c72c0ce9500cfd88057c5aae1647634696f0cd43418009d90d0e288ecfe9abe93fa61dd83ddaffe3d85083b1268d091941f911a1a0ab06ac833d16f066ea116d0b33a216d21c02f9ba5a19bbece29ffa94ee903c23cf505e4c972c61a3ac99952f32453d40c881ee56f26a978fad21a5e53e611f9f1de54816420df5cafe3a67c0accdb686b2d0961211c73ae048c8775c0b9798a744c6aeb5a1317827e36426c0ddd18038a970e45ae15f1b551300b93c3e27c0df7fa6f889fdc72ab50835696ac4e567bf289ec247d851c2c715b9495e77b5a3dbd03d3aff3180043316d5959709d89b18331b4fb4c921ee14c576d4ce71930b5baf0deb0fc060d35e1e9f1c1323d243ccfc166bda65527438b8b41d969661a1df70a7abff735b35554056a82f498d46eeb835fe6a84f474379699531a5d5d5be2cd0916342ea79424219d1aef2f5871829cb58394898f8901f33d4fc83c67108ebfcfa4c54ae697c2651803c15e6ffa00e583c11f2c91e179562fc6c0e05a6f178f29841a5d1ca12feb279fe86801f32ac95d8977d5993dfc0fbd664ce2cde73afa4b9621d05e1779e6fdc36d579a370381154572d75260cf60a071158e99cfafd311c8af97e268737a729c1ee18bb6a95c64dfaea95cc6c5ba2e82dad8e0cb95334d05cb60db3491f0c756cccf26bc1c9665947bb8107f9bd2825de12311513ac374bd4c7b370243fa8576601f731b8dcb77a3db0950d98b600e67245532940012eece1e09f4d9f009435309227b0f28de1e014afba15b10953cf3dc610fbcbb652965cc72f3a26f91e7510094253b3bae289868b54a5f7f10a20116c0945890bd913534432d386ec3c8047bc525c71d7c37c5111ff90cdf25abaef49ea1a17a1ace80df37bb51cb253f5f6ceec8983a1762f1d4ae0e432e28f46998fa09a29e3165e0c69ed600281d7cc8a9ef09a0033de405e03b8c3afa09e192a1fd83bdf663ef51dc9f49060d5905dfa36abbda8831b168cb1a3f6205a51057da70011ac49ea48b21bcaf27c4f021ff2fa88f777e65d96f27829bbb8d5a7823626457ce00e3351b35ad2048630ff9533bb2b34a0aaba7cf9eab969c1554b3c1a497d0528b34c3f1a1a22405d1c0d9693c19bce1bc9ed536a66fcccbefa942a1cacec656ef56191d32db0fd471e62ac40db50c27ffc6a4de3eee510867d666a5d2a3af70ea49993858c998987e0e3cb534f9146144a7296b9a96c755f122e15e9aed76f537c51837487c554e4d25ddcae881d58069a0093915c3bbe2f8647849acca3aab55432da7107c422274cb43e398e17b8c4f43c50a6a4617d7f3656d3505110f885fc2d2b950c6c34ea0120da2f111e794a38a24fe8e6e70c25c2d2fc6c00dc9c369b1b5dbb5d7bb5f4d3d34f8bfdc633be412182c50caea9b2782666ed1fd8fba61c9fc0b3f75aa05a28b2dd57"]}]}, 0x1000}, 0x1, 0x0, 0x0, 0x8054}, 0x80) r7 = socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) r9 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r9, &(0x7f0000000080)={0x1d, r3}, 0x10) r10 = socket(0x10, 0x80002, 0x0) listen(r7, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x48}}, 0x400400c0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="280000001e000100000000000000000007"], 0x28}}, 0x0) sendmmsg$alg(r10, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x8}, {0x7, 0xf}, {0xe, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x44060}, 0x98) 1.112307979s ago: executing program 2 (id=4687): r0 = socket$inet(0x2, 0x5, 0x0) sendfile(r0, r0, 0x0, 0xffffffffffffffff) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFCONF(r2, 0x8912, 0x0) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002100), 0x48) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000100)={0x18, 0x0, {0xfffd, @random="c0c13c2baeb6", 'macvlan1\x00'}}, 0x1e) sendmmsg$sock(r4, &(0x7f00000009c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="0816", 0x2}], 0x1}}], 0x1, 0x0) unshare(0x28020480) r5 = socket$caif_stream(0x25, 0x1, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1}, 0x50) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r8}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r9}, 0x38) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000240)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl0\x00', r7, 0x29, 0x6, 0x45, 0x11, 0x48, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x1, 0x707, 0x9, 0x7}}) setsockopt$CAIFSO_LINK_SELECT(r5, 0x116, 0x7f, 0x0, 0x22) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)=@ipv6_getrule={0x1c, 0x22, 0x100, 0xd, 0x25dfdbfe, {0xa, 0x0, 0x14, 0xa, 0xa2, 0x0, 0x0, 0x4, 0x10000}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x8, &(0x7f0000000000)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}]}, &(0x7f0000000640)='syzkaller\x00', 0x7, 0xf9, &(0x7f0000000080)=""/249}, 0x70) 1.024753445s ago: executing program 3 (id=4688): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) close(0x3) (async, rerun: 64) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000040000000800000002"], 0x50) (async, rerun: 64) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3}, &(0x7f0000000080), &(0x7f0000000240)=r4}, 0x20) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r4, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000280)="b9ff03076804268c989e14f088a8", 0x0, 0x800, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) (async, rerun: 64) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000031401002cbd7000fcdbdf250900020073797a3200000000080041"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) (async, rerun: 64) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r5, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) (async) r6 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r6, 0x84, 0x7f, &(0x7f0000000080)=""/4041, &(0x7f0000000000)=0xfc9) (async) connect$netrom(r5, &(0x7f00000010c0)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x4}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) listen(r5, 0x7e) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300d68c05036c7200000000000000000000000000000a0001006f776e65720000000900010073797a30000000000900020073797a32"], 0x98}}, 0x4048010) r7 = socket(0x2, 0x80805, 0x0) r8 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r8, 0x29, 0xc8, &(0x7f0000000340), 0x4) (async, rerun: 64) setsockopt$MRT6_DONE(r8, 0x29, 0xc9, 0x12, 0x0) (async, rerun: 64) sendmmsg$inet(r7, &(0x7f0000000c80)=[{{&(0x7f0000001080)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000180)="fd", 0x1}], 0x1}}, {{&(0x7f0000001180)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f00000011c0)}}], 0x2, 0x4000) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000001590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="8b040400000000002000128008000100736974001400028008000200c00002000600080003"], 0x40}}, 0x0) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000040)) 981.680366ms ago: executing program 0 (id=4689): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002d80)={0x6, 0xf, &(0x7f0000002d00)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xe3e, 0x0, 0x0, 0x0, 0x1}, {}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x1}}}, &(0x7f0000000280)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x0, 0xfffffffc}, 0x10}, 0x90) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r2) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r2) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000000f200000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x4004040}, 0x10) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000001880)={@map, 0xffffffffffffffff, 0x16}, 0x20) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@newtaction={0x48, 0x32, 0x1, 0x80, 0x25dfdbfe, {}, [{0x34, 0x1, [@m_vlan={0x30, 0x1, 0x0, 0x0, {{0x9, 0x3}, {0xfffffffffffffd97}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x48}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000040)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x1a}, 0x94) 936.409454ms ago: executing program 2 (id=4690): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x420200, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb000d0200000007020000c81fcd17ec803cbb43e3d31bb41a010006d2c8b8ac7bdf834f4cf262beddd73e7f5f83a48ad36e1b07d51d201687b1bbafb4d181091d1aeedd73a5d1de87ffc7"], 0x56) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x11000) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000100)=@o_path={&(0x7f00000000c0)='./file0\x00', r2, 0x4000, r0}, 0x18) 881.228278ms ago: executing program 4 (id=4691): r0 = socket$inet(0x2, 0x6, 0xb) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000040000000800000014100000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00'], 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0c00000004000000040000000700000000000000", @ANYRES32=r1, @ANYBLOB='\b\x00\x00\x00\v\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x12, 0x7, 0x8, 0x22, 0x100, 0xffffffffffffffff, 0x4}, 0x50) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040)={0xfffd, 0xa2, 0x0, 0x7, 0xd7, 0x5, 0x0, 0x4, 0x0}, &(0x7f0000000100)=0x20) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000680)={r5, 0x95, "c11a09b38ffd1b47cf504171b9fbc3837742559f41741a0014a91dd0f40a82b30023736cd340d17c0e55643a4abb163883d7925c11ccacc81946e754e1ca0dc8988f7fcd863170bd7d44bd3c92fb4a331027978cb0e1d5deb9daa35ec5d71cee4bc2e782eb5f17c456c4ed23f5ee30730f597050c60073e0623507d55ee5e07678e0449595b1cbafb339bcece2132edab7e611c9cd"}, &(0x7f0000000740)=0x9d) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0e0000000400000004000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xe, 0x0, &(0x7f0000000000)="43227504000000b32415f73227b2", 0x0, 0xd01, 0x0, 0x0, 0x47, 0x0, 0x0, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x178, 0xe138, 0x198, 0x0, 0x198, 0x230, 0x358, 0x358, 0x230, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'nicvf0\x00', 'veth0_to_bond\x00'}, 0x0, 0x158, 0x178, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d0005000000000000000404fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c429955608b9952bed40ce4a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000080049", 0x4}}, @inet=@rpfilter={{0x28}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x5, 0x1, 0x9, 0xf, 'pptp\x00', {0xe}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x328) pipe(&(0x7f0000000080)) 818.405182ms ago: executing program 1 (id=4692): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000380), &(0x7f00000003c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r3}, &(0x7f0000000440), &(0x7f0000000480)}, 0x20) (async) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x38, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x84d}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x2}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x337}]}]}, 0x38}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000bf090000000000005509010000030000950000000000000085100000f5ffffffbf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000240)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @sk_reuseport, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0x1}, &(0x7f0000000000), &(0x7f0000000180)}, 0x20) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r4}, &(0x7f0000000080), &(0x7f0000000240)=r5}, 0x20) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0xf, &(0x7f0000000200)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x4000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) 700.371957ms ago: executing program 3 (id=4693): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000fff07006706000020000000170200000ee60000bf050000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad35010000000000840400000000000014000000000000009500000000000000db13d5d8b741f2cdaabc83df03395287fd51a700ea6553f304000000815dcf00c3eebc52267b042d196bde7c382d21ff79a8583a7482c5994747e19325b1ee980cbd800d845dacbcf5ad8cdbc7abf9"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) (async) r0 = socket(0x10, 0x803, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x69}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000bc0)={'ip_vti0\x00', &(0x7f0000000b40)={'gre0\x00', 0x0, 0x1, 0x10, 0x6, 0x0, {{0x7, 0x4, 0x0, 0x8, 0x1c, 0x64, 0x0, 0x5, 0x4, 0x0, @multicast2, @empty, {[@cipso={0x86, 0x6, 0x1}]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1300000056000100000000000000000007"], 0x18}}, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r2, 0x114, 0x6, &(0x7f0000000000)={0x3, "445aa1"}, 0x4) (async) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000040)=0x1, 0x4) (async) syz_genetlink_get_family_id$team(&(0x7f0000000000), r0) 684.708372ms ago: executing program 0 (id=4694): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{}, "cf556c33235019ca", "b21eaca21cd0da29761ca41ca77830b7", "2833fbce", "8893ffe76209f4c5"}, 0x28) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xffffffffffffffff}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x4}]}}]}, 0x48}}, 0x0) socket(0x10, 0x3, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{}, "cf556c33235019ca", "b21eaca21cd0da29761ca41ca77830b7", "2833fbce", "8893ffe76209f4c5"}, 0x28) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'gretap0\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xffffffffffffffff}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x4}]}}]}, 0x48}}, 0x0) (async) 679.511786ms ago: executing program 1 (id=4695): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000800)={'veth1_to_team\x00'}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2}, @TCA_FQ_QUANTUM={0x2, 0x2, 0x7000000}]}}]}, 0x48}}, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x3, {{0x1, 0x4}}}, 0x10) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r4, 0x12, 0x3, &(0x7f0000000040)=0x58, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x25, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5dd9}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x1}, @btf_id={0x18, 0x2, 0x3, 0x0, 0x2}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='syzkaller\x00', 0x101, 0xc5, &(0x7f0000000340)=""/197, 0x74211e840c47fb1c, 0x0, '\x00', r2, @fallback=0x20, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x2, 0x1}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000280)=[{0x0, 0x2, 0x6, 0x5}, {0x3, 0x2, 0x3, 0x9}, {0x5, 0x3, 0x5, 0x5}], 0x10, 0xe3}, 0x94) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000007c0)) syz_extract_tcp_res$synack(&(0x7f0000000840)={0x41424344, 0x41424344}, 0x1, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000880)={@local, @random="a9c942034375", @val={@val={0x88a8, 0x4, 0x1, 0x3}, {0x8100, 0x3, 0x0, 0x1}}, {@ipv4={0x8864, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x22, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}}, {{0x0, 0x0, r6, r6, 0x0, 0x0, 0x5}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r5, 0x0, 0x51, 0x32, &(0x7f0000000500)="303c3af12ea5b3e56aaac1eb9d5aa9965979c95b9654ee82d322ece0b0acb82c466d4149095f6111f4032759c26bd992c88604e5a8610d38c5ae5dade2c870bd9cf2583a1fdef826014f7f9bbc1dac8ecb", &(0x7f0000000580)=""/50, 0x4, 0x0, 0xc6, 0x66, &(0x7f00000005c0)="08082ae5095d1ca047db59410f29d88323d575211b4607346e4294df5012561512b68597c9a8d5388ccc60e45239d23b8aa998f6c90147993654561a00ae0e9ff467b965cfd993b1b13953a57c4fc8096275fc93726264340e19f09c60b00f692f579599394b55c0e4198b2d0828d302fa614b88782f7e84fb46a0c49dfbc8178b779d59c21da03466bcd572cc4f3496aa6ab7aee658067d77e26a524381a95acf1f7ceebb560b00f7d30ce647e2aad01ebb33fa2ca4774bf34a25b3f9da8b45c1d3c3a2f2cd", &(0x7f00000006c0)="3a6f33c6e8fa1daafc6b32e64deddb3b1613e92051901b77336b483d4eb9e36b46da9395ca227a952cc67ea8975d461a8e046a8bb1efdfea3e900e1ea65b7fb041154d9d0aeec09b9f2a27504a4251a572a04451a32e49c624775140d64335642c26d0da0067", 0x4}, 0x50) 612.264054ms ago: executing program 4 (id=4696): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x0, 0x33, &(0x7f0000000000)=0x80000000, 0x4) (async) connect$inet(r0, &(0x7f0000000040)={0x2, 0x6e25, @multicast2}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)=@newlink={0x30, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_NET_NS_PID={0x8}, @IFLA_TARGET_NETNSID={0x8, 0x2e, 0x4}]}, 0x30}}, 0x88890) (async) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x0, 0x33, &(0x7f0000000000)=0x80000000, 0x4) (async) r3 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r3, &(0x7f0000000080)={0x2, 0x0, @broadcast, 0x4}, 0xffffffffffffffd2) close(0x4) 512.3643ms ago: executing program 3 (id=4697): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xc, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000091108c000000000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000500)={0x0, @in={{0x2, 0x4e22, @local}}, 0xf, 0x3}, &(0x7f00000005c0)=0x90) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='blkio.throttle.read_iops_device\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000140)=0x3, 0x12) (async) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c00000030271576aa7668fc7a58aa7120fc3d92c905edec3a2d51df52e72036c1415f4c02c09cd631361794073f3ea0d66df240eb1031e9fe3bb756b20c074dec902c", @ANYRES16=r3, @ANYBLOB="01002bbd7000000000000100000033fc07800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c0005008554330f0294bc3e0c000200ffff000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x2000000}, 0x4000090) (async) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000001c0), r1) sendmsg$NLBL_MGMT_C_LISTDEF(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="000225bd7000fedbdf2506000400"], 0x14}, 0x1, 0x0, 0x0, 0x4000e990}, 0x6008040) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) 512.009769ms ago: executing program 1 (id=4698): r0 = socket(0x10, 0x3, 0x0) recvmsg(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000680)=""/236, 0xec}, {&(0x7f0000000780)=""/164, 0xa4}, {&(0x7f0000000840)=""/4096, 0x1000}, {&(0x7f0000000280)=""/112, 0x70}], 0x4, &(0x7f0000001880)=""/212, 0xd4}, 0x2000) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x14, 0x52, 0x3ab3666c4349b199, 0x0, 0x0, {0x1c}}, 0x14}}, 0x0) (async) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2) (async) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB="14000000000700000300"/20], 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 32) close(0x3) (rerun: 32) connect$unix(r3, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610418000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) (async) sendmsg$NL80211_CMD_REQ_SET_REG(r4, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="c4020000", @ANYRES16=r5, @ANYBLOB="00032cbd7000fbdbdf251b0000000400cc00d40022803400008008000400000000000800060001800000080002000300000008000400c7050000080007000100000008000700030000004c000080080001000900000008000100030000000800020005000000080006000f000000080005000d000000080006000400000008000200030000000800070000020000080002000200000014000080080003000000000008000100030000003c00008008000200090000000800050001000000080004008b0900000800030006000000080001000700000008000100010000000800020000020000c40022803400008008000500d20c0000757e040003000000080007000300000008000600813f000008000400f5ffffff080006000300000034000080080007005e0a0000080007000000000008000700030000000800070002000000080002007f00000008000300ff030000240000800800060024000000080002006c0200000800070084b1000008000600020000003400008008000300040000000800020001a100000800030000f0ffff0800030002000000080007000400000008000500ffffffff08009a0002000000060021006200000006002100620000000400cc0088002280340000800800ff0000040000080004000700000008000200000000000800060002000000080006000000000008000300080000001c000080080003003e4000000800070003000000080006000000000034000080080007002a000000080004000157000008000600090000000800050009000000080004000010000008000700000800007000228014000080080004000e00000008000300040000004400008008000100010400000800030001000000080006000900000008000600fcffffff08000500020000000800030007000000080001000c000000080005000700000014000080080001000600000008000500f9ffffff"], 0x2c4}}, 0x40001) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b36, &(0x7f0000000000)={'wlan0\x00'}) (rerun: 32) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)={r2}) sendmsg$AUDIT_GET_FEATURE(r6, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x10, 0x3fb, 0x8, 0x70bd2d, 0x25dfdbfe, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x4000) 496.494619ms ago: executing program 0 (id=4699): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x13, &(0x7f0000000200)=ANY=[@ANYBLOB="180800001bc81a000000000002000001851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000101180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000e500010000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41000}, 0x94) 484.330214ms ago: executing program 4 (id=4700): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x20, 0x1c, 0xff, 0xfffff014}, {0x6}]}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="24000000190001090000000000000000021800000003de010000000008000100ac1414"], 0x24}}, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f0000000540)={0x0, 0x1f, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r5], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000dc0)={0x58c, r6, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_DEBUG_MSGMASK={0x34, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xb6e}, @ETHTOOL_A_BITSET_BITS={0x20, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}]}]}, @ETHTOOL_A_DEBUG_HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x80, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xed}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x7}, @ETHTOOL_A_BITSET_BITS={0x20, 0x3, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}, @ETHTOOL_A_BITSET_VALUE={0x3a, 0x4, "8f8ffc3db9ada4d90cde26ce592b9c163062c3db9e0768f2c6dcdfe2afe22e3a30d1a3452e44b9c1afedae5c1e636b407e9ece7207ae"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @ETHTOOL_A_DEBUG_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x3d0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}]}]}, @ETHTOOL_A_BITSET_BITS={0x6c, 0x3, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xe, 0x2, 'syzkaller\x00'}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan1\x00'}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '-\'\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'wlan1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '-%-\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}]}, @ETHTOOL_A_BITSET_MASK={0xe3, 0x5, "2fe421b36215673f4071c4e51ace38915aeb813e765fb6c9feb94151a07d8f710f8a60f817b5c55ab86cd2eecb6b4cfebfdd6459cf2481271762e610b1a7b6b9cc6dd2ffc404321dc4a96fd17f97740d3b13ddb327bd1f4c1930e0dc834187be449c98f50597dcb3e7e3e7b4c4f61fc7ee3e76838b5105adaa375d474ac96a88d7d21f5ed4ab299252b2aa3b4eb30c2d3c4190b6a861cd15fc7b3e5afa966ff5c533d4ddba89c2dd5593e64b7d5c36594ccfaae6f1fa6c529e156cdec25bbc46f0ff8b56ae6247c1a19462a4e6b2e37b1a13caf8c8106276c9a10174ec52d2"}, @ETHTOOL_A_BITSET_VALUE={0xde, 0x4, "310eff6f0978b23511ddb3d5acdb02eed44139cf57ed0061c3719206818fdd200123d3296b02b0d4f496c48ee62ee84fd73d7572fa01050e23044338d49038a6d7e9d7bced400a8b6d74f79a3f0f51cf5a860a9048fbce2c8419f1d8ccbc8a28294f1d3e47c4a9ec50ae1fac9249b2e274e76058f57b1316addb2eceeb018c0f45218a8d97ceae4e8af05b9d76d343f1a513bfa20d6a10460571b2b3def61f51a2cefa7cd36e980b2d5c86df458090d65ec7e020c114941dd27a0c42b7c7eaa87b87af2395a7f750276937813314753e2f7ae05a21d8731633ef"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_MASK={0x7b, 0x5, "666b87948a4b902242d3a79dd6cae47d7a2312ec5a874dec873153a2933f6102ac9eb55ac4d35d04cb10aaf95178d3b71f4ddaebfc4b30923e8d2d5b09d6f0d4b6ed518eceb8ac1f508703e40aa755443daff608f135b2b4fe2467aae0b70e3efdd610ca464128feee9377c8d976b11ca2dfb309197b5b"}, @ETHTOOL_A_BITSET_VALUE={0xfa, 0x4, "74223384b7e2eb13d9fdec964838e719a8e3767d30de03ce46acc849b327d11cda95e14f3e36194f2977ebc60f1f44cee96e2bddfcffe5fe6feaf9b7ffcc2c75fc367b9304308f1838c644d2c9e65d62e31f40c1e729f3b1444495087c8c8a8f92932b91e0b620206befa8c7c8a0df03712b39d7e6add31a291a0c1ae261c341d59d6a36fbddd90843a6c547e0c06dfad378e2e2ef425ab3e91f3c4cd42559481218978aa85f547d1030aeba9c2ecee0ed3af771a163e82fa18ee7c7a8653ee09df62fee7899a996e23c2bff902b43c8e7984b90fcde511925660e6711299746ae8e0728b8c90ad2eafdc21674ed08ab55a46011479c"}]}]}, 0x58c}, 0x1, 0x0, 0x0, 0x8000}, 0x44) socket$nl_route(0x10, 0x3, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000040)='/0', 0x2}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x94, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@filter={'filter\x00', 0x4, 0x4, 0x370, 0xffffffff, 0xe8, 0xe8, 0x0, 0xfeffffff, 0xffffffff, 0x2a0, 0x2a0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x1f}, @loopback, [0xffffffff, 0xffffff00, 0xffffffff, 0xffffff00], [0xffffff00, 0xffffffff, 0xffffffff, 0xffffff00], 'wlan1\x00', 'sit0\x00', {}, {0xff}, 0x87, 0x3, 0x4, 0x5}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private2, @empty, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xff000000, 0x1ffffff01], 'sit0\x00', 'batadv_slave_1\x00', {0xff}, {}, 0x34}, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x5, {0x2000010}}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) 403.380654ms ago: executing program 3 (id=4701): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000001100)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x4f, 0x0, "39be251d1eabe5d383b83d7b7e3d8a239273c82b1fc06d23d50e17e69c6ee2848410590f6c0e2a534af6bf6748eb4c584401b16c30a714c496c77ddfd4e196378b7ab3ef23a522d8b89388ab4e3fb8d0"}, 0xd8) (async) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8}, 0x48) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000), 0x20000328) (async) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d40), 0xffffffffffffffff) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x34}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000d80)={0x38, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10000000009}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfe}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x891}, 0x0) 402.746325ms ago: executing program 1 (id=4702): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="660a00000000000061117100000000009500"], &(0x7f0000000000)='GPL\x00'}, 0x90) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.kill\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000a, 0x12, r4, 0x0) ioctl$FIBMAP(r4, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'veth0_to_batadv\x00', 0x0}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000800)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)=r2}, 0x20) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000840)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x5}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x18, 0x20, &(0x7f0000000540)=@raw=[@btf_id={0x18, 0x0, 0x3, 0x0, 0x5}, @exit, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffff9}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x60}}, @map_idx_val={0x18, 0xf, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0xae}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x297d}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}], &(0x7f0000000640)='GPL\x00', 0x9, 0x40, &(0x7f0000000680)=""/64, 0x41000, 0x2, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000700)={0x0, 0x8, 0x2, 0x7fff}, 0x10, 0x0, 0x0, 0x6, &(0x7f00000008c0)=[r6, r7, r8, 0x1], &(0x7f0000000900)=[{0x1, 0x4, 0x4, 0xa}, {0x4, 0x4, 0x7, 0xb}, {0x1, 0x3, 0xc, 0x7}, {0x4, 0x5, 0xe, 0x6}, {0x3, 0x2, 0x0, 0xc}, {0x1, 0x5, 0x5}], 0x10, 0x7}, 0x94) r9 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000003c0)=0x0) sendmsg$NFC_CMD_DEACTIVATE_TARGET(r0, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x4c, r9, 0x10, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r12}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_TARGET_INDEX={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20088001}, 0x14) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000280)={0x0, 0x33, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001ca8186ed8328a492aa52abaf25d793a15a8bc1cb4a2a2581f39668b3304b3325c563b5efd163150c668f105eefa69b21bec01eb54e0dd8f50698b4a4bdc98269ea8baa3ae6d77bd78c39f823cbaf61618d3719bf1338f93832b18e195ee0ce264d085908e90a14ed114e5c9112e0dce", @ANYRES16=r1, @ANYBLOB="210226bd7000fcdbdf250300000006000a00232700000c000200faffffffffff7fff0c00030000020000000000000800010000000000055061243f3ecc58a562439c72d4a29c81db7e86319cac4c11eb95453a4ee5df67ebfd106136d6f7ced70dad22550421fb2175dbe68b8002a05c8be74c3a1cd5"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000004) 354.930805ms ago: executing program 0 (id=4703): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 315.767955ms ago: executing program 4 (id=4704): r0 = socket(0x23, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_1\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 248.342126ms ago: executing program 3 (id=4705): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00', 0x0}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$int_in(r3, 0x5452, &(0x7f0000000180)=0x401) listen(r3, 0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000000)=0xffffffffffffffff) (async) shutdown(r3, 0x0) (async, rerun: 64) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@cgroup=r2, 0xf, 0x1, 0x9, &(0x7f0000000080)=[0x0, 0x0], 0x2, 0x0, &(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) (rerun: 64) recvmsg(r3, &(0x7f00000005c0)={&(0x7f00000002c0)=@x25, 0x80, &(0x7f0000000500)=[{&(0x7f00000003c0)=""/90, 0x5a}, {&(0x7f0000000440)=""/164, 0xa4}], 0x2, &(0x7f0000000540)=""/111, 0x6f}, 0x1) (async, rerun: 64) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000280)={@ifindex=r1, r2, 0xd, 0x2008, r2, @value=r2, @void, @void, @void, r4}, 0x20) (async, rerun: 64) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a90010000060a0b0400000000000000000200000064010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5a4f159d6e5fe8e31627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461469a72f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b87901a2e8f50900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) 231.85887ms ago: executing program 0 (id=4706): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipmr_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x80, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x1c}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000300), r2) sendmsg$L2TP_CMD_NOOP(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x28, r3, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x1f, 0x10, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x81}, [@snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r12}, {}, {0x85, 0x0, 0x0, 0xb3}}]}, &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r13}, 0xc) sendmsg$nl_route_sched(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x3fff, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x4, 0x3}, {0xffff, 0xfffd}, {0xfff1, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0xdc}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x4}, {0xffff, 0xffff}, {0xe, 0x1}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7, 0x1}}}}, @TCA_RATE={0x6, 0x5, {0x0, 0xc1}}]}, 0x48}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 231.321264ms ago: executing program 1 (id=4707): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) close(0x3) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x40000) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x65}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}}, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) r7 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000800)=@newtfilter={0x54, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {}, {0x2, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x20, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x1c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x19}]}]}]}}]}, 0x54}}, 0x20000000) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000180)=@netrom={'nr', 0x0}, 0x10) 158.681843ms ago: executing program 3 (id=4708): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f00000002c0)=0x20, 0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x34, &(0x7f00000000c0)=r0, 0x4) listen(r1, 0xfffffffd) close(r1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000500)={'tunl0\x00', 0x0}) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$int_in(r5, 0x5421, &(0x7f0000000000)=0xfffffffffffffff9) listen(r5, 0x0) accept4(r5, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="48000000100003002abd70000000000000000000", @ANYRES32=r4, @ANYBLOB="0000000000000000280012800900010069706970000000001800028004001900080014000900000006000f"], 0x48}, 0x1, 0x2}, 0x24000085) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) openat$cgroup_freezer_state(r6, &(0x7f0000000080), 0x2, 0x0) write$cgroup_pid(r7, &(0x7f0000000040), 0x12) unshare(0xa020480) r8 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r8, 0x800442d4, &(0x7f00000000c0)=0xb) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r9, 0x400452c9, &(0x7f0000000100)) getsockopt$IP_SET_OP_GET_BYNAME(r9, 0x1, 0x53, 0x0, &(0x7f0000000240)) socket$packet(0x11, 0x2, 0x300) write(r2, &(0x7f0000000040)="05000000010097", 0x7) 85.665994ms ago: executing program 4 (id=4709): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000040)=0xa511, 0x4) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r3, @ANYRES32=r3], 0x44}}, 0x2000800) syz_genetlink_get_family_id$tipc(0x0, r3) 0s ago: executing program 2 (id=4710): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = accept4$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000440)=0x1c, 0x0) getsockopt$inet6_int(r1, 0x29, 0x5, &(0x7f0000000480), &(0x7f00000004c0)=0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x1, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r4, @ANYBLOB="010000000000000000000100000004000180ac000280"], 0xc4}}, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r2, 0x0, 0x0, 0xc806, &(0x7f0000000180)={0x2, 0x4e21, @multicast1}, 0x10) sendto$inet(r2, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x398, 0x0, 0x1170, 0x1398, 0x0, 0x1170, 0x2c8, 0x1398, 0x1398, 0x2c8, 0x1398, 0x3, 0x0, {[{{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@inet=@socket1={{0x28}, 0x17470f201d1ec251}, @inet=@rpfilter={{0x28}, {0xf}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x2, 0x6, 0x800}}}, {{@uncond, 0x0, 0x160, 0x1a8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @common=@srh1={{0x90}, {0x1, 0x0, 0x0, 0x0, 0x0, @loopback, @private0={0xfc, 0x0, '\x00', 0xfe}, @loopback, [0x0, 0x0, 0x0, 0xff], [], [0xffffff, 0x0, 0xff000000], 0x0, 0x803}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x6}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) kernel console output (not intermixed with test programs): 61] bond_slave_0: left allmulticast mode [ 339.969006][T14161] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 339.977912][T14161] bond_slave_1: left allmulticast mode [ 339.985272][T14161] .` (unregistering): (slave bridge_slave_1): Releasing backup interface [ 339.994479][T14161] bridge_slave_1: left allmulticast mode [ 340.001360][T14161] .` (unregistering): Released all slaves [ 340.011078][T14161] bond1 (unregistering): Released all slaves [ 340.024591][T14161] bond2 (unregistering): Released all slaves [ 340.040147][T14161] bond3 (unregistering): Released all slaves [ 340.053153][T14161] bond4 (unregistering): Released all slaves [ 340.073852][T14161] bond5 (unregistering): Released all slaves [ 340.090708][T14161] bond6 (unregistering): Released all slaves [ 340.104153][T14161] bond7 (unregistering): Released all slaves [ 340.117168][T14161] bond8 (unregistering): Released all slaves [ 340.131853][T14161] bond9 (unregistering): Released all slaves [ 340.156553][T14161] bond0 (unregistering): Released all slaves [ 340.172715][T14161] bond10 (unregistering): Released all slaves [ 340.185948][T14161] bond11 (unregistering): Released all slaves [ 340.211668][T14161] bond12 (unregistering): Released all slaves [ 340.225054][T14161] bond13 (unregistering): Released all slaves [ 340.239122][T14161] bond14 (unregistering): Released all slaves [ 340.256595][T14161] bond15 (unregistering): Released all slaves [ 340.551415][T14161] : left promiscuous mode [ 340.783082][T14161] v: left promiscuous mode [ 340.851362][T16886] __nla_validate_parse: 12 callbacks suppressed [ 340.851384][T16886] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3050'. [ 340.988351][T14161] tipc: Disabling bearer [ 341.000612][T14161] tipc: Left network mode [ 341.349046][T16759] chnl_net:caif_netlink_parms(): no params data found [ 341.399246][ T5826] Bluetooth: hci2: command tx timeout [ 341.751866][T16929] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3057'. [ 342.003940][T16940] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3059'. [ 343.339838][T16939] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3059'. [ 343.348939][T16939] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3059'. [ 343.362641][T16939] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3059'. [ 343.479359][ T5826] Bluetooth: hci2: command tx timeout [ 343.623066][T16759] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.629948][T16957] Bluetooth: MGMT ver 1.23 [ 343.639562][T16759] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.651768][T16759] bridge_slave_0: entered allmulticast mode [ 343.661026][T16759] bridge_slave_0: entered promiscuous mode [ 343.686509][T16963] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3063'. [ 343.703267][T16959] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3065'. [ 343.711914][T16759] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.723903][T16759] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.735428][T16759] bridge_slave_1: entered allmulticast mode [ 343.744617][T16759] bridge_slave_1: entered promiscuous mode [ 343.861044][T16970] netlink: 'syz.4.3067': attribute type 2 has an invalid length. [ 343.880834][T16970] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3067'. [ 343.926560][T16978] netlink: 'syz.3.3068': attribute type 2 has an invalid length. [ 343.961703][T16759] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 343.993183][T16759] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.224135][T16759] team0: Port device team_slave_0 added [ 344.264869][T16759] team0: Port device team_slave_1 added [ 344.535718][T16759] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 344.569084][T16759] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.635710][T16759] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 344.677781][T16759] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 344.698386][T16759] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.735991][T16759] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 344.964787][T16759] hsr_slave_0: entered promiscuous mode [ 344.987453][T16759] hsr_slave_1: entered promiscuous mode [ 345.020275][T16759] debugfs: 'hsr0' already exists in 'hsr' [ 345.026070][T16759] Cannot create hsr debugfs directory [ 345.126304][T14161] hsr_slave_1: left promiscuous mode [ 345.142872][T14161] veth1_vlan: left allmulticast mode [ 345.251771][T14161] team0 (unregistering): Port device batadv1 removed [ 345.342935][T17041] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3079'. [ 345.436695][T14161] team0 (unregistering): Port device team_slave_1 removed [ 345.451855][T14161] team0 (unregistering): Port device team_slave_0 removed [ 345.569638][ T5826] Bluetooth: hci2: command tx timeout [ 345.961855][T17057] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3085'. [ 346.415713][T17072] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 346.432347][T17086] netlink: 'syz.3.3090': attribute type 10 has an invalid length. [ 346.441935][T14161] IPVS: stop unused estimator thread 0... [ 346.470326][T17084] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3092'. [ 346.492159][T17087] netlink: 'syz.3.3090': attribute type 10 has an invalid length. [ 346.500852][T17084] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3092'. [ 347.010402][T17123] netlink: 'syz.2.3098': attribute type 1 has an invalid length. [ 347.036119][T17123] netlink: 'syz.2.3098': attribute type 1 has an invalid length. [ 347.078859][T17123] netlink: 'syz.2.3098': attribute type 1 has an invalid length. [ 347.132054][T17123] netlink: 'syz.2.3098': attribute type 1 has an invalid length. [ 347.185481][T16759] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 347.204567][T17123] netlink: 'syz.2.3098': attribute type 1 has an invalid length. [ 347.210662][T16759] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 347.219775][T17123] netlink: 'syz.2.3098': attribute type 1 has an invalid length. [ 347.274359][T16759] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 347.315753][T16759] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 347.562654][T17149] net_ratelimit: 56 callbacks suppressed [ 347.562677][T17149] openvswitch: netlink: Unexpected mask (mask=2020040, allowed=2010048) [ 347.595588][T17151] tunl0: entered promiscuous mode [ 347.603439][T17151] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3104'. [ 347.615892][T17149] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3105'. [ 347.633296][T17153] vlan2: entered allmulticast mode [ 347.638461][T17153] bond0: entered allmulticast mode [ 347.653453][T17149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 347.661851][T17153] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3106'. [ 347.678419][T17154] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3104'. [ 347.715184][T17153] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 347.794910][T17153] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 347.822836][T17153] .` (unregistering): (slave netdevsim0): Releasing backup interface [ 347.842317][T17153] .` (unregistering): (slave bridge0): Releasing backup interface [ 347.857359][T17153] .` (unregistering): Released all slaves [ 347.874906][T17169] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3110'. [ 347.911529][T17168] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3109'. [ 347.916756][T17163] syzkaller0: entered promiscuous mode [ 347.926714][T17163] syzkaller0: entered allmulticast mode [ 348.183466][T16759] 8021q: adding VLAN 0 to HW filter on device bond0 [ 348.207281][T17182] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.3113'. [ 348.386075][T17191] gretap0: entered promiscuous mode [ 348.396278][T17191] vlan2: entered promiscuous mode [ 348.402126][T17198] openvswitch: netlink: Flow actions attr not present in new flow. [ 348.434334][T16759] 8021q: adding VLAN 0 to HW filter on device team0 [ 348.457006][T17185] bond1: (slave vcan1): refused to change device type [ 348.521200][T17195] vlan0: left promiscuous mode [ 348.526211][T17195] geneve1: left promiscuous mode [ 348.579886][T17195] vlan0: left allmulticast mode [ 348.599637][T17195] geneve1: left allmulticast mode [ 348.629637][T14162] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.636890][T14162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 348.734213][T14162] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.741490][T14162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 348.897557][T17208] syzkaller0: entered promiscuous mode [ 348.906241][T17208] syzkaller0: entered allmulticast mode [ 350.201857][ T5826] Bluetooth: hci0: command tx timeout [ 351.269017][T17232] __nla_validate_parse: 3 callbacks suppressed [ 351.269040][T17232] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3124'. [ 351.285793][T17234] validate_nla: 62 callbacks suppressed [ 351.285811][T17234] netlink: 'syz.3.3118': attribute type 29 has an invalid length. [ 351.582268][T17293] tipc: Enabling of bearer rejected, failed to enable media [ 351.699347][T17302] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3128'. [ 351.773516][T17302] hsr_slave_0 (unregistering): left promiscuous mode [ 351.885119][T16759] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 351.968834][T16759] veth0_vlan: entered promiscuous mode [ 351.994636][T16759] veth1_vlan: entered promiscuous mode [ 352.080574][T17320] bond2: option lp_interval: invalid value (0) [ 352.087081][T17320] bond2: option lp_interval: allowed values 1 - 2147483647 [ 352.100601][T17320] bond2 (unregistering): Released all slaves [ 352.158390][T16759] veth0_macvtap: entered promiscuous mode [ 352.192360][T16759] veth1_macvtap: entered promiscuous mode [ 352.224119][T16759] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 352.242849][T16759] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 352.283603][ T7449] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.319577][ T7449] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.336416][ T7449] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.363457][ T7449] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.603060][T14163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 352.636713][T14163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 352.681606][T17334] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3136'. [ 352.713550][T14163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 352.728477][T14163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.595791][T17382] vlan1: entered promiscuous mode [ 353.611229][ T5823] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 353.611764][T17382] bridge0: entered promiscuous mode [ 353.621466][ T5823] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 353.634913][ T5823] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 353.643378][T17386] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3149'. [ 353.657125][T17387] netlink: 'syz.4.3149': attribute type 1 has an invalid length. [ 353.665595][T17386] netlink: 'syz.4.3149': attribute type 1 has an invalid length. [ 353.675415][ T5823] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 353.685464][ T5823] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 353.752034][T17387] 8021q: adding VLAN 0 to HW filter on device bond2 [ 353.783197][T17392] bond2: (slave geneve2): making interface the new active one [ 353.793779][T17392] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 353.853783][T17395] netlink: 'syz.2.3151': attribute type 1 has an invalid length. [ 353.873450][T17396] netlink: 'syz.2.3151': attribute type 1 has an invalid length. [ 353.968821][T17395] bond11: entered promiscuous mode [ 353.976949][T17403] netlink: 'syz.4.3153': attribute type 15 has an invalid length. [ 353.985255][T17403] netlink: 'syz.4.3153': attribute type 1 has an invalid length. [ 354.014607][T17395] bond11: entered allmulticast mode [ 354.025824][T17395] 8021q: adding VLAN 0 to HW filter on device bond11 [ 354.044105][T17409] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3154'. [ 354.114822][T17399] bond1: option fail_over_mac: invalid value (16) [ 354.146178][T17399] bond1 (unregistering): Released all slaves [ 354.244899][T17416] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3155'. [ 354.264203][T17418] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3156'. [ 354.278481][T17416] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3155'. [ 354.354989][T17385] lo speed is unknown, defaulting to 1000 [ 354.369574][T17421] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 354.492078][T14163] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.534156][T14163] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.579984][T17432] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3159'. [ 354.600367][T17433] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3159'. [ 354.676784][T14163] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.709375][T14163] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.812499][T14163] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.839863][T14163] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.883591][T17385] ip6_vti0 speed is unknown, defaulting to 1000 [ 354.910086][T17441] x_tables: duplicate underflow at hook 3 [ 354.920096][T17444] netlink: 'syz.4.3164': attribute type 33 has an invalid length. [ 354.941330][T14163] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.952458][T14163] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.053896][T17444] bond3: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 355.066962][T17444] bond3 (unregistering): Released all slaves [ 355.112235][T17447] sit3: entered promiscuous mode [ 355.117392][T17447] sit3: entered allmulticast mode [ 355.494349][T17468] netlink: 'syz.4.3172': attribute type 1 has an invalid length. [ 355.522642][T17470] xt_l2tp: invalid flags combination: 0 [ 355.577294][T17472] xt_hashlimit: Unknown mode mask C4, kernel too old? [ 355.719908][ T5823] Bluetooth: hci1: command tx timeout [ 356.523859][T14163] gretap0: left allmulticast mode [ 356.529098][T14163] gretap0: left promiscuous mode [ 356.542616][T14163] bridge0: port 3(gretap0) entered disabled state [ 356.574448][T14163] bridge_slave_1: left allmulticast mode [ 356.581199][T14163] bridge_slave_1: left promiscuous mode [ 356.587801][T14163] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.621155][T14163] bridge_slave_0: left allmulticast mode [ 356.629782][T14163] bridge_slave_0: left promiscuous mode [ 356.635615][T14163] bridge0: port 1(bridge_slave_0) entered disabled state [ 356.728899][T17518] __nla_validate_parse: 4 callbacks suppressed [ 356.728919][T17518] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3184'. [ 356.745649][T14163] tipc: Resetting bearer [ 356.895243][T14163] bond2 (unregistering): (slave ip6gre2): Releasing backup interface [ 357.023028][ T7449] smc: removing ib device syz2 [ 357.347927][T14163] bond5 (unregistering): (slave geneve2): Releasing active interface [ 357.619278][T14163] tipc: Disabling bearer [ 357.679794][T14163] bond4 (unregistering): (slave bridge2): Releasing backup interface [ 357.714926][T14163] bridge2 (unregistering): left promiscuous mode [ 357.799996][ T5823] Bluetooth: hci1: command tx timeout [ 358.037126][T14163] bond1 (unregistering): Released all slaves [ 358.077644][T14163] bond2 (unregistering): Released all slaves [ 358.147969][T14163] bond3 (unregistering): Released all slaves [ 358.207235][T14163] bond4 (unregistering): Released all slaves [ 358.278932][T14163] bond5 (unregistering): Released all slaves [ 358.310592][T14163] bond6 (unregistering): Released all slaves [ 358.325384][T14163] bond7 (unregistering): Released all slaves [ 358.344948][T14163] bond0 (unregistering): Released all slaves [ 358.357979][T14163] bond8 (unregistering): Released all slaves [ 358.408667][T17521] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 358.423406][T17521] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 358.502892][T14163] 9: left promiscuous mode [ 358.632315][T17385] chnl_net:caif_netlink_parms(): no params data found [ 358.667053][T14163] tipc: Disabling bearer [ 358.709935][T14163] tipc: Left network mode [ 358.889924][T17547] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3192'. [ 358.977346][T17557] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3193'. [ 359.002931][T17557] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3193'. [ 359.012383][T17557] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3193'. [ 359.218000][T17385] bridge0: port 1(bridge_slave_0) entered blocking state [ 359.239410][T17385] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.270103][T17385] bridge_slave_0: entered allmulticast mode [ 359.293786][T17385] bridge_slave_0: entered promiscuous mode [ 359.326027][T17385] bridge0: port 2(bridge_slave_1) entered blocking state [ 359.348517][T17385] bridge0: port 2(bridge_slave_1) entered disabled state [ 359.368440][T17385] bridge_slave_1: entered allmulticast mode [ 359.386328][T17385] bridge_slave_1: entered promiscuous mode [ 359.406332][T17573] syz_tun: entered allmulticast mode [ 359.455233][T17586] netlink: 'syz.2.3199': attribute type 1 has an invalid length. [ 359.456063][T17580] dvmrp8: entered allmulticast mode [ 359.505407][T17584] Cannot find add_set index 0 as target [ 359.518023][T17573] dvmrp8: left allmulticast mode [ 359.583914][T17592] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.615134][T17586] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 359.696910][T17385] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 359.782668][T17385] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 359.880766][ T5823] Bluetooth: hci1: command tx timeout [ 359.991591][T17570] syz_tun: left allmulticast mode [ 360.067570][T17613] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3205'. [ 360.106319][T17385] team0: Port device team_slave_0 added [ 360.126738][T17385] team0: Port device team_slave_1 added [ 360.127087][T17615] xt_CT: You must specify a L4 protocol and not use inversions on it [ 360.202862][T17614] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3204'. [ 360.264519][T17385] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 360.293587][T17385] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 360.356135][T17385] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 360.437295][T17626] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3208'. [ 360.440839][T17385] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 360.468967][T17626] netlink: 'syz.4.3208': attribute type 30 has an invalid length. [ 360.478686][T17385] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 360.639072][T17385] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 361.003985][T14163] hsr_slave_0: left promiscuous mode [ 361.015559][T14163] hsr_slave_1: left promiscuous mode [ 361.027546][T17643] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 361.038043][T14163] veth1_vlan: left allmulticast mode [ 361.253918][T17652] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3214'. [ 361.399088][T17657] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3215'. [ 361.415664][T17657] netlink: 'syz.4.3215': attribute type 5 has an invalid length. [ 361.428580][T17657] netlink: 'syz.4.3215': attribute type 6 has an invalid length. [ 361.467012][T17657] netlink: 'syz.4.3215': attribute type 29 has an invalid length. [ 361.645174][T14163] veth0_to_team (unregistering): left allmulticast mode [ 361.874271][ T7451] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 361.892036][ T7451] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 361.909286][ T7451] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 361.960894][ T5823] Bluetooth: hci1: command tx timeout [ 361.974937][ T7451] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 362.093534][T17385] hsr_slave_0: entered promiscuous mode [ 362.122323][T17680] __nla_validate_parse: 3 callbacks suppressed [ 362.122344][T17680] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3222'. [ 362.133196][T17385] hsr_slave_1: entered promiscuous mode [ 362.155169][T17385] debugfs: 'hsr0' already exists in 'hsr' [ 362.161719][T17385] Cannot create hsr debugfs directory [ 362.441927][T17695] veth0: entered promiscuous mode [ 362.463610][T17695] veth0: left promiscuous mode [ 362.764872][T14163] IPVS: stop unused estimator thread 0... [ 362.782920][T17707] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3230'. [ 363.017188][T17722] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3234'. [ 363.025111][T17724] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3235'. [ 363.028394][T17718] lo: entered allmulticast mode [ 363.111466][T17722] : entered promiscuous mode [ 363.150978][T17724] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3235'. [ 363.200376][T17730] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 363.219933][T17727] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 363.532550][T17744] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3239'. [ 363.577707][T17744] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3239'. [ 363.831571][T17758] SET target dimension over the limit! [ 363.860183][T17385] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 363.897483][T17385] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 363.946238][T17385] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 364.005516][T17385] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 364.320204][T17804] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3252'. [ 364.386035][T17804] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 364.443110][T17809] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 364.499032][T17385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 364.528523][T17815] IPv6: addrconf: prefix option has invalid lifetime [ 364.538708][T17812] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3253'. [ 364.554405][T17385] 8021q: adding VLAN 0 to HW filter on device team0 [ 364.567508][T17812] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 364.574874][T17812] IPv6: NLM_F_CREATE should be set when creating new route [ 364.596058][ T7451] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.603302][ T7451] bridge0: port 1(bridge_slave_0) entered forwarding state [ 364.659030][ T7451] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.666278][ T7451] bridge0: port 2(bridge_slave_1) entered forwarding state [ 365.274911][T17854] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3261'. [ 365.350083][T17385] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 365.987406][T17385] veth0_vlan: entered promiscuous mode [ 366.025524][T17385] veth1_vlan: entered promiscuous mode [ 366.114949][T17385] veth0_macvtap: entered promiscuous mode [ 366.177758][T17385] veth1_macvtap: entered promiscuous mode [ 366.242789][T17898] tipc: Started in network mode [ 366.250700][T17898] tipc: Node identity ac14140f, cluster identity 4711 [ 366.278831][T17898] tipc: New replicast peer: 255.255.255.255 [ 366.308397][T17898] tipc: Enabled bearer , priority 10 [ 366.375943][T17385] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 366.419637][T17385] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 366.465012][ T7449] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.495982][ T7449] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.527376][ T7449] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.540194][ T8774] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.779604][T14161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.803978][T14161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.930969][ T8774] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.954588][ T8774] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 367.298588][T17950] bond0: entered promiscuous mode [ 367.337746][T17950] bond_slave_0: entered promiscuous mode [ 367.366621][T17950] bond_slave_1: entered promiscuous mode [ 367.404483][T17950] batadv0: entered promiscuous mode [ 367.450846][T17950] hsr1: entered promiscuous mode [ 367.455878][T17950] hsr1: entered allmulticast mode [ 367.512348][T17950] bond0: entered allmulticast mode [ 367.517715][T17950] bond_slave_0: entered allmulticast mode [ 367.546117][T17950] bond_slave_1: entered allmulticast mode [ 367.561681][T17950] batadv0: entered allmulticast mode [ 367.590480][T17950] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 367.627227][T17950] bond0: left promiscuous mode [ 367.650714][T17950] bond_slave_0: left promiscuous mode [ 367.656610][T17950] bond_slave_1: left promiscuous mode [ 367.679390][ T5826] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 367.689533][ T5826] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 367.697549][T17950] batadv0: left promiscuous mode [ 367.705405][ T5826] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 367.721490][ T5826] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 367.734421][ T5826] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 367.837817][ T5830] tipc: Node number set to 2886997007 [ 368.008477][T17966] lo speed is unknown, defaulting to 1000 [ 368.325718][T17991] __nla_validate_parse: 1 callbacks suppressed [ 368.325739][T17991] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3297'. [ 368.793508][T18004] netlink: 'syz.3.3300': attribute type 1 has an invalid length. [ 368.846331][T18004] netlink: 476 bytes leftover after parsing attributes in process `syz.3.3300'. [ 368.876884][T18007] netlink: 401 bytes leftover after parsing attributes in process `syz.3.3300'. [ 368.905026][T18004] netlink: 1041 bytes leftover after parsing attributes in process `syz.3.3300'. [ 369.194875][T18022] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3306'. [ 369.253901][T18025] netlink: 'syz.4.3304': attribute type 1 has an invalid length. [ 369.318159][T18025] netlink: 'syz.4.3304': attribute type 2 has an invalid length. [ 369.528228][T18025] xt_addrtype: ipv6 does not support BROADCAST matching [ 369.595478][T18046] IPVS: set_ctl: invalid protocol: 59 172.20.20.170:20000 [ 369.696043][ T8774] bond3 (unregistering): (slave ip6gretap1): Releasing active interface [ 369.718910][ T8774] bond5 (unregistering): (slave ip6gretap2): Releasing active interface [ 369.801484][ T5823] Bluetooth: hci4: command tx timeout [ 369.863859][ T8774] dvmrp0 (unregistering): left allmulticast mode [ 370.064109][ T8774] bond0 (unregistering): Released all slaves [ 370.074475][ T8774] bond1 (unregistering): Released all slaves [ 370.090179][ T8774] bond2 (unregistering): Released all slaves [ 370.104977][ T8774] bond3 (unregistering): Released all slaves [ 370.118358][ T8774] bond4 (unregistering): Released all slaves [ 370.133022][ T8774] bond5 (unregistering): Released all slaves [ 370.160470][ T8774] bond6 (unregistering): Released all slaves [ 370.174293][ T8774] bond7 (unregistering): Released all slaves [ 370.188965][ T8774] bond8 (unregistering): (slave veth9): Releasing active interface [ 370.198848][ T8774] bond8 (unregistering): Released all slaves [ 370.214776][ T8774] bond9 (unregistering): Released all slaves [ 370.237089][ T8774] bond10 (unregistering): Released all slaves [ 370.251135][ T8774] bond11 (unregistering): Released all slaves [ 370.427863][ T8774] : left promiscuous mode [ 370.484139][T17966] chnl_net:caif_netlink_parms(): no params data found [ 370.522875][ T8774] : left promiscuous mode [ 370.578371][T18062] netlink: 'syz.3.3314': attribute type 5 has an invalid length. [ 370.637108][ T8774] 9: left promiscuous mode [ 370.831378][ T8774] tipc: Left network mode [ 370.866944][T17966] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.883355][T17966] bridge0: port 1(bridge_slave_0) entered disabled state [ 370.892319][T17966] bridge_slave_0: entered allmulticast mode [ 370.905033][T17966] bridge_slave_0: entered promiscuous mode [ 370.916573][T17966] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.933697][T17966] bridge0: port 2(bridge_slave_1) entered disabled state [ 370.941518][T17966] bridge_slave_1: entered allmulticast mode [ 370.957679][T17966] bridge_slave_1: entered promiscuous mode [ 370.972650][ T8774] IPVS: stopping backup sync thread 10013 ... [ 371.100963][T18086] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 371.162939][T17966] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 371.257606][T17966] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 371.303846][T18098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3324'. [ 371.372971][T17966] team0: Port device team_slave_0 added [ 371.386493][T18098] netlink: 'syz.1.3324': attribute type 1 has an invalid length. [ 371.397434][T18098] netlink: 'syz.1.3324': attribute type 3 has an invalid length. [ 371.413108][T17966] team0: Port device team_slave_1 added [ 371.451272][T18098] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3324'. [ 371.687632][T17966] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 371.695135][T17966] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 371.779800][T17966] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 371.832458][T17966] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 371.851907][T17966] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 371.882291][ T5823] Bluetooth: hci4: command tx timeout [ 371.906164][T17966] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 371.918977][T18125] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3330'. [ 371.931077][T18125] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3330'. [ 371.941645][T18125] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3330'. [ 372.077615][T18129] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 372.246778][T17966] hsr_slave_0: entered promiscuous mode [ 372.260748][T17966] hsr_slave_1: entered promiscuous mode [ 372.267282][T17966] debugfs: 'hsr0' already exists in 'hsr' [ 372.298229][T17966] Cannot create hsr debugfs directory [ 372.812070][T18165] netlink: 'syz.0.3341': attribute type 10 has an invalid length. [ 372.836488][T18172] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 372.924671][T18165] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.946256][T18165] bridge_slave_1: left allmulticast mode [ 372.952311][T18165] bridge_slave_1: left promiscuous mode [ 372.961506][T18165] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.975537][T18165] bridge_slave_1: entered allmulticast mode [ 372.983054][T18165] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 372.999832][T18181] block nbd0: not configured, cannot reconfigure [ 373.461068][T18199] __nla_validate_parse: 1 callbacks suppressed [ 373.461089][T18199] netlink: 212 bytes leftover after parsing attributes in process `syz.1.3348'. [ 373.969972][ T5823] Bluetooth: hci4: command tx timeout [ 374.140353][T18223] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 374.176659][T18223] netlink: 209564 bytes leftover after parsing attributes in process `syz.4.3353'. [ 374.546284][T18258] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3354'. [ 374.881144][T18258] bridge0: port 2(bridge_slave_1) entered disabled state [ 374.889778][T18258] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.015740][ T8774] hsr_slave_0: left promiscuous mode [ 375.035191][ T8774] hsr_slave_1: left promiscuous mode [ 375.102849][T18191] syz.3.3346 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 375.124406][T18191] CPU: 0 UID: 0 PID: 18191 Comm: syz.3.3346 Not tainted syzkaller #0 PREEMPT(full) [ 375.124438][T18191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 375.124450][T18191] Call Trace: [ 375.124459][T18191] [ 375.124468][T18191] dump_stack_lvl+0xe8/0x150 [ 375.124502][T18191] dump_header+0xd3/0x4c0 [ 375.124529][T18191] oom_kill_process+0x3ab/0x970 [ 375.124557][T18191] out_of_memory+0x106c/0x1410 [ 375.124576][T18191] ? percpu_ref_put+0x19/0x180 [ 375.124603][T18191] ? __pfx___mutex_lock+0x10/0x10 [ 375.124642][T18191] ? __pfx_out_of_memory+0x10/0x10 [ 375.124660][T18191] ? do_raw_spin_unlock+0xf5/0x210 [ 375.124694][T18191] try_charge_memcg+0xc53/0x1560 [ 375.124720][T18191] ? __lock_acquire+0x6b5/0x2cf0 [ 375.124772][T18191] ? __pfx_try_charge_memcg+0x10/0x10 [ 375.124791][T18191] ? xa_load+0x60/0x210 [ 375.124830][T18191] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 375.124858][T18191] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 375.124885][T18191] mem_cgroup_swapin_charge_folio+0x2e3/0x4d0 [ 375.124911][T18191] __swap_cache_prepare_and_add+0x52a/0x700 [ 375.124962][T18191] swap_cache_alloc_folio+0xf1/0x240 [ 375.124996][T18191] swap_cluster_readahead+0x369/0x690 [ 375.125032][T18191] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 375.125077][T18191] ? get_vma_policy+0x27b/0x3c0 [ 375.125105][T18191] swapin_readahead+0x196/0xc50 [ 375.125148][T18191] ? __pfx_swapin_readahead+0x10/0x10 [ 375.125179][T18191] ? swap_table_get+0x1e/0x260 [ 375.125204][T18191] ? swap_table_get+0x1e/0x260 [ 375.125228][T18191] ? swap_table_get+0x1e/0x260 [ 375.125255][T18191] ? swap_table_get+0x216/0x260 [ 375.125283][T18191] ? swap_cache_get_folio+0x513/0x520 [ 375.125317][T18191] do_swap_page+0x54f/0x58d0 [ 375.125345][T18191] ? __lock_acquire+0x6b5/0x2cf0 [ 375.125399][T18191] ? do_swap_page+0x12c/0x58d0 [ 375.125424][T18191] ? __pfx_do_swap_page+0x10/0x10 [ 375.125448][T18191] ? __pte_offset_map+0x1ae/0x240 [ 375.125482][T18191] ? pte_offset_map_rw_nolock+0xea/0x160 [ 375.125514][T18191] handle_mm_fault+0x12d2/0x3310 [ 375.125558][T18191] ? handle_mm_fault+0xee/0x3310 [ 375.125593][T18191] ? __pfx_handle_mm_fault+0x10/0x10 [ 375.125618][T18191] ? lock_vma_under_rcu+0x45a/0x500 [ 375.125669][T18191] do_user_addr_fault+0xa73/0x1340 [ 375.125705][T18191] ? rcu_is_watching+0x15/0xb0 [ 375.125733][T18191] ? trace_page_fault_user+0x84/0x210 [ 375.125785][T18191] exc_page_fault+0x6a/0xc0 [ 375.125816][T18191] asm_exc_page_fault+0x26/0x30 [ 375.125836][T18191] RIP: 0033:0x7eff800659d0 [ 375.125857][T18191] Code: 00 00 45 31 d2 48 83 b8 88 00 00 00 ff 41 b9 03 00 00 00 ba 01 00 00 00 0f 85 59 ff ff ff eb ca 66 2e 0f 1f 84 00 00 00 00 00 <80> 3d 0e fd ed 00 00 74 40 80 3d f3 fc ed 00 00 74 2e 80 3d f6 fc [ 375.125874][T18191] RSP: 002b:00007ffd18141b48 EFLAGS: 00010246 [ 375.125893][T18191] RAX: 0000000000000000 RBX: 00007eff80417da0 RCX: 00007eff8019c799 [ 375.125908][T18191] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 375.125920][T18191] RBP: 00007eff80417da0 R08: 0000000000000006 R09: 0000000000000000 [ 375.125932][T18191] R10: 00007eff80417cb0 R11: 0000000000000246 R12: 000000000005b541 [ 375.125945][T18191] R13: 00007eff8041618c R14: 000000000005b319 R15: 00007eff80416180 [ 375.125980][T18191] [ 375.126112][T18191] memory: usage 307200kB, limit 307200kB, failcnt 651 [ 375.529192][T18191] memory+swap: usage 288116kB, limit 9007199254740988kB, failcnt 0 [ 375.549177][T18191] kmem: usage 285568kB, limit 9007199254740988kB, failcnt 0 [ 375.556609][T18191] Memory cgroup stats for /syz3: [ 375.556942][T18191] cache 0 [ 375.579499][T18191] rss 24576 [ 375.582670][T18191] rss_huge 0 [ 375.585885][T18191] shmem 0 [ 375.588838][T18191] mapped_file 0 [ 375.609479][T18191] dirty 0 [ 375.612488][T18191] writeback 0 [ 375.615789][T18191] workingset_refault_anon 13 [ 375.629196][T18191] workingset_refault_file 0 [ 375.640020][T18191] swap 159744 [ 375.643444][T18191] swapcached 208896 [ 375.647287][T18191] pgpgin 64391 [ 375.660803][T18191] pgpgout 64379 [ 375.669516][T18191] pgfault 130048 [ 375.673200][T18191] pgmajfault 12 [ 375.676762][T18191] inactive_anon 0 [ 375.689190][T18191] active_anon 45056 [ 375.693059][T18191] inactive_file 0 [ 375.705531][T18191] active_file 0 [ 375.709036][T18191] unevictable 0 [ 375.719168][T18191] hierarchical_memory_limit 314572800 [ 375.724597][T18191] hierarchical_memsw_limit 9223372036854771712 [ 375.743155][T18191] total_cache 0 [ 375.746716][T18191] total_rss 24576 [ 375.759454][T18191] total_rss_huge 0 [ 375.763246][T18191] total_shmem 0 [ 375.766733][T18191] total_mapped_file 0 [ 375.779342][T18191] total_dirty 0 [ 375.782855][T18191] total_writeback 0 [ 375.786761][T18191] total_workingset_refault_anon 13 [ 375.805747][T18191] total_workingset_refault_file 0 [ 375.819517][T18191] total_swap 159744 [ 375.823406][T18191] total_swapcached 208896 [ 375.827748][T18191] total_pgpgin 64391 [ 375.849412][T18191] total_pgpgout 64379 [ 375.853454][T18191] total_pgfault 130048 [ 375.857534][T18191] total_pgmajfault 12 [ 375.866947][T18191] total_inactive_anon 0 [ 375.879464][T18191] total_active_anon 45056 [ 375.883915][T18191] total_inactive_file 0 [ 375.888097][T18191] total_active_file 0 [ 375.909445][T18191] total_unevictable 0 [ 375.913478][T18191] anon_cost 0 [ 375.916779][T18191] file_cost 0 [ 375.929185][T18191] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.3346,pid=18191,uid=0 [ 375.956581][T18191] Memory cgroup out of memory: Killed process 18191 (syz.3.3346) total-vm:102416kB, anon-rss:1264kB, file-rss:23364kB, shmem-rss:0kB, UID:0 pgtables:140kB oom_score_adj:1000 [ 376.011728][ T8774] lo (unregistering): left allmulticast mode [ 376.018903][ T7445] smc: removing ib device syz0 [ 376.039366][ T5823] Bluetooth: hci4: command tx timeout [ 376.167273][T18268] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3358'. [ 376.809999][T18282] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 377.097488][T17966] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 377.149611][T18301] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3365'. [ 377.203707][T17966] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 377.241735][T18305] netlink: 'syz.4.3366': attribute type 3 has an invalid length. [ 377.253579][T18305] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3366'. [ 377.315530][T17966] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 377.415783][T17966] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 377.592640][T18299] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 378.322174][T18285] bond1: entered promiscuous mode [ 378.708787][T17966] 8021q: adding VLAN 0 to HW filter on device bond0 [ 378.778874][T17966] 8021q: adding VLAN 0 to HW filter on device team0 [ 378.848778][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.855987][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.065700][ T8769] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.072927][ T8769] bridge0: port 1(bridge_slave_0) entered forwarding state [ 379.181927][ T8769] bridge0: port 2(bridge_slave_1) entered blocking state [ 379.189350][ T8769] bridge0: port 2(bridge_slave_1) entered forwarding state [ 379.435102][T17966] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 379.560761][T18377] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3376'. [ 379.592302][T18354] netlink: 830 bytes leftover after parsing attributes in process `syz.0.3372'. [ 379.593370][T18380] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3378'. [ 379.609602][ T8774] IPVS: stop unused estimator thread 0... [ 379.647065][T18380] openvswitch: netlink: Flow key attr not present in new flow. [ 379.967538][T18390] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3379'. [ 380.026760][T17966] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 380.224413][T17966] veth0_vlan: entered promiscuous mode [ 380.254866][T17966] veth1_vlan: entered promiscuous mode [ 380.408370][T17966] veth0_macvtap: entered promiscuous mode [ 380.456715][T17966] veth1_macvtap: entered promiscuous mode [ 380.463889][T18404] netdevsim netdevsim0: Direct firmware load for  failed with error -2 [ 380.477411][T18404] netdevsim netdevsim0: Falling back to sysfs fallback for:  [ 380.597005][T17966] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 380.649050][T17966] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 380.735983][ T7447] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.775742][ T7447] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.802438][ T7447] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.836586][T18426] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3389'. [ 380.897639][T18417] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 380.948853][T18417] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.014867][T18421] pim6reg1: entered promiscuous mode [ 381.023330][T18421] pim6reg1: entered allmulticast mode [ 381.044836][ T7447] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.185268][T18428] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 381.266405][T18417] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 381.285410][T18417] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.331669][T18436] syzkaller0: entered promiscuous mode [ 381.337328][T18436] syzkaller0: entered allmulticast mode [ 381.440243][T18417] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 381.456278][T18417] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.488621][T18436] syzkaller0: left promiscuous mode [ 381.494685][T18436] syzkaller0: left allmulticast mode [ 381.641781][T18417] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 381.679199][T18417] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.932227][T18473] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3396'. [ 381.953710][T18474] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3396'. [ 381.963218][ T7447] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.973597][ T7447] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 382.058572][ T8774] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 382.079379][ T8774] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.228926][ T8774] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 382.255636][ T8774] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 382.263451][ T8772] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 382.278998][ T8772] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.328330][T18487] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 382.355202][ T8772] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 382.370836][ T8772] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.384165][T18494] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3401'. [ 382.500874][ T8771] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 382.510740][T18498] netlink: 688 bytes leftover after parsing attributes in process `syz.0.3402'. [ 382.532723][T18498] openvswitch: netlink: ERSPAN option length err (len 4713, max 255). [ 382.539244][ T8771] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 382.573002][T18501] netlink: 'syz.4.3404': attribute type 2 has an invalid length. [ 382.622710][T18510] netlink: 'syz.4.3404': attribute type 2 has an invalid length. [ 382.657984][T18508] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3288'. [ 382.810687][T18520] IPv6: NLM_F_CREATE should be specified when creating new route [ 383.064846][T18537] vlan2: entered allmulticast mode [ 383.290457][T18553] x_tables: duplicate underflow at hook 3 [ 383.393615][T18547] bond2: ARP target 1.0.0.0 is already present [ 383.412517][T18547] bond2: option arp_ip_target: invalid value (1) [ 383.449098][T18547] bond2 (unregistering): Released all slaves [ 384.090944][T18597] netlink: 'syz.1.3423': attribute type 1 has an invalid length. [ 384.333527][T18612] netlink: 'syz.4.3428': attribute type 32 has an invalid length. [ 384.607706][T18631] netlink: 'syz.0.3432': attribute type 1 has an invalid length. [ 384.641657][T18633] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 384.668561][T18631] netlink: 'syz.0.3432': attribute type 4 has an invalid length. [ 384.737782][T18631] __nla_validate_parse: 4 callbacks suppressed [ 384.737806][T18631] netlink: 9491 bytes leftover after parsing attributes in process `syz.0.3432'. [ 384.913938][T18645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3436'. [ 384.948714][T18645] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3436'. [ 384.966576][T18652] netlink: 'syz.3.3439': attribute type 7 has an invalid length. [ 384.989843][T18645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3436'. [ 385.006538][T18652] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3439'. [ 385.321535][T18668] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.367059][T18674] xt_CT: You must specify a L4 protocol and not use inversions on it [ 385.486519][T18682] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 385.565638][T18692] netlink: 272 bytes leftover after parsing attributes in process `syz.2.3451'. [ 385.630794][T18685] nbd0: detected capacity change from 0 to 127 [ 385.883840][T18714] netlink: 'syz.3.3456': attribute type 1 has an invalid length. [ 386.240771][T18731] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3461'. [ 386.254644][ T5823] block nbd0: Receive control failed (result -104) [ 386.447302][T18743] wlan1: mtu less than device minimum [ 386.462946][T18742] wlan1: mtu less than device minimum [ 386.476586][T18742] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3463'. [ 386.623693][T18747] tipc: Started in network mode [ 386.642054][T18747] tipc: Node identity c20377bf4139, cluster identity 4711 [ 386.665787][T18747] tipc: Enabled bearer , priority 0 [ 386.690172][T18750] syzkaller0: entered promiscuous mode [ 386.707274][T18750] syzkaller0: entered allmulticast mode [ 386.717920][T18752] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 386.733035][T18752] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 386.772702][T18747] tipc: Resetting bearer [ 386.780680][T18752] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 386.795531][T18745] tipc: Resetting bearer [ 386.850944][T18745] tipc: Disabling bearer [ 386.877251][T18764] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3468'. [ 386.887134][T18764] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3468'. [ 387.106134][T18775] netlink: 'syz.3.3471': attribute type 10 has an invalid length. [ 387.415629][T18794] openvswitch: netlink: Message has 8 unknown bytes. [ 387.449350][T18794] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 387.661718][T18804] IPVS: set_ctl: invalid protocol: 137 10.1.1.2:20000 [ 387.761787][T18808] bond1: option fail_over_mac: invalid value (16) [ 387.812392][T18808] bond1 (unregistering): Released all slaves [ 388.845595][T18874] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 389.292027][T18900] nft_compat: unsupported protocol 1 [ 390.014901][T18948] __nla_validate_parse: 74 callbacks suppressed [ 390.014926][T18948] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3517'. [ 390.135730][T18955] sctp: [Deprecated]: syz.1.3520 (pid 18955) Use of int in max_burst socket option deprecated. [ 390.135730][T18955] Use struct sctp_assoc_value instead [ 390.317008][T18969] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 390.492288][T18979] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3527'. [ 390.562613][T18982] syzkaller0: entered promiscuous mode [ 390.576862][T18982] syzkaller0: entered allmulticast mode [ 390.597428][T18982] 0: reclassify loop, rule prio 0, protocol 800 [ 390.892497][T19001] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 390.928571][T19001] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 390.983057][T19001] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 391.014632][T19001] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 391.031803][T19011] netlink: 'syz.4.3536': attribute type 1 has an invalid length. [ 391.202795][T19018] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 391.230405][T19018] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 391.388289][T19011] bond3: (slave bridge1): Enslaving as an active interface with a down link [ 391.462067][T19037] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3541'. [ 391.492082][T19023] bond3: (slave gretap2): making interface the new active one [ 391.514785][T19038] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3539'. [ 391.536341][T19023] bond3: (slave gretap2): Enslaving as an active interface with an up link [ 391.791680][T19045] tun0: tun_chr_ioctl cmd 1074025675 [ 391.812051][T19045] tun0: persist disabled [ 391.872288][T19056] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3547'. [ 391.935633][T19045] syzkaller0: entered promiscuous mode [ 391.953002][T19045] syzkaller0: entered allmulticast mode [ 392.469964][T19095] netlink: 'syz.1.3555': attribute type 1 has an invalid length. [ 394.094126][T19095] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 394.269949][T19111] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3557'. [ 394.339101][T19111] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 394.797050][T19141] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3566'. [ 394.909438][T19141] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 394.930111][T19141] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3566'. [ 395.116567][T19154] netlink: 92 bytes leftover after parsing attributes in process `syz.1.3569'. [ 395.285753][T19165] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3574'. [ 395.371811][T19164] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3574'. [ 395.409735][T19179] netlink: 'syz.2.3576': attribute type 5 has an invalid length. [ 395.604878][T19189] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3579'. [ 395.872630][T19208] block nbd1: Unsupported socket: should be TCP or UNIX. [ 396.278258][T19230] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3590'. [ 396.566117][T19243] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 396.741783][T19258] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3600'. [ 396.852492][T19267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3603'. [ 396.970788][T19277] xt_TPROXY: Can be used only with -p tcp or -p udp [ 397.083520][T19284] xt_recent: Unsupported userspace flags (000000b1) [ 397.153311][T19286] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.3610'. [ 397.375618][T19305] netlink: 'syz.3.3618': attribute type 1 has an invalid length. [ 397.384654][T19304] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 397.394351][T19305] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3618'. [ 397.529630][T19318] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3619'. [ 397.588156][T19318] bond0: entered promiscuous mode [ 397.595682][T19318] bond_slave_0: entered promiscuous mode [ 397.602492][T19318] bond_slave_1: entered promiscuous mode [ 397.608816][T19318] bridge_slave_1: entered promiscuous mode [ 397.654039][T19318] bond0: left promiscuous mode [ 397.661948][T19318] bond_slave_0: left promiscuous mode [ 397.667782][T19318] bond_slave_1: left promiscuous mode [ 397.674112][T19318] bridge_slave_1: left promiscuous mode [ 397.852559][T19321] syzkaller0: entered promiscuous mode [ 397.858105][T19321] syzkaller0: entered allmulticast mode [ 397.882836][T19331] nbd: must specify an index to disconnect [ 398.025204][ T5913] IPVS: starting estimator thread 0... [ 398.141727][T19343] IPVS: using max 26 ests per chain, 62400 per kthread [ 398.269382][T19360] x9: renamed from bridge_slave_0 (while UP) [ 398.390016][T19360] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 398.402843][T19364] syzkaller0: entered promiscuous mode [ 398.411835][T19364] syzkaller0: entered allmulticast mode [ 398.724876][T19380] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 400.330598][T19386] netlink: 'syz.2.3642': attribute type 1 has an invalid length. [ 400.351827][T19385] netlink: 'syz.2.3642': attribute type 1 has an invalid length. [ 400.517765][T19389] bridge3: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 400.559818][T19386] 8021q: adding VLAN 0 to HW filter on device bond1 [ 400.797735][ T8179] IPVS: starting estimator thread 0... [ 400.803747][T19415] netlink: 'syz.4.3650': attribute type 64 has an invalid length. [ 400.816248][T19415] __nla_validate_parse: 6 callbacks suppressed [ 400.816268][T19415] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3650'. [ 400.884795][T19421] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3652'. [ 400.899575][T19417] IPVS: using max 28 ests per chain, 67200 per kthread [ 400.962424][T19425] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 400.975523][T19425] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3654'. [ 401.008830][T19428] FAULT_INJECTION: forcing a failure. [ 401.008830][T19428] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 401.053282][T19428] CPU: 1 UID: 0 PID: 19428 Comm: syz.4.3655 Not tainted syzkaller #0 PREEMPT(full) [ 401.053313][T19428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 401.053325][T19428] Call Trace: [ 401.053333][T19428] [ 401.053341][T19428] dump_stack_lvl+0xe8/0x150 [ 401.053376][T19428] should_fail_ex+0x412/0x560 [ 401.053416][T19428] _copy_from_iter+0x1d3/0x1670 [ 401.053445][T19428] ? rcu_is_watching+0x15/0xb0 [ 401.053479][T19428] ? __pfx__copy_from_iter+0x10/0x10 [ 401.053511][T19428] ? netlink_sendmsg+0x650/0xb40 [ 401.053535][T19428] ? skb_put+0x11b/0x210 [ 401.053566][T19428] netlink_sendmsg+0x6c0/0xb40 [ 401.053601][T19428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 401.053629][T19428] ? aa_sock_msg_perm+0xf1/0x1b0 [ 401.053654][T19428] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 401.053680][T19428] ____sys_sendmsg+0x972/0x9f0 [ 401.053721][T19428] ? __pfx_____sys_sendmsg+0x10/0x10 [ 401.053759][T19428] ? import_iovec+0x73/0xa0 [ 401.053790][T19428] ___sys_sendmsg+0x2a5/0x360 [ 401.053825][T19428] ? __pfx____sys_sendmsg+0x10/0x10 [ 401.053892][T19428] ? __fget_files+0x2a/0x420 [ 401.053919][T19428] ? __fget_files+0x3a0/0x420 [ 401.053957][T19428] __x64_sys_sendmsg+0x1bd/0x2a0 [ 401.053989][T19428] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 401.054028][T19428] ? __pfx_ksys_write+0x10/0x10 [ 401.054062][T19428] do_syscall_64+0x14d/0xf80 [ 401.054090][T19428] ? trace_irq_disable+0x3b/0x150 [ 401.054118][T19428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.054138][T19428] ? clear_bhb_loop+0x40/0x90 [ 401.054163][T19428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.054184][T19428] RIP: 0033:0x7f9bc9f9c799 [ 401.054204][T19428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 401.054221][T19428] RSP: 002b:00007f9bcae9f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 401.054244][T19428] RAX: ffffffffffffffda RBX: 00007f9bca215fa0 RCX: 00007f9bc9f9c799 [ 401.054259][T19428] RDX: 0000000000008090 RSI: 0000200000001540 RDI: 0000000000000003 [ 401.054273][T19428] RBP: 00007f9bcae9f090 R08: 0000000000000000 R09: 0000000000000000 [ 401.054285][T19428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 401.054298][T19428] R13: 00007f9bca216038 R14: 00007f9bca215fa0 R15: 00007ffe23a9b5e8 [ 401.054330][T19428] [ 401.582847][T19448] netlink: 576 bytes leftover after parsing attributes in process `syz.1.3660'. [ 401.668893][T19455] netlink: 1044 bytes leftover after parsing attributes in process `syz.3.3659'. [ 401.964428][T19467] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3666'. [ 402.042655][T19469] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3667'. [ 402.300467][T19482] nbd1: detected capacity change from 0 to 127 [ 402.373247][T19490] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 402.417340][T19490] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 402.516083][T19494] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3677'. [ 402.527817][T19494] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3677'. [ 402.543536][ T5823] block nbd1: Receive control failed (result -104) [ 402.774487][T19508] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.082870][T19529] vlan2: entered promiscuous mode [ 403.088152][T19529] bridge0: entered promiscuous mode [ 403.197268][T19539] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3693'. [ 403.301929][ T8179] IPVS: starting estimator thread 0... [ 403.310177][T19541] syzkaller1: entered promiscuous mode [ 403.315708][T19541] syzkaller1: entered allmulticast mode [ 403.399367][T19544] IPVS: using max 25 ests per chain, 60000 per kthread [ 403.453416][T19553] netlink: 'syz.1.3697': attribute type 1 has an invalid length. [ 403.662300][T19549] syzkaller0: entered promiscuous mode [ 403.668002][T19549] syzkaller0: entered allmulticast mode [ 403.678846][T19562] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 403.697973][T19553] syzkaller0: entered promiscuous mode [ 403.705594][T19553] syzkaller0: entered allmulticast mode [ 405.692914][ T8179] IPVS: starting estimator thread 0... [ 405.780566][T19603] IPVS: using max 25 ests per chain, 60000 per kthread [ 405.867906][T19613] __nla_validate_parse: 4 callbacks suppressed [ 405.867928][T19613] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3713'. [ 406.196042][T19638] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 406.216083][T19639] netlink: 'syz.1.3719': attribute type 1 has an invalid length. [ 406.235224][T19639] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3719'. [ 406.246161][T19638] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3717'. [ 406.254388][T19639] netlink: 658 bytes leftover after parsing attributes in process `syz.1.3719'. [ 406.279320][T19639] netlink: 'syz.1.3719': attribute type 1 has an invalid length. [ 406.311635][T19639] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3719'. [ 406.397498][T19639] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3719'. [ 406.434321][T19639] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3719'. [ 406.645718][T19670] netlink: 'syz.4.3726': attribute type 12 has an invalid length. [ 406.704702][T19670] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3726'. [ 406.760203][T19674] netlink: 'syz.1.3727': attribute type 10 has an invalid length. [ 406.788566][T19674] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.795862][T19674] bridge0: port 2(bridge_slave_1) entered listening state [ 406.803381][T19674] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.810635][T19674] bridge0: port 1(bridge_slave_0) entered listening state [ 406.870465][T19652] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3717'. [ 406.904147][T19674] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 406.979706][T19689] netlink: 401 bytes leftover after parsing attributes in process `syz.0.3728'. [ 407.367002][T19709] IPv6: NLM_F_CREATE should be specified when creating new route [ 407.400029][T19709] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 407.407421][T19709] IPv6: NLM_F_CREATE should be set when creating new route [ 407.414957][T19709] IPv6: NLM_F_CREATE should be set when creating new route [ 407.426967][ T84] bond0: (slave bond_slave_0): interface is now down [ 407.452038][ T84] bond0: (slave bond_slave_1): interface is now down [ 407.478215][ T84] bond0: (slave bridge0): interface is now down [ 407.512813][T19721] netlink: 'syz.3.3735': attribute type 178 has an invalid length. [ 407.643286][T14161] bond0: (slave bond_slave_0): interface is now down [ 407.654004][T14161] bond0: (slave bond_slave_1): interface is now down [ 407.669011][T14161] bond0: (slave bridge0): interface is now down [ 407.688357][T14161] bond0: now running without any active interface! [ 407.781526][T19738] xt_cgroup: path and classid specified [ 408.333385][T19778] x_tables: duplicate underflow at hook 3 [ 408.428133][T19782] openvswitch: netlink: Flow actions attr not present in new flow. [ 408.466257][T19785] netlink: 'syz.2.3757': attribute type 11 has an invalid length. [ 408.531227][T19788] macvlan1: entered allmulticast mode [ 408.581735][T19788] veth1_vlan: entered allmulticast mode [ 408.588118][T19788] macvlan1: entered promiscuous mode [ 409.021797][T19817] bridge0: entered promiscuous mode [ 409.027278][T19817] vlan2: entered promiscuous mode [ 409.098149][T19808] vlan2: entered promiscuous mode [ 409.334272][T19836] netlink: 'syz.1.3770': attribute type 1 has an invalid length. [ 409.577447][ T84] bond0: (slave bond_slave_0): interface is now down [ 409.588541][ T84] bond0: (slave bond_slave_1): interface is now down [ 409.866788][T19860] IPv6: addrconf: prefix option has invalid lifetime [ 409.873583][T19860] IPv6: addrconf: prefix option has invalid lifetime [ 409.966587][T19865] syzkaller0: entered promiscuous mode [ 409.984351][T19865] syzkaller0: entered allmulticast mode [ 410.116049][T19874] netlink: 'syz.4.3781': attribute type 21 has an invalid length. [ 410.336742][T19884] SET target dimension over the limit! [ 410.435048][T19896] netlink: 'syz.0.3786': attribute type 1 has an invalid length. [ 410.474157][T19891] sctp: [Deprecated]: syz.4.3785 (pid 19891) Use of struct sctp_assoc_value in delayed_ack socket option. [ 410.474157][T19891] Use struct sctp_sack_info instead [ 410.492682][T19898] netlink: 'syz.0.3786': attribute type 2 has an invalid length. [ 410.537279][T19903] netlink: 'syz.3.3788': attribute type 2 has an invalid length. [ 410.570022][T19903] 8021q: VLANs not supported on ip6_vti0 [ 410.678985][T19906] vlan2: entered promiscuous mode [ 410.708688][T19906] bridge0: entered promiscuous mode [ 410.884878][T19922] __nla_validate_parse: 19 callbacks suppressed [ 410.884899][T19922] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3792'. [ 410.910605][T19923] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3793'. [ 411.145569][T19935] netem: change failed [ 411.385231][T19957] netlink: 112 bytes leftover after parsing attributes in process `syz.0.3799'. [ 411.510893][T19968] openvswitch: netlink: Invalid VLAN frame [ 411.785442][T19975] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.3804'. [ 411.823077][T19980] netlink: 54 bytes leftover after parsing attributes in process `syz.1.3806'. [ 411.852667][T19980] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3806'. [ 411.948550][T19991] netlink: 212324 bytes leftover after parsing attributes in process `syz.0.3810'. [ 411.963150][T19991] netlink: 'syz.0.3810': attribute type 4 has an invalid length. [ 412.128606][T19998] rose0: entered allmulticast mode [ 412.135317][T19998] rose0: left allmulticast mode [ 412.262937][T20006] netlink: 'syz.0.3812': attribute type 32 has an invalid length. [ 412.312862][T20006] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3812'. [ 412.404620][T20006] bond1: option coupled_control: invalid value (52) [ 412.426075][T20006] bond1 (unregistering): Released all slaves [ 412.538186][T20019] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 412.669702][T20027] IPv6: NLM_F_CREATE should be specified when creating new route [ 412.677623][T20027] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 412.685123][T20027] IPv6: NLM_F_CREATE should be set when creating new route [ 412.828374][T20039] netlink: 'syz.3.3819': attribute type 1 has an invalid length. [ 412.880358][T20039] netlink: 'syz.3.3819': attribute type 3 has an invalid length. [ 412.924354][T20039] netlink: 172 bytes leftover after parsing attributes in process `syz.3.3819'. [ 412.961376][T20039] NCSI netlink: No device for ifindex 813332851 [ 413.155005][T20056] netlink: 'syz.2.3826': attribute type 1 has an invalid length. [ 413.290035][T20064] syzkaller0: entered promiscuous mode [ 413.295754][T20064] syzkaller0: entered allmulticast mode [ 413.337988][T20070] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3828'. [ 413.867772][T20092] nftables ruleset with unbound chain [ 414.355279][T20127] syz_tun: entered allmulticast mode [ 414.407264][T20127] bond0: (slave bridge0): Releasing backup interface [ 414.470314][T20127] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.477768][T20127] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.536282][T20127] bridge_slave_0: left promiscuous mode [ 414.571146][T20127] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.615854][T20127] bridge_slave_1: left allmulticast mode [ 414.649925][T20127] bridge_slave_1: left promiscuous mode [ 414.660488][T20127] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.711208][T20127] bond0: (slave bond_slave_0): Releasing backup interface [ 414.722947][T20137] block nbd2: not configured, cannot reconfigure [ 414.762217][T20127] bond0: (slave bond_slave_1): Releasing backup interface [ 414.803048][T20127] team0: Port device team_slave_0 removed [ 414.811698][T20142] validate_nla: 2 callbacks suppressed [ 414.811722][T20142] netlink: 'syz.0.3844': attribute type 15 has an invalid length. [ 414.833598][T20127] team0: Port device team_slave_1 removed [ 414.841348][T20127] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 414.850703][T20127] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 414.877591][T20127] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 414.892262][T20127] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 414.918034][T20127] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 415.070054][T20150] tipc: Enabling of bearer rejected, failed to enable media [ 415.216577][T20160] syzkaller1: entered promiscuous mode [ 415.224349][T20160] syzkaller1: entered allmulticast mode [ 415.387376][T20169] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 415.969604][ T1731] block nbd0: Possible stuck request ffff888026990000: control (read@0,4096B). Runtime 30 seconds [ 416.092229][T20209] netlink: 'syz.3.3859': attribute type 1 has an invalid length. [ 416.266793][T20221] __nla_validate_parse: 5 callbacks suppressed [ 416.266818][T20221] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3860'. [ 416.287175][T20220] delete_channel: no stack [ 416.512345][T20246] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3868'. [ 416.526107][T20246] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3868'. [ 416.636892][T20254] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3870'. [ 416.874170][T20270] bond1: option packets_per_slave: invalid value (18446744073709551615) [ 416.876573][T20272] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3874'. [ 416.882864][T20270] bond1: option packets_per_slave: allowed values 0 - 65535 [ 416.932141][T20270] bond1 (unregistering): Released all slaves [ 416.962505][T20272] netlink: 120 bytes leftover after parsing attributes in process `syz.0.3874'. [ 416.985434][T20279] xt_CT: You must specify a L4 protocol and not use inversions on it [ 417.092168][T20286] netlink: 'syz.3.3881': attribute type 3 has an invalid length. [ 417.187103][T20286] netlink: 'syz.3.3881': attribute type 1 has an invalid length. [ 417.202623][T20286] netlink: 'syz.3.3881': attribute type 1 has an invalid length. [ 417.214019][T20294] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3883'. [ 417.371154][T20303] netlink: 'syz.1.3886': attribute type 3 has an invalid length. [ 417.379588][T20303] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3886'. [ 417.509383][T20310] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3889'. [ 417.843351][T20338] netlink: 'syz.1.3893': attribute type 1 has an invalid length. [ 417.871659][T20338] netlink: 'syz.1.3893': attribute type 2 has an invalid length. [ 418.164014][T20366] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3903'. [ 418.528323][T20383] netlink: 'syz.2.3910': attribute type 3 has an invalid length. [ 418.799444][T20396] veth3: entered promiscuous mode [ 418.943513][T20411] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 419.487931][T20453] bridge_slave_1: default FDB implementation only supports local addresses [ 419.557092][T20447] netlink: 'syz.2.3929': attribute type 9 has an invalid length. [ 432.602662][ T25] block nbd1: Possible stuck request ffff888026a18000: control (read@0,1024B). Runtime 30 seconds [ 432.613398][ T25] block nbd1: Possible stuck request ffff888026a18200: control (read@1024,1024B). Runtime 30 seconds [ 432.624498][ T25] block nbd1: Possible stuck request ffff888026a18400: control (read@2048,1024B). Runtime 30 seconds [ 432.636584][ T25] block nbd1: Possible stuck request ffff888026a18600: control (read@3072,1024B). Runtime 30 seconds [ 437.241962][ T5826] Bluetooth: hci5: command 0x0406 tx timeout [ 440.294317][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 446.041605][ T1731] block nbd0: Possible stuck request ffff888026990000: control (read@0,4096B). Runtime 60 seconds [ 446.267757][ T5190] udevd[5190]: worker [18697] /devices/virtual/block/nbd0 is taking a long time [ 452.599575][ T5826] Bluetooth: hci0: command 0x0406 tx timeout [ 462.683217][ T25] block nbd1: Possible stuck request ffff888026a18000: control (read@0,1024B). Runtime 60 seconds [ 462.694020][ T25] block nbd1: Possible stuck request ffff888026a18200: control (read@1024,1024B). Runtime 60 seconds [ 462.705364][ T25] block nbd1: Possible stuck request ffff888026a18400: control (read@2048,1024B). Runtime 60 seconds [ 462.717057][ T25] block nbd1: Possible stuck request ffff888026a18600: control (read@3072,1024B). Runtime 60 seconds [ 462.839627][ T5826] Bluetooth: hci2: command 0x0406 tx timeout [ 465.855861][ T5190] udevd[5190]: worker [18760] /devices/virtual/block/nbd1 is taking a long time [ 475.749395][T20463] validate_nla: 2 callbacks suppressed [ 475.749418][T20463] netlink: 'syz.0.3932': attribute type 29 has an invalid length. [ 475.772886][T20463] __nla_validate_parse: 12 callbacks suppressed [ 475.772908][T20463] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3932'. [ 475.806561][T20463] netlink: 'syz.0.3932': attribute type 29 has an invalid length. [ 475.814890][T20463] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3932'. [ 475.912243][T20476] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3937'. [ 475.954986][T20476] netlink: 320 bytes leftover after parsing attributes in process `syz.3.3937'. [ 476.125053][ T1731] block nbd0: Possible stuck request ffff888026990000: control (read@0,4096B). Runtime 90 seconds [ 476.281364][T20496] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3944'. [ 476.307753][T20496] netlink: 13 bytes leftover after parsing attributes in process `syz.4.3944'. [ 476.308449][T20499] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3947'. [ 476.346809][T20503] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3947'. [ 476.376950][T20496] veth5: entered promiscuous mode [ 476.414334][T20504] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3948'. [ 476.492110][T20511] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3949'. [ 477.939965][T20596] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 478.910400][T20637] netlink: 'syz.4.3982': attribute type 1 has an invalid length. [ 478.936100][T20644] nbd: must specify at least one socket [ 478.985679][T20637] 8021q: adding VLAN 0 to HW filter on device bond4 [ 479.710937][T20679] x_tables: duplicate underflow at hook 1 [ 479.732930][T20679] syz_tun: tun_net_xmit 86 [ 480.099010][T20686] netlink: 'syz.2.3997': attribute type 9 has an invalid length. [ 480.759339][ C1] syz_tun: tun_net_xmit 86 [ 481.346094][T20739] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ku crK:̥B| [ 481.560788][T20744] __nla_validate_parse: 15 callbacks suppressed [ 481.560812][T20744] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4015'. [ 481.799437][ C1] syz_tun: tun_net_xmit 86 [ 481.847940][T20757] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4016'. [ 481.891460][T20756] netlink: 'syz.2.4017': attribute type 1 has an invalid length. [ 481.945530][T20756] 8021q: adding VLAN 0 to HW filter on device bond2 [ 481.975599][T20756] bond2: (slave batadv0): Opening slave failed [ 482.139514][T20766] delete_channel: no stack [ 482.331229][T20787] syz_tun: entered allmulticast mode [ 482.342075][T20786] syz_tun: left allmulticast mode [ 482.620114][T20798] netlink: 1280 bytes leftover after parsing attributes in process `syz.4.4028'. [ 482.853227][T20810] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4033'. [ 482.876074][T20810] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4033'. [ 482.899425][T20810] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4033'. [ 482.920168][T20810] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4033'. [ 482.940374][T20810] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4033'. [ 483.194958][T20825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4037'. [ 483.212780][T20825] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 483.261791][T20825] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 483.294334][T20825] gretap1: entered promiscuous mode [ 483.315520][T20825] gretap1: entered allmulticast mode [ 483.544645][T20849] vlan2: entered promiscuous mode [ 483.567337][T20849] geneve1: entered promiscuous mode [ 483.575731][T20849] vlan2: entered allmulticast mode [ 483.582356][T20849] geneve1: entered allmulticast mode [ 483.684794][T20857] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4045'. [ 484.207273][T20883] bridge0: entered promiscuous mode [ 484.219748][T20883] macsec1: entered promiscuous mode [ 484.231941][T20883] macsec1: entered allmulticast mode [ 484.242904][T20883] bridge0: entered allmulticast mode [ 484.251029][T20883] bridge0: port 3(macsec1) entered blocking state [ 484.257860][T20883] bridge0: port 3(macsec1) entered disabled state [ 484.271786][T20883] bridge0: left allmulticast mode [ 484.277716][T20883] bridge0: left promiscuous mode [ 484.661636][T20902] FAULT_INJECTION: forcing a failure. [ 484.661636][T20902] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 484.733664][T20902] CPU: 0 UID: 0 PID: 20902 Comm: syz.2.4060 Not tainted syzkaller #0 PREEMPT(full) [ 484.733697][T20902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 484.733710][T20902] Call Trace: [ 484.733719][T20902] [ 484.733728][T20902] dump_stack_lvl+0xe8/0x150 [ 484.733763][T20902] should_fail_ex+0x412/0x560 [ 484.733793][T20902] _copy_from_user+0x2d/0xb0 [ 484.733822][T20902] __sys_sendto+0x2b0/0x710 [ 484.733853][T20902] ? __pfx___sys_sendto+0x10/0x10 [ 484.733877][T20902] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 484.733918][T20902] ? __fget_files+0x3a0/0x420 [ 484.733956][T20902] ? ksys_write+0x242/0x270 [ 484.733979][T20902] ? __pfx_ksys_write+0x10/0x10 [ 484.734006][T20902] __x64_sys_sendto+0xde/0x100 [ 484.734036][T20902] do_syscall_64+0x14d/0xf80 [ 484.734063][T20902] ? trace_irq_disable+0x3b/0x150 [ 484.734091][T20902] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.734110][T20902] ? clear_bhb_loop+0x40/0x90 [ 484.734135][T20902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.734154][T20902] RIP: 0033:0x7f7db119c799 [ 484.734172][T20902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.734189][T20902] RSP: 002b:00007f7db203d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 484.734211][T20902] RAX: ffffffffffffffda RBX: 00007f7db1415fa0 RCX: 00007f7db119c799 [ 484.734225][T20902] RDX: 0000000000000028 RSI: 0000200000000180 RDI: 0000000000000003 [ 484.734237][T20902] RBP: 00007f7db203d090 R08: 0000200000000040 R09: 0000000000000014 [ 484.734250][T20902] R10: 00000000000408a1 R11: 0000000000000246 R12: 0000000000000001 [ 484.734262][T20902] R13: 00007f7db1416038 R14: 00007f7db1415fa0 R15: 00007ffffc9d4288 [ 484.734294][T20902] [ 485.486539][T20936] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 485.606722][T20947] FAULT_INJECTION: forcing a failure. [ 485.606722][T20947] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 485.629354][T20947] CPU: 0 UID: 0 PID: 20947 Comm: syz.3.4073 Not tainted syzkaller #0 PREEMPT(full) [ 485.629383][T20947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 485.629395][T20947] Call Trace: [ 485.629403][T20947] [ 485.629411][T20947] dump_stack_lvl+0xe8/0x150 [ 485.629443][T20947] should_fail_ex+0x412/0x560 [ 485.629472][T20947] _copy_to_user+0x31/0xb0 [ 485.629502][T20947] simple_read_from_buffer+0xe1/0x170 [ 485.629535][T20947] proc_fail_nth_read+0x1bb/0x230 [ 485.629566][T20947] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 485.629595][T20947] ? rw_verify_area+0x2a6/0x4d0 [ 485.629614][T20947] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 485.629643][T20947] vfs_read+0x20c/0xa70 [ 485.629661][T20947] ? fdget_pos+0x246/0x320 [ 485.629694][T20947] ? __pfx___mutex_lock+0x10/0x10 [ 485.629725][T20947] ? __pfx_vfs_read+0x10/0x10 [ 485.629746][T20947] ? __fget_files+0x2a/0x420 [ 485.629778][T20947] ? __fget_files+0x3a0/0x420 [ 485.629804][T20947] ? __fget_files+0x2a/0x420 [ 485.629841][T20947] ksys_read+0x150/0x270 [ 485.629865][T20947] ? __pfx_ksys_read+0x10/0x10 [ 485.629897][T20947] do_syscall_64+0x14d/0xf80 [ 485.629924][T20947] ? trace_irq_disable+0x3b/0x150 [ 485.629951][T20947] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.629972][T20947] ? clear_bhb_loop+0x40/0x90 [ 485.629998][T20947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.630018][T20947] RIP: 0033:0x7eff8015cfce [ 485.630038][T20947] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 485.630055][T20947] RSP: 002b:00007eff7e3d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 485.630077][T20947] RAX: ffffffffffffffda RBX: 00007eff7e3d56c0 RCX: 00007eff8015cfce [ 485.630092][T20947] RDX: 000000000000000f RSI: 00007eff7e3d50a0 RDI: 0000000000000005 [ 485.630105][T20947] RBP: 00007eff7e3d5090 R08: 0000000000000000 R09: 0000000000000000 [ 485.630116][T20947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 485.630128][T20947] R13: 00007eff80416218 R14: 00007eff80416180 R15: 00007ffd181419e8 [ 485.630162][T20947] [ 486.322905][ T8772] tipc: Subscription rejected, illegal request [ 486.558583][T20943] netlink: 'syz.4.4074': attribute type 2 has an invalid length. [ 486.626764][T20976] __nla_validate_parse: 4 callbacks suppressed [ 486.626787][T20976] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4084'. [ 487.048230][T20995] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4088'. [ 487.090261][T20998] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4089'. [ 487.244520][T21003] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4091'. [ 487.278756][T21005] netlink: 'syz.0.4092': attribute type 4 has an invalid length. [ 487.287836][T21003] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4091'. [ 487.327792][T21004] netlink: 'syz.0.4092': attribute type 4 has an invalid length. [ 487.328059][T20997] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4090'. [ 487.365218][T20997] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4090'. [ 487.373016][T21008] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4094'. [ 487.567032][T21015] openvswitch: netlink: IPv4 tunnel dst address is zero [ 487.785828][T21027] xt_time: unknown flags 0xf4 [ 487.811788][T21030] x_tables: duplicate underflow at hook 2 [ 487.837953][T21033] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4099'. [ 488.124567][T21046] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4103'. [ 488.349835][T21065] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 488.439312][ T5826] Bluetooth: hci1: command 0x0406 tx timeout [ 488.500184][T21057] xt_CT: No such helper "pptp" [ 488.865525][T21080] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 488.901602][T21080] netlink: 'syz.1.4114': attribute type 1 has an invalid length. [ 488.913994][T21081] ip6gretap0: entered promiscuous mode [ 488.942700][ T5823] Bluetooth: hci4: link tx timeout [ 488.949577][ T5823] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 489.014291][T21080] bond2: entered promiscuous mode [ 489.019953][T21080] 8021q: adding VLAN 0 to HW filter on device bond2 [ 489.060490][T21089] netlink: 'syz.1.4114': attribute type 3 has an invalid length. [ 489.094033][T21080] bond2: (slave bridge3): making interface the new active one [ 489.102100][T21080] bridge3: entered promiscuous mode [ 489.112991][T21080] bond2: (slave bridge3): Enslaving as an active interface with an up link [ 489.161863][T21091] bond0: Error: Cannot enslave bond to itself. [ 489.832491][T21124] netlink: 'syz.2.4127': attribute type 1 has an invalid length. [ 489.851637][ T5823] block nbd2: Receive control failed (result -32) [ 490.069872][T21133] netlink: 'syz.3.4130': attribute type 4 has an invalid length. [ 490.246961][T21140] gre1: entered promiscuous mode [ 490.252466][T21140] gre1: entered allmulticast mode [ 490.982072][T21173] netlink: 'syz.3.4143': attribute type 10 has an invalid length. [ 490.990669][T21169] sctp: [Deprecated]: syz.0.4141 (pid 21169) Use of int in max_burst socket option deprecated. [ 490.990669][T21169] Use struct sctp_assoc_value instead [ 490.998368][T21172] netlink: 'syz.2.4142': attribute type 29 has an invalid length. [ 491.011269][ T5823] Bluetooth: hci4: command 0x0406 tx timeout [ 491.132617][T21173] team0 (unregistering): Port device team_slave_0 removed [ 491.177040][T21173] team0 (unregistering): Port device team_slave_1 removed [ 491.236194][T21174] dvmrp0: entered allmulticast mode [ 491.266263][T21172] netlink: 'syz.2.4142': attribute type 29 has an invalid length. [ 491.829001][T21210] __nla_validate_parse: 18 callbacks suppressed [ 491.829024][T21210] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4152'. [ 491.836632][T21212] vcan1: entered promiscuous mode [ 491.855781][T21212] vcan1: entered allmulticast mode [ 491.883402][T21213] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4153'. [ 492.007418][T21212] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 492.213137][T21226] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4155'. [ 492.270803][T21226] netlink: 'syz.0.4155': attribute type 1 has an invalid length. [ 492.289728][T21226] nbd: error processing sock list [ 492.300091][T21231] netlink: 'syz.3.4158': attribute type 64 has an invalid length. [ 492.724217][T21251] syzkaller1: entered promiscuous mode [ 492.751791][T21251] syzkaller1: entered allmulticast mode [ 492.760607][ T25] block nbd1: Possible stuck request ffff888026a18000: control (read@0,1024B). Runtime 90 seconds [ 492.773075][ T25] block nbd1: Possible stuck request ffff888026a18200: control (read@1024,1024B). Runtime 90 seconds [ 492.785022][ T25] block nbd1: Possible stuck request ffff888026a18400: control (read@2048,1024B). Runtime 90 seconds [ 492.796173][ T25] block nbd1: Possible stuck request ffff888026a18600: control (read@3072,1024B). Runtime 90 seconds [ 492.966665][T21269] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4169'. [ 492.978986][T21269] netlink: 'syz.1.4169': attribute type 7 has an invalid length. [ 493.009498][T21269] netlink: 'syz.1.4169': attribute type 8 has an invalid length. [ 493.061828][T21269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4169'. [ 493.606023][T21292] netlink: 'syz.4.4174': attribute type 1 has an invalid length. [ 493.624973][T21292] netlink: 96 bytes leftover after parsing attributes in process `syz.4.4174'. [ 493.635309][T21292] netlink: 1 bytes leftover after parsing attributes in process `syz.4.4174'. [ 493.648366][T21292] netlink: 'syz.4.4174': attribute type 1 has an invalid length. [ 493.686765][T21292] netlink: 'syz.4.4174': attribute type 8 has an invalid length. [ 493.697260][T21292] netlink: 606 bytes leftover after parsing attributes in process `syz.4.4174'. [ 493.836977][T21306] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4178'. [ 494.167850][T21328] netlink: 'syz.3.4184': attribute type 1 has an invalid length. [ 494.184533][T21328] netlink: 'syz.3.4184': attribute type 3 has an invalid length. [ 494.209483][T21328] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4184'. [ 494.350665][T21340] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 494.795758][T21360] IPv6: NLM_F_CREATE should be specified when creating new route [ 494.912545][T21368] netlink: 'syz.1.4194': attribute type 1 has an invalid length. [ 494.930560][ T8167] syz_tun: tun_net_xmit 110 [ 495.211051][T21381] netlink: 'syz.1.4198': attribute type 1 has an invalid length. [ 495.230984][T21381] NCSI netlink: No device for ifindex 813332851 [ 495.389440][ T5941] syz_tun: tun_net_xmit 110 [ 495.548732][T21397] bond1: entered promiscuous mode [ 495.578747][T21397] 8021q: adding VLAN 0 to HW filter on device bond1 [ 495.683463][T21397] bond1: (slave bridge6): making interface the new active one [ 495.720581][T21397] bridge6: entered promiscuous mode [ 495.728687][T21397] bond1: (slave bridge6): Enslaving as an active interface with an up link [ 496.121941][T21372] lec:lec_atm_close: lec0: Shut down! [ 496.490756][T21454] xt_policy: neither incoming nor outgoing policy selected [ 496.777481][T21468] IPVS: Unknown mcast interface: vcan0 [ 496.897741][T21478] __nla_validate_parse: 19 callbacks suppressed [ 496.897763][T21478] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4218'. [ 497.149468][ T8176] lec:lec_start_xmit: lec0:No lecd attached [ 497.151898][T21496] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4226'. [ 497.312592][T21503] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.4228'. [ 497.352633][T21498] : entered promiscuous mode [ 497.397297][T21507] validate_nla: 4 callbacks suppressed [ 497.397347][T21507] netlink: 'syz.4.4227': attribute type 3 has an invalid length. [ 497.557179][T21519] netlink: 512 bytes leftover after parsing attributes in process `syz.1.4232'. [ 497.722997][T21528] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.4235'. [ 497.759779][T21528] bridge_slave_1: default FDB implementation only supports local addresses [ 497.875852][T21536] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20004 [ 498.082807][T21550] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4241'. [ 498.116394][T21550] netlink: 176 bytes leftover after parsing attributes in process `syz.3.4241'. [ 498.149431][T21550] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4241'. [ 498.177839][T21558] netlink: 'syz.3.4241': attribute type 11 has an invalid length. [ 498.206031][T21558] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4241'. [ 499.222262][T21614] netlink: 'syz.3.4259': attribute type 11 has an invalid length. [ 499.230466][T21614] netlink: 'syz.3.4259': attribute type 11 has an invalid length. [ 499.231116][T21609] syzkaller0: entered promiscuous mode [ 499.238414][T21614] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4259'. [ 499.239888][ T8176] IPVS: starting estimator thread 0... [ 499.250555][T21616] netlink: 'syz.0.4260': attribute type 8 has an invalid length. [ 499.253967][T21614] IPVS: ip_vs_edit_dest(): server weight less than zero [ 499.258989][T21609] syzkaller0: entered allmulticast mode [ 499.370219][T21617] IPVS: using max 25 ests per chain, 60000 per kthread [ 499.386998][T21620] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 499.814907][T21652] tipc: Started in network mode [ 499.827308][T21652] tipc: Node identity 969e7e3bc364, cluster identity 4711 [ 499.847347][T21652] tipc: Enabled bearer , priority 0 [ 499.872575][T21658] syzkaller0: entered promiscuous mode [ 499.888568][T21658] syzkaller0: entered allmulticast mode [ 499.910807][T21644] tipc: Resetting bearer [ 499.933354][T21644] tipc: Disabling bearer [ 500.143316][T21673] netlink: 'syz.2.4278': attribute type 3 has an invalid length. [ 500.381993][T21685] netlink: 'syz.4.4282': attribute type 2 has an invalid length. [ 500.729612][T21704] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 500.814302][ T5826] block nbd3: Receive control failed (result -32) [ 500.837713][ T29] audit: type=1107 audit(1772632988.748:4): pid=21708 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 501.246611][T21733] Dead loop on virtual device ip6_vti0, fix it urgently! [ 501.460475][T21700] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 501.489701][T21742] block nbd4: server does not support multiple connections per device. [ 501.500945][T21742] block nbd4: shutting down sockets [ 501.736918][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.754783][T21768] bond2: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 501.769532][T21768] bond2 (unregistering): Released all slaves [ 501.798672][T21771] netlink: 'syz.2.4309': attribute type 3 has an invalid length. [ 501.820550][T21771] syzkaller1: entered promiscuous mode [ 501.826212][T21771] syzkaller1: entered allmulticast mode [ 502.032918][T21785] syzkaller0: entered promiscuous mode [ 502.038938][T21785] syzkaller0: entered allmulticast mode [ 502.126132][T21790] __nla_validate_parse: 7 callbacks suppressed [ 502.126153][T21790] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4315'. [ 502.225855][T21792] bond2: (slave gre0): Device is not bonding slave [ 502.242444][T21792] bond2: option active_slave: invalid value (gre0) [ 502.261969][T21792] bond2 (unregistering): Released all slaves [ 502.326945][T21793] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 502.345469][T21805] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 502.359139][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5210 ms [ 502.376961][ C0] lec:lec_tx_timeout: lec0 [ 502.382441][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 502.468578][T21820] tipc: Trying to set illegal importance in message [ 502.629543][T21831] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4324'. [ 502.641661][T21829] netlink: 'syz.3.4323': attribute type 1 has an invalid length. [ 502.831861][T21837] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 502.865149][T21837] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 502.960477][T21829] bond2: (slave gretap1): making interface the new active one [ 502.969582][T21829] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 503.054800][T21850] macvlan2: entered promiscuous mode [ 503.061448][T21850] macvlan2: entered allmulticast mode [ 503.068528][T21850] bond2: entered promiscuous mode [ 503.074244][T21850] gretap1: entered promiscuous mode [ 503.104486][T21850] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 503.121980][T21850] bond2: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 503.135183][T21850] bond2: left promiscuous mode [ 503.141328][T21850] gretap1: left promiscuous mode [ 503.165746][T21869] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4332'. [ 503.177276][T21869] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4332'. [ 503.212066][T21872] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4334'. [ 503.302348][T21876] FAULT_INJECTION: forcing a failure. [ 503.302348][T21876] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 503.323275][T21876] CPU: 0 UID: 0 PID: 21876 Comm: syz.2.4336 Not tainted syzkaller #0 PREEMPT(full) [ 503.323307][T21876] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 503.323319][T21876] Call Trace: [ 503.323327][T21876] [ 503.323335][T21876] dump_stack_lvl+0xe8/0x150 [ 503.323370][T21876] should_fail_ex+0x412/0x560 [ 503.323401][T21876] _copy_from_iter+0x1d3/0x1670 [ 503.323431][T21876] ? rcu_is_watching+0x15/0xb0 [ 503.323465][T21876] ? __pfx__copy_from_iter+0x10/0x10 [ 503.323498][T21876] ? netlink_sendmsg+0x650/0xb40 [ 503.323522][T21876] ? skb_put+0x11b/0x210 [ 503.323554][T21876] netlink_sendmsg+0x6c0/0xb40 [ 503.323587][T21876] ? __pfx_netlink_sendmsg+0x10/0x10 [ 503.323614][T21876] ? aa_sock_msg_perm+0xf1/0x1b0 [ 503.323639][T21876] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 503.323664][T21876] ____sys_sendmsg+0x972/0x9f0 [ 503.323699][T21876] ? __pfx_____sys_sendmsg+0x10/0x10 [ 503.323735][T21876] ? import_iovec+0x73/0xa0 [ 503.323765][T21876] ___sys_sendmsg+0x2a5/0x360 [ 503.323798][T21876] ? __pfx____sys_sendmsg+0x10/0x10 [ 503.323860][T21876] ? __fget_files+0x2a/0x420 [ 503.323886][T21876] ? __fget_files+0x3a0/0x420 [ 503.323924][T21876] __x64_sys_sendmsg+0x1bd/0x2a0 [ 503.323956][T21876] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 503.324018][T21876] ? __pfx_ksys_write+0x10/0x10 [ 503.324052][T21876] do_syscall_64+0x14d/0xf80 [ 503.324079][T21876] ? trace_irq_disable+0x3b/0x150 [ 503.324105][T21876] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.324136][T21876] ? clear_bhb_loop+0x40/0x90 [ 503.324161][T21876] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.324180][T21876] RIP: 0033:0x7f7db119c799 [ 503.324200][T21876] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 503.324216][T21876] RSP: 002b:00007f7db203d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 503.324241][T21876] RAX: ffffffffffffffda RBX: 00007f7db1415fa0 RCX: 00007f7db119c799 [ 503.324256][T21876] RDX: 0000000002000800 RSI: 0000200000000000 RDI: 0000000000000005 [ 503.324269][T21876] RBP: 00007f7db203d090 R08: 0000000000000000 R09: 0000000000000000 [ 503.324281][T21876] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.324293][T21876] R13: 00007f7db1416038 R14: 00007f7db1415fa0 R15: 00007ffffc9d4288 [ 503.324325][T21876] [ 503.339580][T21878] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4337'. [ 503.477762][T21884] netlink: 'syz.4.4337': attribute type 1 has an invalid length. [ 503.662496][T21889] !: renamed from dummy0 (while UP) [ 503.749997][T21884] 8021q: adding VLAN 0 to HW filter on device bond5 [ 504.030279][T21914] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4347'. [ 504.056265][T21918] FAULT_INJECTION: forcing a failure. [ 504.056265][T21918] name failslab, interval 1, probability 0, space 0, times 0 [ 504.090629][T21918] CPU: 0 UID: 0 PID: 21918 Comm: syz.2.4349 Not tainted syzkaller #0 PREEMPT(full) [ 504.090659][T21918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 504.090670][T21918] Call Trace: [ 504.090677][T21918] [ 504.090684][T21918] dump_stack_lvl+0xe8/0x150 [ 504.090719][T21918] should_fail_ex+0x412/0x560 [ 504.090748][T21918] should_failslab+0xa8/0x100 [ 504.090772][T21918] ? skb_clone+0x212/0x3a0 [ 504.090802][T21918] kmem_cache_alloc_noprof+0x87/0x650 [ 504.090832][T21918] ? __netlink_lookup+0xc6/0x8b0 [ 504.090865][T21918] skb_clone+0x212/0x3a0 [ 504.090898][T21918] __netlink_deliver_tap+0x404/0x850 [ 504.090936][T21918] ? netlink_deliver_tap+0x2e/0x1b0 [ 504.090962][T21918] netlink_deliver_tap+0x19c/0x1b0 [ 504.090988][T21918] netlink_unicast+0x7e3/0x9b0 [ 504.091019][T21918] ? __pfx_netlink_unicast+0x10/0x10 [ 504.091041][T21918] ? netlink_sendmsg+0x650/0xb40 [ 504.091063][T21918] ? skb_put+0x11b/0x210 [ 504.091093][T21918] netlink_sendmsg+0x813/0xb40 [ 504.091126][T21918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 504.091154][T21918] ? aa_sock_msg_perm+0xf1/0x1b0 [ 504.091178][T21918] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 504.091203][T21918] ____sys_sendmsg+0x972/0x9f0 [ 504.091242][T21918] ? __pfx_____sys_sendmsg+0x10/0x10 [ 504.091281][T21918] ? import_iovec+0x73/0xa0 [ 504.091312][T21918] ___sys_sendmsg+0x2a5/0x360 [ 504.091347][T21918] ? __pfx____sys_sendmsg+0x10/0x10 [ 504.091412][T21918] ? __fget_files+0x2a/0x420 [ 504.091440][T21918] ? __fget_files+0x3a0/0x420 [ 504.091488][T21918] __x64_sys_sendmsg+0x1bd/0x2a0 [ 504.091518][T21918] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 504.091555][T21918] ? __pfx_ksys_write+0x10/0x10 [ 504.091588][T21918] do_syscall_64+0x14d/0xf80 [ 504.091615][T21918] ? trace_irq_disable+0x3b/0x150 [ 504.091641][T21918] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.091662][T21918] ? clear_bhb_loop+0x40/0x90 [ 504.091685][T21918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.091705][T21918] RIP: 0033:0x7f7db119c799 [ 504.091724][T21918] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 504.091741][T21918] RSP: 002b:00007f7db203d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 504.091763][T21918] RAX: ffffffffffffffda RBX: 00007f7db1415fa0 RCX: 00007f7db119c799 [ 504.091778][T21918] RDX: 0000000002000800 RSI: 0000200000000000 RDI: 0000000000000005 [ 504.091791][T21918] RBP: 00007f7db203d090 R08: 0000000000000000 R09: 0000000000000000 [ 504.091803][T21918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 504.091815][T21918] R13: 00007f7db1416038 R14: 00007f7db1415fa0 R15: 00007ffffc9d4288 [ 504.091849][T21918] [ 504.491444][T21926] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4352'. [ 504.693541][T21942] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4357'. [ 504.819496][T21951] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4360'. [ 505.066153][T21967] netlink: 'syz.0.4363': attribute type 10 has an invalid length. [ 505.243864][T21981] netlink: 'syz.1.4369': attribute type 1 has an invalid length. [ 505.269448][T21979] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.316745][T21979] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.397590][T21981] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 505.407328][T21991] erspan0: entered promiscuous mode [ 505.504120][T22003] IPVS: set_ctl: invalid protocol: 1 224.0.0.2:20002 [ 505.628648][T22013] netlink: 'syz.1.4377': attribute type 83 has an invalid length. [ 505.979852][T22040] xt_TCPMSS: Only works on TCP SYN packets [ 506.199811][ T1731] block nbd0: Possible stuck request ffff888026990000: control (read@0,4096B). Runtime 120 seconds [ 507.095469][T22097] netlink: 'syz.4.4404': attribute type 9 has an invalid length. [ 507.103919][T22097] netlink: 'syz.4.4404': attribute type 11 has an invalid length. [ 507.113372][T22097] netlink: 'syz.4.4404': attribute type 12 has an invalid length. [ 507.191657][T22104] tc_dump_action: action bad kind [ 507.198915][T22104] __nla_validate_parse: 9 callbacks suppressed [ 507.198935][T22104] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4405'. [ 507.361891][T22111] bond6: entered promiscuous mode [ 507.449044][T22116] netlink: 'syz.1.4409': attribute type 3 has an invalid length. [ 507.468481][T22116] tap0: tun_chr_ioctl cmd 2148553947 [ 507.560221][T22121] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4412'. [ 507.745480][T22139] netlink: 'syz.4.4416': attribute type 1 has an invalid length. [ 507.753565][T22139] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4416'. [ 507.766086][T22139] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4416'. [ 508.062883][T22159] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4422'. [ 508.073188][T22159] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4422'. [ 508.125048][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 508.133194][ C0] lec:lec_tx_timeout: lec0 [ 508.138299][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 508.198667][T22161] bond2: option resend_igmp: invalid value (32767) [ 508.217305][T22161] bond2: option resend_igmp: allowed values 0 - 255 [ 508.231587][T22161] bond2 (unregistering): Released all slaves [ 508.831177][T22183] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4428'. [ 509.241103][ T5826] Bluetooth: hci0: command 0x0406 tx timeout [ 510.168702][T22183] hsr_slave_0 (unregistering): left promiscuous mode [ 510.531941][T22205] IPVS: set_ctl: invalid protocol: 103 172.30.0.2:20001 [ 511.058776][T22163] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 511.081401][T22160] netlink: 'syz.0.4422': attribute type 1 has an invalid length. [ 511.089366][T22160] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4422'. [ 511.312141][T22237] batadv_slave_1: entered allmulticast mode [ 511.586979][T22254] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 511.679653][T22254] bond3: (slave lo): Enslaving as an active interface with an up link [ 511.708671][T22254] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 511.903018][T22278] sock: sock_timestamping_bind_phc: sock not bind to device [ 512.411993][T22300] netlink: 'syz.3.4455': attribute type 2 has an invalid length. [ 512.440170][T22300] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4455'. [ 512.478502][T22300] bridge_slave_0 (unregistering): left allmulticast mode [ 512.499218][T22300] bridge_slave_0 (unregistering): left promiscuous mode [ 512.516424][T22300] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.662944][T22305] xt_CONNSECMARK: invalid mode: 0 [ 512.805464][T22307] team_slave_0: entered allmulticast mode [ 512.846723][T22307] team_slave_0: entered promiscuous mode [ 513.003606][T22319] syz_tun: tun_net_xmit 54 [ 513.034151][T22319] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 513.159227][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 513.167636][ C0] lec:lec_tx_timeout: lec0 [ 513.172318][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 513.203343][T22331] netlink: 'syz.3.4467': attribute type 2 has an invalid length. [ 513.345684][T22337] xt_hashlimit: invalid rate [ 513.497898][ T84] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0xe2 [ 513.597595][T22349] bond3: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 513.610920][T22349] bond3 (unregistering): Released all slaves [ 513.642701][T22358] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4474'. [ 514.007979][T22351] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.276170][T22351] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.335513][T22374] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4478'. [ 514.478384][T22351] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.498072][T22378] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4479'. [ 514.595522][T22351] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.660670][T22388] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4484'. [ 514.678667][T22389] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4484'. [ 514.688943][T22386] nbd: must specify a device to reconfigure [ 514.840807][T22396] delete_channel: no stack [ 514.851651][T14161] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.906802][T22403] IPVS: set_ctl: invalid protocol: 59 224.0.0.2:20002 [ 514.927915][T14161] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.975733][ T7440] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.991889][T22407] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4488'. [ 515.056293][T14161] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.096162][T22411] netlink: 'syz.4.4491': attribute type 1 has an invalid length. [ 515.140441][T22412] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4492'. [ 515.200671][T22411] 8021q: adding VLAN 0 to HW filter on device bond7 [ 515.633700][T22444] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4498'. [ 515.662602][T22444] openvswitch: netlink: Missing key (keys=40, expected=80) [ 515.745748][T22449] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4500'. [ 515.755224][T22449] netlink: 'syz.4.4500': attribute type 7 has an invalid length. [ 515.951107][T22457] bridge_slave_1: left allmulticast mode [ 515.957059][T22457] bridge_slave_1: left promiscuous mode [ 515.964068][T22457] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.984701][T22457] bond0: (slave bond_slave_0): Releasing backup interface [ 516.003864][T22457] bond0: (slave bond_slave_1): Releasing backup interface [ 516.036249][T22457] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 516.047115][T22457] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 516.059557][T22457] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 516.291828][T22455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 516.330300][T22455] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 516.426325][T22485] xt_hashlimit: size too large, truncated to 1048576 [ 516.481108][T22495] netlink: 'syz.1.4514': attribute type 16 has an invalid length. [ 516.491131][T22495] netlink: 'syz.1.4514': attribute type 17 has an invalid length. [ 516.510519][T22495] tunl0: left promiscuous mode [ 516.561250][T22498] xt_hashlimit: overflow, try lower: 222/0 [ 516.608055][T22495] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 517.168950][T22537] netlink: 'syz.2.4526': attribute type 21 has an invalid length. [ 517.298588][T22525] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.458763][T22525] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 517.477374][T22525] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 517.766157][T22528] veth5: entered allmulticast mode [ 517.821796][T22537] netlink: 'syz.2.4526': attribute type 6 has an invalid length. [ 517.830859][T22537] __nla_validate_parse: 4 callbacks suppressed [ 517.830878][T22537] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4526'. [ 517.850314][ T84] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.884477][ T84] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.914706][ T84] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.943984][ T84] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 518.021266][T22557] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4531'. [ 518.046781][T22557] veth1_to_bond: entered allmulticast mode [ 518.054370][T22556] veth1_to_bond: left allmulticast mode [ 518.061701][T22549] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 518.081582][T22566] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4534'. [ 518.086246][T22545] lec:lec_atm_close: lec0: Shut down! [ 518.141571][T22566] bond4 (unregistering): Released all slaves [ 518.321306][T22578] netlink: 'syz.0.4535': attribute type 2 has an invalid length. [ 518.395058][T22578] 9: entered promiscuous mode [ 518.412510][T22580] netlink: 'syz.1.4537': attribute type 11 has an invalid length. [ 518.454376][T22580] netlink: 'syz.1.4537': attribute type 11 has an invalid length. [ 518.463140][T22580] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4537'. [ 518.505915][T22585] netlink: 144 bytes leftover after parsing attributes in process `syz.1.4537'. [ 518.580236][T22591] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4541'. [ 518.601664][T22591] openvswitch: netlink: Flow key attr not present in new flow. [ 518.773030][T22599] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4543'. [ 518.800525][T22601] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4544'. [ 518.970233][T22612] netlink: 'syz.1.4548': attribute type 6 has an invalid length. [ 519.013778][T22612] netlink: 'syz.1.4548': attribute type 6 has an invalid length. [ 519.438344][T22642] tipc: Started in network mode [ 519.467027][T22642] tipc: Node identity 22d78ed9e171, cluster identity 4711 [ 519.501562][T22642] tipc: Enabled bearer , priority 0 [ 519.527145][T22645] syzkaller0: entered promiscuous mode [ 519.568184][T22645] syzkaller0: entered allmulticast mode [ 519.708636][ T29] audit: type=1107 audit(1772633007.618:5): pid=22659 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 519.913527][T22675] netlink: 'syz.1.4560': attribute type 18 has an invalid length. [ 520.208179][T22642] tipc: Resetting bearer [ 520.436278][T22642] tipc: Resetting bearer [ 520.579867][T22642] tipc: Disabling bearer [ 520.665359][ T5959] tipc: Node number set to 3282472665 [ 520.805411][T22711] tipc: Enabled bearer , priority 0 [ 520.924972][T22711] syzkaller0: entered promiscuous mode [ 520.931062][T22711] syzkaller0: entered allmulticast mode [ 520.938858][T22711] tipc: Resetting bearer [ 520.988265][T22710] tipc: Resetting bearer [ 521.736422][T22748] netlink: 'syz.1.4577': attribute type 3 has an invalid length. [ 521.844147][T22752] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 521.996749][T22757] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4579'. [ 522.841496][ T25] block nbd1: Possible stuck request ffff888026a18000: control (read@0,1024B). Runtime 120 seconds [ 522.854482][ T25] block nbd1: Possible stuck request ffff888026a18200: control (read@1024,1024B). Runtime 120 seconds [ 522.866315][ T25] block nbd1: Possible stuck request ffff888026a18400: control (read@2048,1024B). Runtime 120 seconds [ 522.877820][ T25] block nbd1: Possible stuck request ffff888026a18600: control (read@3072,1024B). Runtime 120 seconds [ 523.164416][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5080 ms [ 523.172566][ C0] lec:lec_tx_timeout: lec0 [ 523.177239][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 523.334834][T22710] tipc: Disabling bearer [ 523.344361][ T5941] tipc: Node number set to 1442479675 [ 523.574745][T22778] netlink: 828 bytes leftover after parsing attributes in process `syz.0.4584'. [ 524.045199][T22808] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4591'. [ 524.090793][T22808] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4591'. [ 524.176325][T22813] syzkaller0: entered promiscuous mode [ 524.181968][T22813] syzkaller0: entered allmulticast mode [ 524.247938][T22817] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4594'. [ 524.334218][T22824] : renamed from tunl0 (while UP) [ 524.371675][T22823] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 524.399197][T22829] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4596'. [ 524.516445][T22833] FAULT_INJECTION: forcing a failure. [ 524.516445][T22833] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 524.560608][T22833] CPU: 0 UID: 0 PID: 22833 Comm: syz.4.4600 Not tainted syzkaller #0 PREEMPT(full) [ 524.560639][T22833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 524.560651][T22833] Call Trace: [ 524.560660][T22833] [ 524.560668][T22833] dump_stack_lvl+0xe8/0x150 [ 524.560703][T22833] should_fail_ex+0x412/0x560 [ 524.560733][T22833] _copy_from_user+0x2d/0xb0 [ 524.560764][T22833] ___sys_sendmsg+0x1c6/0x360 [ 524.560799][T22833] ? __pfx____sys_sendmsg+0x10/0x10 [ 524.560864][T22833] ? __fget_files+0x2a/0x420 [ 524.560890][T22833] ? __fget_files+0x3a0/0x420 [ 524.560928][T22833] __x64_sys_sendmsg+0x1bd/0x2a0 [ 524.560959][T22833] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 524.560998][T22833] ? __pfx_ksys_write+0x10/0x10 [ 524.561031][T22833] do_syscall_64+0x14d/0xf80 [ 524.561059][T22833] ? trace_irq_disable+0x3b/0x150 [ 524.561086][T22833] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.561106][T22833] ? clear_bhb_loop+0x40/0x90 [ 524.561132][T22833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.561163][T22833] RIP: 0033:0x7f9bc9f9c799 [ 524.561182][T22833] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 524.561199][T22833] RSP: 002b:00007f9bcae9f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 524.561221][T22833] RAX: ffffffffffffffda RBX: 00007f9bca215fa0 RCX: 00007f9bc9f9c799 [ 524.561235][T22833] RDX: 0000000000040800 RSI: 00002000000002c0 RDI: 0000000000000003 [ 524.561248][T22833] RBP: 00007f9bcae9f090 R08: 0000000000000000 R09: 0000000000000000 [ 524.561261][T22833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 524.561273][T22833] R13: 00007f9bca216038 R14: 00007f9bca215fa0 R15: 00007ffe23a9b5e8 [ 524.561305][T22833] [ 524.820138][T22841] bond4: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 524.844938][T22841] bond4 (unregistering): Released all slaves [ 524.868255][T22844] xt_hashlimit: size too large, truncated to 1048576 [ 524.886782][T22847] team_slave_0: entered allmulticast mode [ 524.989469][T22853] syz_tun: tun_net_xmit 86 [ 525.026032][T22849] netlink: 277 bytes leftover after parsing attributes in process `syz.2.4606'. [ 525.268356][T22874] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4612'. [ 525.391886][T22880] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4615'. [ 525.402974][T22880] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4615'. [ 525.490490][T22886] netlink: 'syz.1.4617': attribute type 1 has an invalid length. [ 525.498465][T22886] netlink: 'syz.1.4617': attribute type 11 has an invalid length. [ 525.510099][T22886] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4617'. [ 526.040266][ C1] syz_tun: tun_net_xmit 86 [ 527.079393][ C1] syz_tun: tun_net_xmit 86 [ 527.358795][T22899] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 527.366722][T22899] team0: Device macvlan6 is already an upper device of the team interface [ 527.763992][T22927] syz_tun: tun_net_xmit 42 [ 527.886090][T22936] netlink: 'syz.1.4634': attribute type 23 has an invalid length. [ 527.934815][T22938] 0: renamed from hsr_slave_1 [ 527.961649][T22938] 0: entered allmulticast mode [ 527.991354][T22938] A link change request failed with some changes committed already. Interface c0 may have been left with an inconsistent configuration, please check. [ 528.189102][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 528.197289][ C0] lec:lec_tx_timeout: lec0 [ 528.202183][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 528.459535][T22960] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 528.691158][T22975] __nla_validate_parse: 3 callbacks suppressed [ 528.691178][T22975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4647'. [ 528.886132][T22986] x_tables: unsorted underflow at hook 1 [ 528.994803][T22992] netlink: 'syz.2.4652': attribute type 4 has an invalid length. [ 529.014201][T22992] netlink: 'syz.2.4652': attribute type 16 has an invalid length. [ 529.030261][T22992] netlink: 'syz.2.4652': attribute type 17 has an invalid length. [ 529.072942][T22992] ip6gretap0: left promiscuous mode [ 529.077504][T22999] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4655'. [ 529.092138][T22992] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 529.341061][T23012] sch_fq: defrate 0 ignored. [ 529.355265][ T5826] block nbd4: Receive control failed (result -32) [ 529.472098][T23021] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4660'. [ 529.482220][T23021] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4660'. [ 529.562501][ T7451] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 529.581264][ T7451] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 529.583023][T23025] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4662'. [ 529.665913][ T7451] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 529.683842][ T7451] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 529.798340][T23042] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4666'. [ 530.004828][T23053] netlink: 'syz.0.4670': attribute type 64 has an invalid length. [ 530.207051][T23061] netlink: 'syz.0.4672': attribute type 1 has an invalid length. [ 530.233652][T23061] netlink: 'syz.0.4672': attribute type 2 has an invalid length. [ 530.522818][T23076] netlink: 'syz.4.4677': attribute type 18 has an invalid length. [ 530.534604][T23076] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4677'. [ 530.575447][T23081] netlink: 'syz.4.4677': attribute type 1 has an invalid length. [ 530.687397][T23083] bridge7: the hash_elasticity option has been deprecated and is always 16 [ 530.820294][T23092] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 530.827852][T23092] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 530.839826][T23092] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 530.847270][T23092] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 530.864695][T23098] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4681'. [ 530.874184][T23098] netlink: 176 bytes leftover after parsing attributes in process `syz.4.4681'. [ 530.898004][T23098] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4681'. [ 530.960242][T23103] nbd: must specify at least one socket [ 531.224439][T23117] netlink: 'syz.0.4689': attribute type 3 has an invalid length. [ 531.787731][T23167] netlink: 'syz.4.4704': attribute type 10 has an invalid length. [ 531.808044][T23167] bridge0: port 2(bridge_slave_1) entered disabled state [ 531.838417][T23167] bridge_slave_1: left allmulticast mode [ 531.845473][T23167] bridge_slave_1: left promiscuous mode [ 531.856592][T23167] bridge0: port 2(bridge_slave_1) entered disabled state [ 531.888258][T23167] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 531.942080][T23175] netlink: 'syz.0.4706': attribute type 1 has an invalid length. [ 532.060830][T23180] [ 532.063223][T23180] ====================================================== [ 532.070366][T23180] WARNING: possible circular locking dependency detected [ 532.077675][T23180] syzkaller #0 Not tainted [ 532.082275][T23180] ------------------------------------------------------ [ 532.089300][T23180] syz.1.4707/23180 is trying to acquire lock: [ 532.095379][T23180] ffffffff8fd48cb8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xbe/0x860 [ 532.105155][T23180] [ 532.105155][T23180] but task is already holding lock: [ 532.112515][T23180] ffffffff8fd48c58 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 532.122101][T23180] [ 532.122101][T23180] which lock already depends on the new lock. [ 532.122101][T23180] [ 532.132602][T23180] [ 532.132602][T23180] the existing dependency chain (in reverse order) is: [ 532.141717][T23180] [ 532.141717][T23180] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 532.149640][T23180] _raw_spin_lock_bh+0x36/0x50 [ 532.154951][T23180] nr_rt_ioctl+0x40c/0xf90 [ 532.159917][T23180] sock_do_ioctl+0x101/0x320 [ 532.165043][T23180] sock_ioctl+0x5c6/0x7f0 [ 532.169990][T23180] __se_sys_ioctl+0xfc/0x170 [ 532.175132][T23180] do_syscall_64+0x14d/0xf80 [ 532.180372][T23180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.187069][T23180] [ 532.187069][T23180] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 532.195178][T23180] _raw_spin_lock_bh+0x36/0x50 [ 532.200591][T23180] nr_rt_ioctl+0x215/0xf90 [ 532.205547][T23180] sock_do_ioctl+0x101/0x320 [ 532.210664][T23180] sock_ioctl+0x5c6/0x7f0 [ 532.215517][T23180] __se_sys_ioctl+0xfc/0x170 [ 532.220718][T23180] do_syscall_64+0x14d/0xf80 [ 532.225838][T23180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.232262][T23180] [ 532.232262][T23180] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 532.240107][T23180] __lock_acquire+0x15a5/0x2cf0 [ 532.245487][T23180] lock_acquire+0xf0/0x2e0 [ 532.250426][T23180] _raw_spin_lock_bh+0x36/0x50 [ 532.255716][T23180] nr_rt_device_down+0xbe/0x860 [ 532.261286][T23180] nr_device_event+0x137/0x150 [ 532.266608][T23180] notifier_call_chain+0x1be/0x400 [ 532.272266][T23180] __dev_notify_flags+0x16d/0x310 [ 532.277839][T23180] netif_change_flags+0xe8/0x1a0 [ 532.283340][T23180] dev_change_flags+0x130/0x260 [ 532.289254][T23180] dev_ioctl+0x7b4/0x1150 [ 532.294137][T23180] sock_do_ioctl+0x23e/0x320 [ 532.299255][T23180] sock_ioctl+0x5c6/0x7f0 [ 532.304141][T23180] __se_sys_ioctl+0xfc/0x170 [ 532.309373][T23180] do_syscall_64+0x14d/0xf80 [ 532.314507][T23180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.320923][T23180] [ 532.320923][T23180] other info that might help us debug this: [ 532.320923][T23180] [ 532.331154][T23180] Chain exists of: [ 532.331154][T23180] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 532.331154][T23180] [ 532.345244][T23180] Possible unsafe locking scenario: [ 532.345244][T23180] [ 532.352725][T23180] CPU0 CPU1 [ 532.358089][T23180] ---- ---- [ 532.363543][T23180] lock(nr_neigh_list_lock); [ 532.368250][T23180] lock(&nr_node->node_lock); [ 532.375625][T23180] lock(nr_neigh_list_lock); [ 532.382834][T23180] lock(nr_node_list_lock); [ 532.387535][T23180] [ 532.387535][T23180] *** DEADLOCK *** [ 532.387535][T23180] [ 532.395778][T23180] 2 locks held by syz.1.4707/23180: [ 532.400999][T23180] #0: ffffffff8fbcc908 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 532.409902][T23180] #1: ffffffff8fd48c58 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 532.420185][T23180] [ 532.420185][T23180] stack backtrace: [ 532.426528][T23180] CPU: 0 UID: 0 PID: 23180 Comm: syz.1.4707 Not tainted syzkaller #0 PREEMPT(full) [ 532.426554][T23180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 532.426564][T23180] Call Trace: [ 532.426575][T23180] [ 532.426582][T23180] dump_stack_lvl+0xe8/0x150 [ 532.426610][T23180] print_circular_bug+0x2e1/0x300 [ 532.426636][T23180] check_noncircular+0x12e/0x150 [ 532.426663][T23180] __lock_acquire+0x15a5/0x2cf0 [ 532.426685][T23180] ? __lock_acquire+0x6b5/0x2cf0 [ 532.426709][T23180] lock_acquire+0xf0/0x2e0 [ 532.426726][T23180] ? nr_rt_device_down+0xbe/0x860 [ 532.426752][T23180] ? nr_rt_device_down+0xbe/0x860 [ 532.426774][T23180] _raw_spin_lock_bh+0x36/0x50 [ 532.426794][T23180] ? nr_rt_device_down+0xbe/0x860 [ 532.426815][T23180] nr_rt_device_down+0xbe/0x860 [ 532.426836][T23180] ? nr_device_event+0x12f/0x150 [ 532.426858][T23180] nr_device_event+0x137/0x150 [ 532.426879][T23180] notifier_call_chain+0x1be/0x400 [ 532.426905][T23180] __dev_notify_flags+0x16d/0x310 [ 532.426927][T23180] ? __pfx___dev_notify_flags+0x10/0x10 [ 532.426947][T23180] ? __dev_change_flags+0x4c6/0x690 [ 532.426969][T23180] ? __pfx___dev_change_flags+0x10/0x10 [ 532.426990][T23180] ? full_name_hash+0x92/0xe0 [ 532.427012][T23180] netif_change_flags+0xe8/0x1a0 [ 532.427034][T23180] dev_change_flags+0x130/0x260 [ 532.427057][T23180] dev_ioctl+0x7b4/0x1150 [ 532.427213][T23180] sock_do_ioctl+0x23e/0x320 [ 532.427234][T23180] ? __pfx_sock_do_ioctl+0x10/0x10 [ 532.427250][T23180] ? do_futex+0x333/0x420 [ 532.427274][T23180] sock_ioctl+0x5c6/0x7f0 [ 532.427290][T23180] ? __pfx_sock_ioctl+0x10/0x10 [ 532.427305][T23180] ? __fget_files+0x2a/0x420 [ 532.427328][T23180] ? __fget_files+0x3a0/0x420 [ 532.427349][T23180] ? __fget_files+0x2a/0x420 [ 532.427379][T23180] ? bpf_lsm_file_ioctl+0x9/0x20 [ 532.427397][T23180] ? __pfx_sock_ioctl+0x10/0x10 [ 532.427412][T23180] __se_sys_ioctl+0xfc/0x170 [ 532.427429][T23180] do_syscall_64+0x14d/0xf80 [ 532.427452][T23180] ? trace_irq_disable+0x3b/0x150 [ 532.427474][T23180] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.427490][T23180] ? clear_bhb_loop+0x40/0x90 [ 532.427506][T23180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.427522][T23180] RIP: 0033:0x7f5bee19c799 [ 532.427538][T23180] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 532.427553][T23180] RSP: 002b:00007f5bef05a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 532.427573][T23180] RAX: ffffffffffffffda RBX: 00007f5bee416090 RCX: 00007f5bee19c799 [ 532.427585][T23180] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000008 [ 532.427596][T23180] RBP: 00007f5bee232bd9 R08: 0000000000000000 R09: 0000000000000000 [ 532.427605][T23180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 532.427615][T23180] R13: 00007f5bee416128 R14: 00007f5bee416090 R15: 00007fff69907b78 [ 532.427632][T23180] [ 532.732678][T23188] xt_socket: unknown flags 0x50 [ 533.209141][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 533.217202][ C0] lec:lec_tx_timeout: lec0 [ 533.222243][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 536.279385][ T1731] block nbd0: Possible stuck request ffff888026990000: control (read@0,4096B). Runtime 150 seconds [ 537.569317][ C0] syz_tun: tun_net_xmit 42 [ 538.229497][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 538.237539][ C0] lec:lec_tx_timeout: lec0 [ 538.242143][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 538.599222][ C0] syz_tun: tun_net_xmit 42 [ 539.639264][ C0] syz_tun: tun_net_xmit 42