last executing test programs: 2.726761984s ago: executing program 1 (id=11038): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00020b, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r1}, &(0x7f0000000040), &(0x7f0000000080)=r2}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf092000000000000d090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000001c00000000000000bf9800000000000056080000000000008500000005000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 2.714316362s ago: executing program 4 (id=11039): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r0, 0x0, 0x0) sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}, 0x8820) 2.534135424s ago: executing program 1 (id=11042): r0 = socket(0x10, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000100000e00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket(0x10, 0x80003, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xb, "0000000000020400"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) 2.309447202s ago: executing program 1 (id=11044): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) sendto$inet6(r0, &(0x7f0000000000)="01", 0x1, 0xc000, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, 0xffffffffffffffff, 0x4000) sendto$inet6(r0, &(0x7f0000000100)='0', 0x12, 0x0, 0x0, 0x0) 2.202257489s ago: executing program 1 (id=11047): r0 = socket(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x50, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x50}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200000054000480500001800a000100696e6e65720000004000028008"], 0xa8}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x4, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0xa000}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c810}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a"], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 2.186417513s ago: executing program 0 (id=11048): r0 = socket$kcm(0x23, 0x5, 0x0) sendmsg$sock(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000002"], 0x78) 2.110855759s ago: executing program 3 (id=11049): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x3, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r3, r2}, 0x14) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 2.07214038s ago: executing program 1 (id=11050): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) preadv(r0, &(0x7f0000000100)=[{&(0x7f00000007c0)=""/4096, 0x1000}], 0x1, 0x497, 0x9) 1.920754082s ago: executing program 0 (id=11052): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) listen(r1, 0x6) listen(r0, 0xa) 1.855213215s ago: executing program 0 (id=11053): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001800dd8d000000000000000002000000000000060000000006001500050000002800160000000000000000040000000000ff010000647e0c200000000000000000000000010000000007000000908725b42569269bb34368865c6a4df42644a4c8d2a0a8931260f0c411a4b024dc0b770d42123a843a8c611d9f31dcb23a144a437db0cdbe1ff316ee7b46e812390f6553c91e8a38eac7c3887c07e9e0688bc73a6a53ba733c98948fc3dd5b0b529409b36bc2"], 0x4c}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010024bd7000fddbdf251700000008000300", @ANYRES32=r4, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4020804) 1.806863481s ago: executing program 4 (id=11054): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0xe4) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="24040000040801"], 0x24}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000068000000060a010400000000000000000100000008000b4000000000400004802800018007000100637400001c000280080001400000000108000240000000090500030000000000140001800a0001007265646972000000040002800900010073797a30"], 0xdc}, 0x1, 0x0, 0x0, 0x15}, 0x4000000) 1.595910751s ago: executing program 3 (id=11055): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x20, r1, 0x6a98047402e98331, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x841}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_LBT_MODE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4008001) 1.560102368s ago: executing program 0 (id=11057): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/ipc\x00') unshare(0x6a040000) socket$packet(0x11, 0x3, 0x300) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendto(r0, &(0x7f0000000080)="9c0facf9c0", 0x5, 0x0, 0x0, 0x0) 1.514060622s ago: executing program 4 (id=11058): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) sendmmsg(r1, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) r2 = epoll_create(0x7) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x20000000}) 1.500113238s ago: executing program 2 (id=11059): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0f000000040000000800000001"], 0x37) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000340)=ANY=[@ANYBLOB="12000000020000000800000002"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000400)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r0}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001540)={{r2}, &(0x7f00000014c0), &(0x7f0000001500)=r1}, 0x20) 1.397411649s ago: executing program 3 (id=11060): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x24000050}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="40000000210a018800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380100000800c000180060001"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 1.352074384s ago: executing program 2 (id=11061): sendmsg$IPSET_CMD_SAVE(0xffffffffffffffff, 0x0, 0x4000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x60, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}, @TCA_RATE={0x6, 0x5, {0x8, 0x8}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) 1.33045512s ago: executing program 4 (id=11062): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x24040800, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000240)={0xa, 0x4e23, 0x27bf, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xa}}, 0x3}, 0x1c) sendto$inet6(r0, &(0x7f0000000040)='[', 0x1, 0xc0, 0x0, 0x0) 1.214066117s ago: executing program 3 (id=11063): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) close(r0) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200000000310000000008000a40fffffffc08000340000000140c0009800800014000000081140000001100010000"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1.209055118s ago: executing program 4 (id=11064): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket$netlink(0x10, 0x3, 0x12) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) write$rfkill(r0, &(0x7f0000000200)={0x9, 0x3, 0x2, 0x1, 0x1}, 0x8) 1.170008881s ago: executing program 0 (id=11065): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1d19cb307b3472ab9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x3, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x2c}}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41000}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r0, &(0x7f0000000e40)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x302, 0x0) 1.097937387s ago: executing program 2 (id=11066): mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 1.097574069s ago: executing program 3 (id=11067): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x1000009, 0x11, r1, 0xd371f000) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x2000007, 0x12, r0, 0x12574000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000200), 0xffffffc1) 897.802049ms ago: executing program 2 (id=11068): r0 = socket(0x28, 0x5, 0x0) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r1, 0x4) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x2d, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0) r2 = accept4$unix(r1, 0x0, 0x0, 0x800) recvfrom$unix(r2, &(0x7f0000000140)=""/249, 0x13f, 0x102, 0x0, 0x0) 749.137279ms ago: executing program 2 (id=11069): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newqdisc={0x7c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0x5}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x4c, 0x2, {{0x0, 0x4, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0x401, 0x7fff, 0x7, 0x85f3, 0x9}}]}, @TCA_NETEM_RATE64={0xc, 0x8, 0xc3aff7f8daad9175}, @TCA_NETEM_ECN={0x8, 0x7, 0x1}]}}}]}, 0x7c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000600)=@getqdisc={0x24, 0x26, 0x705, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xffe0}, {0x10, 0xe}, {0xfff2, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x24000804}, 0x0) 295.93065ms ago: executing program 3 (id=11070): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'nr0\x00', 0x6132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'nr0\x00', 0x6132}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'nr0\x00', 0x6132}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'syz_tun\x00', 0x400}) write$cgroup_subtree(r1, &(0x7f0000000000), 0xfe3a) 220.639508ms ago: executing program 4 (id=11071): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r1, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r2, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r5], 0x30}}, 0x0) 185.38834ms ago: executing program 1 (id=11072): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) r3 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r3, &(0x7f0000000140)={0x1d, r2, 0x3, {0x1, 0xff, 0x4}}, 0x18) sendmmsg(r1, &(0x7f0000003dc0)=[{{&(0x7f0000000180)=@can, 0x80, &(0x7f0000001600)=[{&(0x7f0000000440)="4e358ed59ee7a636d3a35d9bb1a2", 0xe}], 0x1}}], 0x1, 0x48010) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@newtfilter={0x24, 0x11, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xb, 0xfff2}, {0xfff1, 0x9}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) 165.45887ms ago: executing program 2 (id=11073): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x810}], 0x1, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001bc0)=ANY=[], 0x11a0}, 0x1, 0x0, 0x0, 0x8040}, 0x8080) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) 0s ago: executing program 0 (id=11074): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x4, 0x4, 0x5}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$unix(r1, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): gth. [ 319.411954][T17894] : entered promiscuous mode [ 319.619850][ C0] net_ratelimit: 5 callbacks suppressed [ 319.619869][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 320.283813][T17950] xt_HMARK: spi-set and port-set can't be combined [ 320.462020][T17958] __nla_validate_parse: 4 callbacks suppressed [ 320.462042][T17958] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5748'. [ 320.659651][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 321.034661][T17993] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5762'. [ 321.108496][T17997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5764'. [ 321.699820][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 322.068431][T18050] netlink: 'syz.4.5786': attribute type 25 has an invalid length. [ 322.200587][T18055] netlink: 640 bytes leftover after parsing attributes in process `syz.3.5788'. [ 322.229794][T18055] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 322.739731][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 323.130245][T18113] netlink: 'syz.3.5806': attribute type 2 has an invalid length. [ 323.146088][T18113] netlink: 188 bytes leftover after parsing attributes in process `syz.3.5806'. [ 323.779832][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 323.980746][ T5885] IPVS: starting estimator thread 0... [ 324.079725][T18161] IPVS: using max 28 ests per chain, 67200 per kthread [ 324.390781][T18186] netlink: 272 bytes leftover after parsing attributes in process `syz.3.5837'. [ 324.490208][T18188] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5838'. [ 324.819654][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 325.360101][T18240] netlink: 'syz.4.5855': attribute type 62 has an invalid length. [ 325.859664][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 326.018103][T18279] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5871'. [ 326.224335][T18287] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5875'. [ 326.284883][T18287] bond2: Invalid ad_actor_system MAC address. [ 326.291740][T18287] bond2: option ad_actor_system: invalid value (1) [ 326.311296][T18287] bond2 (unregistering): Released all slaves [ 326.565598][T18302] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 326.899958][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 327.608092][T18358] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5908'. [ 327.627128][T18359] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5909'. [ 327.639942][T18358] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5908'. [ 327.660281][T18358] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5908'. [ 327.939767][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 327.985861][T18371] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5915'. [ 327.996360][T18371] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5915'. [ 328.604575][T18409] netlink: 'syz.1.5933': attribute type 13 has an invalid length. [ 328.670315][T18409] veth0_macvtap: left promiscuous mode [ 328.688241][T18409] macvtap0: entered allmulticast mode [ 328.723835][T18409] macvtap0: refused to change device tx_queue_len [ 328.966486][ T796] IPVS: starting estimator thread 0... [ 328.979756][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 329.069695][T18430] IPVS: using max 28 ests per chain, 67200 per kthread [ 329.306290][T18447] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5948'. [ 329.863067][T18484] netlink: 'syz.0.5963': attribute type 3 has an invalid length. [ 329.945826][T18488] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 330.019741][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 330.488160][T18515] netlink: 204 bytes leftover after parsing attributes in process `syz.0.5977'. [ 330.497418][T18520] netlink: 'syz.4.5978': attribute type 2 has an invalid length. [ 331.059658][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 331.322140][T18566] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 331.331492][T18570] __nla_validate_parse: 2 callbacks suppressed [ 331.331510][T18570] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6004'. [ 331.544198][T18584] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 331.975213][T18610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6025'. [ 332.099737][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 332.362699][T18637] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6037'. [ 332.403258][T18640] netlink: 216 bytes leftover after parsing attributes in process `syz.0.6038'. [ 332.430043][T18640] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6038'. [ 332.625603][T18648] vlan4: entered allmulticast mode [ 333.139765][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 333.307888][T18688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6062'. [ 333.413224][T18682] syz.1.6060 (18682) used greatest stack depth: 17472 bytes left [ 333.643928][T18705] netlink: 'syz.2.6067': attribute type 3 has an invalid length. [ 333.801024][T18711] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6070'. [ 334.179802][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 334.592661][T18750] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6090'. [ 334.612879][T18750] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 334.843583][T18764] netlink: 'syz.0.6096': attribute type 1 has an invalid length. [ 334.883760][T18764] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 334.949367][T18772] netlink: 'syz.1.6098': attribute type 32 has an invalid length. [ 334.958019][T18771] netlink: 'syz.3.6100': attribute type 4 has an invalid length. [ 334.962051][T18772] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6098'. [ 335.001154][T18772] bond2: option coupled_control: invalid value (192) [ 335.020120][T18772] bond2 (unregistering): Released all slaves [ 335.219813][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 335.390379][T18794] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6108'. [ 336.259762][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 336.427639][T18856] __nla_validate_parse: 1 callbacks suppressed [ 336.427662][T18856] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6139'. [ 336.563548][T18860] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.6141'. [ 336.602815][ T29] audit: type=1107 audit(1776168212.469:5): pid=18861 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 336.903485][T18877] netlink: 'syz.4.6148': attribute type 10 has an invalid length. [ 336.906176][T18876] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6150'. [ 336.949291][T18877] team0: Port device dummy0 added [ 337.299715][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 337.769269][T18925] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6174'. [ 338.339684][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 338.393979][T18963] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6187'. [ 338.842853][T18985] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6197'. [ 339.379653][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 339.401616][T19019] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.6213'. [ 339.420950][T19011] lo speed is unknown, defaulting to 1000 [ 339.710970][T19029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6218'. [ 339.731653][T19035] netlink: 'syz.4.6220': attribute type 8 has an invalid length. [ 339.762540][T19036] blkio.reset_stats is deprecated [ 340.169806][T19058] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6231'. [ 340.234308][T19061] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6232'. [ 340.419649][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 341.459724][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 341.734069][T19133] __nla_validate_parse: 1 callbacks suppressed [ 341.734090][T19133] netlink: 108 bytes leftover after parsing attributes in process `syz.0.6262'. [ 342.499652][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 342.538198][ T5489] veth0_macvtap: left promiscuous mode [ 343.170709][T19198] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6287'. [ 343.211053][T19199] netlink: 100 bytes leftover after parsing attributes in process `syz.4.6286'. [ 343.539752][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 344.226699][T19245] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6307'. [ 344.394618][T19245] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6307'. [ 344.579726][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 344.970166][T19286] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6323'. [ 345.486522][T19318] netlink: 'syz.0.6340': attribute type 1 has an invalid length. [ 345.509986][T19318] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6340'. [ 345.619679][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 346.559003][T19384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6367'. [ 346.659870][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 346.794703][T19398] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6373'. [ 347.072495][T19414] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6381'. [ 347.084989][ T1104] bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex [ 347.112180][ T1104] bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex [ 347.136808][ T1104] bond0: active interface up! [ 347.227137][T19423] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6385'. [ 347.236747][T19423] netlink: 176 bytes leftover after parsing attributes in process `syz.2.6385'. [ 347.246957][T19423] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6385'. [ 347.384192][T19431] netlink: 81 bytes leftover after parsing attributes in process `syz.3.6389'. [ 347.699737][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 347.782022][T19453] netlink: 220 bytes leftover after parsing attributes in process `syz.3.6402'. [ 347.846199][T19459] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6403'. [ 347.878699][T19459] xfrm1: entered promiscuous mode [ 347.899148][T19459] xfrm1: entered allmulticast mode [ 347.915211][T19460] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6403'. [ 348.009363][T19464] sctp: [Deprecated]: syz.1.6405 (pid 19464) Use of struct sctp_assoc_value in delayed_ack socket option. [ 348.009363][T19464] Use struct sctp_sack_info instead [ 348.169040][T19473] veth1_macvtap: left promiscuous mode [ 348.286665][T19478] netlink: 'syz.3.6412': attribute type 4 has an invalid length. [ 348.459261][T19489] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6417'. [ 348.600948][T19497] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 348.739749][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 349.256090][T19529] netlink: 'syz.1.6436': attribute type 9 has an invalid length. [ 349.542394][ T5836] block nbd0: Receive control failed (result -32) [ 349.554271][T19542] netlink: zone id is out of range [ 349.631718][T19542] netlink: zone id is out of range [ 349.712668][T19548] block nbd0: reconnected socket [ 349.721171][ T5836] block nbd0: Receive control failed (result -32) [ 349.728627][T19540] netlink: set zone limit has 4 unknown bytes [ 349.780434][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 349.823298][T19550] veth0_to_bridge: entered promiscuous mode [ 349.851637][T19549] veth0_to_bridge: left promiscuous mode [ 350.819649][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 351.017574][T19624] hsr_slave_0: left promiscuous mode [ 351.047938][T19624] 0: left promiscuous mode [ 351.474468][T19648] netlink: 'syz.3.6489': attribute type 9 has an invalid length. [ 351.859755][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 351.982240][T19676] __nla_validate_parse: 7 callbacks suppressed [ 351.982263][T19676] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6503'. [ 352.005677][T19676] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6503'. [ 352.247558][T19685] netlink: 14 bytes leftover after parsing attributes in process `syz.1.6507'. [ 352.716539][T19700] tap0: tun_chr_ioctl cmd 2148553947 [ 352.899725][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 353.039387][T19724] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6523'. [ 353.939730][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 354.038791][T19781] team0: No ports can be present during mode change [ 354.381076][T19796] netlink: 284 bytes leftover after parsing attributes in process `syz.4.6557'. [ 354.684015][T19810] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.6564'. [ 354.816880][T19818] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6566'. [ 354.847569][T19819] TCP: TCP_TX_DELAY enabled [ 354.979736][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 356.019746][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 356.056273][T19893] vcan0: tx address claim with dlc 0 [ 357.059735][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 357.473654][T19976] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6629'. [ 357.612759][T19983] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6632'. [ 357.799491][T19993] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6636'. [ 357.838193][T19993] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6636'. [ 357.866535][T19993] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6636'. [ 358.071054][T20012] netlink: 196 bytes leftover after parsing attributes in process `syz.3.6643'. [ 358.099695][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 358.884573][T20047] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6658'. [ 359.021410][T20052] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6661'. [ 359.139869][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 359.283501][T20063] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6665'. [ 359.422902][T20070] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6671'. [ 359.468160][T20070] hsr0: entered promiscuous mode [ 359.473936][T20070] macvlan2: entered allmulticast mode [ 359.479451][T20070] hsr0: entered allmulticast mode [ 359.486155][T20070] hsr_slave_0: entered allmulticast mode [ 359.492353][T20070] hsr_slave_1: entered allmulticast mode [ 359.586834][T20078] block nbd1: Unsupported socket: should be TCP or UNIX. [ 360.180162][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 361.219793][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 361.813629][T20224] netlink: 'syz.4.6742': attribute type 8 has an invalid length. [ 361.837657][T20224] sch_fq: defrate 0 ignored. [ 362.133914][T20240] netlink: 'syz.2.6748': attribute type 1 has an invalid length. [ 362.169886][T20240] netlink: 'syz.2.6748': attribute type 1 has an invalid length. [ 362.204621][T20240] netlink: 'syz.2.6748': attribute type 8 has an invalid length. [ 362.259762][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 362.411659][T20257] netlink: 'syz.3.6755': attribute type 1 has an invalid length. [ 362.566591][T20266] __nla_validate_parse: 6 callbacks suppressed [ 362.566614][T20266] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6758'. [ 362.658924][T20272] veth0: entered promiscuous mode [ 362.680855][T20271] veth0: left promiscuous mode [ 362.782404][T20278] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.6765'. [ 363.137327][T20299] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.160006][T20302] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6773'. [ 363.198825][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 363.206174][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 363.299736][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 363.781808][T20340] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6790'. [ 363.831065][T20344] sch_tbf: burst 0 is lower than device lo mtu (143) ! [ 363.843550][T20345] netlink: 'syz.2.6792': attribute type 4 has an invalid length. [ 364.007943][T20347] lo speed is unknown, defaulting to 1000 [ 364.339740][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 364.394764][T20371] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6805'. [ 365.379637][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 365.853522][T20449] netlink: 'syz.4.6843': attribute type 4 has an invalid length. [ 366.347875][T20480] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6854'. [ 366.419736][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 366.650069][T20496] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6860'. [ 367.112742][T20515] ipvlan2: entered allmulticast mode [ 367.124774][T20515] batadv_slave_1: entered allmulticast mode [ 367.152476][T20515] batman_adv: batadv0: Adding interface: ipvlan2 [ 367.175587][T20515] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 367.223800][T20515] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 367.255122][T20515] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 367.279717][T20515] batman_adv: batadv0: Interface activated: ipvlan2 [ 367.297854][T20525] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 367.305426][T20525] syzkaller1: linktype set to 823 [ 367.459816][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 367.525210][T20536] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6878'. [ 367.546035][T20534] tipc: Started in network mode [ 367.581095][T20534] tipc: Node identity ac14140f, cluster identity 4711 [ 367.604612][T20534] tipc: New replicast peer: 255.255.255.255 [ 367.621092][T20534] tipc: Enabled bearer , priority 10 [ 367.681992][T20545] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.6881'. [ 368.235920][T20580] netlink: 'syz.2.6896': attribute type 21 has an invalid length. [ 368.263232][T20580] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6896'. [ 368.500816][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 368.557207][T20597] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6903'. [ 368.582451][T20597] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6903'. [ 368.692791][T20600] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.726480][T20607] IPv6: NLM_F_CREATE should be specified when creating new route [ 368.740387][ T5939] tipc: Node number set to 2886997007 [ 368.876259][T20614] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6911'. [ 369.068766][T20623] IPv6: Can't replace route, no match found [ 369.096461][T20623] IPv6: Can't replace route, no match found [ 369.539637][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 369.627081][T20656] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.6931'. [ 369.924903][T20673] netlink: 'syz.2.6940': attribute type 83 has an invalid length. [ 370.579739][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 370.916981][T20712] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6958'. [ 371.374817][T20744] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6972'. [ 371.408027][T20744] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6972'. [ 371.619751][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 372.030777][T20778] netlink: 'syz.0.6987': attribute type 12 has an invalid length. [ 372.038753][T20778] netlink: 'syz.0.6987': attribute type 29 has an invalid length. [ 372.079746][T20778] netlink: 148 bytes leftover after parsing attributes in process `syz.0.6987'. [ 372.145283][T20786] sctp: [Deprecated]: syz.1.6990 (pid 20786) Use of int in maxseg socket option. [ 372.145283][T20786] Use struct sctp_assoc_value instead [ 372.563812][T20806] bond4: entered promiscuous mode [ 372.659995][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 373.700013][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 374.071088][T20895] __nla_validate_parse: 1 callbacks suppressed [ 374.071109][T20895] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7041'. [ 374.311206][T20904] netem: incorrect gi model size [ 374.325095][T20904] netem: change failed [ 374.740706][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 375.453273][T20974] netlink: 'syz.2.7075': attribute type 12 has an invalid length. [ 375.485977][T20974] netlink: 190972 bytes leftover after parsing attributes in process `syz.2.7075'. [ 375.779782][ C0] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 375.843585][T20999] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7086'. [ 375.963327][T21003] bridge0: port 4(syz_tun) entered blocking state [ 375.980232][T21003] bridge0: port 4(syz_tun) entered disabled state [ 375.997457][T21003] syz_tun: entered allmulticast mode [ 376.018294][T21003] syz_tun: entered promiscuous mode [ 376.049047][T21003] bridge0: port 4(syz_tun) entered blocking state [ 376.055911][T21003] bridge0: port 4(syz_tun) entered forwarding state [ 376.136523][T21015] tipc: Enabling of bearer rejected, already enabled [ 376.189003][T21014] gtp0: entered promiscuous mode [ 376.195423][T21014] gtp0: entered allmulticast mode [ 376.203450][T21015] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7093'. [ 376.213284][T21015] tipc: Disabling bearer [ 377.296795][T21075] netlink: 'syz.1.7117': attribute type 3 has an invalid length. [ 377.718064][T21091] IPVS: persistence engine module ip_vs_pe_ not found [ 377.908110][T21108] netlink: 'syz.3.7130': attribute type 5 has an invalid length. [ 378.003543][T21111] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7132'. [ 378.028387][T21111] bridge0: port 2(bridge_slave_1) entered disabled state [ 378.036227][T21111] bridge0: port 1(0x9) entered disabled state [ 378.664178][T21148] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7149'. [ 378.758381][T21153] netlink: 'syz.1.7151': attribute type 2 has an invalid length. [ 378.808364][T21153] netlink: 100 bytes leftover after parsing attributes in process `syz.1.7151'. [ 378.945842][T21161] netlink: 'syz.4.7155': attribute type 1 has an invalid length. [ 378.982772][T21161] netlink: 'syz.4.7155': attribute type 2 has an invalid length. [ 379.023137][T21161] netlink: 'syz.4.7155': attribute type 1 has an invalid length. [ 379.337490][T21187] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7167'. [ 379.348769][T21187] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7167'. [ 379.523517][T21198] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7171'. [ 379.532794][T21198] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7171'. [ 379.839427][T21215] netlink: 'syz.2.7179': attribute type 83 has an invalid length. [ 380.177737][T21236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7188'. [ 380.781742][T21268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7206'. [ 380.796861][T21268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7206'. [ 380.819218][T21268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7206'. [ 380.867619][T21272] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7207'. [ 381.970965][T21331] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7234'. [ 382.207480][T21342] netlink: 'syz.1.7239': attribute type 1 has an invalid length. [ 382.602829][T21369] netlink: 'syz.3.7253': attribute type 83 has an invalid length. [ 383.430421][T21422] tipc: New replicast peer: 255.255.255.255 [ 383.464929][T21422] tipc: Enabled bearer , priority 10 [ 383.594654][T21429] veth0_to_team: entered allmulticast mode [ 383.761087][T21437] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5 [ 384.473314][T21470] __nla_validate_parse: 2 callbacks suppressed [ 384.473345][T21470] netlink: 27 bytes leftover after parsing attributes in process `syz.3.7299'. [ 384.585299][T21474] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 384.626641][T21474] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 384.945733][T21492] syz.4.7310: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 384.971473][T21492] CPU: 1 UID: 0 PID: 21492 Comm: syz.4.7310 Not tainted syzkaller #0 PREEMPT(full) [ 384.971514][T21492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 384.971538][T21492] Call Trace: [ 384.971547][T21492] [ 384.971558][T21492] dump_stack_lvl+0xe8/0x150 [ 384.971607][T21492] warn_alloc+0x249/0x340 [ 384.971637][T21492] ? stack_trace_save+0xa9/0x100 [ 384.971666][T21492] ? __pfx_warn_alloc+0x10/0x10 [ 384.971702][T21492] ? kasan_save_track+0x4f/0x80 [ 384.971727][T21492] ? kasan_save_track+0x3e/0x80 [ 384.971751][T21492] ? __kasan_kmalloc+0x93/0xb0 [ 384.971776][T21492] ? __kmalloc_cache_noprof+0x31c/0x660 [ 384.971801][T21492] ? xskq_create+0x56/0x170 [ 384.971829][T21492] ? xsk_setsockopt+0x54c/0x990 [ 384.971854][T21492] ? do_sock_setsockopt+0x17c/0x1b0 [ 384.971882][T21492] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 384.971911][T21492] ? do_syscall_64+0x14d/0xf80 [ 384.971946][T21492] __vmalloc_node_range_noprof+0x132/0x1730 [ 384.972006][T21492] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 384.972041][T21492] ? __kasan_kmalloc+0x93/0xb0 [ 384.972073][T21492] vmalloc_user_noprof+0xad/0xe0 [ 384.972099][T21492] ? xskq_create+0xbf/0x170 [ 384.972129][T21492] xskq_create+0xbf/0x170 [ 384.972166][T21492] xsk_init_queue+0x8a/0xe0 [ 384.972198][T21492] xsk_setsockopt+0x54c/0x990 [ 384.972233][T21492] ? __pfx_xsk_setsockopt+0x10/0x10 [ 384.972264][T21492] ? __pfx_aa_sk_perm+0x10/0x10 [ 384.972312][T21492] ? aa_sock_opt_perm+0xff/0x1a0 [ 384.972337][T21492] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 384.972365][T21492] ? __pfx_xsk_setsockopt+0x10/0x10 [ 384.972393][T21492] do_sock_setsockopt+0x17c/0x1b0 [ 384.972429][T21492] __x64_sys_setsockopt+0x13d/0x1b0 [ 384.972466][T21492] do_syscall_64+0x14d/0xf80 [ 384.972497][T21492] ? trace_irq_disable+0x3b/0x150 [ 384.972518][T21492] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.972541][T21492] ? clear_bhb_loop+0x40/0x90 [ 384.972569][T21492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.972600][T21492] RIP: 0033:0x7f634dd9c819 [ 384.972627][T21492] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.972648][T21492] RSP: 002b:00007f634eb9b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 384.972674][T21492] RAX: ffffffffffffffda RBX: 00007f634e015fa0 RCX: 00007f634dd9c819 [ 384.972691][T21492] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 384.972705][T21492] RBP: 00007f634de32c91 R08: 0000000000000004 R09: 0000000000000000 [ 384.972720][T21492] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 384.972734][T21492] R13: 00007f634e016038 R14: 00007f634e015fa0 R15: 00007fff454617f8 [ 384.972770][T21492] [ 384.972783][T21492] Mem-Info: [ 385.301692][T21492] active_anon:5721 inactive_anon:0 isolated_anon:0 [ 385.301692][T21492] active_file:3269 inactive_file:40052 isolated_file:0 [ 385.301692][T21492] unevictable:768 dirty:327 writeback:0 [ 385.301692][T21492] slab_reclaimable:11537 slab_unreclaimable:101200 [ 385.301692][T21492] mapped:29404 shmem:1360 pagetables:1237 [ 385.301692][T21492] sec_pagetables:0 bounce:0 [ 385.301692][T21492] kernel_misc_reclaimable:0 [ 385.301692][T21492] free:1326671 free_pcp:9937 free_cma:0 [ 385.394855][T21507] netlink: 'syz.3.7315': attribute type 2 has an invalid length. [ 385.449650][T21492] Node 0 active_anon:22784kB inactive_anon:0kB active_file:13076kB inactive_file:160004kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117416kB dirty:1308kB writeback:0kB shmem:3904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12208kB pagetables:4716kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 385.534516][T21492] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 385.633279][T21492] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 385.704510][T21492] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 385.731750][T21525] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7322'. [ 385.749639][T21492] Node 0 DMA32 free:1351040kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27184kB inactive_anon:0kB active_file:13076kB inactive_file:160004kB unevictable:1536kB writepending:1308kB zspages:0kB present:3129332kB managed:2552564kB mlocked:0kB bounce:0kB free_pcp:38532kB local_pcp:29980kB free_cma:0kB [ 385.865273][T21492] lowmem_reserve[]: 0 0 0 0 0 [ 385.879648][T21492] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:872kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 385.930687][T21530] netlink: 'syz.1.7325': attribute type 29 has an invalid length. [ 385.952792][T21492] lowmem_reserve[]: 0 0 0 0 0 [ 385.970043][T21530] netlink: 'syz.1.7325': attribute type 29 has an invalid length. [ 385.977983][T21492] Node 1 Normal free:3935316kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:1004kB local_pcp:1004kB free_cma:0kB [ 386.021978][T21530] netlink: 'syz.1.7325': attribute type 29 has an invalid length. [ 386.040517][T21530] netlink: 'syz.1.7325': attribute type 29 has an invalid length. [ 386.048903][T21530] netlink: 'syz.1.7325': attribute type 29 has an invalid length. [ 386.057106][T21492] lowmem_reserve[]: 0 0 0 0 0 [ 386.070159][T21492] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 386.090275][T21530] netlink: 'syz.1.7325': attribute type 29 has an invalid length. [ 386.109239][T21492] Node 0 DMA32: 4520*4kB (UME) 3195*8kB (UE) 1694*16kB (UME) 52*32kB (UME) 91*64kB (UE) 290*128kB (UME) 227*256kB (UME) 211*512kB (UM) 126*1024kB (UME) 56*2048kB (U) 199*4096kB (UM) = 1340312kB [ 386.131188][T21530] netlink: 'syz.1.7325': attribute type 29 has an invalid length. [ 386.149594][T21492] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 386.190144][T21492] Node 1 Normal: 1*4kB (U) 1*8kB (M) 2*16kB (UM) 1*32kB (M) 4*64kB (UM) 4*128kB (UM) 3*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 3*2048kB (U) 958*4096kB (M) = 3935308kB [ 386.224820][T21492] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 386.263362][T21492] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 386.280419][T21492] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 386.299717][T21492] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 386.309123][T21492] 49952 total pagecache pages [ 386.314226][T21492] 0 pages in swap cache [ 386.318521][T21492] Free swap = 124996kB [ 386.330824][T21492] Total swap = 124996kB [ 386.339508][T21492] 2097051 pages RAM [ 386.347748][T21492] 0 pages HighMem/MovableOnly [ 386.359208][T21492] 427077 pages reserved [ 386.368004][T21492] 0 pages cma reserved [ 387.874147][T21616] sch_fq: defrate 0 ignored. [ 388.244136][T21639] sch_tbf: peakrate 5 is lower than or equals to rate 16783679728848008391 ! [ 388.495994][T21648] sctp: [Deprecated]: syz.0.7380 (pid 21648) Use of int in max_burst socket option deprecated. [ 388.495994][T21648] Use struct sctp_assoc_value instead [ 389.664336][T21715] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7410'. [ 389.952660][T21731] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7418'. [ 389.964475][T21731] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7418'. [ 390.124033][T21740] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7422'. [ 390.190103][T21744] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7424'. [ 390.293963][T21751] netlink: 'syz.3.7428': attribute type 4 has an invalid length. [ 390.311958][T21751] netlink: 17 bytes leftover after parsing attributes in process `syz.3.7428'. [ 390.332024][T21751] netlink: 14601 bytes leftover after parsing attributes in process `syz.3.7428'. [ 390.359935][T21753] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7427'. [ 390.369035][T21753] netlink: 2 bytes leftover after parsing attributes in process `syz.0.7427'. [ 391.229226][T21802] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7450'. [ 392.382709][T21851] skbuff: bad partial csum: csum=65535/0 headroom=64 headlen=65537 [ 393.342109][T21917] ip6gre0: Master is either lo or non-ether device [ 394.953636][T21977] __nla_validate_parse: 5 callbacks suppressed [ 394.953658][T21977] netlink: 272 bytes leftover after parsing attributes in process `syz.4.7533'. [ 395.352492][T22002] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7542'. [ 395.400043][T22002] erspan0: entered promiscuous mode [ 395.803771][T22031] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7555'. [ 396.125190][T22050] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7565'. [ 396.149397][T22050] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7565'. [ 396.233127][T22054] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7567'. [ 396.242479][T22054] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7567'. [ 396.426400][T22062] netlink: 'syz.4.7570': attribute type 4 has an invalid length. [ 396.612327][T22072] netlink: 'syz.0.7576': attribute type 10 has an invalid length. [ 396.663247][T22072] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 396.697412][T22072] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 397.207894][T22110] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7594'. [ 398.615031][T22192] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7631'. [ 398.884549][T22208] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7638'. [ 400.257081][T22298] __nla_validate_parse: 1 callbacks suppressed [ 400.257138][T22298] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7676'. [ 400.310207][T22298] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7676'. [ 401.079813][T22339] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7693'. [ 401.131096][T22342] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7693'. [ 401.406174][T22352] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7698'. [ 401.418856][T22352] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7698'. [ 401.451015][T22353] ip6erspan0: entered allmulticast mode [ 401.736125][ T1104] tipc: Subscription rejected, illegal request [ 401.903168][ T29] audit: type=1804 audit(1776168277.769:6): pid=22383 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.7715" name="/newroot/1509/cgroup.controllers" dev="tmpfs" ino=7591 res=1 errno=0 [ 401.943238][T22385] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7713'. [ 401.959847][ T29] audit: type=1800 audit(1776168277.769:7): pid=22383 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7715" name="cgroup.controllers" dev="tmpfs" ino=7591 res=0 errno=0 [ 401.993158][T22385] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7713'. [ 402.223735][T22398] netlink: 190972 bytes leftover after parsing attributes in process `syz.4.7721'. [ 402.275416][T22404] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.7724'. [ 402.515645][T22409] tap0: tun_chr_ioctl cmd 1074025678 [ 402.526410][T22409] tap0: group set to 0 [ 403.153194][T22461] erspan0: entered promiscuous mode [ 403.574085][T22485] tipc: New replicast peer: 172.20.20.187 [ 403.601894][T22485] tipc: Enabled bearer , priority 10 [ 403.795058][T22500] h: entered promiscuous mode [ 403.931493][T22509] netlink: 'syz.2.7773': attribute type 30 has an invalid length. [ 404.179934][T22519] nbd1: detected capacity change from 0 to 127 [ 404.191453][ T5836] block nbd1: Receive control failed (result -32) [ 404.216334][T22527] block nbd1: Dead connection, failed to find a fallback [ 404.269732][T22527] block nbd1: shutting down sockets [ 404.275484][T22527] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.335923][T22527] Buffer I/O error on dev nbd1, logical block 0, async page read [ 404.359889][T22527] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.380190][T22527] Buffer I/O error on dev nbd1, logical block 1, async page read [ 404.408431][T22527] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.449221][T22527] Buffer I/O error on dev nbd1, logical block 2, async page read [ 404.457497][T22527] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.484830][T22527] Buffer I/O error on dev nbd1, logical block 3, async page read [ 404.510596][T22527] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.534179][T22527] Buffer I/O error on dev nbd1, logical block 0, async page read [ 404.556931][T22527] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.577202][T22527] Buffer I/O error on dev nbd1, logical block 1, async page read [ 404.597748][T22527] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.625700][T22527] Buffer I/O error on dev nbd1, logical block 2, async page read [ 404.655528][T22527] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.692171][T22527] Buffer I/O error on dev nbd1, logical block 3, async page read [ 404.714785][T22527] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.742241][T22527] Buffer I/O error on dev nbd1, logical block 0, async page read [ 404.765371][T22527] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 404.790382][T22527] Buffer I/O error on dev nbd1, logical block 1, async page read [ 404.809334][T22527] ldm_validate_partition_table(): Disk read failed. [ 404.837307][T22527] Dev nbd1: unable to read RDB block 0 [ 404.855832][T22527] nbd1: unable to read partition table [ 404.900273][T22527] ldm_validate_partition_table(): Disk read failed. [ 404.935222][T22527] Dev nbd1: unable to read RDB block 0 [ 404.959151][T22527] nbd1: unable to read partition table [ 405.035393][T22566] netlink: 'syz.2.7798': attribute type 1 has an invalid length. [ 405.059263][T22566] netlink: 'syz.2.7798': attribute type 7 has an invalid length. [ 405.070655][T22566] netlink: 'syz.2.7798': attribute type 8 has an invalid length. [ 405.078446][T22566] NCSI netlink: No device for ifindex 65584 [ 405.229205][T22576] netlink: 'syz.2.7803': attribute type 1 has an invalid length. [ 405.237740][T22576] netlink: 'syz.2.7803': attribute type 2 has an invalid length. [ 405.250099][T22576] netlink: 'syz.2.7803': attribute type 1 has an invalid length. [ 405.262344][T22576] netlink: 'syz.2.7803': attribute type 3 has an invalid length. [ 405.285895][T22580] __nla_validate_parse: 10 callbacks suppressed [ 405.285915][T22580] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7805'. [ 405.300420][T22576] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7803'. [ 405.672845][T22603] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7816'. [ 406.166608][T22638] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7832'. [ 406.337578][T22649] veth0: entered promiscuous mode [ 406.361589][T22649] veth0: left promiscuous mode [ 406.704406][T22671] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:1) [ 407.287939][T22699] netlink: 88 bytes leftover after parsing attributes in process `syz.1.7862'. [ 407.310120][T22699] netem: invalid attributes len -24 [ 408.273309][T22765] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7891'. [ 408.597741][T22787] netlink: 64 bytes leftover after parsing attributes in process `syz.4.7902'. [ 409.056189][T22817] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7916'. [ 409.081175][T22816] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.088584][T22816] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.101422][T22817] block nbd2: Unsupported socket: should be TCP or UNIX. [ 409.143034][T22822] vcan0: tx address claim with dest, not broadcast [ 409.447279][T22840] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7925'. [ 409.466943][T22840] bond0: entered promiscuous mode [ 409.481077][T22840] bond_slave_0: entered promiscuous mode [ 409.487017][T22840] bond_slave_1: entered promiscuous mode [ 409.519834][T22840] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 409.537240][T22840] bond0: left promiscuous mode [ 409.555638][T22840] bond_slave_0: left promiscuous mode [ 409.565778][T22840] bond_slave_1: left promiscuous mode [ 409.572217][T22840] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 409.654223][T22851] netlink: 'syz.0.7932': attribute type 25 has an invalid length. [ 411.139277][T22920] netlink: 236 bytes leftover after parsing attributes in process `syz.2.7962'. [ 411.154600][T22920] netlink: 236 bytes leftover after parsing attributes in process `syz.2.7962'. [ 411.423478][T22933] netlink: 'syz.2.7969': attribute type 5 has an invalid length. [ 411.691761][T22949] block nbd1: NBD_DISCONNECT [ 411.696619][T22949] block nbd1: Send disconnect failed -32 [ 412.106225][T22973] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7987'. [ 413.395559][T23057] xt_hashlimit: size too large, truncated to 1048576 [ 413.457732][T23061] : renamed from vxcan1 (while UP) [ 413.511940][T23063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8027'. [ 413.717640][T23069] netlink: 168 bytes leftover after parsing attributes in process `syz.4.8031'. [ 413.903254][T23079] xt_hashlimit: size too large, truncated to 1048576 [ 414.158425][T23097] netlink: 'syz.1.8040': attribute type 2 has an invalid length. [ 414.199665][T23097] netlink: 'syz.1.8040': attribute type 2 has an invalid length. [ 414.545690][T23112] tipc: Enabling of bearer rejected, already enabled [ 415.304514][T23159] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 415.728136][T23187] syzkaller1: entered promiscuous mode [ 415.737786][T23187] syzkaller1: entered allmulticast mode [ 415.906289][T23197] netlink: 'syz.3.8083': attribute type 17 has an invalid length. [ 415.919250][T23197] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8083'. [ 415.928667][T23197] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8083'. [ 415.956528][T23197] gretap0: entered promiscuous mode [ 415.974387][T23197] gretap0: left promiscuous mode [ 415.994767][T23200] sctp: [Deprecated]: syz.1.8084 (pid 23200) Use of int in max_burst socket option. [ 415.994767][T23200] Use struct sctp_assoc_value instead [ 416.201928][T23209] syzkaller1: entered promiscuous mode [ 416.217934][T23209] syzkaller1: entered allmulticast mode [ 416.235631][T23210] syzkaller1: entered promiscuous mode [ 416.249995][T23210] syzkaller1: entered allmulticast mode [ 416.373226][T23218] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8093'. [ 416.382521][T23218] netlink: 'syz.2.8093': attribute type 7 has an invalid length. [ 416.391208][T23218] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8093'. [ 416.511947][T23224] netlink: 'syz.2.8097': attribute type 2 has an invalid length. [ 416.562762][T23226] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.8096'. [ 416.570742][T23224] netlink: 'syz.2.8097': attribute type 2 has an invalid length. [ 416.972650][T23252] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 417.029931][T23255] block nbd1: server does not support multiple connections per device. [ 417.047032][T23255] block nbd1: shutting down sockets [ 417.180915][T23261] xt_hashlimit: size too large, truncated to 1048576 [ 417.249398][T23263] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 417.284616][T23263] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 417.296405][T23263] gretap2: entered promiscuous mode [ 417.318942][T23263] gretap2: entered allmulticast mode [ 417.414539][T23275] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8117'. [ 417.456734][T23275] gtp0: entered promiscuous mode [ 417.469638][T23275] gtp0: entered allmulticast mode [ 418.082268][T23308] sock: sock_set_timeout: `syz.1.8133' (pid 23308) tries to set negative timeout [ 418.191175][T23316] netlink: 'syz.3.8138': attribute type 29 has an invalid length. [ 418.211986][T23316] netlink: 'syz.3.8138': attribute type 29 has an invalid length. [ 418.222509][T23316] netlink: 500 bytes leftover after parsing attributes in process `syz.3.8138'. [ 418.242384][T23316] unsupported nla_type 58 [ 418.367303][T23322] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8141'. [ 419.087471][T23365] netlink: 'syz.3.8161': attribute type 2 has an invalid length. [ 419.138599][T23369] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.8162'. [ 419.643112][T23396] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 420.020264][T23419] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 420.055470][T23421] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8184'. [ 420.252411][T23430] netlink: 'syz.3.8188': attribute type 1 has an invalid length. [ 421.484456][T23498] syzkaller1: entered promiscuous mode [ 421.578168][T23501] netlink: 'syz.2.8220': attribute type 2 has an invalid length. [ 421.599432][T23501] netlink: 'syz.2.8220': attribute type 2 has an invalid length. [ 421.978377][T23513] geneve2: entered promiscuous mode [ 422.006381][ T135] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 56849 - 0 [ 422.036640][ T135] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 56849 - 0 [ 422.066295][ T135] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 56849 - 0 [ 422.088500][ T135] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 56849 - 0 [ 422.295211][T23531] netlink: 'syz.4.8234': attribute type 1 has an invalid length. [ 422.298943][T23529] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8233'. [ 422.353410][T23531] netlink: 136 bytes leftover after parsing attributes in process `syz.4.8234'. [ 422.400142][T23531] netlink: 'syz.4.8234': attribute type 1 has an invalid length. [ 422.414227][T23531] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8234'. [ 423.055560][T23572] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8253'. [ 423.522081][T23599] syzkaller1: entered promiscuous mode [ 423.532741][T23599] syzkaller1: entered allmulticast mode [ 423.836703][T23617] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 424.060697][T23632] syzkaller1: entered promiscuous mode [ 424.066242][T23632] syzkaller1: entered allmulticast mode [ 425.073873][T23691] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8309'. [ 425.084560][T23691] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8309'. [ 425.124942][T23691] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8309'. [ 425.138304][T23691] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8309'. [ 425.681746][T23722] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8321'. [ 426.055775][T23744] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.8331'. [ 426.479026][T23760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 426.733596][ T5836] Bluetooth: hci2: link tx timeout [ 426.750062][ T5836] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 426.794934][T23767] team0: Port device team_slave_0 removed [ 427.908283][T23840] __nla_validate_parse: 3 callbacks suppressed [ 427.908305][T23840] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8372'. [ 427.942964][T23840] bond0: ARP target 8.4.0.0 is already present [ 427.961111][T23840] bond0: option arp_ip_target: invalid value (1032) [ 428.731851][T23885] syzkaller1: entered promiscuous mode [ 428.738917][T23885] syzkaller1: entered allmulticast mode [ 428.824599][ T5834] Bluetooth: hci2: command 0x0405 tx timeout [ 429.002402][T23899] netlink: 68 bytes leftover after parsing attributes in process `syz.1.8399'. [ 429.031111][T23899] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8399'. [ 429.108793][T23908] sctp: [Deprecated]: syz.4.8400 (pid 23908) Use of int in max_burst socket option deprecated. [ 429.108793][T23908] Use struct sctp_assoc_value instead [ 429.490182][T23925] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8408'. [ 429.592265][T23927] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8408'. [ 429.644595][T23927] nbd: device at index 64 is going down [ 429.846544][T23891] udevd[23891]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 430.526182][T23980] sctp: [Deprecated]: syz.1.8432 (pid 23980) Use of struct sctp_assoc_value in delayed_ack socket option. [ 430.526182][T23980] Use struct sctp_sack_info instead [ 430.621950][T23986] netlink: 207952 bytes leftover after parsing attributes in process `syz.0.8436'. [ 430.980554][T24004] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8444'. [ 430.993712][ T5836] block nbd0: Receive control failed (result -107) [ 431.001316][T24004] block nbd0: reconnected socket [ 431.030351][T24008] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.8446'. [ 431.069842][T24009] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8447'. [ 431.404296][ T29] audit: type=1800 audit(1776168307.249:8): pid=24022 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.8454" name="memory.events" dev="tmpfs" ino=8296 res=0 errno=0 [ 431.615314][T24037] netlink: 'syz.2.8459': attribute type 10 has an invalid length. [ 431.657610][T24037] bridge_slave_1: left allmulticast mode [ 431.674030][T24037] bridge_slave_1: left promiscuous mode [ 431.681029][T24037] bridge0: port 2(bridge_slave_1) entered disabled state [ 431.960612][T24055] syzkaller1: entered promiscuous mode [ 431.981391][T24055] syzkaller1: entered allmulticast mode [ 432.188759][T24067] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8474'. [ 432.208207][T24067] netlink: 'syz.0.8474': attribute type 7 has an invalid length. [ 432.219650][T24067] netlink: 'syz.0.8474': attribute type 8 has an invalid length. [ 432.276651][T24070] syzkaller1: entered promiscuous mode [ 432.299656][T24070] syzkaller1: entered allmulticast mode [ 432.522442][T24085] netlink: 'syz.0.8483': attribute type 1 has an invalid length. [ 432.551791][T24085] netlink: 'syz.0.8483': attribute type 2 has an invalid length. [ 432.763240][T24105] netlink: 'syz.1.8491': attribute type 63 has an invalid length. [ 432.772049][T24105] netlink: 'syz.1.8491': attribute type 63 has an invalid length. [ 432.964062][T24110] macvlan0: entered promiscuous mode [ 434.461470][T24189] syzkaller1: entered promiscuous mode [ 434.467151][T24189] syzkaller1: entered allmulticast mode [ 434.697493][T24195] syzkaller1: entered promiscuous mode [ 434.735132][T24195] syzkaller1: entered allmulticast mode [ 434.935833][T24210] __nla_validate_parse: 2 callbacks suppressed [ 434.935855][T24210] netlink: 27 bytes leftover after parsing attributes in process `syz.0.8541'. [ 435.013687][T24217] netlink: 156 bytes leftover after parsing attributes in process `syz.2.8545'. [ 435.391079][T24241] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 435.395950][T24242] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8555'. [ 435.411329][T24242] block nbd0: Unsupported socket: should be TCP or UNIX. [ 435.745039][T24259] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8564'. [ 436.891395][T24326] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8594'. [ 437.163863][T24342] batadv_slave_1: entered promiscuous mode [ 437.183878][T24340] batadv_slave_1: left promiscuous mode [ 437.207505][T24345] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8599'. [ 437.383883][T24353] macvlan0: entered promiscuous mode [ 439.113783][T24447] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.8646'. [ 439.214882][T24452] syzkaller1: entered promiscuous mode [ 439.227343][T24455] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.8651'. [ 439.262557][T24452] syzkaller1: entered allmulticast mode [ 439.407327][T24466] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8655'. [ 439.642977][T24477] veth0: entered promiscuous mode [ 439.670994][T24475] veth0: left promiscuous mode [ 440.102614][T24504] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8671'. [ 440.508183][T24527] syzkaller1: entered promiscuous mode [ 440.515338][T24527] syzkaller1: entered allmulticast mode [ 441.167901][T24561] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8696'. [ 441.203524][T24565] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 441.356313][T24573] netlink: 'syz.1.8703': attribute type 1 has an invalid length. [ 441.365689][T24573] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8703'. [ 441.742926][T24595] netlink: 212336 bytes leftover after parsing attributes in process `syz.4.8715'. [ 441.952350][T24607] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.8720'. [ 442.251196][T24622] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 442.641233][T24649] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8739'. [ 443.254962][T24685] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8756'. [ 443.286895][T24685] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8756'. [ 443.329937][T24685] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8756'. [ 443.354253][T24685] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8756'. [ 443.621640][ T5834] Bluetooth: hci2: command 0x0405 tx timeout [ 443.627963][ T5836] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 443.767324][T24708] IPVS: rr: TCP [::]:0 - no destination available [ 444.054842][T24717] syzkaller1: entered promiscuous mode [ 444.071878][T24717] syzkaller1: entered allmulticast mode [ 444.334623][T24730] syzkaller1: entered promiscuous mode [ 444.352016][T24730] syzkaller1: entered allmulticast mode [ 444.830986][T24756] netlink: 'syz.2.8779': attribute type 4 has an invalid length. [ 444.982328][ T5899] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.109207][T24770] block nbd4: NBD_DISCONNECT [ 445.301391][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.311896][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.320427][ T1104] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.331303][ T5899] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.340141][T24780] __nla_validate_parse: 3 callbacks suppressed [ 445.340162][T24780] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8787'. [ 445.403639][T24780] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8787'. [ 445.921369][T24817] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8800'. [ 445.933354][T24817] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8800'. [ 445.943076][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.605562][T24851] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 446.959373][T24876] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 447.056604][T24882] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8830'. [ 447.080744][T24882] netlink: 'syz.1.8830': attribute type 7 has an invalid length. [ 447.094552][T24876] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 447.100960][T24882] netlink: 'syz.1.8830': attribute type 8 has an invalid length. [ 447.109484][T24882] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8830'. [ 448.020467][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.122344][T24942] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8857'. [ 448.258191][T24946] xt_hashlimit: size too large, truncated to 1048576 [ 448.552218][T24958] netdevsim netdevsim0: Direct firmware load for r1 failed with error -2 [ 448.570817][T24958] netdevsim netdevsim0: Falling back to sysfs fallback for: r1 [ 449.364814][T24995] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8877'. [ 450.027201][T25032] netlink: 'syz.1.8897': attribute type 1 has an invalid length. [ 450.035352][T25032] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8897'. [ 450.125381][T25036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8899'. [ 450.688358][T25064] syzkaller1: entered promiscuous mode [ 450.696494][T25064] syzkaller1: entered allmulticast mode [ 451.503953][T25116] syzkaller1: entered promiscuous mode [ 451.509503][T25116] syzkaller1: entered allmulticast mode [ 451.773127][T25132] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.8945'. [ 452.042915][T25152] netlink: 27 bytes leftover after parsing attributes in process `syz.1.8954'. [ 452.806910][T25199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8977'. [ 453.031734][T25213] nbd: socks must be embedded in a SOCK_ITEM attr [ 453.135852][T25218] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8986'. [ 453.263556][T25229] netlink: 'syz.2.8988': attribute type 11 has an invalid length. [ 453.458368][T25238] netlink: 16215 bytes leftover after parsing attributes in process `syz.3.8994'. [ 453.597492][T25247] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8997'. [ 453.963501][T25266] netlink: 212324 bytes leftover after parsing attributes in process `syz.3.9007'. [ 454.204314][T25280] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 455.401065][T25339] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.9039'. [ 455.455846][T25341] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.9040'. [ 455.696348][T25349] netlink: 'syz.3.9044': attribute type 10 has an invalid length. [ 455.720667][T25351] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.9045'. [ 455.740712][T25351] netlink: ct family unspecified [ 455.800438][T25349] bridge_slave_1: left allmulticast mode [ 455.810399][T25349] bridge_slave_1: left promiscuous mode [ 455.830307][T25349] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.905758][T25349] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 456.037457][T25355] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 456.593558][T25388] netlink: 'syz.1.9062': attribute type 10 has an invalid length. [ 456.632634][T25388] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.654751][T25388] bridge_slave_1: left allmulticast mode [ 456.666417][T25388] bridge_slave_1: left promiscuous mode [ 456.673295][T25388] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.687468][T25388] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 458.064693][T25470] __nla_validate_parse: 2 callbacks suppressed [ 458.064716][T25470] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9101'. [ 458.166860][T25476] netlink: 7 bytes leftover after parsing attributes in process `syz.4.9104'. [ 458.413198][T25491] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9109'. [ 458.424007][T25485] tipc: Resetting bearer [ 458.482844][ T1557] lo speed is unknown, defaulting to 1000 [ 458.494396][T25491] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9109'. [ 458.582403][ T5834] Bluetooth: hci2: command 0x0405 tx timeout [ 459.744831][T25559] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9137'. [ 459.951170][T25568] netlink: 27 bytes leftover after parsing attributes in process `syz.2.9143'. [ 459.963190][T25571] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9144'. [ 459.975110][T25571] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9144'. [ 460.269688][T25589] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9153'. [ 460.317319][T25591] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 460.456295][T25599] netlink: 256 bytes leftover after parsing attributes in process `syz.2.9157'. [ 461.190299][T25645] syzkaller1: entered promiscuous mode [ 461.209750][T25645] syzkaller1: entered allmulticast mode [ 461.809917][T25685] netlink: 'syz.1.9197': attribute type 11 has an invalid length. [ 462.048861][T25693] tipc: Resetting bearer [ 462.238214][T25693] tipc: Disabling bearer [ 462.296015][T25698] macvtap1: entered promiscuous mode [ 462.303555][T25698] macvtap1: entered allmulticast mode [ 462.308995][T25698] veth1_vlan: entered allmulticast mode [ 462.363733][T25705] macvtap2: entered promiscuous mode [ 462.369191][T25705] macvtap2: entered allmulticast mode [ 462.912337][T25742] syzkaller1: entered promiscuous mode [ 462.930321][T25742] syzkaller1: entered allmulticast mode [ 463.140653][T25753] __nla_validate_parse: 7 callbacks suppressed [ 463.140675][T25753] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.9225'. [ 463.283781][T25761] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.9229'. [ 463.409966][T25767] netlink: 43 bytes leftover after parsing attributes in process `syz.3.9232'. [ 463.598586][T25781] netlink: 'syz.1.9238': attribute type 17 has an invalid length. [ 463.607223][T25781] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9238'. [ 463.617378][T25781] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9238'. [ 463.649912][T25785] netlink: 84 bytes leftover after parsing attributes in process `syz.2.9237'. [ 464.264179][T25809] netlink: 'syz.2.9253': attribute type 4 has an invalid length. [ 464.366121][T25814] syzkaller1: entered promiscuous mode [ 464.374177][T25814] syzkaller1: entered allmulticast mode [ 464.406369][T25814] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 464.642832][T25833] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9260'. [ 464.685616][T25835] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.9262'. [ 464.914932][T25848] veth0: entered promiscuous mode [ 464.932077][T25847] veth0: left promiscuous mode [ 465.418899][T25881] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9282'. [ 465.894515][T25910] netlink: 104 bytes leftover after parsing attributes in process `syz.1.9297'. [ 466.125731][T25926] block nbd1: Unsupported socket: should be TCP or UNIX. [ 466.635194][T25954] netlink: 'syz.3.9317': attribute type 4 has an invalid length. [ 468.293427][T26049] __nla_validate_parse: 5 callbacks suppressed [ 468.293450][T26049] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9360'. [ 468.438172][T26057] netlink: 67 bytes leftover after parsing attributes in process `syz.4.9365'. [ 468.614041][T26063] pim6reg1: entered promiscuous mode [ 468.624115][T26063] pim6reg1: entered allmulticast mode [ 468.724540][T26071] netlink: 'syz.3.9372': attribute type 11 has an invalid length. [ 468.743620][T26071] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9372'. [ 468.776089][T26071] netlink: 'syz.3.9372': attribute type 11 has an invalid length. [ 468.791511][T26073] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9373'. [ 468.796167][T26071] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9372'. [ 468.831000][T26073] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9373'. [ 468.870648][T26073] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9373'. [ 469.050794][T26085] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9379'. [ 469.085318][T26085] netlink: 'syz.2.9379': attribute type 7 has an invalid length. [ 469.110844][T26085] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9379'. [ 469.367373][T26103] netem: change failed [ 470.114941][T26145] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9404'. [ 470.600982][ T29] audit: type=1800 audit(1776168346.469:9): pid=26174 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.9418" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=9683 res=0 errno=0 [ 470.996694][T26200] chnl_net:caif_netlink_parms(): no params data found [ 471.201988][T26207] netlink: 'syz.1.9430': attribute type 1 has an invalid length. [ 471.321261][T26207] 8021q: adding VLAN 0 to HW filter on device bond3 [ 471.405131][T26227] netlink: 'syz.4.9435': attribute type 8 has an invalid length. [ 472.170013][T26278] netlink: 'syz.2.9454': attribute type 11 has an invalid length. [ 472.447448][T26292] netlink: 'syz.4.9463': attribute type 1 has an invalid length. [ 472.528635][T26292] bond0: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 472.545842][T26292] bond0: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 472.559331][T26292] bond0: (slave ip6gre1): making interface the new active one [ 472.568291][T26292] bond0: (slave ip6gre1): Enslaving as an active interface with an up link [ 472.709683][T26302] netlink: 'syz.2.9469': attribute type 7 has an invalid length. [ 472.717687][T26302] netlink: 'syz.2.9469': attribute type 8 has an invalid length. [ 472.767506][T26307] 8021q: VLANs not supported on bond0 [ 472.788340][T26307] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 472.846237][T26307] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 472.879802][T26307] .` (unregistering): Released all slaves [ 472.938085][T26313] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 473.525748][T26343] netlink: 'syz.0.9486': attribute type 1 has an invalid length. [ 473.653732][T26350] __nla_validate_parse: 9 callbacks suppressed [ 473.653754][T26350] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9490'. [ 473.672445][T26343] 8021q: adding VLAN 0 to HW filter on device bond4 [ 473.728702][T26348] bond4: (slave geneve4): making interface the new active one [ 473.742096][T26348] bond4: (slave geneve4): Enslaving as an active interface with an up link [ 473.771634][T26353] bridge_slave_0: left promiscuous mode [ 473.777659][T26353] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.804833][T26353] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 473.819338][T26353] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 473.847218][T26353] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 473.855701][T26353] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 473.918033][T26360] netlink: 'syz.3.9491': attribute type 20 has an invalid length. [ 473.926854][T26360] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9491'. [ 474.033484][T26360] netlink: 'syz.3.9491': attribute type 20 has an invalid length. [ 474.052697][T26360] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9491'. [ 474.297030][T26380] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9497'. [ 474.837049][T26410] vlan0: entered allmulticast mode [ 474.854851][T26410] bond0: entered allmulticast mode [ 474.870620][T26413] netlink: 14 bytes leftover after parsing attributes in process `syz.0.9512'. [ 474.880108][T26410] bond_slave_0: entered allmulticast mode [ 474.885904][T26410] bond_slave_1: entered allmulticast mode [ 474.906508][T26410] batadv0: entered allmulticast mode [ 474.929197][T26415] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9514'. [ 474.954989][T26413] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 474.968567][T26413] bond_slave_0: left allmulticast mode [ 474.983719][T26413] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 474.994257][T26413] bond_slave_1: left allmulticast mode [ 475.007556][T26413] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 475.052908][T26413] batadv0: left allmulticast mode [ 475.064491][T26413] bond0 (unregistering): Released all slaves [ 475.813864][T26463] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.9533'. [ 475.824447][T26462] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.9534'. [ 475.844908][T26463] netlink: Unknown conntrack attr (0) [ 476.135741][T26482] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.9542'. [ 476.462689][T26499] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 476.514824][T26506] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.9550'. [ 476.539338][T26503] netlink: 'syz.4.9549': attribute type 1 has an invalid length. [ 476.547566][T26506] netlink: Unknown conntrack attr (0) [ 477.482842][T26556] netlink: Unknown conntrack attr (0) [ 477.659267][T26567] 8021q: adding VLAN 0 to HW filter on device bond6 [ 477.862580][T26577] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 478.113920][T26591] bridge_slave_0: left allmulticast mode [ 478.158260][T26591] bridge_slave_0: left promiscuous mode [ 478.165276][T26591] bridge0: port 1(bridge_slave_0) entered disabled state [ 478.188757][T26591] bond0: (slave bridge_slave_1): Releasing backup interface [ 478.226733][T26591] bond0: (slave bond_slave_0): Releasing backup interface [ 478.282073][T26591] bond0: (slave bond_slave_1): Releasing backup interface [ 478.339427][T26591] team0: Port device team_slave_0 removed [ 478.380025][T26591] team0: Port device team_slave_1 removed [ 478.392636][T26591] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 478.421069][T26591] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 478.434282][T26591] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 478.461468][T26591] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 478.592830][T26591] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 478.653236][T26598] team0: Mode changed to "random" [ 478.813702][T26618] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 478.823817][T26618] syzkaller1: Linktype set failed because interface is up [ 479.158058][T26633] netlink: 'syz.2.9593': attribute type 12 has an invalid length. [ 479.355835][T26638] netlink: 'syz.4.9595': attribute type 15 has an invalid length. [ 479.389372][T26638] __nla_validate_parse: 4 callbacks suppressed [ 479.389393][T26638] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9595'. [ 479.470985][T26638] netlink: 'syz.4.9595': attribute type 15 has an invalid length. [ 479.472718][ T12] netdevsim netdevsim4 eth0: set [0, 1] type 1 family 0 port 2816 - 0 [ 479.479377][T26638] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9595'. [ 479.508195][ T12] netdevsim netdevsim4 eth1: set [0, 1] type 1 family 0 port 2816 - 0 [ 479.528335][T26639] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9596'. [ 479.540432][ T12] netdevsim netdevsim4 eth2: set [0, 1] type 1 family 0 port 2816 - 0 [ 479.580033][ T12] netdevsim netdevsim4 eth3: set [0, 1] type 1 family 0 port 2816 - 0 [ 479.995704][T26655] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9603'. [ 480.747500][T26686] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9618'. [ 480.926217][T26695] gretap3: entered promiscuous mode [ 480.950791][T26695] batman_adv: batadv0: Adding interface: gretap3 [ 480.970789][T26695] batman_adv: batadv0: The MTU of interface gretap3 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 481.019932][T26695] batman_adv: batadv0: Not using interface gretap3 (retrying later): interface not active [ 482.068793][T26741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9633'. [ 482.115590][T26732] pim6reg1: entered promiscuous mode [ 482.126583][T26732] pim6reg1: entered allmulticast mode [ 482.310806][T26753] netlink: 'syz.2.9649': attribute type 25 has an invalid length. [ 482.319173][T26753] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9649'. [ 482.368402][ T105] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 482.368448][T26753] netlink: 'syz.2.9649': attribute type 25 has an invalid length. [ 482.386349][ T105] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 482.401061][ T105] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 482.430035][ T105] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 482.457757][T26753] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9649'. [ 482.482216][T26758] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9650'. [ 482.592101][T26766] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 482.677485][T26766] bond2: (slave lo): Enslaving as an active interface with an up link [ 482.713410][T26766] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 482.783193][ T5899] lo speed is unknown, defaulting to 1000 [ 482.789336][ T9] lo speed is unknown, defaulting to 1000 [ 482.798561][ T9] syz0: Port: 1 Link ACTIVE [ 482.928896][T26793] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 482.930524][T26784] nbd4: detected capacity change from 0 to 63 [ 482.964577][T26792] block nbd4: NBD_DISCONNECT [ 482.973080][T26793] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 482.997607][T26792] block nbd4: Disconnected due to user request. [ 483.050826][T26792] block nbd4: shutting down sockets [ 483.089129][ C0] blk_print_req_error: 138 callbacks suppressed [ 483.089153][ C0] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.105365][ C0] buffer_io_error: 138 callbacks suppressed [ 483.105387][ C0] Buffer I/O error on dev nbd4, logical block 0, async page read [ 483.119154][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.128707][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 483.136582][ C0] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.146133][ C0] Buffer I/O error on dev nbd4, logical block 2, async page read [ 483.154059][ C0] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.163696][ C0] Buffer I/O error on dev nbd4, logical block 3, async page read [ 483.172427][T26702] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.183537][T26702] Buffer I/O error on dev nbd4, logical block 0, async page read [ 483.199667][T26702] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.243610][T26702] Buffer I/O error on dev nbd4, logical block 1, async page read [ 483.258737][T26702] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.299964][T26702] Buffer I/O error on dev nbd4, logical block 2, async page read [ 483.315250][T26702] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.335116][T26702] Buffer I/O error on dev nbd4, logical block 3, async page read [ 483.352180][T26702] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.384925][T26702] Buffer I/O error on dev nbd4, logical block 0, async page read [ 483.406120][T26803] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9669'. [ 483.418938][T26702] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 483.465119][T26702] Buffer I/O error on dev nbd4, logical block 1, async page read [ 483.480705][T26702] ldm_validate_partition_table(): Disk read failed. [ 483.491722][T26702] Dev nbd4: unable to read RDB block 0 [ 483.497896][T26702] nbd4: unable to read partition table [ 483.551315][T26702] ldm_validate_partition_table(): Disk read failed. [ 483.558473][T26702] Dev nbd4: unable to read RDB block 0 [ 483.589464][T26702] nbd4: unable to read partition table [ 483.683692][T26818] netlink: 'syz.3.9673': attribute type 9 has an invalid length. [ 483.709725][T26818] netlink: 'syz.3.9673': attribute type 11 has an invalid length. [ 483.717604][T26818] netlink: 'syz.3.9673': attribute type 12 has an invalid length. [ 483.763984][T26823] netlink: 'syz.2.9676': attribute type 7 has an invalid length. [ 483.782579][T26823] netlink: 'syz.2.9676': attribute type 7 has an invalid length. [ 484.105762][T26840] block nbd0: Unsupported socket: should be TCP or UNIX. [ 484.294886][T26845] "syz.0.9685" (26845) uses obsolete ecb(arc4) skcipher [ 484.463668][T26859] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.475871][T26859] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.581684][T26859] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.594515][T26859] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.703102][T26859] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.719951][T26859] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 484.747840][T26866] syzkaller1: entered promiscuous mode [ 484.754213][T26866] syzkaller1: entered allmulticast mode [ 484.761190][T26864] lo speed is unknown, defaulting to 1000 [ 484.873417][T26859] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 484.897127][T26859] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.137399][ T135] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.148518][ T135] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.196627][ T135] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.240039][ T135] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.408011][ T105] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.416685][ T105] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.432159][T26884] syz_tun: left allmulticast mode [ 485.441826][T26884] syz_tun: left promiscuous mode [ 485.467670][T26884] bridge0: port 4(syz_tun) entered disabled state [ 485.484301][T26884] dummy0: left allmulticast mode [ 485.489707][T26884] bridge0: port 3(dummy0) entered disabled state [ 485.504298][T26884] bridge_slave_0: left allmulticast mode [ 485.511168][T26884] bridge_slave_0: left promiscuous mode [ 485.517049][T26884] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.528809][T26884] bridge_slave_1: left allmulticast mode [ 485.536924][T26884] bridge_slave_1: left promiscuous mode [ 485.543575][T26884] bridge0: port 2(bridge_slave_1) entered disabled state [ 485.558401][T26884] team0: Port device team_slave_0 removed [ 485.568761][T26884] team0: Port device team_slave_1 removed [ 485.576055][T26884] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 485.584009][T26884] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 485.594256][T26884] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 485.602487][T26884] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 485.613929][T26884] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 485.643870][T26888] team0: Mode changed to "random" [ 485.675365][ T12] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.684520][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.906096][T26900] netlink: 'syz.2.9706': attribute type 1 has an invalid length. [ 485.931958][T26900] __nla_validate_parse: 3 callbacks suppressed [ 485.931987][T26900] netlink: 224 bytes leftover after parsing attributes in process `syz.2.9706'. [ 486.104453][ T5836] block nbd2: Receive control failed (result -107) [ 486.140071][T26911] nbd2: detected capacity change from 0 to 127 [ 486.159041][T26702] block nbd2: Dead connection, failed to find a fallback [ 486.211708][T26702] block nbd2: shutting down sockets [ 486.219225][T26702] ldm_validate_partition_table(): Disk read failed. [ 486.227285][T26702] Dev nbd2: unable to read RDB block 0 [ 486.246754][T26702] nbd2: unable to read partition table [ 486.311757][T26702] ldm_validate_partition_table(): Disk read failed. [ 486.355454][T26702] Dev nbd2: unable to read RDB block 0 [ 486.370251][T26702] nbd2: unable to read partition table [ 486.768268][T26949] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9726'. [ 486.800616][T26949] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9726'. [ 486.972781][T26962] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9733'. [ 487.031190][T26964] bridge0: port 1(1x9) entered disabled state [ 487.286417][T26964] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 487.544982][T26976] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9738'. [ 487.641983][ T1104] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.654907][ T1104] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.665254][ T1104] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.675232][ T1104] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.685425][ T1104] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.704927][ T1104] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.730821][ T1104] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.752518][ T1104] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.815394][T27003] trusted_key: syz.2.9751 sent an empty control message without MSG_MORE. [ 488.510534][T27035] lo: left promiscuous mode [ 488.537459][T27037] netlink: 240 bytes leftover after parsing attributes in process `syz.2.9764'. [ 488.678482][T27041] netlink: 212328 bytes leftover after parsing attributes in process `syz.2.9768'. [ 488.706979][T27041] netlink: Unknown conntrack attr (type=2304, max=9) [ 488.818887][T27046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9771'. [ 489.826359][T27035] tipc: Resetting bearer [ 490.084620][T27035] geneve3: left promiscuous mode [ 490.092552][T27035] veth3: left promiscuous mode [ 490.097666][T27035] vlan2: left promiscuous mode [ 490.104673][T27035] geneve1: left promiscuous mode [ 490.113490][T27035] gtp0: left promiscuous mode [ 490.134099][T27035] veth1_vlan: left allmulticast mode [ 490.140399][T27035] macvtap1: left promiscuous mode [ 490.332353][ T135] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 490.357638][ T135] netdevsim netdevsim4 eth0: unset [0, 1] type 1 family 0 port 2816 - 0 [ 490.377904][ T135] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 256 - 0 [ 490.397973][ T135] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 490.420880][ T135] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 490.439945][ T135] netdevsim netdevsim4 eth1: unset [0, 1] type 1 family 0 port 2816 - 0 [ 490.466629][ T135] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 256 - 0 [ 490.497973][ T135] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 490.518761][T27090] vcan0: tx drop: invalid da for name 0x0000000000000008 [ 490.526054][ T135] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 490.537975][ T135] netdevsim netdevsim4 eth2: unset [0, 1] type 1 family 0 port 2816 - 0 [ 490.548061][ T135] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 256 - 0 [ 490.557059][ T135] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 490.567641][ T135] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 490.609845][ T135] netdevsim netdevsim4 eth3: unset [0, 1] type 1 family 0 port 2816 - 0 [ 490.638991][ T135] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 256 - 0 [ 490.664510][ T135] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 490.982990][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058122400: rx timeout, send abort [ 491.074556][T27111] syzkaller1: entered promiscuous mode [ 491.083875][T27111] syzkaller1: entered allmulticast mode [ 491.484062][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058122000: rx timeout, send abort [ 491.493228][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058122400: abort rx timeout. Force session deactivation [ 491.668967][T27132] netlink: 'syz.1.9797': attribute type 1 has an invalid length. [ 491.700441][T27132] netlink: 96 bytes leftover after parsing attributes in process `syz.1.9797'. [ 491.709475][T27132] netlink: 1 bytes leftover after parsing attributes in process `syz.1.9797'. [ 491.992391][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058122000: abort rx timeout. Force session deactivation [ 492.442205][T27168] netlink: 'syz.3.9808': attribute type 4 has an invalid length. [ 492.452079][T27168] netlink: 'syz.3.9808': attribute type 4 has an invalid length. [ 492.859141][T27181] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9811'. [ 492.887495][T27181] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9811'. [ 492.981310][T27181] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9811'. [ 492.991173][T27181] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9811'. [ 493.010367][T27187] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.9814'. [ 493.183000][T27162] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 493.191511][T27162] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 493.236864][T27192] "syz.2.9817" (27192) uses obsolete ecb(arc4) skcipher [ 493.342519][T27195] netlink: 140 bytes leftover after parsing attributes in process `syz.2.9818'. [ 493.532958][T27205] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.9822'. [ 493.553080][T27204] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9823'. [ 494.109899][ T135] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.118882][ T135] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.161472][ T135] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.190309][ T135] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 494.645184][T27252] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 494.676638][T27252] bond0: (slave lo): Enslaving as an active interface with an up link [ 494.688823][T27252] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 494.842681][T27258] bond5: entered allmulticast mode [ 494.894721][T27263] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 495.190633][T27271] netlink: 'syz.2.9852': attribute type 21 has an invalid length. [ 495.202421][T27271] netlink: 'syz.2.9852': attribute type 21 has an invalid length. [ 495.269017][T27274] IPv6: sit2: Disabled Multicast RS [ 496.077969][T27317] pim6reg1: entered promiscuous mode [ 496.101634][T27317] pim6reg1: entered allmulticast mode [ 497.338579][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.353656][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 1] type 2 family 0 port 56849 - 0 [ 497.363351][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.389282][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 56849 - 0 [ 497.409423][ T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.422481][ T13] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 56849 - 0 [ 497.443867][ T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.453952][ T13] netdevsim netdevsim1 netdevsim3: unset [1, 1] type 2 family 0 port 56849 - 0 [ 497.607235][T27364] netlink: 'syz.4.9892': attribute type 9 has an invalid length. [ 497.617134][T27365] __nla_validate_parse: 16 callbacks suppressed [ 497.617157][T27365] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9893'. [ 497.635651][T27364] netlink: 'syz.4.9892': attribute type 11 has an invalid length. [ 497.646777][T27364] netlink: 'syz.4.9892': attribute type 12 has an invalid length. [ 497.666883][T27364] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.9892'. [ 497.692427][T27364] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9892'. [ 497.712689][T27367] syzkaller1: entered promiscuous mode [ 497.718230][T27367] syzkaller1: entered allmulticast mode [ 497.995829][T27386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9900'. [ 498.142726][T27393] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9905'. [ 498.403557][T27401] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9908'. [ 498.430100][T27401] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9908'. [ 498.606777][ T13] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.630202][ T13] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.655613][ T13] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.697982][ T13] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.735500][ T13] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.756316][ T13] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.769300][T27410] ip6tnl4: entered promiscuous mode [ 498.778203][T27415] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9913'. [ 498.788971][ T13] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.797808][ T13] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.017420][T27429] veth0: entered promiscuous mode [ 499.027676][T27429] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9922'. [ 499.046975][T27429] veth0 (unregistering): left promiscuous mode [ 499.495874][T27461] netlink: 'syz.0.9933': attribute type 1 has an invalid length. [ 499.565206][T27464] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9934'. [ 499.716435][T27472] netlink: 'syz.1.9938': attribute type 5 has an invalid length. [ 499.717703][T27473] netlink: 'syz.0.9937': attribute type 13 has an invalid length. [ 499.732903][T27472] netlink: 'syz.1.9938': attribute type 5 has an invalid length. [ 499.751389][T27473] netlink: 'syz.0.9937': attribute type 13 has an invalid length. [ 499.752175][ T1104] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.769017][ T1104] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.790001][ T1104] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.806883][ T1104] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 500.332015][T27498] netlink: 'syz.4.9950': attribute type 9 has an invalid length. [ 500.348556][T27498] netlink: 'syz.4.9950': attribute type 11 has an invalid length. [ 500.930057][T27537] syzkaller1: entered promiscuous mode [ 500.935855][T27537] syzkaller1: entered allmulticast mode [ 502.007708][T27589] bond2: option mode: unable to set because the bond device has slaves [ 502.017121][T27589] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 502.672018][T27625] __nla_validate_parse: 17 callbacks suppressed [ 502.672041][T27625] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.10003'. [ 502.723653][T27629] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10004'. [ 503.055130][T27649] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10014'. [ 503.114707][T27653] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 503.210576][T27657] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10017'. [ 503.272919][T27660] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.10019'. [ 503.367762][T27665] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10021'. [ 503.441235][T27669] validate_nla: 2 callbacks suppressed [ 503.441258][T27669] netlink: 'syz.0.10023': attribute type 21 has an invalid length. [ 503.468632][T27669] netlink: 'syz.0.10023': attribute type 22 has an invalid length. [ 503.476930][T27669] netlink: 'syz.0.10023': attribute type 23 has an invalid length. [ 503.483551][T27673] "syz.2.10025" (27673) uses obsolete ecb(arc4) skcipher [ 503.486195][T27669] netlink: 'syz.0.10023': attribute type 25 has an invalid length. [ 503.500394][T27669] netlink: 'syz.0.10023': attribute type 26 has an invalid length. [ 503.508404][T27669] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10023'. [ 503.662046][T27680] netlink: 'syz.0.10029': attribute type 4 has an invalid length. [ 503.957921][T27701] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10037'. [ 503.975959][T27701] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10037'. [ 504.243193][T27716] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10045'. [ 504.709343][T27745] syzkaller1: entered promiscuous mode [ 504.720175][T27745] syzkaller1: entered allmulticast mode [ 504.791985][T27749] netlink: 'syz.1.10060': attribute type 1 has an invalid length. [ 507.606687][T27896] netlink: 'syz.1.10118': attribute type 18 has an invalid length. [ 507.635618][T27896] netlink: 'syz.1.10118': attribute type 18 has an invalid length. [ 507.896922][T27924] __nla_validate_parse: 9 callbacks suppressed [ 507.896945][T27924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10127'. [ 507.916472][T27924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10127'. [ 508.354745][T27938] netlink: 'syz.0.10132': attribute type 7 has an invalid length. [ 508.503816][T27946] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.10136'. [ 508.524165][T27946] netlink: Conntrack attr has 4 unknown bytes [ 509.046784][T27965] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 509.054138][T27965] batman_adv: batadv0: Removing interface: ipvlan2 [ 510.267715][T28002] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.10156'. [ 510.400305][T28008] netlink: 256 bytes leftover after parsing attributes in process `syz.3.10159'. [ 510.439596][T28008] netlink: 256 bytes leftover after parsing attributes in process `syz.3.10159'. [ 510.841389][T28026] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.10167'. [ 511.038917][T27934] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 511.455764][T28048] netlink: 212344 bytes leftover after parsing attributes in process `syz.1.10176'. [ 511.489122][T28051] validate_nla: 1 callbacks suppressed [ 511.489144][T28051] netlink: 'syz.2.10177': attribute type 15 has an invalid length. [ 511.603894][T28057] netlink: 32 bytes leftover after parsing attributes in process `syz.1.10180'. [ 511.619125][T28059] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10181'. [ 511.797045][T28065] netlink: 'syz.1.10185': attribute type 3 has an invalid length. [ 511.797045][T28063] syzkaller1: entered promiscuous mode [ 511.814350][T28071] netlink: 'syz.3.10184': attribute type 1 has an invalid length. [ 511.814775][T28065] netlink: 'syz.1.10185': attribute type 3 has an invalid length. [ 511.828380][T28063] syzkaller1: entered allmulticast mode [ 511.897230][T28071] 8021q: adding VLAN 0 to HW filter on device bond8 [ 512.031563][T28074] bond8: (slave geneve3): making interface the new active one [ 512.071191][T28074] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 512.119907][T26528] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 512.146258][T26528] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 512.225098][T26528] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 512.277908][T26528] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 512.337310][T28098] netlink: 'syz.4.10197': attribute type 6 has an invalid length. [ 512.380553][T28098] netlink: 'syz.4.10197': attribute type 6 has an invalid length. [ 512.743865][T28119] netlink: 'syz.4.10203': attribute type 14 has an invalid length. [ 512.758332][T28119] netlink: 'syz.4.10203': attribute type 14 has an invalid length. [ 512.916339][T28129] __nla_validate_parse: 9 callbacks suppressed [ 512.916362][T28129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10206'. [ 512.934343][T28129] netlink: 'syz.0.10206': attribute type 1 has an invalid length. [ 512.943153][T28129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10206'. [ 512.993597][T28129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10206'. [ 513.026554][T28129] netlink: 'syz.0.10206': attribute type 1 has an invalid length. [ 513.066006][T28129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10206'. [ 513.398483][T28149] xt_hashlimit: size too large, truncated to 1048576 [ 513.462874][T28154] dvmrp0: left allmulticast mode [ 513.468021][T28154] pimreg: left allmulticast mode [ 513.533862][T28157] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10218'. [ 514.595396][T28203] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10233'. [ 515.262966][T28238] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.10246'. [ 515.281337][T28238] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10246'. [ 515.345077][T28242] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10249'. [ 515.484509][T28250] syzkaller1: entered promiscuous mode [ 515.490528][T28250] syzkaller1: entered allmulticast mode [ 515.691844][T28260] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10258'. [ 515.723174][T28266] bond2: option mode: unable to set because the bond device has slaves [ 515.733389][T28266] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 516.062280][ T13] netdevsim netdevsim4 eth0: set [0, 1] type 1 family 0 port 2816 - 0 [ 516.072237][ T13] netdevsim netdevsim4 eth1: set [0, 1] type 1 family 0 port 2816 - 0 [ 516.090326][ T13] netdevsim netdevsim4 eth2: set [0, 1] type 1 family 0 port 2816 - 0 [ 516.099024][ T13] netdevsim netdevsim4 eth3: set [0, 1] type 1 family 0 port 2816 - 0 [ 516.494104][T28303] validate_nla: 5 callbacks suppressed [ 516.494125][T28303] netlink: 'syz.2.10276': attribute type 19 has an invalid length. [ 516.510773][T28303] netlink: 'syz.2.10276': attribute type 19 has an invalid length. [ 516.683555][T28309] veth0: entered promiscuous mode [ 516.690868][T28309] veth0: left promiscuous mode [ 517.074568][T28334] netlink: Conntrack attr has 3 unknown bytes [ 518.065499][T28388] __nla_validate_parse: 10 callbacks suppressed [ 518.065523][T28388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10312'. [ 518.088782][T28388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10312'. [ 518.098360][T28388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10312'. [ 518.957592][T28438] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10331'. [ 518.989473][T28438] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10331'. [ 519.142094][T28443] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.10335'. [ 519.207724][T28447] netlink: 'syz.1.10338': attribute type 1 has an invalid length. [ 519.291726][T28447] bond4: entered promiscuous mode [ 519.310209][T28453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10339'. [ 519.319820][T28453] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10339'. [ 519.329214][T28453] netlink: 'syz.0.10339': attribute type 15 has an invalid length. [ 519.338097][T28447] 8021q: adding VLAN 0 to HW filter on device bond4 [ 519.390667][T28450] bond4: (slave bridge3): making interface the new active one [ 519.408539][T28450] bridge3: entered promiscuous mode [ 519.415867][T28450] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 519.441549][T28453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10339'. [ 519.454335][T28453] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10339'. [ 519.455174][ T1104] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 519.476350][T28453] netlink: 'syz.0.10339': attribute type 15 has an invalid length. [ 519.497283][ T1104] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 519.531690][ T1104] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 519.566061][ T1104] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 520.578810][T28510] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 522.625942][T28624] veth1_to_bond: entered allmulticast mode [ 522.671461][T28624] veth1_to_bond: left allmulticast mode [ 522.747824][T28634] netlink: 'syz.4.10417': attribute type 51 has an invalid length. [ 523.106790][T28653] __nla_validate_parse: 13 callbacks suppressed [ 523.106815][T28653] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.10426'. [ 523.529271][T28678] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10438'. [ 523.580431][T28681] syzkaller1: entered promiscuous mode [ 523.586884][T28681] syzkaller1: entered allmulticast mode [ 523.809238][T28689] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10444'. [ 523.831547][T28689] bridge: RTM_NEWNEIGH with invalid ether address [ 523.849032][T28689] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10444'. [ 523.889715][T28689] bridge: RTM_NEWNEIGH with invalid ether address [ 524.160092][T28710] netlink: 'syz.2.10452': attribute type 1 has an invalid length. [ 524.302009][T28710] 8021q: adding VLAN 0 to HW filter on device bond3 [ 524.583685][T28730] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10459'. [ 525.017131][T28754] netlink: 212344 bytes leftover after parsing attributes in process `syz.1.10469'. [ 525.157421][T28761] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10472'. [ 525.160059][T28759] syzkaller1: entered promiscuous mode [ 525.179065][T28759] syzkaller1: entered allmulticast mode [ 525.275994][T28762] lo speed is unknown, defaulting to 1000 [ 525.575077][T28782] netlink: 816 bytes leftover after parsing attributes in process `syz.0.10480'. [ 525.595502][T28780] netlink: 'syz.2.10481': attribute type 15 has an invalid length. [ 525.687051][T28778] netlink: 'syz.1.10479': attribute type 1 has an invalid length. [ 525.709403][T28778] netlink: 'syz.1.10479': attribute type 1 has an invalid length. [ 525.820521][T28791] netlink: 192 bytes leftover after parsing attributes in process `syz.0.10483'. [ 525.840722][T28791] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10483'. [ 525.896381][T28789] lo speed is unknown, defaulting to 1000 [ 527.213107][T28851] syzkaller1: entered promiscuous mode [ 527.233179][T28851] syzkaller1: entered allmulticast mode [ 528.898365][T28937] lo: Caught tx_queue_len zero misconfig [ 529.222053][T28943] __nla_validate_parse: 2 callbacks suppressed [ 529.222079][T28943] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10525'. [ 529.408372][T28946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10527'. [ 529.459711][T28946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10527'. [ 529.543968][T28955] syzkaller1: entered promiscuous mode [ 529.551949][T28955] syzkaller1: entered allmulticast mode [ 529.974583][T28968] netlink: 'syz.3.10537': attribute type 10 has an invalid length. [ 529.993467][T28968] netlink: 16154 bytes leftover after parsing attributes in process `syz.3.10537'. [ 530.108770][T28972] netlink: 184 bytes leftover after parsing attributes in process `syz.3.10539'. [ 530.545238][T28990] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10547'. [ 530.998346][T29014] netlink: 'syz.3.10558': attribute type 11 has an invalid length. [ 531.007550][T29014] netlink: 'syz.3.10558': attribute type 4 has an invalid length. [ 531.015997][T29014] netlink: 'syz.3.10558': attribute type 5 has an invalid length. [ 531.026810][T29014] netlink: 'syz.3.10558': attribute type 6 has an invalid length. [ 531.035431][T29014] netlink: 199748 bytes leftover after parsing attributes in process `syz.3.10558'. [ 531.401622][T29029] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 532.001527][T29069] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10582'. [ 532.049760][T29069] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10582'. [ 532.275864][T29084] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10589'. [ 532.303850][T29084] netlink: 'syz.4.10589': attribute type 7 has an invalid length. [ 532.328887][T29084] netlink: 'syz.4.10589': attribute type 8 has an invalid length. [ 532.337186][T29086] netlink: 'syz.3.10590': attribute type 1 has an invalid length. [ 532.536450][T29097] lo speed is unknown, defaulting to 1000 [ 532.677021][T29106] syzkaller1: entered promiscuous mode [ 532.682899][T29106] syzkaller1: entered allmulticast mode [ 533.819090][T29174] netlink: 'syz.4.10626': attribute type 1 has an invalid length. [ 533.828055][T29174] netlink: 'syz.4.10626': attribute type 4 has an invalid length. [ 534.276730][T29146] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 534.277496][T29202] netlink: 'syz.4.10636': attribute type 4 has an invalid length. [ 534.452775][T29206] __nla_validate_parse: 7 callbacks suppressed [ 534.452794][T29206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10638'. [ 534.525348][T29206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10638'. [ 534.629360][T29217] policy can only be matched on NF_INET_PRE_ROUTING [ 534.629383][T29217] unable to load match [ 534.831521][T29231] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.10649'. [ 534.997653][T29237] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10653'. [ 535.042636][T29244] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10656'. [ 535.052755][T29244] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10656'. [ 535.212924][T29237] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10653'. [ 535.717200][T29273] gretap0: entered promiscuous mode [ 535.861646][T29280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10669'. [ 535.881359][T29280] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10669'. [ 535.905585][T29280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10669'. [ 535.994867][T29286] validate_nla: 1 callbacks suppressed [ 535.994887][T29286] netlink: 'syz.3.10672': attribute type 25 has an invalid length. [ 536.347357][T29263] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 536.721905][T29307] syzkaller1: entered promiscuous mode [ 536.728774][T29307] syzkaller1: entered allmulticast mode [ 540.719252][T29455] __nla_validate_parse: 3 callbacks suppressed [ 540.719277][T29455] netlink: 40 bytes leftover after parsing attributes in process `syz.4.10743'. [ 541.424379][T29486] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 541.432178][T29486] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 541.902599][T29473] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 542.721301][T29525] sock: sock_set_timeout: `syz.1.10768' (pid 29525) tries to set negative timeout [ 542.921818][T29531] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10769'. [ 542.951251][T29531] hsr_slave_1 (unregistering): left promiscuous mode [ 543.080734][T29544] netlink: 'syz.0.10773': attribute type 29 has an invalid length. [ 543.142027][T29547] netlink: 'syz.0.10773': attribute type 29 has an invalid length. [ 543.183867][T29544] netlink: 'syz.0.10773': attribute type 32 has an invalid length. [ 543.196591][T29550] netlink: 'syz.3.10777': attribute type 21 has an invalid length. [ 543.205076][T29550] netlink: 'syz.3.10777': attribute type 22 has an invalid length. [ 543.216297][T29550] netlink: 'syz.3.10777': attribute type 23 has an invalid length. [ 543.247687][T29550] netlink: 'syz.3.10777': attribute type 25 has an invalid length. [ 543.269269][T29550] netlink: 96 bytes leftover after parsing attributes in process `syz.3.10777'. [ 543.473899][T29564] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10784'. [ 543.507853][T29564] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10784'. [ 543.565847][T29564] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10784'. [ 543.582176][T29564] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10784'. [ 543.918616][T29579] GUP no longer grows the stack in syz.1.10789 (29579): 200000003000-20000000a000 (200000001000) [ 543.940006][T29579] CPU: 0 UID: 0 PID: 29579 Comm: syz.1.10789 Not tainted syzkaller #0 PREEMPT(full) [ 543.940058][T29579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 543.940081][T29579] Call Trace: [ 543.940090][T29579] [ 543.940100][T29579] dump_stack_lvl+0xe8/0x150 [ 543.940140][T29579] __get_user_pages+0x2453/0x29d0 [ 543.940178][T29579] ? __lock_acquire+0x6b5/0x2cf0 [ 543.940231][T29579] ? __gup_longterm_locked+0xc4e/0x1630 [ 543.940272][T29579] ? down_read_killable+0x1bb/0x340 [ 543.940302][T29579] __gup_longterm_locked+0xdcf/0x1630 [ 543.940376][T29579] gup_fast_fallback+0x1d82/0x22e0 [ 543.940451][T29579] ? __pfx_gup_fast_fallback+0x10/0x10 [ 543.940484][T29579] ? futex_unqueue+0x22/0x240 [ 543.940511][T29579] ? futex_unqueue+0x22/0x240 [ 543.940537][T29579] ? is_valid_gup_args+0x11f/0x200 [ 543.940575][T29579] ? get_user_pages_fast+0x4d/0xb0 [ 543.940613][T29579] __iov_iter_get_pages_alloc+0x3b6/0xb10 [ 543.940650][T29579] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 543.940681][T29579] iov_iter_get_pages2+0x5e/0xa0 [ 543.940712][T29579] __se_sys_vmsplice+0x7b3/0x1490 [ 543.940758][T29579] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 543.940782][T29579] ? __pfx_futex_wait+0x10/0x10 [ 543.940830][T29579] ? lockdep_hardirqs_on+0x7a/0x110 [ 543.940931][T29579] do_syscall_64+0x14d/0xf80 [ 543.940962][T29579] ? trace_irq_disable+0x3b/0x150 [ 543.940982][T29579] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.941006][T29579] ? clear_bhb_loop+0x40/0x90 [ 543.941035][T29579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.941058][T29579] RIP: 0033:0x7f2109d9c819 [ 543.941079][T29579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.941099][T29579] RSP: 002b:00007f2107fee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 543.941123][T29579] RAX: ffffffffffffffda RBX: 00007f210a015fa0 RCX: 00007f2109d9c819 [ 543.941140][T29579] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000005 [ 543.941155][T29579] RBP: 00007f2109e32c91 R08: 0000000000000000 R09: 0000000000000000 [ 543.941169][T29579] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 543.941183][T29579] R13: 00007f210a016038 R14: 00007f210a015fa0 R15: 00007ffd4704c168 [ 543.941221][T29579] [ 544.330648][T29586] syzkaller1: entered promiscuous mode [ 544.336184][T29586] syzkaller1: entered allmulticast mode [ 545.278434][T29630] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 545.466646][T29643] netlink: 'syz.0.10813': attribute type 1 has an invalid length. [ 545.515378][T29643] bond6: (slave geneve5): making interface the new active one [ 545.525145][T29643] bond6: (slave geneve5): Enslaving as an active interface with an up link [ 545.534707][ T13] netdevsim netdevsim0 netdevsim0: set [1, 2] type 2 family 0 port 20000 - 0 [ 545.566826][ T13] netdevsim netdevsim0 netdevsim1: set [1, 2] type 2 family 0 port 20000 - 0 [ 545.614849][ T13] netdevsim netdevsim0 netdevsim2: set [1, 2] type 2 family 0 port 20000 - 0 [ 545.673207][ T13] netdevsim netdevsim0 netdevsim3: set [1, 2] type 2 family 0 port 20000 - 0 [ 545.961349][T29667] tipc: Failed to remove unknown binding: 66,1,1/541956973:1097084205/1097084207 [ 545.971400][T29667] tipc: Failed to remove unknown binding: 66,1,1/541956973:1097084205/1097084207 [ 546.747934][T29693] netlink: 'syz.3.10834': attribute type 2 has an invalid length. [ 547.112784][T29708] netlink: 'syz.4.10840': attribute type 1 has an invalid length. [ 547.154250][T29708] bond3: entered promiscuous mode [ 547.160012][T29708] 8021q: adding VLAN 0 to HW filter on device bond3 [ 547.201809][T29708] 8021q: adding VLAN 0 to HW filter on device bond3 [ 547.209321][T29708] bond3: (slave vti0): The slave device specified does not support setting the MAC address [ 547.220802][T29708] bond3: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 547.235020][T29708] bond3: (slave vti0): making interface the new active one [ 547.242685][T29708] vti0: entered promiscuous mode [ 547.250080][T29708] bond3: (slave vti0): Enslaving as an active interface with an up link [ 547.598127][T29734] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10849'. [ 547.725359][T29741] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10852'. [ 547.775920][T29741] team0: entered promiscuous mode [ 547.785577][T29741] team0: entered allmulticast mode [ 547.815600][T29744] netlink: 212344 bytes leftover after parsing attributes in process `syz.1.10854'. [ 548.162695][T29718] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 548.319922][T29770] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10863'. [ 548.525164][T29780] netlink: 'syz.2.10867': attribute type 26 has an invalid length. [ 548.533254][T29780] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10867'. [ 548.543037][T29780] netlink: 'syz.2.10867': attribute type 26 has an invalid length. [ 548.559739][T29780] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10867'. [ 548.946403][T29807] only policy match revision 0 supported [ 548.946426][T29807] unable to load match [ 549.056985][T29811] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10881'. [ 549.478144][T29831] sctp: [Deprecated]: syz.1.10890 (pid 29831) Use of int in maxseg socket option. [ 549.478144][T29831] Use struct sctp_assoc_value instead [ 549.640575][T29838] syzkaller1: entered promiscuous mode [ 549.646118][T29838] syzkaller1: entered allmulticast mode [ 549.946761][T29854] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 549.978531][T29854] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 550.276632][T29871] syzkaller1: entered promiscuous mode [ 550.282469][T29871] syzkaller1: entered allmulticast mode [ 550.476701][T29878] netlink: 'syz.4.10911': attribute type 4 has an invalid length. [ 550.507410][T29878] netlink: 'syz.4.10911': attribute type 4 has an invalid length. [ 550.847390][T29901] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10921'. [ 551.104636][T29912] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10924'. [ 551.254236][T29917] bond2: (slave lo): Releasing backup interface [ 551.261437][T29917] bond2: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 551.271986][T29917] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 551.287745][ T796] lo speed is unknown, defaulting to 1000 [ 551.293618][ T796] syz0: Port: 1 Link DOWN [ 551.364242][T29922] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.10928'. [ 551.377578][T29922] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 551.520751][T29924] lo speed is unknown, defaulting to 1000 [ 552.288539][T29955] netlink: 'syz.1.10941': attribute type 4 has an invalid length. [ 552.792861][T29972] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10948'. [ 552.947215][T29978] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10951'. [ 553.695368][T29890] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 553.877215][T29989] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10954'. [ 553.911460][T29992] netlink: 'syz.3.10957': attribute type 1 has an invalid length. [ 553.976859][T29997] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10957'. [ 554.004346][T29997] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10957'. [ 554.710584][T29992] bond9: entered promiscuous mode [ 554.716159][T29992] 8021q: adding VLAN 0 to HW filter on device bond9 [ 554.828034][T30001] bond9: (slave bridge4): making interface the new active one [ 554.843875][T30001] bridge4: entered promiscuous mode [ 554.852459][T30001] bond9: (slave bridge4): Enslaving as an active interface with an up link [ 555.032299][T30019] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10967'. [ 555.292615][T30031] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10971'. [ 555.373466][T30035] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10972'. [ 555.822097][T30058] sctp: [Deprecated]: syz.3.10981 (pid 30058) Use of struct sctp_assoc_value in delayed_ack socket option. [ 555.822097][T30058] Use struct sctp_sack_info instead [ 555.928645][T30061] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10982'. [ 556.191978][T30072] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10986'. [ 557.341947][T30076] A link change request failed with some changes committed already. Interface eth0 may have been left with an inconsistent configuration, please check. [ 558.226453][T30122] __nla_validate_parse: 1 callbacks suppressed [ 558.226476][T30122] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11004'. [ 559.053074][T30146] netlink: 'syz.2.11013': attribute type 1 has an invalid length. [ 559.113786][T30146] bond4: entered promiscuous mode [ 559.124204][T30146] 8021q: adding VLAN 0 to HW filter on device bond4 [ 559.176196][T30151] bond4: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 559.254246][T30154] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11014'. [ 559.272659][T30151] bond4: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 559.283585][T30151] bond4: (slave ipvlan3): Setting fail_over_mac to active for active-backup mode [ 559.377274][T30154] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 559.386455][T30154] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 559.411845][T30154] team0: Failed to send options change via netlink (err -105) [ 559.449207][T30154] team0: Port device batadv1 added [ 559.970867][T30176] netlink: 'syz.1.11021': attribute type 4 has an invalid length. [ 559.990670][T30176] netlink: 'syz.1.11021': attribute type 4 has an invalid length. [ 560.153936][T30178] syzkaller1: entered promiscuous mode [ 560.161414][T30178] syzkaller1: entered allmulticast mode [ 560.474040][T30192] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11028'. [ 560.585926][T30194] lo speed is unknown, defaulting to 1000 [ 560.751129][T30203] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11033'. [ 560.981144][T30213] netlink: 11562 bytes leftover after parsing attributes in process `syz.4.11037'. [ 561.049104][T30215] tipc: Failed to remove unknown binding: 66,1,1/541956973:3201136072/3201136074 [ 561.668896][T30242] netlink: 'syz.3.11049': attribute type 1 has an invalid length. [ 561.731412][T30242] bond10: entered promiscuous mode [ 561.737105][T30242] 8021q: adding VLAN 0 to HW filter on device bond10 [ 561.770274][T30244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11051'. [ 561.818440][T30242] bond10: (slave bridge5): making interface the new active one [ 561.827472][T30242] bridge5: entered promiscuous mode [ 561.838114][T30242] bridge5: left promiscuous mode [ 561.876276][T30214] tipc: Failed to remove unknown binding: 66,1,1/541956973:3201136072/3201136074 [ 561.885676][T30214] tipc: Failed to remove unknown binding: 66,1,1/541956973:3201136072/3201136074 [ 562.007758][T30258] netlink: 48 bytes leftover after parsing attributes in process `syz.0.11053'. [ 562.091748][T30255] netlink: 36 bytes leftover after parsing attributes in process `syz.0.11053'. [ 562.316139][T30266] lo speed is unknown, defaulting to 1000 [ 563.640167][T30298] netlink: 156 bytes leftover after parsing attributes in process `syz.4.11071'. [ 563.675457][T30298] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11071'. [ 563.686737][T30302] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11072'. [ 563.766966][T30303] ================================================================== [ 563.775106][T30303] BUG: KASAN: slab-out-of-bounds in af_alg_pull_tsgl+0x1c6/0x740 [ 563.782879][T30303] Read of size 8 at addr ffff888055eef460 by task syz.2.11073/30303 [ 563.790901][T30303] [ 563.793276][T30303] CPU: 1 UID: 0 PID: 30303 Comm: syz.2.11073 Not tainted syzkaller #0 PREEMPT(full) [ 563.793305][T30303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 563.793320][T30303] Call Trace: [ 563.793329][T30303] [ 563.793339][T30303] dump_stack_lvl+0xe8/0x150 [ 563.793375][T30303] print_report+0xba/0x230 [ 563.793402][T30303] ? af_alg_pull_tsgl+0x1c6/0x740 [ 563.793436][T30303] kasan_report+0x117/0x150 [ 563.793467][T30303] ? af_alg_pull_tsgl+0x1c6/0x740 [ 563.793507][T30303] af_alg_pull_tsgl+0x1c6/0x740 [ 563.793553][T30303] skcipher_recvmsg+0x5df/0x1140 [ 563.793591][T30303] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 563.793616][T30303] ? aa_sock_msg_perm+0xf1/0x1b0 [ 563.793652][T30303] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 563.793678][T30303] ? security_socket_recvmsg+0x7e/0x2c0 [ 563.793705][T30303] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 563.793731][T30303] sock_recvmsg+0x172/0x1b0 [ 563.793756][T30303] __sys_recvfrom+0x240/0x3c0 [ 563.793812][T30303] ? __pfx___sys_recvfrom+0x10/0x10 [ 563.793856][T30303] ? exc_page_fault+0x6a/0xc0 [ 563.793889][T30303] ? do_user_addr_fault+0xc6f/0x1340 [ 563.793921][T30303] __x64_sys_recvfrom+0xde/0x100 [ 563.793950][T30303] do_syscall_64+0x14d/0xf80 [ 563.793980][T30303] ? trace_irq_disable+0x3b/0x150 [ 563.793999][T30303] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.794020][T30303] ? clear_bhb_loop+0x40/0x90 [ 563.794045][T30303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.794067][T30303] RIP: 0033:0x7f180215d04e [ 563.794087][T30303] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 563.794108][T30303] RSP: 002b:00007f180306ee88 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 563.794132][T30303] RAX: ffffffffffffffda RBX: 00007f18030706c0 RCX: 00007f180215d04e [ 563.794148][T30303] RDX: 0000000000001000 RSI: 00007f180306f000 RDI: 0000000000000004 [ 563.794163][T30303] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 563.794176][T30303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 563.794190][T30303] R13: 00007f180306ef58 R14: 00007f180306f000 R15: 0000000000000000 [ 563.794217][T30303] [ 563.794225][T30303] [ 564.013361][T30303] Allocated by task 30303: [ 564.017812][T30303] kasan_save_track+0x3e/0x80 [ 564.022521][T30303] __kasan_kmalloc+0x93/0xb0 [ 564.027137][T30303] __kmalloc_noprof+0x35c/0x760 [ 564.032017][T30303] sock_kmalloc+0xd6/0x160 [ 564.036462][T30303] skcipher_recvmsg+0x54d/0x1140 [ 564.041420][T30303] sock_recvmsg+0x172/0x1b0 [ 564.045949][T30303] __sys_recvfrom+0x240/0x3c0 [ 564.050657][T30303] __x64_sys_recvfrom+0xde/0x100 [ 564.055658][T30303] do_syscall_64+0x14d/0xf80 [ 564.060279][T30303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.066198][T30303] [ 564.068542][T30303] The buggy address belongs to the object at ffff888055eef440 [ 564.068542][T30303] which belongs to the cache kmalloc-32 of size 32 [ 564.082654][T30303] The buggy address is located 0 bytes to the right of [ 564.082654][T30303] allocated 32-byte region [ffff888055eef440, ffff888055eef460) [ 564.097084][T30303] [ 564.099433][T30303] The buggy address belongs to the physical page: [ 564.105862][T30303] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55eef [ 564.114657][T30303] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 564.121845][T30303] page_type: f5(slab) [ 564.125869][T30303] raw: 00fff00000000000 ffff88813fea7780 dead000000000100 dead000000000122 [ 564.134494][T30303] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000 [ 564.143098][T30303] page dumped because: kasan: bad access detected [ 564.149540][T30303] page_owner tracks the page as allocated [ 564.155274][T30303] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5826, tgid 5826 (syz-executor), ts 183153347064, free_ts 183148368047 [ 564.175094][T30303] post_alloc_hook+0x231/0x280 [ 564.179895][T30303] get_page_from_freelist+0x24dc/0x2580 [ 564.185473][T30303] __alloc_frozen_pages_noprof+0x18d/0x380 [ 564.191312][T30303] allocate_slab+0x77/0x660 [ 564.195842][T30303] refill_objects+0x331/0x3c0 [ 564.200553][T30303] __pcs_replace_empty_main+0x2e6/0x730 [ 564.206135][T30303] __kmalloc_cache_noprof+0x392/0x660 [ 564.211536][T30303] kmem_cache_free+0x15b/0x630 [ 564.216331][T30303] fput_close_sync+0x11f/0x240 [ 564.221124][T30303] __x64_sys_close+0x7e/0x110 [ 564.225824][T30303] do_syscall_64+0x14d/0xf80 [ 564.230440][T30303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.236355][T30303] page last free pid 10638 tgid 10637 stack trace: [ 564.242869][T30303] __free_frozen_pages+0xc2b/0xdb0 [ 564.247997][T30303] tlb_finish_mmu+0x144/0x230 [ 564.252699][T30303] exit_mmap+0x498/0xa10 [ 564.257034][T30303] __mmput+0x118/0x430 [ 564.261183][T30303] exit_mm+0x168/0x220 [ 564.265284][T30303] do_exit+0x6a2/0x23c0 [ 564.269487][T30303] do_group_exit+0x21b/0x2d0 [ 564.274118][T30303] get_signal+0x1284/0x1330 [ 564.278655][T30303] arch_do_signal_or_restart+0xbc/0x830 [ 564.284232][T30303] exit_to_user_mode_loop+0x86/0x480 [ 564.289551][T30303] do_syscall_64+0x32d/0xf80 [ 564.294179][T30303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.300094][T30303] [ 564.302432][T30303] Memory state around the buggy address: [ 564.308078][T30303] ffff888055eef300: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 564.316159][T30303] ffff888055eef380: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 564.324239][T30303] >ffff888055eef400: 00 00 00 fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 564.332321][T30303] ^ [ 564.339541][T30303] ffff888055eef480: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 564.347622][T30303] ffff888055eef500: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 564.355703][T30303] ================================================================== [ 564.394367][T30303] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 564.401646][T30303] CPU: 1 UID: 0 PID: 30303 Comm: syz.2.11073 Not tainted syzkaller #0 PREEMPT(full) [ 564.411146][T30303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 564.421237][T30303] Call Trace: [ 564.424558][T30303] [ 564.427520][T30303] vpanic+0x56c/0xa60 [ 564.431556][T30303] ? __pfx_vpanic+0x10/0x10 [ 564.436120][T30303] ? __pfx___schedule+0x10/0x10 [ 564.441024][T30303] panic+0xc5/0xd0 [ 564.444803][T30303] ? __pfx_panic+0x10/0x10 [ 564.449275][T30303] ? preempt_schedule_common+0x82/0xd0 [ 564.454787][T30303] ? af_alg_pull_tsgl+0x1c6/0x740 [ 564.459854][T30303] check_panic_on_warn+0x89/0xb0 [ 564.464848][T30303] ? af_alg_pull_tsgl+0x1c6/0x740 [ 564.469909][T30303] end_report+0x73/0x180 [ 564.474196][T30303] ? af_alg_pull_tsgl+0x1c6/0x740 [ 564.479258][T30303] kasan_report+0x128/0x150 [ 564.483805][T30303] ? af_alg_pull_tsgl+0x1c6/0x740 [ 564.488893][T30303] af_alg_pull_tsgl+0x1c6/0x740 [ 564.493801][T30303] skcipher_recvmsg+0x5df/0x1140 [ 564.498784][T30303] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 564.504202][T30303] ? aa_sock_msg_perm+0xf1/0x1b0 [ 564.509177][T30303] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 564.514494][T30303] ? security_socket_recvmsg+0x7e/0x2c0 [ 564.520076][T30303] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 564.525525][T30303] sock_recvmsg+0x172/0x1b0 [ 564.530070][T30303] __sys_recvfrom+0x240/0x3c0 [ 564.534817][T30303] ? __pfx___sys_recvfrom+0x10/0x10 [ 564.540070][T30303] ? exc_page_fault+0x6a/0xc0 [ 564.544805][T30303] ? do_user_addr_fault+0xc6f/0x1340 [ 564.550127][T30303] __x64_sys_recvfrom+0xde/0x100 [ 564.555106][T30303] do_syscall_64+0x14d/0xf80 [ 564.559738][T30303] ? trace_irq_disable+0x3b/0x150 [ 564.564807][T30303] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.570903][T30303] ? clear_bhb_loop+0x40/0x90 [ 564.575621][T30303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.581549][T30303] RIP: 0033:0x7f180215d04e [ 564.585998][T30303] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 564.605628][T30303] RSP: 002b:00007f180306ee88 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 564.614074][T30303] RAX: ffffffffffffffda RBX: 00007f18030706c0 RCX: 00007f180215d04e [ 564.622080][T30303] RDX: 0000000000001000 RSI: 00007f180306f000 RDI: 0000000000000004 [ 564.630075][T30303] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 564.638064][T30303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 564.646059][T30303] R13: 00007f180306ef58 R14: 00007f180306f000 R15: 0000000000000000 [ 564.654086][T30303] [ 564.657746][T30303] Kernel Offset: disabled [ 564.662082][T30303] Rebooting in 86400 seconds..