last executing test programs: 6.782701946s ago: executing program 1 (id=2505): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000240)={r1, 0x0}, 0x20) r2 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r2, &(0x7f0000000580)={0xa, 0x4e23, 0x0, @empty, 0x3}, 0xb) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000040)={@private2, r3}, 0x14) 6.64360693s ago: executing program 1 (id=2508): r0 = socket(0x6, 0x3, 0x0) close(0x3) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r2, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) connect$unix(r4, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001"], 0xb8}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = epoll_create1(0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000008000000000000007e1b1f2995"], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$llc(0x1a, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=r6, @ANYBLOB="00000000000000001c002b8008000800", @ANYRES32, @ANYRES16=r7, @ANYRES32=r6], 0x44}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x300, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x7d}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) ioctl$FS_IOC_SETFLAGS(r5, 0x40088a01, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r1, &(0x7f0000000580)={0x40000008}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000140)={'erspan0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x8, 0x700, 0x9, 0x1, {{0x35, 0x4, 0x2, 0x19, 0xd4, 0x66, 0x0, 0xf9, 0x2f, 0x0, @empty, @private=0xa010101, {[@timestamp_addr={0x44, 0x1c, 0x8d, 0x1, 0x1, [{@rand_addr=0x64010102, 0x684d}, {@private=0xa010102}, {@local, 0xdcb}]}, @cipso={0x86, 0x2a, 0x1, [{0x0, 0x12, "edca5568bfcabf56c02acd837f17f4a0"}, {0x2, 0x12, "5c2bc899f597a4b3653662e5d7e749b2"}]}, @noop, @cipso={0x86, 0x66, 0x0, [{0x7, 0x10, "5e1b24c7b1c3642be17a48966b8a"}, {0x2, 0x6, "b7bcecca"}, {0x6, 0x8, "ba43a46a8e1f"}, {0x7, 0x2}, {0x6, 0xb, "b417af8d87e38e6b8b"}, {0x0, 0xe, "6da210cf6dbc9988dbdffcaf"}, {0x9, 0x2}, {0x1, 0x11, "afc6d58cb7580d04e0a3c3eb7e1ceb"}, {0x2, 0xe, "0d9eebaf868313fa683f76a8"}, {0x6, 0x6, "75d87979"}]}, @lsrr={0x83, 0x13, 0x80, [@dev={0xac, 0x14, 0x14, 0x3b}, @multicast1, @empty, @dev={0xac, 0x14, 0x14, 0x3e}]}]}}}}}) r10 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000200), 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0d00000001000080040000000800000010040000", @ANYRES32, @ANYBLOB="d8cdef242800000000fa0000000000000089ff0000", @ANYRES32=r9, @ANYRES32=r10, @ANYBLOB="00000000020000000300"/28], 0x50) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x30}], 0x1, 0x0) 5.642330149s ago: executing program 4 (id=2523): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20"], 0xfc}}, 0x0) socket(0x24, 0x6, 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_int(r0, 0x29, 0x12, 0x0, 0x6e) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r3 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$inet(r3, 0x0, 0x8000000) unshare(0x6a040280) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[], 0x0, 0x4}, 0x94) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000002a80), r6) sendmsg$NFC_CMD_ENABLE_SE(r6, &(0x7f0000002b80)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="244dd52439069a2775936ccd20068220488a5eb5b6c66f8851c484c88d249c47b02534bc130e7d930b882c8b33e9e3be6d7521da4b8c4cbd011a"], 0x1c}, 0x1, 0x0, 0x0, 0x48881}, 0x4000) syz_emit_ethernet(0x32, &(0x7f0000000100)=ANY=[@ANYRES16=r2, @ANYRES32=r0, @ANYRESOCT=r4, @ANYRES64=r1, @ANYRES8=r1, @ANYRESOCT=r0], 0x0) socket$rxrpc(0x21, 0x2, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) r8 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000980)={0xffffffffffffffff, 0x0, 0x4042c0, &(0x7f00000008c0)={@_ha_fsid={[0x7, 0x6]}, {0x4003, 0xffff, 0x5, 0xfffffffffffffffc}}, 0x6, &(0x7f0000000900), &(0x7f0000000940)=0xfffffffd}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="1b00000000000000000000000800000000000000", @ANYRES32=0x1, @ANYBLOB="0300ec4ad6910000000000000000000000000002", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="03000000010000000400"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x12, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000040000000000000000051aa750dd9004ca67e1626b0e8000038980018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000850000006500000018540000100000000000000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f00000006c0)='syzkaller\x00', 0x3, 0xe4, &(0x7f0000000700)=""/228, 0x41100, 0x8, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x8, &(0x7f0000000840)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000ac0)=[{0x1, 0x3, 0xa, 0xb}], 0x10, 0x217}, 0x94) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) accept4(r7, 0x0, 0x0, 0x800) 4.66446839s ago: executing program 1 (id=2535): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee9, 0x8031, r0, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) ioctl$sock_TIOCINQ(r1, 0x61d8, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x210200, &(0x7f0000000040)={@align=0x9, {0x5, 0xe2cc, 0x5, 0x4}}, 0x0, &(0x7f0000000080), &(0x7f00000000c0)=0xc10e}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DISASSOCIATE(r2, &(0x7f0000000280)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r3, 0x4, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x7fffffff, 0x65}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x40}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000c085}, 0x8997b2573594d27d) sendmsg$AUDIT_GET(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x10, 0x3e8, 0x200, 0x70bd2c, 0x25dfdbfd, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x40000}, 0x840) 1.986364497s ago: executing program 3 (id=2561): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000180)=0x43e4, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x5, 0x4) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, 0x0}, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) 1.92848805s ago: executing program 0 (id=2562): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b400000000000000791090000000000063000000000000009500000000000000b8a164aed91d3d5b664c4ca806f01293f84f25209077b1bb4ab4cf447b29fad55603aa97715b6f60e53760e0565b07dd0f"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0xe4) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="24040000040801"], 0x24}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000068000000060a010400000000000000000100000008000b4000000000400004802800018007000100637400001c000280080001400000000108000240000000090500030000000000140001800a0001007265646972000000040002800900010073797a30"], 0xdc}, 0x1, 0x0, 0x0, 0x15}, 0x4000000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={@fallback=r3, r3, 0x2f, 0x8, 0xffffffffffffffff, @void, @value=0x0}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)=ANY=[], 0x20) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000980)={'wpan1\x00'}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000100)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002abd7000fbdbdf25200000001c002d000005000400010000000000000000000000000000000000000f8662251c1cea30973592880c5fb5e378b5c24814b11775de0f1716b23573d0f2fbdc7173a0634f676d1290bbab29289165f6fe12603a48e6a891cf18"], 0x30}, 0x1, 0x0, 0x0, 0x20048011}, 0x40048c0) 1.782441655s ago: executing program 3 (id=2563): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40201, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000001540)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {0xc}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) sendmsg$alg(r2, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x890}, 0x0) sendmsg$nl_route_sched_retired(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=@delqdisc={0xe4, 0x25, 0x800, 0x70bd2d, 0x25dfdafe, {0x0, 0x0, 0x0, 0x0, {0xd}, {0x7, 0x9}, {0x1, 0xffe0}}, [@q_dsmark={{0xb}, {0x24, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x30}]}}, @q_dsmark={{0xb}, {0x18, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x15}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}]}}, @q_dsmark={{0xb}, {0x20, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x9d}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x3}]}}, @q_dsmark={{0xb}, {0x4}}, @q_dsmark={{0xb}, {0xc, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x20}]}}, @q_dsmark={{0xb}, {0xc, 0x2, [@TCA_DSMARK_INDICES={0x6}]}}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4008044}, 0x0) recvmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000300)=""/223, 0xdf}, {&(0x7f0000000840)=""/127, 0x7f}], 0x2}, 0x101}], 0x1, 0x60, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) recvmsg(r4, &(0x7f0000002bc0)={&(0x7f0000000080)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/139, 0x8b}, {&(0x7f00000018c0)=""/222, 0xde}, {&(0x7f00000019c0)=""/68, 0x44}, {&(0x7f0000001a40)=""/63, 0x3f}, {&(0x7f0000001a80)=""/118, 0x76}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x7, &(0x7f0000002b80)=""/33, 0x21}, 0x2000) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@multicast1, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4e24, 0x0, 0x4e22, 0x2, 0x2, 0x0, 0x20, 0x6c, 0x0, 0xee00}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0xfe, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @empty}, {0x0, 0x4, 0x6d, 0x9, 0x0, 0x40000000000, 0x7, 0x543}, {0x7, 0x49}, {0x2000, 0x0, 0x2000000}, 0x70bd2d, 0x34fd, 0x8, 0x4, 0x0, 0x50}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x100, "210466d38547aa140db90100000000c54222cb7a"}}, @encap={0x1c, 0x4, {0xfffffffffffffffe, 0x4e24, 0x4e24, @in=@remote}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_pauseparam={0x13}}) r8 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_SIOCDELRT(r8, 0x890c, &(0x7f00000001c0)={0x0, {0x2, 0x4e21, @loopback}, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e21, @empty}, 0x2b3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x7f, 0x4, 0x400}) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2d}, 0x90) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r9, r12, 0x25, 0x2, @void}, 0x10) write$tun(r5, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f"], 0xfdef) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000002c00)={0x518, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x2, 0xfffd, 0x3, 0x3, 0x5, 0xca, 0x6]}}]}]}, @NL80211_ATTR_TX_RATES={0x318, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x70, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1676, 0x8, 0x7f, 0x1, 0xff50, 0x4, 0xfbff, 0x4]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x27, 0x2, [{0x7, 0x7}, {0x6, 0xc}, {0x0, 0x6}, {0x6, 0x4}, {0x2, 0x9}, {0x1, 0x6}, {0x3, 0x2}, {0x5, 0x8}, {0x1, 0x9}, {0x1, 0x1}, {0x1, 0x5}, {0x2}, {0x6, 0x8}, {0x0, 0x4}, {0x4, 0x1}, {0x0, 0x4}, {0x1, 0xa}, {0x2, 0x2}, {0x7, 0x6}, {0x3, 0xa}, {}, {0x0, 0x4}, {0x7, 0x1}, {0x5, 0x8}, {0x3, 0x4}, {0x4, 0x6}, {0x4, 0x1}, {0x2, 0x4}, {0x2, 0x4}, {0x2, 0x6}, {0x7, 0x8}, {0x1, 0x2}, {0x0, 0x5}, {0x7, 0x9}, {0x0, 0x5}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_2GHZ={0x64, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x1b, 0x2d, 0x1f, 0xc, 0x30, 0x16, 0x1, 0x24, 0x1, 0x60, 0x6, 0x1b]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x6c, 0x5, 0x36, 0x16, 0x30, 0x16, 0x48, 0x9, 0x9, 0x1b, 0x1, 0xb, 0x0, 0x56, 0x1821b8fd0e02d6d, 0x19, 0x1b, 0xd, 0xc, 0x34, 0x9, 0x36, 0x48, 0x60, 0x48, 0x44, 0x3, 0x3, 0x60]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x5110, 0xb, 0xa6f, 0x40, 0x9, 0xfe01, 0x5]}}]}, @NL80211_BAND_5GHZ={0xb8, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2b, 0x2, [{0x1, 0x6}, {0x0, 0x9}, {0x3, 0x7}, {0x2, 0x3}, {0x0, 0x9}, {0x3}, {0x0, 0x6}, {0x0, 0x3}, {0x0, 0x9}, {0x1, 0x2}, {0x2, 0x2}, {0x7, 0x6}, {0x3, 0x8}, {0x1, 0x9}, {0x2, 0x5}, {0x1, 0x7}, {0x2, 0xa}, {0x0, 0x1}, {0x0, 0x7}, {0x2, 0x8}, {0x7, 0x1}, {0x0, 0x9}, {0x2, 0x3}, {0x5, 0x6}, {0x1, 0x3}, {0x2, 0x8}, {0x7, 0x3}, {0x2, 0x2}, {0x0, 0x5}, {0x3, 0x3}, {0x1, 0x1}, {0x0, 0x6}, {0x0, 0x5}, {0x3, 0x7}, {0x3}, {0x7, 0x1}, {0x2, 0x1}, {0x5, 0x2}, {0x1, 0x2}]}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x3, 0x36, 0x18, 0xd6a7df70d921e740]}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x6, 0x16, 0x167abcc23aff146e, 0x24, 0x2, 0x16, 0x24, 0x60, 0x18, 0x30, 0x4, 0x18]}, @NL80211_TXRATE_HT={0x51, 0x2, [{0x5, 0x2}, {0x5, 0x9}, {0x4, 0xa}, {0x1, 0x4}, {0x7, 0x4}, {0x4, 0x9}, {0x4, 0xd}, {0x7, 0x8}, {0x5, 0x6}, {0x1, 0x3}, {0x7, 0x4}, {0x2, 0x5}, {0x7}, {0x7, 0x3}, {0x2, 0xa}, {0x1, 0x8}, {0x6, 0x6}, {0x1, 0x1}, {0x5, 0x4}, {0x0, 0x9}, {0x1, 0x3}, {0x7, 0x2}, {0x1}, {0x5, 0x8}, {0x3, 0x8}, {0x6, 0x3}, {0x4, 0x6}, {0x6, 0x4}, {0x1}, {0x0, 0x8}, {0x2, 0x7}, {0x5, 0x8}, {0x5, 0xa}, {0x1, 0x6}, {0x3, 0x6}, {0x0, 0x7}, {0x2, 0x5}, {0x6, 0x7}, {0x1, 0xa}, {0x2, 0x9}, {0x1, 0x3}, {0x3, 0x3}, {0x6, 0x6}, {0x6, 0x2}, {0x0, 0x3}, {0x1, 0xa}, {0x7, 0x9}, {0x5}, {0x0, 0x2}, {0x7, 0x9}, {0x7}, {0x7, 0x2}, {0x5, 0x6}, {0x0, 0x6}, {0x6, 0x7}, {0x0, 0xa}, {0x1, 0x7}, {0x1, 0x6}, {0x3, 0xa}, {0x0, 0x3}, {0x7, 0x9}, {0x0, 0x2}, {0x2, 0x3}, {0x3, 0x3}, {0x1, 0x1}, {0x1, 0x2}, {0x2, 0x4}, {0x5, 0x8}, {0x1, 0xa}, {0x6, 0x5}, {0x2, 0x6}, {0x7, 0xa}, {0x5, 0x4}, {0x3, 0x6}, {0x2, 0x1}, {0x1, 0x7}, {0x4, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x7fff, 0x9, 0xc, 0x6, 0x7f, 0x6, 0x4]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_60GHZ={0x54, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xfffa, 0xe8d, 0x91c, 0x1000, 0x7, 0xbf, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x7, 0x2, [{0x0, 0x1}, {0x0, 0x4}, {0x0, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x3, 0x1, 0x9, 0x1, 0x1, 0x800, 0x5]}}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x7fff, 0xb67d, 0x8, 0x9, 0xa, 0x2, 0x1, 0xd3]}}]}, @NL80211_BAND_6GHZ={0xdc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x26, 0x2, [{0x3, 0x5}, {0x6, 0x4}, {0x2, 0x3}, {0x0, 0x1}, {0x4, 0x5}, {0x6, 0xa}, {0x3}, {0x5, 0x3}, {0x3, 0x7}, {0x1, 0x4}, {0x1, 0x3}, {0x4, 0x5}, {0x5, 0x4}, {0x3}, {0x4, 0x6}, {0x6, 0x5}, {0x1, 0xa}, {0x4, 0x7}, {0x0, 0x3}, {0x6, 0x6}, {0x0, 0x8}, {0x1, 0xa}, {0x5, 0x3}, {0x1}, {0x4, 0x1}, {0x5, 0x6}, {0x0, 0x1}, {0x7, 0x1c}, {0x3, 0x1}, {0x7, 0x3}, {0x7, 0x1}, {0x4, 0x8}, {0x0, 0x2}, {0x3, 0x8}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7ff, 0x9, 0x6, 0xfff9, 0x8]}}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x3}, {0x5, 0x2}, {0x7, 0x6}, {0x1, 0x4}, {0x5, 0x4}, {0x4, 0x5}, {0x4, 0x6}, {0x7, 0x8}, {0x6, 0x2}, {0x3, 0x5}, {0x0, 0xa}, {0x0, 0x1}, {0x5, 0x1}, {0x0, 0xa}, {0x4, 0x6}, {0x3, 0x6}, {0x2, 0x3}, {0x0, 0x7}, {0x7, 0x6}, {0x6}, {0x3, 0x3}, {0x4, 0x8}, {0x1, 0x3}, {0x2, 0x1}, {0x1, 0x3}, {0x7, 0x9}, {0x3, 0x5}, {0x4, 0x2}, {0x7, 0x1}, {0x6, 0x1}, {0x6}, {0x2, 0x8}, {0x3, 0x5}, {0x6, 0x7}, {0x0, 0x8}, {0x1, 0x7}, {0x2, 0x9}, {0x4}, {0x5, 0x3}, {0x1, 0x1}, {0x7, 0x3}, {0x7, 0x2}, {0x2, 0x5}, {0x2}, {0x2, 0x3}, {0x1, 0x6}, {0x5, 0x2}, {0x6, 0x3}, {0x7, 0x3}, {0x0, 0x1}, {0x0, 0x8}, {0x4, 0x6}, {0x1, 0x8}, {0x6, 0x4}, {0x6, 0x1}, {0x1, 0x6}, {0x5, 0x5}, {0x4, 0x2}, {0x1, 0x7}, {0x7, 0x9}, {0x4}, {0x1, 0x5}, {0x2, 0x5}, {0x7, 0x7}, {0x6, 0x1}, {0x2, 0x4}, {0x6, 0x1}, {0x0, 0x2}, {0x2, 0x5}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x37, 0x2, [{0x1, 0x8}, {0x0, 0x2}, {0x2, 0x1}, {0x4}, {0x0, 0x9}, {0x5, 0x1}, {0x5, 0x7}, {0x3, 0x4}, {0x3}, {0x2}, {0x3, 0x6}, {0x0, 0x6}, {0x1, 0xa}, {0x2, 0x6}, {0x1, 0x2}, {0x2, 0x6}, {0x5, 0x5}, {0x7, 0x9}, {0x1, 0x4}, {0x4, 0x1}, {0x1, 0x3}, {0x3, 0x4}, {0x0, 0x6}, {0x1, 0xa}, {0x0, 0x7}, {0x6, 0x5}, {0x5, 0x9}, {0x2}, {0x1, 0x1}, {0x1, 0x1}, {0x4, 0x9}, {0x6, 0x7}, {0x3, 0x6}, {0x7, 0x6}, {0x0, 0x1}, {0x4, 0x4}, {0x3, 0xa}, {0x3, 0x5}, {0x3, 0x1}, {0x7, 0x1}, {0x5, 0x1}, {0x5, 0xa}, {0x7, 0xa}, {0x3, 0x6}, {0x1, 0x2}, {0x5, 0x7}, {0x7, 0x7}, {0x5, 0x7}, {0x2, 0x1}, {0x4, 0x3}, {0x7, 0xa}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0x24, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x9, 0x9, 0x1, 0x24]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_2GHZ={0x4}, @NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x200, 0x9, 0x1, 0x0, 0x2, 0xb7, 0x100]}}]}]}, @NL80211_ATTR_TX_RATES={0x1c8, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x9, 0x7, 0x9, 0x1f28, 0x100, 0x9, 0xc4f]}}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x36, 0x4, 0x1b, 0x18, 0x36, 0x5, 0x36, 0x6, 0x60, 0x36, 0x6, 0x24, 0x48, 0x48, 0x4, 0x24, 0x60, 0x13, 0x5, 0x36, 0x36, 0xc, 0x2, 0x5, 0x1b]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x3a, 0x2, [{0x5}, {0x4, 0x5}, {0x6, 0x1}, {0x1, 0x5}, {0x0, 0x5}, {0x0, 0x5}, {0x1}, {0x1, 0x7}, {0x2, 0x3}, {0x1, 0x2}, {0x7, 0x3}, {0x7, 0x8}, {0x4, 0xa}, {0x3, 0x1}, {0x6, 0x7}, {0x1, 0x8}, {0x1, 0xa}, {0x5, 0x7}, {0x4, 0x6}, {0x0, 0x3}, {0x7, 0x6}, {0x5, 0x5}, {0x1, 0x6}, {0x6, 0x6}, {0x2, 0xa}, {0x1, 0x6}, {0x4, 0x1}, {0x4, 0x6}, {0x0, 0x9}, {0x5}, {0x4, 0x7}, {0x6, 0x4}, {0x0, 0x4}, {0x7, 0x1}, {0x3, 0x2}, {0x7, 0x5}, {0x1, 0x6}, {0x1, 0x8}, {0x6, 0x2}, {0x0, 0xa}, {0x1, 0x9}, {0x5, 0x4}, {0x0, 0x6}, {0x5, 0x2}, {0x4, 0x1}, {0x5, 0x2}, {0x4, 0x4}, {0x1, 0xa}, {0x5}, {0x5, 0x3}, {0x7, 0x4}, {0x5, 0x2}, {0x6, 0x4}, {0x1, 0x2}]}]}, @NL80211_BAND_6GHZ={0x64, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x18, 0x2, [{0x4, 0x4}, {0x4, 0x7}, {0x2, 0x6}, {0x3, 0x2}, {0x4, 0xa}, {0x0, 0x9}, {0x0, 0x9}, {0x0, 0x5}, {0x1, 0x6}, {0x1, 0x2}, {0x7, 0x4}, {0x1, 0x4}, {0x1, 0x3}, {0x0, 0x5}, {0x3}, {0x0, 0x3}, {0x1, 0x7}, {0x6}, {0x4, 0x9}, {0x3, 0x7}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x2e, 0x2, [{0x4, 0x8}, {0x0, 0x3}, {0x6, 0x2}, {0x3, 0xa}, {0x7, 0x6}, {0x1, 0x8}, {0x0, 0x3}, {0x6, 0x4}, {0x5, 0x1}, {0x2, 0x3}, {0x1}, {0x1, 0x1}, {0x3, 0x2}, {0x0, 0x8}, {0x6, 0x3}, {0x0, 0x1}, {0x4, 0x8}, {0x0, 0xa}, {0x0, 0x6}, {0x1, 0x7}, {0x7, 0xa}, {0x4, 0x4}, {0x3, 0x7}, {0x4, 0x2}, {0x0, 0x8}, {0x4, 0x4}, {0x0, 0x5}, {0x6, 0x2}, {0x0, 0x1}, {0x5, 0x4}, {0x4, 0x9}, {0x1, 0x9}, {0x5, 0x8}, {0x7, 0x8}, {0x1, 0x1}, {0x0, 0x1a}, {0x6, 0x4}, {0x2, 0x1}, {0x2, 0x5}, {0x6, 0x9}, {0x2, 0x6}, {0x2, 0x8}]}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x9, 0x18]}]}, @NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0xc, 0xb, 0x9, 0x6c, 0x24, 0x60, 0x9, 0xc, 0x1, 0x18, 0x4, 0x36, 0x9, 0x16, 0x6c, 0x5, 0x5, 0x21, 0x2, 0x18, 0x24, 0x48, 0x0, 0x0, 0x3, 0x1b, 0x5, 0x6c, 0x16]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x60, 0x1, 0xb, 0x2, 0x3]}]}, @NL80211_BAND_60GHZ={0x98, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x3, 0x7, 0x3, 0x5, 0x7, 0x7, 0x8]}}, @NL80211_TXRATE_HT={0xc, 0x2, [{0x1, 0x2}, {0x5, 0xa}, {0x0, 0x2}, {0x0, 0x2}, {0x0, 0x4}, {0x4, 0x6}, {0x5, 0xa}, {0x1, 0x2}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x9, 0x401, 0x0, 0x6d, 0xab15, 0x232, 0x8]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x2c, 0x2, [{0x0, 0x5}, {0x4, 0x7}, {0x7, 0x1}, {0x4, 0x7}, {0x7, 0x7}, {0x2, 0xa}, {0x0, 0x7}, {}, {0x5, 0x2}, {0x6, 0x5}, {0x6, 0xa}, {0x2, 0x3}, {0x5, 0x5}, {0x0, 0x6}, {0x7, 0x9}, {0x3, 0x7}, {0x0, 0x3}, {0x3, 0x7}, {0x2}, {0x6, 0x5}, {0x0, 0x9}, {0x3, 0x1}, {0x1, 0x6}, {0x5}, {0x0, 0x5}, {0x3, 0xa}, {0x5, 0x7}, {0x7, 0x7}, {0x4, 0x5}, {}, {0x1, 0x1}, {0x5, 0x3}, {0x6}, {0x2, 0xa}, {0x7, 0x9}, {0x6, 0xa}, {0x3, 0x9}, {0x0, 0x5}, {0x1, 0x6}, {0x3, 0x7}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x6163, 0x8, 0x4, 0x6, 0x1, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5}]}]}]}, 0x518}}, 0x0) 1.551370761s ago: executing program 0 (id=2564): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101801, 0x0) (async) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x3, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, r3, 0x1, 0x0, 0xffffffff}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) socket(0x11, 0xa, 0x9) r4 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0xa, 0x3, 0x3a) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r6 = socket(0x6f6413ae64e4ff3b, 0x80002, 0xfffffffd) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r6, @ANYRES32=r6], 0x44}}, 0x2000800) r7 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r7, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) (async) listen(r7, 0x0) (async) r8 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r8, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r9 = accept4(r7, 0x0, 0x0, 0x0) sendto(r9, &(0x7f0000000180)='+', 0x1, 0x0, 0x0, 0x0) (async) recvmmsg(r8, &(0x7f0000005cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004400)=""/211, 0xd3}}, {{0x0, 0x0, &(0x7f0000004600), 0x2}}, {{0x0, 0x0, &(0x7f0000005c40)=[{0x0, 0x7}], 0x1}}], 0x3, 0x0, &(0x7f0000005ec0)={0x0, 0x3938700}) (async, rerun: 32) writev(r8, &(0x7f0000000440)=[{&(0x7f0000000240)='I', 0x1}], 0x1) (rerun: 32) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0xa75, @mcast1, 0x2}, 0x1c) 1.482775289s ago: executing program 2 (id=2565): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x5, &(0x7f0000000000)=0x3ff, 0x4) getsockopt$inet6_tcp_int(r1, 0x6, 0x5, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 1.42014366s ago: executing program 2 (id=2566): syz_emit_ethernet(0x6c, &(0x7f0000000140)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x2f, 0x0, @private=0xa010100, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x22eb, 0x0, 0x0, [0x9, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x800, [0x3d5]}, {}, {0x8, 0x88be, 0x0, {{}, 0x1, {0x7}}}}}}}}, 0x0) 1.405271862s ago: executing program 4 (id=2567): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x4e23, 0x27bf, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xa}}, 0x3}, 0x1c) shutdown(0xffffffffffffffff, 0x0) 1.242643588s ago: executing program 3 (id=2568): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'dvmrp1\x00'}) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe0, 0xe0, 0x5, [@fwd={0x6}, @ptr={0x7, 0x0, 0x0, 0x2, 0x4}, @var={0x7, 0x0, 0x0, 0xe, 0x1, 0x2}, @struct={0x9, 0x8, 0x0, 0x4, 0x0, 0x20000, [{0x5, 0x5, 0x144}, {0xb, 0x1, 0xe}, {0xc, 0x2, 0xd9}, {0x7, 0x0, 0x43e6b471}, {0x1, 0x3, 0x80000000}, {0x5, 0x1, 0x5}, {0xe, 0x0, 0x572b}, {0x0, 0x2, 0x1}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x4, 0x8}}, @typedef={0x5}, @type_tag={0xb, 0x0, 0x0, 0x12, 0x3}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x5}, {0x5, 0x4}]}]}, {0x0, [0x30, 0x30, 0x5f]}}, &(0x7f0000000300)=""/86, 0xfd, 0x56, 0x1, 0x800}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100bd0300000800034000000001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) r6 = socket$inet(0xa, 0x801, 0x84) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01060000000000000000090000003c0004801300010062726f6164636173742d6c696e6b000024000780080005000000000008000300ff"], 0x50}}, 0x0) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000400)) ioctl$sock_netdev_private(r10, 0x8914, &(0x7f0000000000)) r11 = syz_init_net_socket$rose(0xb, 0x5, 0x0) syz_emit_ethernet(0x12, &(0x7f0000000000)=ANY=[@ANYBLOB="910418166421b54fa0aaaa050004424203"], 0x0) ioctl$sock_rose_SIOCADDRT(r11, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @bcast, @null]}) 1.224613539s ago: executing program 0 (id=2569): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x14, 0x1, 0x7, 0x201, 0x0, 0x0, {0x7, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) sendmsg$inet6(r1, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e20, 0x80000, @dev={0xfe, 0x80, '\x00', 0x20}, 0xfffffffe}, 0x1c, 0x0}, 0x40c0) r3 = getpid() sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000046000701fcffffff02000000017c000008000100", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x21dfdbfe, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xe, 0x4}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x1ff, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x4000010) 1.162147725s ago: executing program 2 (id=2570): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newlink={0x48, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x7300}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_IP_TARGET={0x4}, @IFLA_BOND_ARP_INTERVAL={0x8}]}}}, @IFLA_LINK_NETNSID={0x8, 0x25, 0x3}]}, 0x48}}, 0x0) r1 = socket(0x1e, 0x4, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@map=0x1, 0xffffffffffffffff, 0x22, 0x2004}, 0x20) (async) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) (async) bind$tipc(r1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000040)="ebd7e2f2132acb489a1b9cd6aab7b715bda2cb63baf8da1f1e3e4090e47fd6cd57d617264f2333a4ab2f60220c665fb224287f3baa892f8f46ca3c285a975fcfc31f14eb360abbaca1b34f73afa3304e6af822bf6114485db88c92652a473283dea3a4f4182ddc89e210d03caab549c24571d21fcde0f9b1818657d7805f363356dd4faa365c96480c318517c14567c98409c293a9d59e97b76147fd51408f8179746f6d54e5199320966decd86e4d992aa301fff454d0704a15b7e9a9300ae9f70ac3a5bf44d9d1d6dc778000e85363cdfbc5b39f5fba74ef5453f8aaa95aea596181befeb58d4faaf7", 0xea, 0x4000c010, &(0x7f00000001c0)={0x11, 0xec, r2, 0x1, 0x7, 0x6, @broadcast}, 0x14) 1.161880545s ago: executing program 4 (id=2571): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000008c0)=ANY=[@ANYRES8=r0], 0x14}, 0x1, 0x0, 0x0, 0x4044084}, 0x0) 914.291644ms ago: executing program 0 (id=2572): syz_emit_ethernet(0xad, &(0x7f0000000900)={@local, @broadcast, @void, {@generic={0x8863, "821b744f8f3d944136f6a01af15292223eadb065a8dd884d977081ae66c26ab5bb17de88b8f02b85b02ef3528a008b4e2ac7f26fd062240b823daf3d1299cee02a9e1e79e1243215ffee2edeb9366f837fe40519d3fe86e5b38d61aff1586ef5f5a58db21818e91055409b14695715634aa6b023421c2411cb463dbd47d222f31be25cde4632c110b5997f99d78453da8d104c808415d29bfb96b49c00ad91"}}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101401, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r4, {0x0, 0xc}, {0xb, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x405c071}, 0x400c840) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {0x0, 0xc}, {0x8}}}, 0x24}}, 0x40004) 891.662284ms ago: executing program 1 (id=2573): r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) poll(&(0x7f0000001140), 0x0, 0xb) 890.710367ms ago: executing program 2 (id=2574): r0 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=@newqdisc={0x38, 0x24, 0xd0f, 0xfffffffd, 0x25dfdbfe, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_TUPDATE={0x8, 0x8, 0xffffffff}]}}]}, 0x38}}, 0x0) (async, rerun: 64) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, 0x0, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x2}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008001}, 0x40842) (rerun: 64) 871.085213ms ago: executing program 4 (id=2575): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f0000001780)={{0x0, 0x6}}, 0x10) sendmmsg(r0, &(0x7f0000000c80)=[{{&(0x7f0000000000)=@l2tp={0x2, 0x0, @remote}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=']', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="100e0000000000008400000001000000"], 0x10}}], 0x2, 0x0) 589.900796ms ago: executing program 4 (id=2576): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'lo\x00', 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0x138, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x338, 0xffffffff, 0xffffffff, 0x338, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0xffffff00, 0xff000000], [0xffffffff], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x88}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x0, 0x0, 0x3096, 0x7fff, 0x56e5, {0x2}}}, @common=@inet=@udplite={{0x30}, {[0x4e23, 0x4e23], [0x4e24, 0x4e21], 0x1}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @dev}, [], [0xff, 0x0, 0x0, 0xff000000], 'erspan0\x00', 'gre0\x00', {}, {}, 0x0, 0x0, 0x3}, 0x0, 0x1d0, 0x288, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x80000001, 0x3, 0x20, 0x0, 'syz1\x00', 0x4}}, @common=@ah={{0x30}, {[0x4d4, 0x4d4], 0x84, 0x25, 0x3}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0xffffffff}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000003580)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x503}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x1}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}]}}}]}, 0x44}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r1, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h'], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r3, 0x9, 0x2, 0x7ff}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x8, 0x9, 0x0, 0x0, @uid}]}, @nested={0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'syztnl0\x00', r1, 0x4, 0x7, 0xe0, 0x81, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, @loopback, 0x80, 0x80, 0x3ff, 0x5}}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000340)=0x14) sendmsg$nl_route(r6, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=@ipv6_getnetconf={0x34, 0x52, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@NETCONFA_FORWARDING={0x8, 0x2, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r8}, @NETCONFA_RP_FILTER={0x8, 0x3, 0xf}, @NETCONFA_IFINDEX={0x8, 0x1, r9}]}, 0x34}}, 0x10) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 589.599831ms ago: executing program 1 (id=2577): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$netlink(0x10, 0x3, 0x4) (async) r1 = socket$netlink(0x10, 0x3, 0x4) pselect6(0x40, &(0x7f0000000080)={0x80000001, 0xfff, 0x9, 0x562, 0xc00, 0x8, 0x2, 0x2}, &(0x7f00000000c0)={0x0, 0x4, 0x4, 0x7fffffffffffffff, 0x9, 0x8, 0x8, 0x8}, &(0x7f0000000100)={0x401, 0x4, 0x5, 0x1, 0xfffffffffffffffb, 0x2ee15423, 0x5, 0x1}, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f00000001c0)={&(0x7f0000000180), 0x8}) write(r1, &(0x7f0000001600)="2700000014000707030e0000120f0a000000008a151f7508003900000000000000000000000200", 0x27) getsockopt$inet6_int(r0, 0x29, 0x4e, 0x0, &(0x7f0000000000)) (async) getsockopt$inet6_int(r0, 0x29, 0x4e, 0x0, &(0x7f0000000000)) r2 = socket(0x10, 0x3, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="0218000014000000000000000000000005000500000000000a00ffff00000000fe8000000000000000000000000000aa0000000000000000080012000000000003000000000000002600000000000000000000000000000002000002000000000000000000000000fc010000000000000000000000000000050006006c0000000a"], 0xa0}}, 0x0) clock_gettime(0x23eaa8d54bacd65c, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [0x0, 0x0, 0x0, 0xfc], 0x0, [0x8, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc, 0x0, 0x8000], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [0x0, 0x0, 0x0, 0xfc], 0x0, [0x8, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc, 0x0, 0x8000], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 589.148668ms ago: executing program 3 (id=2578): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000600)=ANY=[@ANYBLOB="0a00000016000000080000007f00000000000020a657280b3a2e00", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x40, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r3, 0x0, 0xc, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) (async) r4 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r4, 0x8982, &(0x7f00000005c0)) (async) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r4, 0x8982, &(0x7f00000005c0)) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000a00)={r4, &(0x7f0000000000)='ip6tnl0\x00', 0x4002, &(0x7f0000000940)={@align=0x9, {0x6e9, 0x7, 0x5, 0x670d}}, 0x2, &(0x7f0000000980)={@_ha_fsid}, &(0x7f00000009c0)=0x1}) bind$alg(r5, &(0x7f0000000a40)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000190001002cbd700000c8c3532d"], 0x24}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000200)={'ip6tnl0\x00', @multicast}) (async) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000200)={'ip6tnl0\x00', @multicast}) socket$inet_mptcp(0x2, 0x1, 0x106) (async) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r7, 0x0, 0x1a, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6c, 0x6c, 0x3, [@int={0xb, 0x0, 0x0, 0x1, 0x0, 0x7, 0x0, 0x54}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{0x10, 0x1}, {0x5}, {0xa, 0x1}, {0xe, 0x4}, {0xc, 0x5}, {0xf, 0x2}, {0x7, 0x5}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x1}}]}, {0x0, [0x2e]}}, &(0x7f0000000840)=""/39, 0x87, 0x27, 0x1, 0x0, 0x10000, @value=r1}, 0x28) (async) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6c, 0x6c, 0x3, [@int={0xb, 0x0, 0x0, 0x1, 0x0, 0x7, 0x0, 0x54}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{0x10, 0x1}, {0x5}, {0xa, 0x1}, {0xe, 0x4}, {0xc, 0x5}, {0xf, 0x2}, {0x7, 0x5}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x1, 0x1}}]}, {0x0, [0x2e]}}, &(0x7f0000000840)=""/39, 0x87, 0x27, 0x1, 0x0, 0x10000, @value=r1}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000000680)=@framed={{0x18, 0x8, 0x0, 0x0, 0x80000000}}, &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, r8}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x3, &(0x7f0000000680)=@framed={{0x18, 0x8, 0x0, 0x0, 0x80000000}}, &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, r8}, 0x94) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000060a0b0400000000000000000200000014000480100001800b0001007470726f787900010000000073797a31000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x68}}, 0x0) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000700)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="400000000206010200000000000000000a000004051805000700000024000780050007002100000008000a400000000308000b40ff1300f8080006400000000e"], 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x40094) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000340)={r1, &(0x7f0000000240)='/dev/net/tun\x00', 0x20000, &(0x7f0000000280)={@align=0x6, {0x1606, 0xffff, 0xfff, 0x10}}, 0x6, &(0x7f00000002c0), &(0x7f0000000300)}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000380)={0x0, @empty, @multicast1}, &(0x7f00000003c0)=0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r10, 0x89f8, &(0x7f0000000580)={'sit0\x00', &(0x7f0000000400)={'tunl0\x00', r11, 0x7, 0x40, 0x20005, 0x0, {{0x49, 0x4, 0x3, 0x38, 0x124, 0x66, 0x0, 0x4, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x26}, @loopback, {[@cipso={0x86, 0x66, 0x3, [{0x2, 0x3, "f8"}, {0x1, 0xf, "530f986f9e23d785cc7399b983"}, {0x6, 0xe, "a6fc936c22219a959fc4547e"}, {0x6, 0x10, "cb2dbbc2c1df2530c5af711ec3ad"}, {0x1, 0x4, "2f9a"}, {0x1, 0x8, "f6397de1e8bf"}, {0x7, 0x11, "67efe281afe1c22b9e91d58afd7661"}, {0x0, 0x11, "e0866bad99c3454770599d6193b547"}, {0x0, 0x2}]}, @timestamp_prespec={0x44, 0x54, 0xe5, 0x3, 0x8, [{@multicast1, 0x2}, {@multicast2, 0x76}, {@empty, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffffffc}, {@local, 0x10000}, {@local, 0x2}, {@multicast1, 0xfffffffc}, {@local, 0xffff}, {@private=0xa010100, 0x8}, {@empty, 0x7}]}, @generic={0xc3, 0xa, "003154699dfbe096"}, @lsrr={0x83, 0x1f, 0x4, [@remote, @multicast2, @multicast1, @local, @empty, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x28, 0x87, 0x0, 0x3, [0xc, 0x9, 0x5, 0x3, 0x262, 0x73f, 0x8, 0xff000002, 0x3]}]}}}}}) 503.344284ms ago: executing program 0 (id=2579): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@gettaction={0x4c, 0x32, 0x20, 0x70bd2d, 0x25dfdbda, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x3d, 0x0, 0x0, @TCA_ACT_KIND={0x0, 0x1, 'pedit\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xfffffffffffffecf, 0x1, 'ife\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0x0, 0x2, {0x1}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40806}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0x1, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4800000010000d0413f37000fcdbff2500648000", @ANYRESDEC=r0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0xc800) setsockopt$CAIFSO_LINK_SELECT(0xffffffffffffffff, 0x116, 0x7f, &(0x7f0000000c80)=0xe3, 0x4) connect$caif(0xffffffffffffffff, &(0x7f0000000cc0), 0x18) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f00000006c0)=0x13, 0x4) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000040)=0x13, 0x4) 429.298231ms ago: executing program 2 (id=2580): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b000000000000000000000000800000000000001af2ce23e06fe950c13e450a16871924563ea533", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000002c0)=@o_path={&(0x7f0000000640)='./file0\x00', r0}, 0x18) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000002c0), r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071121c000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="03000000a6c1f321babb08003101d5fa268713b750b8b1d5e1330d0b620b0a493c808c7737e34dc5f64267299866901adb7625da12003e58cd1b44c21d7d6a12b0ab9a25e068d4e7", @ANYRES16=r2, @ANYBLOB="05000000000000000000067400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000"], 0x40}, 0x1, 0xffffffff00000003, 0x0, 0x20000800}, 0x0) 351.932636ms ago: executing program 4 (id=2581): unshare(0x6020400) gettid() (async) r0 = gettid() syz_init_net_socket$llc(0x1a, 0x801, 0x0) (async) r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) connect$llc(r1, &(0x7f0000000240)={0x1a, 0x302, 0x0, 0x6, 0x0, 0x0, @broadcast}, 0x10) accept4$llc(r1, 0x0, 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/uts\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f00000002c0)=@ethtool_sfeatures={0x33, 0x1, [{0x2e2e, 0x80000000}]}}) unshare(0x2c060000) close(0x3) (async) close(0x3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32=0x0, @ANYBLOB="00060000000000800c003c00"/31], 0x40}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYRESHEX, @ANYRES32=0x0, @ANYBLOB="00060000000000800c003c00"/31], 0x40}}, 0x0) 297.200834ms ago: executing program 3 (id=2582): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x80, 0x2, 0x6, 0x801, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PROTO={0x5, 0x7, 0x2}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x2e}]}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xfffffffd}]}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x2}, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) (async) unshare(0x20010800) (async) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000180)="9c6f5224d1ebe3a504725cf4d67095a6ae09a674e81124261607b72865329ba5592e7a0656846a8bd0b528d4dadd385fcdc37e10ca24abe093f8eb9884b4bdd0fc646e53e89be2f9ff84457d495b61270d372e1dc7ff912ba95b16efea9a68d791f257391e7c26762b916825a02309511dab5c81c1b7462527a85a12fafeb0c3d64934f3ca298b3424716bc83d13f8cfe3f7d859b75025b3be1ddb79f520ff486c6c78888025c9562bf748955861f1dadf45424d7699ecb9b7d808f52ae5afd2b1ee265ea3b8b474ad703b8acf9e377c67a6ef8dd1ed1107c807eeb83b65a7e4a3806f62e2f4e296728628a717a74a6b", 0xf0}, {&(0x7f0000000280)="c655476fc0e7b2ae790263726f1db573cdd4c07afab3370b74aaf528db2488b0a4cc6cc683b1a049ef6d5f85c94f86fdbb27ca3492ec01", 0x37}, {&(0x7f00000002c0)="41be53ad827e973594f5d2ee44b211dd0af58653174fcd5e8f7be744f0", 0x1d}, {&(0x7f0000000300)="7ea86c3ae03d63316b7f288ab9dc02626652c66c8737e0248b6c7a6da14bd49e67d2f51a662ee50e795bf29c623e43a976297406f2e32114c68ce33ce5484d", 0x3f}, {&(0x7f0000000340)="276016", 0x3}], 0x5) (async) r1 = socket$netlink(0x10, 0x3, 0xa) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x78, 0x1, 0x2, 0x201, 0x0, 0x0, {0x7, 0x0, 0x7}, [@CTA_EXPECT_HELP_NAME={0xa, 0x6, 'H.245\x00'}, @CTA_EXPECT_MASTER={0x50, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x40c4}, 0x24000015) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000540)={0x0, @in6={{0xa, 0x4e21, 0x200, @empty, 0x7}}, 0xff, 0x50d, 0x1e6a, 0xa7e, 0xad, 0x0, 0x5}, &(0x7f0000000600)=0x9c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000640)={r2, @in6={{0xa, 0x4e24, 0x3, @remote, 0xfffffff8}}, [0x6, 0x1000, 0x6, 0x0, 0x6, 0x8, 0x0, 0x90, 0x100, 0x4, 0xa, 0xc, 0x7, 0x12]}, &(0x7f0000000740)=0x100) r3 = accept(r0, &(0x7f0000000780)=@l2tp={0x2, 0x0, @private}, &(0x7f0000000800)=0x80) getsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f0000000840), &(0x7f0000000880)=0x4) (async) accept4$nfc_llcp(r0, &(0x7f00000008c0), &(0x7f0000000940)=0x60, 0x80000) (async) recvmsg(r1, &(0x7f0000000b40)={&(0x7f0000000980), 0x80, &(0x7f0000000ac0)=[{&(0x7f0000000a00)=""/183, 0xb7}], 0x1, &(0x7f0000000b00)=""/2, 0x2}, 0x100) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000bc0), r3) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000c80)={'ip6gre0\x00', &(0x7f0000000c00)={'ip6gre0\x00', 0x0, 0x29, 0x80, 0x4, 0x5, 0x1, @dev={0xfe, 0x80, '\x00', 0x32}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8, 0x80, 0xe000, 0x3}}) getsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000cc0)={@empty, @initdev, 0x0}, &(0x7f0000000d00)=0xc) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000d40)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r4, &(0x7f0000000e40)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d80)={0x78, r5, 0x200, 0x70bd25, 0x25dfdbff, {}, [@HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4}, 0x4084) (async) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000ec0), r3) sendmsg$TIPC_NL_BEARER_ADD(r4, &(0x7f00000010c0)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001080)={&(0x7f0000000f00)={0x178, r9, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x10}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}]}, @TIPC_NLA_NODE={0xa0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x9c, 0x3, "909e9a8a3d5bd23249de1389763ceba78d25c7c3ba9c9bd5c65ed8202f304d3d5f0068e98546263eaf56e6926431071f702be6cfc24da0b46ff3ebb4ea098b4a6c9caa3ef9e87b2909e7631d380fdf2f9f2a256cfee7bec9548e82b68d245e9e8c0838e6cc7bf8275dbfd5f29870520947e702f1d620bcb2d38423eb491e9305cdcdc478784a1f2269787f2529c3bb7f985e2f7ab1a39857"}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xa}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000000}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x48e}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8000}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000081) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001140), r1) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000001240)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001200)={&(0x7f0000001180)={0x6c, r10, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffffc}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffff000}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xa75}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xffffffff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x4}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xffffffff}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0xc044055}, 0x4840) (async) ioctl$XFS_IOC_START_COMMIT(r4, 0x80585882, &(0x7f0000001280)) (async) write$cgroup_subtree(r0, &(0x7f0000001300)={[{0x2d, 'cpu'}, {0x2b, 'io'}, {0x2b, 'net'}, {0x2b, 'io'}]}, 0x12) (async) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000001340)={'mangle\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) (async) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001400), r0) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000014c0)={'syztnl0\x00', &(0x7f0000001440)={'ip6_vti0\x00', r7, 0x29, 0xe, 0x93, 0x1, 0x84, @mcast2, @remote, 0x20, 0x7, 0x81, 0x2}}) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f0000001680)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0xa4ab8d073063fd0f}, 0xc, &(0x7f0000001640)={&(0x7f0000001500)={0x120, r11, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x91}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x11}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x40, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @local}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xe}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x2000}, 0x80) (async) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r0, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001780)={&(0x7f0000001700)={0x50, r11, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7f}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x35}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000044}, 0x4000880) (async) sendmsg$DEVLINK_CMD_SB_POOL_GET(r1, &(0x7f00000019c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001980)={&(0x7f0000001880)={0xd0, 0x0, 0x400, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xe09c}, {0x6, 0x11, 0xfffd}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x47}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x80000001}, {0x6, 0x11, 0xff}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0xff80}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) 234.065327ms ago: executing program 2 (id=2583): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000010c0)=@newtaction={0xd8, 0x30, 0xffff, 0x0, 0x0, {}, [{0xc4, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {}, {0xd6}}}]]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x54, 0x2, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18}, @TCA_GACT_PROB={0xc, 0x3, {0x1, 0xec6}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xd8}}, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.time_recursive\x00', 0x0, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f00000000c0)) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {}, {}, {0xffe0, 0x5}}, [@filter_kind_options=@f_u32={{0x8}, {0xfffffed3, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0xffffffff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x20048850) pread64(r0, &(0x7f0000000140)=""/135, 0x87, 0x4) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(rfc7539esp(ecb-twofish-3way,sha3-224-generic))\x00'}, 0x58) 77.627567ms ago: executing program 0 (id=2584): setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000000)=0xfffffffc, 0x4) (async) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$OCFS2_IOC_GROUP_ADD64(r0, 0x40186f03, &(0x7f0000000040)={0x2, 0x5, 0x7, 0xfffc}) (async, rerun: 64) r1 = socket$netlink(0x10, 0x3, 0x5) (async, rerun: 64) r2 = socket$inet_sctp(0x2, 0x1, 0x84) (async) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0xebcb, 0x2}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000100)={0x8, 0x1, 0x1, 0x54, r3}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f0000000180)={r4, 0x2e5}, 0x8) (async) ioctl$XFS_IOC_SCRUB_METADATA(r0, 0xc040583c, &(0x7f00000001c0)={0x1b, 0xcd, 0x2, 0x1, 0x75}) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r1) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'gre0\x00', &(0x7f0000000280)={'gre0\x00', 0x0, 0xff09, 0x8, 0x37, 0x8e11, {{0x29, 0x4, 0x1, 0x4, 0xa4, 0x64, 0x0, 0xf, 0x2f, 0x0, @loopback, @local, {[@noop, @rr={0x7, 0x23, 0xa0, [@remote, @loopback, @private=0xa010102, @multicast2, @rand_addr=0x64010100, @multicast1, @multicast1, @broadcast]}, @timestamp={0x44, 0x24, 0x70, 0x0, 0x3, [0x4, 0x80000001, 0x54d4, 0x56b4, 0xfffff422, 0xc76, 0xb2a, 0x6]}, @rr={0x7, 0x13, 0xa4, [@empty, @multicast2, @multicast1, @loopback]}, @timestamp_addr={0x44, 0x34, 0x21, 0x1, 0x4, [{@dev={0xac, 0x14, 0x14, 0x1f}, 0x8cba}, {@dev={0xac, 0x14, 0x14, 0x44}, 0x8}, {@local, 0xa2}, {@multicast1, 0x8}, {@dev={0xac, 0x14, 0x14, 0x3a}, 0x4f05}, {@local}]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000440)={'syztnl0\x00', &(0x7f00000003c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x1, 0x1, 0xc, 0x4aeca3e5863e9761, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x27}}, @empty, 0x40, 0x7, 0x3, 0x3}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000500)={'ip6tnl0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x29, 0x1, 0x52, 0x2ff9, 0x4, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7, 0x7, 0x4, 0x8}}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000540)={'vcan0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000005c0)={'erspan0\x00', &(0x7f0000000580)={'erspan0\x00', 0x0, 0x40, 0x1, 0x3, 0x101, {{0x8, 0x4, 0x1, 0x38, 0x20, 0x68, 0x0, 0x1, 0x2f, 0x0, @rand_addr=0x64010100, @broadcast, {[@ssrr={0x89, 0xb, 0x6b, [@dev={0xac, 0x14, 0x14, 0x34}, @dev={0xac, 0x14, 0x14, 0x22}]}]}}}}}) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000680)={'syztnl1\x00', &(0x7f0000000600)={'ip6tnl0\x00', 0x0, 0x29, 0x0, 0x8, 0x3ff, 0x2c, @loopback, @private0, 0x7800, 0x80, 0x3, 0xe}}) (async, rerun: 32) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000780)={'syztnl0\x00', &(0x7f00000006c0)={'erspan0\x00', 0x0, 0x80, 0x10, 0x100, 0x8c, {{0x1e, 0x4, 0x1, 0x1d, 0x78, 0x66, 0x0, 0x9, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x43}, @rand_addr=0x64010100, {[@lsrr={0x83, 0xf, 0xc5, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @empty]}, @rr={0x7, 0x17, 0xd8, [@local, @remote, @multicast1, @multicast2, @empty]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x21, 0x2, [{0x7, 0x8, "8e93cf588228"}, {0x5, 0xa, "37658a65eba42d19"}, {0x6, 0x6, "f1d41681"}, {0x7, 0x3, 'F'}]}, @lsrr={0x83, 0x17, 0x18, [@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @broadcast, @dev={0xac, 0x14, 0x14, 0x25}]}]}}}}}) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000840)={'syztnl1\x00', &(0x7f00000007c0)={'syztnl0\x00', 0x0, 0x2f, 0x6, 0x7, 0x8, 0x6f, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7, 0x8000, 0xa47, 0x2}}) (rerun: 64) sendmsg$ETHTOOL_MSG_RINGS_GET(r1, &(0x7f00000009c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10020200}, 0xc, &(0x7f0000000980)={&(0x7f0000000880)={0xe4, r5, 0x800, 0x70bd29, 0x25dfdbfb, {}, [@HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}]}, @HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4040}, 0x49) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000a00)) ioctl$XFS_IOC_INUMBERS(r2, 0x80405880, &(0x7f0000000a40)={{0xd, 0x1, 0x1, 0x9, 0x2}, [{0xffff, 0x40, 0x3, 0xa}, {0x2, 0x8, 0x7, 0x8}, {0x8000000000000001, 0x2, 0x8, 0x5}]}) (async, rerun: 32) ioctl$BTRFS_IOC_SYNC(r2, 0x9408, 0x0) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000b80)={'syztnl0\x00', &(0x7f0000000b00)={'syztnl2\x00', r11, 0x2f, 0x4, 0x2, 0x8, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x10, 0x8000, 0x3, 0xfff}}) r14 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000c40)={'tunl0\x00', &(0x7f0000000bc0)={'ip_vti0\x00', r11, 0x40, 0x8000, 0x5, 0x1ff, {{0xe, 0x4, 0x1, 0x2e, 0x38, 0x64, 0x0, 0xee, 0x0, 0x0, @remote, @multicast2, {[@end, @lsrr={0x83, 0x23, 0xa6, [@multicast1, @dev={0xac, 0x14, 0x14, 0x3a}, @empty, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x39}, @multicast2, @dev={0xac, 0x14, 0x14, 0x3a}, @private=0xa010100]}]}}}}}) sendmsg$kcm(r14, &(0x7f0000001180)={&(0x7f0000000c80)=@ll={0x11, 0xf7, r15, 0x1, 0x4}, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000d00)="1c5739be79211d773a4aab55d09d7ec79a7bc1bfb343476e161f9defc2addff3a134e6683508921c60809069c2b54c98185c7d441452001b5190802cdcb3caae844a2082fb24767d5ef2b6156c002044b1dfca9cd3409aa9e728af1981979bf1e9c4e1b70727ae538067afb6b1be2c074e30e2347d9bef7f94eba085d2418c1511441a585b3ed43bcf02dae615e59d0a98e5c1c2b680752d2532e47ff5faae5b404a66", 0xa3}], 0x1, &(0x7f0000000e00)=[{0x100, 0x1, 0x6, "ea7296b84e364e2c8a111db2ac0f4f08459cde97b36b2a9a1c13adf1c2f21837d8c760286464afdadfab4c11d617dea86ceb5ee491ecffd8d3b693d0331d0940867226a1d92df1ff8c9273bc2e3b6c30c4755661e72bc5907c93c0070d49cfb6eb1efb37f91571307c34a70749c2c0a4f3f4e6d2ce9bfc658ea3f097bd59c9d5c6722fbb4c3a13dc610e6d9e626128c8fd6311cf51cf0167c4c62e01636c99baa181aa00b4da10e65a0620ff3d7723c1c19df7bf7d66c827777f673474cae7e396dfecb1e39922423ebc11e5d7476fb7eda653601f18b257099963474e3a18fe16a321afc38ea11a7a"}, {0x40, 0xff, 0x0, "4a619137ae5cb837625116f29d0a50cfd0d8c469b958769d6133434b82a5175a178438fd40a938c2cb9707db67"}, {0xf0, 0x113, 0x7, "818244daba63d00071bf86b587b5050bd5d0963b304fdd3cb93ea91265ae71a7ad1f120dc95246b805898980e3c1edf61e814693fead1284dba1d3c08579cb3ddca277c4eeed892a78c630e9239f2efa11d6ffa10d66152ae265bf8b78f443f17e07e2297f3e7cc15d5938f64ab86a590ac3da23196192754ee4fa8267324fabd77710b511da3f2422d1524a30055cf19dbc3fbd3d835daa03c4d5de47146e2ae154bd89177c4721b975b583c2ce25d49b24df87136aea68b31f3304e789c53ffb19e89d4936261dd33a0cff0c30e692e8c542be8b2d69008afb3a1f"}, {0xe8, 0x108, 0x1000, "f88617e920072c4f20604a9ab3874bd8b274b8922b4abe950d231cecacd8efb61c5da237e27f820bc11f8cddbf7c268780e6edace76b34fa06842cd78597f70bf664ae5544151aeb509509fc7f600a95ee54b5139101739a056d898c2fdd44c6ef053befd4336b8d2ff5da508b4f15ee8f27a10f9570b00512ef7f6c8c6c4aa617e23d93420bc4760f8747699ba5e055ef4f59c488be75989577f39e996fc279a113757615273a5cf4a72efcd30d11393a9302cf7fd70da5b35d6133b124562c46002a638137ab2c84ab2a84fb4737945bcd52179230"}, {0x50, 0x0, 0x0, "37b587f8ca168b28ac95d38a1ef437daf7e32066062d30240a0b87035c82ede7665323b29e3f404682e1cf9eba4e9deb701bc956a632ed04978f1737"}], 0x368}, 0x4) (async) socket$alg(0x26, 0x5, 0x0) r16 = openat$tun(0xffffffffffffff9c, &(0x7f00000011c0), 0x101000, 0x0) ioctl$SIOCGSKNS(r16, 0x894c, &(0x7f0000001200)={'pimreg1\x00', 0x400}) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, &(0x7f0000001380)={0x0, @in6={{0xa, 0x4e22, 0x200, @private1={0xfc, 0x1, '\x00', 0x1}, 0x6}}}, 0x84) 34.168931ms ago: executing program 1 (id=2585): write$tun(0xffffffffffffffff, &(0x7f0000000000)={@val={0x0, 0xf6}, @void, @llc={@snap={0xab, 0xaa, "bdb4", "4b3bff", 0x200, "7660983a02d984b17a8251ec9321fd5d10b650dc6d3894b8a95cfea1a46ab991ccf64906d5a285c723a5f5b9"}}}, 0x39) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000040)={@initdev}, &(0x7f0000000080)=0x14) r1 = socket(0x1f, 0x3, 0x3901dbe7) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x400000, 0x0) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) ioctl$XFS_IOC_OPEN_BY_HANDLE(r0, 0xc038586b, &(0x7f0000000200)={r2, &(0x7f0000000100)='/dev/net/tun\x00', 0x86802, &(0x7f0000000140)={@align=0x5, {0x5, 0x0, 0xf, 0x1}}, 0x3e5, &(0x7f0000000180)={@_ha_fsid}, &(0x7f00000001c0)=0x3}) sendmsg$AUDIT_TTY_GET(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x10, 0x3f8, 0x10, 0x70bd2a, 0x25dfdbfe, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000050}, 0x4000004) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000480)=0xffffffffffffffff, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001640)={0xffffffffffffffff, 0x20, &(0x7f0000001600)={&(0x7f0000000540)=""/4096, 0x1000, 0x0, &(0x7f0000001540)=""/169, 0xa9}}, 0x10) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000016c0)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000340), &(0x7f0000000380)='syzkaller\x00', 0x101, 0x9a, &(0x7f00000003c0)=""/154, 0x41100, 0x10, '\x00', 0x0, 0x1b, r3, 0x8, &(0x7f00000004c0)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000500)={0x1, 0xd, 0x3, 0x2}, 0x10, r4, 0x0, 0x1, 0x0, &(0x7f0000001680)=[{0x5, 0x1, 0xd, 0x1}]}, 0x94) sendmsg$IPCTNL_MSG_CT_DELETE(r1, &(0x7f0000001900)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000018c0)={&(0x7f00000017c0)={0xd4, 0x2, 0x1, 0x201, 0x0, 0x0, {0x1, 0x0, 0x6}, [@CTA_SYNPROXY={0x34, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x7ff}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_ITS={0x8}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x9}]}, @CTA_SEQ_ADJ_ORIG={0x54, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7ff}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x8001}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xa06}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xf}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x4}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x6e}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x10000}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x60528}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0xf}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_SEQ_ADJ_ORIG={0xc, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xb51}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x100}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x9}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x1}]}, 0xd4}}, 0x4) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r6, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x18, 0x140c, 0x2, 0x70bd26, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x8800}, 0x4040004) sendmsg$IPCTNL_MSG_CT_GET_DYING(r1, &(0x7f0000001b00)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001ac0)={&(0x7f0000001a80)={0x14, 0x6, 0x1, 0x401, 0x0, 0x0, {0x2, 0x0, 0x9}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x805) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000001dc0)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001d80)={&(0x7f0000001b80)={0x1e0, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x98, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3afe}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x80000000}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x40}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x100}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xffff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x401}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffbff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x84}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x200}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xd0}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_NODE={0x70, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x13, 0x3, "d4a87ef93d62bc0d773a0234a309d8"}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "d9709ffc25af1e74e54d5b9d73ef3d828cf2049f55c0ce02ba8d"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x200}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x40}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffd}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}]}, 0x1e0}, 0x1, 0x0, 0x0, 0x40010}, 0x80) getsockname$packet(r1, &(0x7f0000001e40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001e80)=0x14) sendmsg$nl_route(r0, &(0x7f0000001f80)={&(0x7f0000001e00)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001f40)={&(0x7f0000001ec0)=@ipv6_getaddrlabel={0x68, 0x4a, 0x1, 0x70bd27, 0x25dfdbfe, {0xa, 0x0, 0x3f, 0x0, r7, 0x7091}, [@IFAL_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_LABEL={0x8, 0x2, 0x5}, @IFAL_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IFAL_LABEL={0x8, 0x2, 0xb}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000002}, 0x20008084) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000002180)={{r3, &(0x7f0000001fc0)='\x00', 0xc0480, &(0x7f0000002000)={@_ha_fsid={[0x2]}, {0x7, 0xe85, 0x3, 0x4}}, 0x0, &(0x7f0000002040)={@_ha_fsid}, &(0x7f0000002080)}, {[0xc1, 0x930, 0x10001, 0x590]}, 0x28, 0xa6, &(0x7f00000020c0)=""/166}) ioctl$TUNSETCARRIER(r8, 0x400454e2, &(0x7f0000002200)) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000002240)={'wlan0\x00'}) ioctl$XFS_IOC_FD_TO_HANDLE(r2, 0xc038586a, &(0x7f0000002380)={r5, &(0x7f0000002280)='\x00', 0x10000, &(0x7f00000022c0)={@_ha_fsid={[0x3, 0x8]}, {0x0, 0x6, 0xd7a1, 0x3}}, 0x383173df, &(0x7f0000002300), &(0x7f0000002340)=0x7}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000002800)={0x7, &(0x7f00000023c0)=[{}, {@none}, {@fixed}, {}, {}, {}, {}]}) sendmsg$nl_route(r1, &(0x7f0000002900)={&(0x7f0000002840)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000028c0)={&(0x7f0000002880)=@bridge_newneigh={0x38, 0x1c, 0x200, 0x70bd2a, 0x25dfdbfe, {0x2, 0x0, 0x0, r7, 0x80, 0x4, 0x3}, [@NDA_DST_IPV6={0x14, 0x1, @private1}, @NDA_SRC_VNI={0x8, 0xb, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x8084}, 0x20000000) write(r9, &(0x7f0000002940)="d6a5db1f40ba9c19b68c3dfeadbf2dfa1fda5bdc358f50ea94263383a95522e4f83c515e8f608e05423daa464684a2b906bb53f5e50bf84ef535a8983dd2d49a9c945f1a30fd1f35195c3c8894ce50162e6f6f107df073ece79f6599e0602cd1fa4c3f2c13ea0e0080ea7a6117669a7e797aa62235b93cec77964fb86dfba606b911559fb900f2c1c802974ddcf278e264ee6a17953c607b9d958e509fcd7a1a34beb271efc72b259db8c4dc9f900e9cf99d6aafc80c6fd0ddece3b638d5aba6edf1bd0e699f4ff89bb623ec28d4c5be2156f953ecc7bed64c441019450ba80560aeb75e2ecf7a1d", 0xe8) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000002b00)={&(0x7f0000002a40)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000002ac0)={&(0x7f0000002a80)=@getneigh={0x14, 0x1e, 0x4, 0x70bd25, 0x25dfdbfb, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000004}, 0x4040040) ioctl$XFS_IOC_AG_GEOMETRY(r8, 0xc080583d, &(0x7f0000002b40)={0x0, 0x3, 0xff, 0x5, 0x9, 0x0, 0x6, 0x4}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$OCFS2_IOC_RESVSP64(r11, 0x4030582a, &(0x7f0000002bc0)={0x0, 0x1, 0x1, 0xa, 0x1, 0x2}) 0s ago: executing program 3 (id=2586): r0 = socket$netlink(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_type(r1, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r2, &(0x7f0000000280), 0x9) r3 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) r4 = socket(0x18, 0x2, 0x2) bind$netlink(r4, 0x0, 0x0) write$cgroup_pid(r3, &(0x7f0000000c40), 0x12) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) splice(r8, 0x0, r7, 0x0, 0xffffffff, 0x4) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x503, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}, @IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9d}]}}}]}, 0x44}}, 0x0) kernel console output (not intermixed with test programs): _pfx_ref_tracker_free+0x10/0x10 [ 144.902435][ T7085] ? __asan_memcpy+0x40/0x70 [ 144.902487][ T7085] ? __skb_clone+0x63/0x7a0 [ 144.902528][ T7085] netlink_rcv_skb+0x232/0x4b0 [ 144.902559][ T7085] ? __pfx_genl_rcv_msg+0x10/0x10 [ 144.902583][ T7085] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 144.902629][ T7085] ? down_read+0x270/0x2e0 [ 144.902662][ T7085] ? genl_rcv+0xd/0x40 [ 144.902684][ T7085] genl_rcv+0x28/0x40 [ 144.902702][ T7085] netlink_unicast+0x75c/0x8e0 [ 144.902739][ T7085] netlink_sendmsg+0x813/0xb40 [ 144.902776][ T7085] ? __pfx_netlink_sendmsg+0x10/0x10 [ 144.902809][ T7085] ? aa_sock_msg_perm+0xf1/0x1b0 [ 144.902836][ T7085] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 144.902870][ T7085] ____sys_sendmsg+0x972/0x9f0 [ 144.902902][ T7085] ? __might_fault+0xaf/0x130 [ 144.902937][ T7085] ? __pfx_____sys_sendmsg+0x10/0x10 [ 144.902977][ T7085] ? import_iovec+0x73/0xa0 [ 144.903002][ T7085] ___sys_sendmsg+0x2a5/0x360 [ 144.903032][ T7085] ? __lock_acquire+0x6b5/0x2cf0 [ 144.903064][ T7085] ? __pfx____sys_sendmsg+0x10/0x10 [ 144.903142][ T7085] ? __fget_files+0x2a/0x420 [ 144.903169][ T7085] ? __fget_files+0x3a0/0x420 [ 144.903212][ T7085] __x64_sys_sendmsg+0x1bd/0x2a0 [ 144.903248][ T7085] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 144.903296][ T7085] ? __pfx_ksys_write+0x10/0x10 [ 144.903335][ T7085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.903358][ T7085] do_syscall_64+0x15f/0xf80 [ 144.903383][ T7085] ? trace_irq_disable+0x3b/0x140 [ 144.903406][ T7085] ? clear_bhb_loop+0x40/0x90 [ 144.903432][ T7085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.903453][ T7085] RIP: 0033:0x7f6fd719c819 [ 144.903473][ T7085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.903490][ T7085] RSP: 002b:00007f6fd80b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 144.903524][ T7085] RAX: ffffffffffffffda RBX: 00007f6fd7416090 RCX: 00007f6fd719c819 [ 144.903546][ T7085] RDX: 0000000000008080 RSI: 0000200000000500 RDI: 0000000000000004 [ 144.903560][ T7085] RBP: 00007f6fd80b1090 R08: 0000000000000000 R09: 0000000000000000 [ 144.903590][ T7085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 144.903603][ T7085] R13: 00007f6fd7416128 R14: 00007f6fd7416090 R15: 00007ffe7edcf2a8 [ 144.903647][ T7085] [ 145.105394][ T5993] net_ratelimit: 7 callbacks suppressed [ 145.105448][ T5993] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 145.389752][ T5825] Bluetooth: hci4: link tx timeout [ 145.408679][ T5825] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 145.509657][ T7104] netlink: 16 bytes leftover after parsing attributes in process `syz.0.306'. [ 145.602303][ T7096] netlink: 16 bytes leftover after parsing attributes in process `syz.0.306'. [ 145.774493][ T7114] netlink: 8 bytes leftover after parsing attributes in process `syz.2.312'. [ 145.875513][ T7119] tipc: Enabling of bearer rejected, failed to enable media [ 145.886067][ T7120] xt_TPROXY: Can be used only with -p tcp or -p udp [ 145.916124][ T7121] ip6tnl1: entered allmulticast mode [ 145.947972][ T7119] tunl0: entered promiscuous mode [ 145.970683][ T7125] netlink: 8 bytes leftover after parsing attributes in process `syz.2.312'. [ 145.993722][ T7119] netlink: 'syz.4.313': attribute type 3 has an invalid length. [ 146.024552][ T7119] netlink: 9 bytes leftover after parsing attributes in process `syz.4.313'. [ 146.080389][ T5940] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 146.101438][ T36] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 146.113010][ T36] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 146.146039][ T11] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 146.210344][ T5940] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 146.246012][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 146.279996][ T5940] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 146.292761][ T11] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 146.348878][ T7138] veth0: entered promiscuous mode [ 146.363179][ T7138] netlink: 60 bytes leftover after parsing attributes in process `syz.4.318'. [ 146.407383][ T7138] netlink: 60 bytes leftover after parsing attributes in process `syz.4.318'. [ 146.434143][ T7138] veth0: left promiscuous mode [ 146.445150][ T7138] netlink: 24 bytes leftover after parsing attributes in process `syz.4.318'. [ 146.462224][ T7143] netlink: 'syz.3.319': attribute type 1 has an invalid length. [ 146.472474][ T7144] netlink: 'syz.0.321': attribute type 4 has an invalid length. [ 146.480534][ T7143] netlink: 224 bytes leftover after parsing attributes in process `syz.3.319'. [ 146.490536][ T7144] netlink: 28 bytes leftover after parsing attributes in process `syz.0.321'. [ 146.509402][ T7146] FAULT_INJECTION: forcing a failure. [ 146.509402][ T7146] name failslab, interval 1, probability 0, space 0, times 0 [ 146.522510][ T11] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 146.546208][ T7146] CPU: 0 UID: 0 PID: 7146 Comm: syz.1.320 Not tainted syzkaller #0 PREEMPT(full) [ 146.546238][ T7146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 146.546251][ T7146] Call Trace: [ 146.546260][ T7146] [ 146.546269][ T7146] dump_stack_lvl+0xe8/0x150 [ 146.546307][ T7146] should_fail_ex+0x412/0x560 [ 146.546344][ T7146] should_failslab+0xa8/0x100 [ 146.546397][ T7146] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 146.546432][ T7146] ? __alloc_skb+0x1d0/0x7d0 [ 146.546459][ T7146] ? __local_bh_enable_ip+0xd0/0x130 [ 146.546497][ T7146] __alloc_skb+0x1d0/0x7d0 [ 146.546528][ T7146] ? netlink_ack_tlv_len+0x6c/0x210 [ 146.546562][ T7146] netlink_ack+0x146/0xa50 [ 146.546589][ T7146] ? __pfx_genl_rcv_msg+0x10/0x10 [ 146.546612][ T7146] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 146.546646][ T7146] ? __pfx_nl80211_post_doit+0x10/0x10 [ 146.546680][ T7146] ? __pfx_ref_tracker_free+0x10/0x10 [ 146.546711][ T7146] ? __asan_memcpy+0x40/0x70 [ 146.546739][ T7146] ? __skb_clone+0x63/0x7a0 [ 146.546788][ T7146] netlink_rcv_skb+0x2b6/0x4b0 [ 146.546820][ T7146] ? __pfx_genl_rcv_msg+0x10/0x10 [ 146.546846][ T7146] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 146.546893][ T7146] ? down_read+0x270/0x2e0 [ 146.546921][ T7146] ? genl_rcv+0xd/0x40 [ 146.546946][ T7146] genl_rcv+0x28/0x40 [ 146.546967][ T7146] netlink_unicast+0x75c/0x8e0 [ 146.547005][ T7146] netlink_sendmsg+0x813/0xb40 [ 146.547047][ T7146] ? __pfx_netlink_sendmsg+0x10/0x10 [ 146.547082][ T7146] ? aa_sock_msg_perm+0xf1/0x1b0 [ 146.547108][ T7146] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 146.547139][ T7146] ____sys_sendmsg+0x972/0x9f0 [ 146.547169][ T7146] ? __might_fault+0xaf/0x130 [ 146.547203][ T7146] ? __pfx_____sys_sendmsg+0x10/0x10 [ 146.547240][ T7146] ? import_iovec+0x73/0xa0 [ 146.547263][ T7146] ___sys_sendmsg+0x2a5/0x360 [ 146.547290][ T7146] ? __lock_acquire+0x6b5/0x2cf0 [ 146.547319][ T7146] ? __pfx____sys_sendmsg+0x10/0x10 [ 146.547383][ T7146] ? __fget_files+0x2a/0x420 [ 146.547406][ T7146] ? __fget_files+0x3a0/0x420 [ 146.547440][ T7146] __x64_sys_sendmsg+0x1bd/0x2a0 [ 146.547478][ T7146] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 146.547520][ T7146] ? __pfx_ksys_write+0x10/0x10 [ 146.547559][ T7146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.547581][ T7146] do_syscall_64+0x15f/0xf80 [ 146.547606][ T7146] ? trace_irq_disable+0x3b/0x140 [ 146.547641][ T7146] ? clear_bhb_loop+0x40/0x90 [ 146.547665][ T7146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.547685][ T7146] RIP: 0033:0x7f6fd719c819 [ 146.547704][ T7146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.547722][ T7146] RSP: 002b:00007f6fd80b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 146.547751][ T7146] RAX: ffffffffffffffda RBX: 00007f6fd7416090 RCX: 00007f6fd719c819 [ 146.547765][ T7146] RDX: 0000000000008080 RSI: 0000200000000500 RDI: 0000000000000004 [ 146.547777][ T7146] RBP: 00007f6fd80b1090 R08: 0000000000000000 R09: 0000000000000000 [ 146.547788][ T7146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 146.547800][ T7146] R13: 00007f6fd7416128 R14: 00007f6fd7416090 R15: 00007ffe7edcf2a8 [ 146.547833][ T7146] [ 147.122273][ T5993] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 147.444239][ T5830] Bluetooth: hci4: command 0x0406 tx timeout [ 148.199217][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 148.375133][ T7219] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 148.447626][ T7222] netlink: 'syz.4.341': attribute type 12 has an invalid length. [ 149.204712][ T5920] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 149.303909][ T7259] netlink: 'syz.3.348': attribute type 24 has an invalid length. [ 149.334235][ T149] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.364615][ T3407] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 149.384122][ T149] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.480858][ T149] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.508403][ T149] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 149.544514][ T7265] netlink: 'syz.0.352': attribute type 64 has an invalid length. [ 149.856181][ T7280] gre1: entered promiscuous mode [ 149.866672][ T7280] gre1: entered allmulticast mode [ 149.934987][ T7277] can: request_module (can-proto-0) failed. [ 150.082270][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 150.902639][ T7337] __nla_validate_parse: 18 callbacks suppressed [ 150.902660][ T7337] netlink: 12 bytes leftover after parsing attributes in process `syz.0.372'. [ 150.994211][ T7344] netlink: 40 bytes leftover after parsing attributes in process `syz.2.374'. [ 151.152857][ T7351] netlink: 8 bytes leftover after parsing attributes in process `syz.2.376'. [ 151.169181][ T7351] vxcan0: tx drop: invalid sa for name 0x0000000000000001 [ 151.195020][ T7354] netlink: 'syz.0.375': attribute type 1 has an invalid length. [ 151.204509][ T7351] Bluetooth: MGMT ver 1.23 [ 151.225230][ T7354] netlink: 4 bytes leftover after parsing attributes in process `syz.0.375'. [ 151.816420][ T7386] netlink: 'syz.4.387': attribute type 6 has an invalid length. [ 151.921586][ T7388] netlink: 40 bytes leftover after parsing attributes in process `syz.3.386'. [ 152.021121][ T7394] openvswitch: netlink: Message has 104 unknown bytes. [ 152.307495][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 152.334068][ T7408] syzkaller0: entered promiscuous mode [ 152.358254][ T7408] syzkaller0: entered allmulticast mode [ 152.387911][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 152.428619][ T7418] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 152.464871][ T7418] netlink: 24 bytes leftover after parsing attributes in process `syz.3.394'. [ 152.502117][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 152.771390][ T7431] netlink: 'syz.2.402': attribute type 1 has an invalid length. [ 152.834698][ T7434] netlink: 8 bytes leftover after parsing attributes in process `syz.2.402'. [ 152.885108][ T7431] 8021q: adding VLAN 0 to HW filter on device bond2 [ 152.989052][ T7434] bond3: Unable to set up delay as MII monitoring is disabled [ 153.013642][ T7434] bond3 (unregistering): Released all slaves [ 153.227150][ T7447] netlink: 64 bytes leftover after parsing attributes in process `syz.4.405'. [ 153.439214][ T7169] vxcan1 speed is unknown, defaulting to 1000 [ 153.462353][ T7411] infiniband syz2: set active [ 153.476249][ T7411] infiniband syz2: added vxcan1 [ 153.761331][ T7411] RDS/IB: syz2: added [ 153.779207][ T7411] smc: adding ib device syz2 with port count 1 [ 153.798403][ T7411] smc: ib device syz2 port 1 has no pnetid [ 153.829163][ T5920] vxcan1 speed is unknown, defaulting to 1000 [ 153.895310][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 153.992447][ T7484] ip6gre2: entered promiscuous mode [ 154.005463][ T7484] ip6gre2: entered allmulticast mode [ 154.137310][ T7491] netlink: 12 bytes leftover after parsing attributes in process `syz.0.414'. [ 154.241940][ T7497] netlink: 14 bytes leftover after parsing attributes in process `syz.2.415'. [ 154.348773][ T7492] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 154.389524][ T7497] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 154.403263][ T7504] netlink: 'syz.2.415': attribute type 3 has an invalid length. [ 154.423302][ T7506] netlink: 'syz.1.417': attribute type 5 has an invalid length. [ 154.443845][ T7497] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 154.457837][ T7497] bond0 (unregistering): Released all slaves [ 154.491145][ T7503] tipc: Enabling not permitted [ 154.510575][ T7503] tipc: Enabling of bearer rejected, failed to enable media [ 154.554424][ T7506] geneve2: entered promiscuous mode [ 154.571732][ T7506] geneve2: entered allmulticast mode [ 154.589519][ T36] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 154.626560][ T36] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 154.678200][ T36] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 154.710901][ T7512] netlink: 'syz.0.419': attribute type 11 has an invalid length. [ 154.711844][ T36] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 154.765909][ T7515] tipc: Enabling of bearer rejected, media not registered [ 154.784796][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 155.086434][ T7532] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 155.317514][ T7537] netlink: 'syz.2.425': attribute type 3 has an invalid length. [ 155.656443][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 156.098854][ T7570] netlink: 'syz.4.437': attribute type 1 has an invalid length. [ 156.524868][ T7603] __nla_validate_parse: 8 callbacks suppressed [ 156.524891][ T7603] netlink: 4 bytes leftover after parsing attributes in process `syz.2.438'. [ 156.806047][ T7621] netlink: 'syz.4.439': attribute type 1 has an invalid length. [ 156.883264][ T7623] netlink: 28 bytes leftover after parsing attributes in process `syz.4.439'. [ 156.937442][ T7625] netlink: 14 bytes leftover after parsing attributes in process `syz.4.439'. [ 156.997010][ T7629] openvswitch: netlink: IPv4 tun info is not correct [ 157.198543][ T7637] delete_channel: no stack [ 157.233982][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 157.646222][ T7654] raw_sendmsg: syz.4.448 forgot to set AF_INET. Fix it! [ 157.934687][ T7668] netlink: 4 bytes leftover after parsing attributes in process `syz.1.451'. [ 158.017998][ T7411] vxcan1 speed is unknown, defaulting to 1000 [ 158.402166][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 158.570893][ T7698] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 158.615048][ T7698] netlink: 'syz.4.455': attribute type 1 has an invalid length. [ 158.812904][ T7698] netlink: 8 bytes leftover after parsing attributes in process `syz.4.455'. [ 158.852375][ T7702] netlink: 12 bytes leftover after parsing attributes in process `syz.0.457'. [ 158.979175][ T7714] netlink: 4 bytes leftover after parsing attributes in process `syz.1.458'. [ 159.085316][ T7714] hsr_slave_1 (unregistering): left promiscuous mode [ 159.135305][ T7722] netlink: 40 bytes leftover after parsing attributes in process `syz.1.458'. [ 159.156755][ T7723] netlink: 72 bytes leftover after parsing attributes in process `syz.2.460'. [ 159.203763][ T7723] netlink: 12 bytes leftover after parsing attributes in process `syz.2.460'. [ 159.639091][ T7735] bond2: option miimon: invalid value (18446744073709551585) [ 159.671618][ T7735] bond2: option miimon: allowed values 0 - 2147483647 [ 159.703700][ T7735] bond2 (unregistering): Released all slaves [ 160.014478][ T29] IPVS: starting estimator thread 0... [ 160.130182][ T7768] IPVS: using max 26 ests per chain, 62400 per kthread [ 160.151375][ T7771] syzkaller0: entered promiscuous mode [ 160.163855][ T7771] syzkaller0: entered allmulticast mode [ 160.185716][ T7771] tipc: Started in network mode [ 160.196699][ T7771] tipc: Node identity 5a7255077ac7, cluster identity 4711 [ 160.214103][ T7771] tipc: Enabled bearer , priority 0 [ 160.232952][ T7770] tipc: Resetting bearer [ 160.266348][ T7770] tipc: Disabling bearer [ 160.304398][ T7778] vxcan1 speed is unknown, defaulting to 1000 [ 160.515078][ T7783] netlink: 'syz.2.478': attribute type 10 has an invalid length. [ 160.528451][ T7784] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 173.760421][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 181.401009][ T7810] __nla_validate_parse: 8 callbacks suppressed [ 181.401028][ T7810] netlink: 212336 bytes leftover after parsing attributes in process `syz.3.487'. [ 181.916302][ T7829] netlink: 80 bytes leftover after parsing attributes in process `syz.1.492'. [ 182.024803][ T7836] netlink: 'syz.0.496': attribute type 9 has an invalid length. [ 182.046184][ T7836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.496'. [ 182.123781][ T7601] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.133279][ T7836] netlink: 'syz.0.496': attribute type 9 has an invalid length. [ 182.141612][ T7601] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.154375][ T7836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.496'. [ 182.173009][ T7601] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.188944][ T7601] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 182.236350][ T7848] netlink: 'syz.4.497': attribute type 12 has an invalid length. [ 182.492308][ T7850] netlink: 484 bytes leftover after parsing attributes in process `syz.0.499'. [ 182.526943][ T7858] netlink: 8 bytes leftover after parsing attributes in process `syz.4.500'. [ 182.579861][ T7863] netlink: 12 bytes leftover after parsing attributes in process `syz.1.501'. [ 182.589657][ T7864] netlink: 'syz.1.501': attribute type 2 has an invalid length. [ 182.821276][ T7873] netlink: 32 bytes leftover after parsing attributes in process `syz.1.505'. [ 182.953394][ T7882] netlink: 'syz.1.507': attribute type 2 has an invalid length. [ 182.996421][ T7882] 9: entered promiscuous mode [ 183.183978][ T7892] netlink: 12 bytes leftover after parsing attributes in process `syz.0.510'. [ 183.219951][ T7892] IPv6: NLM_F_CREATE should be specified when creating new route [ 183.234056][ T7892] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 183.242504][ T7892] IPv6: NLM_F_CREATE should be set when creating new route [ 183.249843][ T7892] IPv6: NLM_F_CREATE should be set when creating new route [ 183.379266][ T7905] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 183.643282][ T7915] netlink: 4 bytes leftover after parsing attributes in process `syz.4.516'. [ 183.645362][ T7914] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 183.677200][ T7919] netlink: 'syz.1.517': attribute type 1 has an invalid length. [ 183.761462][ T7919] 8021q: adding VLAN 0 to HW filter on device bond2 [ 183.769228][ T7921] bond2: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 183.782518][ T7921] bond2: entered allmulticast mode [ 183.907730][ T7919] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 183.930713][ T7929] netlink: 'syz.4.522': attribute type 29 has an invalid length. [ 183.950572][ T7933] netlink: 'syz.4.522': attribute type 29 has an invalid length. [ 183.961921][ T7929] unsupported nla_type 58 [ 184.158397][ T7939] netlink: 'syz.4.525': attribute type 16 has an invalid length. [ 184.193777][ T7939] netlink: 'syz.4.525': attribute type 17 has an invalid length. [ 184.213294][ T7939] tunl0: left promiscuous mode [ 184.299645][ T7939] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 184.400247][ C1] af_packet: tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 185.075139][ T7992] ieee802154 phy1 wpan1: encryption failed: -22 [ 185.497184][ T8017] tipc: Enabled bearer , priority 0 [ 185.519453][ T8017] syzkaller0: entered promiscuous mode [ 185.558209][ T8017] syzkaller0: entered allmulticast mode [ 185.677126][ T8017] tipc: Resetting bearer [ 185.763830][ T8017] erspan0: entered promiscuous mode [ 185.781740][ T8017] vlan2: entered promiscuous mode [ 185.938966][ T8016] tipc: Resetting bearer [ 185.988633][ T8016] tipc: Disabling bearer [ 186.369007][ T8066] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.378700][ T8066] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.445959][ T8084] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 186.493100][ T8084] __nla_validate_parse: 12 callbacks suppressed [ 186.493121][ T8084] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.561'. [ 186.588034][ T8066] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 186.603321][ T8066] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 186.768248][ T7595] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.783460][ T7595] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.793801][ T7595] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.804495][ T7595] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.833901][ T7595] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.845030][ T7595] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 186.856763][ T8093] syzkaller1: entered promiscuous mode [ 186.862738][ T8093] syzkaller1: entered allmulticast mode [ 186.869147][ T7595] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 186.882594][ T7595] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.144808][ T8100] openvswitch: netlink: IP tunnel TTL not specified. [ 187.497416][ T8124] netlink: 12 bytes leftover after parsing attributes in process `syz.4.573'. [ 187.511209][ T8124] netlink: 12 bytes leftover after parsing attributes in process `syz.4.573'. [ 187.686308][ T8135] netlink: 88 bytes leftover after parsing attributes in process `syz.4.576'. [ 188.223721][ T8163] netlink: 32 bytes leftover after parsing attributes in process `syz.0.585'. [ 188.477895][ T8167] ipvlan2: entered allmulticast mode [ 188.487741][ T8167] batadv_slave_1: entered allmulticast mode [ 188.507650][ T8167] batman_adv: batadv0: Adding interface: ipvlan2 [ 188.517194][ T8167] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 188.544473][ T8167] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 188.555472][ T8167] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 188.565923][ T8167] batman_adv: batadv0: Interface activated: ipvlan2 [ 188.646690][ T8182] netlink: 8 bytes leftover after parsing attributes in process `syz.0.591'. [ 188.947472][ T8194] netlink: 496 bytes leftover after parsing attributes in process `syz.0.593'. [ 189.145182][ T8203] netlink: 24 bytes leftover after parsing attributes in process `syz.1.598'. [ 189.155537][ T8204] netlink: 24 bytes leftover after parsing attributes in process `syz.1.598'. [ 189.249648][ T8208] validate_nla: 4 callbacks suppressed [ 189.249665][ T8208] netlink: 'syz.2.599': attribute type 1 has an invalid length. [ 189.288298][ T8208] netlink: 20 bytes leftover after parsing attributes in process `syz.2.599'. [ 189.301389][ T8209] netlink: 'syz.4.600': attribute type 2 has an invalid length. [ 189.351239][ T8211] bridge0: entered allmulticast mode [ 189.470854][ T8216] lo: entered promiscuous mode [ 189.483983][ T8216] tunl0: entered promiscuous mode [ 189.491534][ T8216] gre0: entered promiscuous mode [ 189.516162][ T8216] gretap0: entered promiscuous mode [ 189.533379][ T8216] erspan0: entered promiscuous mode [ 189.545909][ T8216] ip_vti0: entered promiscuous mode [ 189.789422][ T8228] netlink: 'syz.2.607': attribute type 1 has an invalid length. [ 190.042325][ T8244] syzkaller0: entered promiscuous mode [ 190.047982][ T8244] syzkaller0: entered allmulticast mode [ 190.215783][ T8251] netlink: 'syz.2.612': attribute type 8 has an invalid length. [ 190.815998][ T8283] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 190.848531][ T8283] team1: entered promiscuous mode [ 190.856410][ T8283] team1: entered allmulticast mode [ 191.121545][ T8291] netlink: 'syz.3.628': attribute type 1 has an invalid length. [ 191.144619][ T8295] netlink: 'syz.0.630': attribute type 2 has an invalid length. [ 191.294079][ T8221] hid (null): global environment stack underflow [ 191.325797][ T8221] hid-generic 0005:07C0:0004.0001: global environment stack underflow [ 191.335031][ T8221] hid-generic 0005:07C0:0004.0001: item 0 0 1 11 parsing failed [ 191.344006][ T8221] hid-generic 0005:07C0:0004.0001: probe with driver hid-generic failed with error -22 [ 191.536416][ T8323] netlink: 'syz.2.634': attribute type 1 has an invalid length. [ 191.734273][ T8330] __nla_validate_parse: 9 callbacks suppressed [ 191.734291][ T8330] netlink: 104 bytes leftover after parsing attributes in process `syz.2.637'. [ 191.830914][ T8337] netlink: 'syz.4.639': attribute type 25 has an invalid length. [ 192.045491][ T8340] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 192.089666][ T8348] netlink: 196 bytes leftover after parsing attributes in process `syz.4.642'. [ 192.387468][ T8367] netlink: 'syz.1.648': attribute type 1 has an invalid length. [ 192.398259][ T8367] netlink: 'syz.1.648': attribute type 2 has an invalid length. [ 192.795959][ T8384] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 192.847011][ T8386] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 192.898867][ T8384] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 192.910385][ T8391] TCP: TCP_TX_DELAY enabled [ 193.084967][ T8407] netlink: 4 bytes leftover after parsing attributes in process `syz.0.659'. [ 193.182552][ T5920] IPVS: starting estimator thread 0... [ 193.290759][ T8414] IPVS: using max 28 ests per chain, 67200 per kthread [ 193.422709][ T8428] netlink: 8 bytes leftover after parsing attributes in process `syz.2.664'. [ 193.598755][ T8438] netlink: 9172 bytes leftover after parsing attributes in process `syz.3.668'. [ 193.855380][ T8452] netlink: 112 bytes leftover after parsing attributes in process `syz.0.670'. [ 194.247636][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.330729][ T8477] netlink: 1 bytes leftover after parsing attributes in process `syz.1.676'. [ 194.342078][ T8479] netlink: 8 bytes leftover after parsing attributes in process `syz.0.674'. [ 194.367408][ T8478] netlink: 12 bytes leftover after parsing attributes in process `syz.1.676'. [ 194.395445][ T8474] netlink: 104 bytes leftover after parsing attributes in process `syz.2.675'. [ 194.622417][ T8488] syzkaller1: entered promiscuous mode [ 194.636752][ T8488] syzkaller1: entered allmulticast mode [ 194.751502][ T8492] validate_nla: 2 callbacks suppressed [ 194.751522][ T8492] netlink: 'syz.1.678': attribute type 10 has an invalid length. [ 194.814585][ T8492] team0: Device ipvlan1 failed to register rx_handler [ 195.126730][ T8508] gretap2: entered promiscuous mode [ 195.149491][ T8508] gretap2: entered allmulticast mode [ 195.362634][ T8521] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 195.655710][ T8533] tipc: Enabling of bearer rejected, failed to enable media [ 195.968363][ T8555] »»»»»»: renamed from bond_slave_0 [ 196.668102][ T8595] netem: change failed [ 196.678334][ T8594] netlink: 'syz.1.717': attribute type 10 has an invalid length. [ 196.718359][ T8594] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.748329][ T8594] bridge_slave_1: left allmulticast mode [ 196.766935][ T8594] bridge_slave_1: left promiscuous mode [ 196.791746][ T8594] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.853813][ T8594] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 197.053589][ T8613] __nla_validate_parse: 15 callbacks suppressed [ 197.053610][ T8613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.723'. [ 197.150029][ T8619] netlink: 8 bytes leftover after parsing attributes in process `syz.4.726'. [ 197.273203][ T8627] netlink: 780 bytes leftover after parsing attributes in process `syz.0.729'. [ 197.293311][ T8630] netlink: 4 bytes leftover after parsing attributes in process `syz.3.731'. [ 197.303656][ T8627] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 197.390878][ T8634] netlink: 12 bytes leftover after parsing attributes in process `syz.1.730'. [ 197.465791][ T8636] netlink: 'syz.4.732': attribute type 1 has an invalid length. [ 197.570475][ T8639] netlink: 28 bytes leftover after parsing attributes in process `syz.4.732'. [ 197.596298][ T8639] 8021q: adding VLAN 0 to HW filter on device bond3 [ 197.635431][ T8644] syzkaller0: entered promiscuous mode [ 197.652212][ T8644] syzkaller0: entered allmulticast mode [ 197.883046][ T8655] batadv0: entered promiscuous mode [ 197.901420][ T8655] macsec1: entered promiscuous mode [ 197.929914][ T8655] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 197.954188][ T8655] batadv0: left promiscuous mode [ 198.148637][ T8672] netlink: 8 bytes leftover after parsing attributes in process `syz.3.742'. [ 198.536765][ T8698] netlink: 'syz.4.750': attribute type 29 has an invalid length. [ 198.549809][ T8698] netlink: 4 bytes leftover after parsing attributes in process `syz.4.750'. [ 198.917473][ T8720] netlink: 8 bytes leftover after parsing attributes in process `syz.3.756'. [ 199.337238][ T8739] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 199.432209][ T8744] netlink: 12 bytes leftover after parsing attributes in process `syz.3.763'. [ 199.492170][ T8751] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 199.499505][ T8751] IPv6: NLM_F_CREATE should be set when creating new route [ 199.506830][ T8751] IPv6: NLM_F_CREATE should be set when creating new route [ 199.514113][ T8751] IPv6: NLM_F_CREATE should be set when creating new route [ 199.536161][ T8751] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 200.253219][ T8779] netlink: 'syz.4.774': attribute type 8 has an invalid length. [ 200.264218][ T8779] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.273883][ T8779] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.448215][ T8787] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 200.835374][ T8799] syzkaller1: entered promiscuous mode [ 200.861129][ T8799] syzkaller1: entered allmulticast mode [ 202.179796][ T8833] __nla_validate_parse: 3 callbacks suppressed [ 202.179815][ T8833] netlink: 32 bytes leftover after parsing attributes in process `syz.1.787'. [ 202.197661][ T8833] netlink: 9 bytes leftover after parsing attributes in process `syz.1.787'. [ 203.568098][ T8793] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 204.326367][ T8873] netdevsim netdevsim0: Direct firmware load for  failed with error -2 [ 204.348110][ T8878] netlink: 16 bytes leftover after parsing attributes in process `syz.4.799'. [ 204.368392][ T8873] netdevsim netdevsim0: Falling back to sysfs fallback for:  [ 204.540709][ T8887] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.802'. [ 204.753584][ T8894] netlink: 8 bytes leftover after parsing attributes in process `syz.3.803'. [ 204.803482][ T8894] netlink: 8 bytes leftover after parsing attributes in process `syz.3.803'. [ 204.999936][ T8909] netlink: 28 bytes leftover after parsing attributes in process `syz.1.807'. [ 205.243025][ T8915] netlink: 'syz.2.810': attribute type 11 has an invalid length. [ 205.268664][ T8916] netlink: 28 bytes leftover after parsing attributes in process `syz.2.810'. [ 205.845970][ T8944] netlink: 24 bytes leftover after parsing attributes in process `syz.1.817'. [ 205.888439][ T8944] netlink: 24 bytes leftover after parsing attributes in process `syz.1.817'. [ 205.921777][ T8939] netlink: 'syz.1.817': attribute type 1 has an invalid length. [ 206.489073][ T8960] tipc: Enabling of bearer rejected, failed to enable media [ 207.481262][ T8997] xt_hashlimit: size too large, truncated to 1048576 [ 207.616094][ T9000] __nla_validate_parse: 2 callbacks suppressed [ 207.616113][ T9000] netlink: 516 bytes leftover after parsing attributes in process `syz.2.836'. [ 207.677132][ T9000] netlink: 28 bytes leftover after parsing attributes in process `syz.2.836'. [ 207.898954][ T9019] xt_TCPMSS: Only works on TCP SYN packets [ 208.265728][ T9028] netlink: 'syz.3.843': attribute type 24 has an invalid length. [ 208.465139][ T9031] pim6reg: entered allmulticast mode [ 208.711329][ T9050] netlink: 9416 bytes leftover after parsing attributes in process `syz.4.849'. [ 208.756999][ T9050] openvswitch: netlink: Flow key attr not present in new flow. [ 208.856572][ T9057] netlink: 28 bytes leftover after parsing attributes in process `syz.4.849'. [ 208.919264][ T9063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.852'. [ 209.002048][ T9067] netlink: 'syz.0.854': attribute type 10 has an invalid length. [ 209.049987][ T9067] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 209.189710][ T9076] xt_cluster: node mask cannot exceed total number of nodes [ 209.411750][ T9087] veth0: entered promiscuous mode [ 209.456151][ T9087] veth0: left promiscuous mode [ 209.469703][ T9091] netlink: 16 bytes leftover after parsing attributes in process `syz.0.862'. [ 209.644613][ T9096] netlink: 36 bytes leftover after parsing attributes in process `syz.3.863'. [ 209.935786][ T9104] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 210.019355][ T9114] netlink: 8 bytes leftover after parsing attributes in process `syz.3.867'. [ 210.160163][ T9120] netlink: 72 bytes leftover after parsing attributes in process `syz.4.868'. [ 210.387014][ T9122] netlink: 132 bytes leftover after parsing attributes in process `syz.3.869'. [ 210.842124][ T9135] bond4: entered promiscuous mode [ 210.874068][ T9135] bond4: entered allmulticast mode [ 210.900657][ T9135] 8021q: adding VLAN 0 to HW filter on device bond4 [ 211.382663][ T7604] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 211.415051][ T7604] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 211.459874][ T9166] openvswitch: netlink: Missing key (keys=40, expected=80) [ 211.461709][ T7604] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 211.488748][ T9167] netlink: 'syz.2.880': attribute type 1 has an invalid length. [ 211.508605][ T9166] openvswitch: netlink: Missing key (keys=40, expected=80) [ 211.587875][ T7613] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 211.616786][ T9173] tipc: Enabled bearer , priority 0 [ 211.681099][ T5141] Bluetooth: hci2: command 0x0406 tx timeout [ 211.687229][ T5833] Bluetooth: hci3: command 0x0406 tx timeout [ 211.693477][ T5829] Bluetooth: hci1: command 0x0406 tx timeout [ 211.984930][ T9164] syzkaller0: entered promiscuous mode [ 212.002968][ T9164] syzkaller0: entered allmulticast mode [ 212.022627][ T9164] tipc: Resetting bearer [ 212.115082][ T9194] netlink: 'syz.3.888': attribute type 4 has an invalid length. [ 212.395949][ T7599] tipc: Resetting bearer [ 212.436174][ T9163] tipc: Resetting bearer [ 213.959412][ T9163] tipc: Disabling bearer [ 213.972447][ T5920] tipc: Node number set to 525122173 [ 214.114513][ T9228] __nla_validate_parse: 71 callbacks suppressed [ 214.114533][ T9228] netlink: 8 bytes leftover after parsing attributes in process `syz.1.896'. [ 214.183380][ T9232] netlink: 28 bytes leftover after parsing attributes in process `syz.2.897'. [ 214.246067][ T9242] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 214.467540][ T9247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.903'. [ 214.482325][ T9255] openvswitch: netlink: Flow actions attr not present in new flow. [ 214.513758][ T9257] netlink: 40 bytes leftover after parsing attributes in process `syz.0.902'. [ 214.525266][ T9247] IPv6: NLM_F_CREATE should be specified when creating new route [ 214.552339][ T9257] netlink: 40 bytes leftover after parsing attributes in process `syz.0.902'. [ 214.704814][ T9267] nftables ruleset with unbound chain [ 214.885420][ T9276] netlink: 88 bytes leftover after parsing attributes in process `syz.0.909'. [ 215.017722][ T9281] netlink: 8 bytes leftover after parsing attributes in process `syz.3.910'. [ 215.069035][ T9284] netlink: 'syz.0.909': attribute type 1 has an invalid length. [ 215.198513][ T9287] geneve1: mtu less than device minimum [ 215.628435][ T9304] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 215.689507][ T9307] xt_hashlimit: size too large, truncated to 1048576 [ 215.722949][ T9304] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 215.884555][ T9317] netlink: 'syz.3.918': attribute type 1 has an invalid length. [ 215.970360][ T9314] –: renamed from vxcan1 (while UP) [ 216.056842][ T9317] bond3: entered promiscuous mode [ 216.064216][ T9317] 8021q: adding VLAN 0 to HW filter on device bond3 [ 216.073715][ T9321] netlink: 12 bytes leftover after parsing attributes in process `syz.0.920'. [ 216.414835][ T9344] netlink: 28 bytes leftover after parsing attributes in process `syz.1.926'. [ 216.438669][ T9344] netlink: 'syz.1.926': attribute type 7 has an invalid length. [ 216.450655][ T9345] netlink: 12 bytes leftover after parsing attributes in process `syz.0.925'. [ 216.459276][ T9344] netlink: 'syz.1.926': attribute type 8 has an invalid length. [ 216.547263][ T9349] vlan2: entered allmulticast mode [ 216.572137][ T9349] bridge3: entered allmulticast mode [ 216.679067][ T9362] sctp: [Deprecated]: syz.2.930 (pid 9362) Use of struct sctp_assoc_value in delayed_ack socket option. [ 216.679067][ T9362] Use struct sctp_sack_info instead [ 216.757206][ T9366] netlink: 'syz.1.931': attribute type 2 has an invalid length. [ 217.112255][ T9384] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 217.173169][ T9390] openvswitch: netlink: Flow key attr not present in new flow. [ 217.230830][ T9387] vxcan1 speed is unknown, defaulting to 1000 [ 219.644339][ T9477] --map-set only usable from mangle table [ 219.918984][ T9486] __nla_validate_parse: 4 callbacks suppressed [ 219.919003][ T9486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.959'. [ 220.582459][ T7601] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 220.602160][ T7601] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 220.621834][ T7601] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 220.638007][ T7601] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 220.756194][ T9517] netlink: 'syz.2.966': attribute type 30 has an invalid length. [ 220.794498][ T9517] netlink: 4 bytes leftover after parsing attributes in process `syz.2.966'. [ 220.844999][ T9527] openvswitch: netlink: Flow key attr not present in new flow. [ 220.897654][ T9527] smc: net device team0 applied user defined pnetid SYZ2 [ 221.028049][ T9534] netlink: 16 bytes leftover after parsing attributes in process `syz.4.971'. [ 221.112810][ T9537] workqueue: name exceeds WQ_NAME_LEN. Truncating to: KŠŸu ™crµ±K:‘£ÿˆÌ¥ÝBßÝ£| “¼Ú [ 221.562001][ T9564] netlink: 'syz.2.981': attribute type 83 has an invalid length. [ 221.638610][ T9574] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.981'. [ 221.688632][ T9564] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 221.856540][ T9582] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 221.883641][ T9594] netlink: 2376 bytes leftover after parsing attributes in process `syz.1.987'. [ 222.039542][ T9601] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.990'. [ 222.059568][ T9601] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 222.176860][ T9607] netlink: 8 bytes leftover after parsing attributes in process `syz.1.992'. [ 222.802402][ T9646] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1000'. [ 222.837083][ T9657] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1002'. [ 222.932768][ T9662] netlink: 'syz.0.1003': attribute type 8 has an invalid length. [ 225.673439][ T9638] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 225.959588][ T9684] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1008'. [ 226.380687][ T9709] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1018'. [ 226.451953][ T9715] netlink: 'syz.0.1019': attribute type 12 has an invalid length. [ 226.464981][ T9717] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1017'. [ 227.080270][ T9748] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1028'. [ 227.337421][ T9756] netlink: 'syz.0.1031': attribute type 11 has an invalid length. [ 227.359516][ T9756] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1031'. [ 227.387380][ T9764] syzkaller1: entered promiscuous mode [ 227.397331][ T9766] trusted_key: syz.3.1032 sent an empty control message without MSG_MORE. [ 227.397467][ T9764] syzkaller1: entered allmulticast mode [ 227.455576][ T9764] block nbd0: not configured, cannot reconfigure [ 227.534476][ T9766] netlink: 'syz.3.1032': attribute type 5 has an invalid length. [ 227.684888][ T9776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1036'. [ 227.706146][ T9776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1036'. [ 227.726517][ T9781] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1037'. [ 227.939174][ T9794] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1041'. [ 227.967683][ T9795] syzkaller0: entered promiscuous mode [ 227.973802][ T9795] syzkaller0: entered allmulticast mode [ 228.152478][ T9805] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1044'. [ 228.243575][ T9811] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 228.268817][ T9812] netlink: 'syz.4.1046': attribute type 1 has an invalid length. [ 228.398504][ T9807] bond0: (slave bond_slave_1): Device is not bonding slave [ 228.414912][ T9807] bond0: option active_slave: invalid value (bond_slave_1) [ 228.433580][ T9807] bond0 (unregistering): Released all slaves [ 228.529647][ T9823] ip6tnl0: Caught tx_queue_len zero misconfig [ 229.172657][ T9868] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 229.180799][ T9868] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 229.189214][ T9868] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 229.198343][ T9868] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 229.253405][ T9872] tipc: Cannot configure node identity twice [ 229.430912][ T9877] smc: ib device syz2 ibport 2 applied user defined pnetid SYZ1 [ 229.999661][ T9906] netlink: 'syz.0.1078': attribute type 1 has an invalid length. [ 230.109449][ T9906] 8021q: adding VLAN 0 to HW filter on device bond3 [ 230.156261][ T9919] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz_tun! [ 230.181708][ T9914] vlan3: entered promiscuous mode [ 230.186876][ T9914] bond3: entered promiscuous mode [ 230.193123][ T9914] vlan3: entered allmulticast mode [ 230.198476][ T9914] bond3: entered allmulticast mode [ 230.276836][ T9906] bond3: (slave bridge5): making interface the new active one [ 230.295070][ T9906] bridge5: entered promiscuous mode [ 230.310820][ T9906] bridge5: entered allmulticast mode [ 230.319475][ T9906] bond3: (slave bridge5): Enslaving as an active interface with an up link [ 230.675654][ T9950] gre1: entered promiscuous mode [ 231.122149][ T9976] FAULT_INJECTION: forcing a failure. [ 231.122149][ T9976] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 231.156030][ T9976] CPU: 1 UID: 0 PID: 9976 Comm: syz.3.1098 Not tainted syzkaller #0 PREEMPT(full) [ 231.156068][ T9976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 231.156082][ T9976] Call Trace: [ 231.156091][ T9976] [ 231.156100][ T9976] dump_stack_lvl+0xe8/0x150 [ 231.156138][ T9976] should_fail_ex+0x412/0x560 [ 231.156175][ T9976] _copy_from_user+0x2d/0xb0 [ 231.156199][ T9976] __sys_connect+0x156/0x450 [ 231.156232][ T9976] ? __pfx___sys_connect+0x10/0x10 [ 231.156275][ T9976] ? __pfx_ksys_write+0x10/0x10 [ 231.156313][ T9976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.156337][ T9976] __x64_sys_connect+0x7a/0x90 [ 231.156367][ T9976] do_syscall_64+0x15f/0xf80 [ 231.156407][ T9976] ? trace_irq_disable+0x3b/0x140 [ 231.156429][ T9976] ? clear_bhb_loop+0x40/0x90 [ 231.156458][ T9976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.156497][ T9976] RIP: 0033:0x7f6e6239c819 [ 231.156517][ T9976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.156534][ T9976] RSP: 002b:00007f6e63177028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 231.156558][ T9976] RAX: ffffffffffffffda RBX: 00007f6e62615fa0 RCX: 00007f6e6239c819 [ 231.156582][ T9976] RDX: 000000000000001c RSI: 00002000000003c0 RDI: 0000000000000003 [ 231.156596][ T9976] RBP: 00007f6e63177090 R08: 0000000000000000 R09: 0000000000000000 [ 231.156609][ T9976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 231.156621][ T9976] R13: 00007f6e62616038 R14: 00007f6e62615fa0 R15: 00007ffe9aca6c18 [ 231.156656][ T9976] [ 231.367941][ T9982] netlink: 'syz.0.1100': attribute type 1 has an invalid length. [ 231.561928][ T9982] 8021q: adding VLAN 0 to HW filter on device bond4 [ 231.590374][T10000] __nla_validate_parse: 12 callbacks suppressed [ 231.590391][T10000] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1104'. [ 231.669570][ T9983] bond4: (slave geneve2): making interface the new active one [ 231.687136][ T9983] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 231.793713][T10001] ip6erspan0: entered promiscuous mode [ 231.831440][ T48] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.853293][ T48] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.889010][ T48] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.926098][ T48] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 232.244974][T10030] FAULT_INJECTION: forcing a failure. [ 232.244974][T10030] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.299582][T10030] CPU: 0 UID: 0 PID: 10030 Comm: syz.3.1113 Not tainted syzkaller #0 PREEMPT(full) [ 232.299609][T10030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 232.299632][T10030] Call Trace: [ 232.299639][T10030] [ 232.299647][T10030] dump_stack_lvl+0xe8/0x150 [ 232.299682][T10030] should_fail_ex+0x412/0x560 [ 232.299714][T10030] _copy_to_user+0x31/0xb0 [ 232.299736][T10030] simple_read_from_buffer+0xe1/0x170 [ 232.299766][T10030] proc_fail_nth_read+0x1bb/0x230 [ 232.299811][T10030] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 232.299842][T10030] ? rw_verify_area+0x2a6/0x4d0 [ 232.299870][T10030] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 232.299899][T10030] vfs_read+0x20c/0xa70 [ 232.299933][T10030] ? __pfx___mutex_lock+0x10/0x10 [ 232.299959][T10030] ? __pfx_vfs_read+0x10/0x10 [ 232.299989][T10030] ? __fget_files+0x2a/0x420 [ 232.300035][T10030] ? __fget_files+0x3a0/0x420 [ 232.300065][T10030] ? __fget_files+0x2a/0x420 [ 232.300101][T10030] ksys_read+0x150/0x270 [ 232.300135][T10030] ? __pfx_ksys_read+0x10/0x10 [ 232.300175][T10030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.300198][T10030] do_syscall_64+0x15f/0xf80 [ 232.300223][T10030] ? trace_irq_disable+0x3b/0x140 [ 232.300245][T10030] ? clear_bhb_loop+0x40/0x90 [ 232.300271][T10030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.300292][T10030] RIP: 0033:0x7f6e6235d04e [ 232.300311][T10030] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 232.300328][T10030] RSP: 002b:00007f6e63176fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 232.300351][T10030] RAX: ffffffffffffffda RBX: 00007f6e631776c0 RCX: 00007f6e6235d04e [ 232.300366][T10030] RDX: 000000000000000f RSI: 00007f6e631770a0 RDI: 0000000000000004 [ 232.300379][T10030] RBP: 00007f6e63177090 R08: 0000000000000000 R09: 0000000000000000 [ 232.300392][T10030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 232.300404][T10030] R13: 00007f6e62616038 R14: 00007f6e62615fa0 R15: 00007ffe9aca6c18 [ 232.300438][T10030] [ 232.784011][T10041] IPv6: sit3: Disabled Multicast RS [ 232.845034][T10044] tipc: Enabled bearer , priority 24 [ 232.899817][T10044] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 233.023524][T10052] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1122'. [ 233.186443][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1123'. [ 233.630868][T10079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1131'. [ 233.797447][T10082] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1133'. [ 233.819812][T10082] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1133'. [ 233.986608][T10091] bridge_slave_1: entered allmulticast mode [ 234.087930][T10058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 234.209989][T10106] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 234.479575][T10119] netlink: 'syz.0.1143': attribute type 1 has an invalid length. [ 234.549161][T10119] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 234.564458][T10119] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 234.677271][T10119] macvlan3: entered promiscuous mode [ 234.686260][T10119] macvlan3: entered allmulticast mode [ 234.700633][T10119] bond5: entered promiscuous mode [ 234.709903][T10119] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 234.743890][T10119] bond5: left promiscuous mode [ 235.065595][T10144] netlink: 'syz.0.1149': attribute type 1 has an invalid length. [ 235.065595][T10146] netlink: 'syz.0.1149': attribute type 1 has an invalid length. [ 235.065636][T10144] netlink: 280 bytes leftover after parsing attributes in process `syz.0.1149'. [ 235.089441][T10147] netlink: 'syz.1.1150': attribute type 11 has an invalid length. [ 235.108609][T10146] netlink: 280 bytes leftover after parsing attributes in process `syz.0.1149'. [ 235.113561][T10147] netlink: 'syz.1.1150': attribute type 11 has an invalid length. [ 235.136663][T10147] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1150'. [ 235.324162][T10157] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 235.587717][T10164] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1154'. [ 236.882668][ T7584] wlan1: Trigger new scan to find an IBSS to join [ 237.039959][T10228] bond0: entered promiscuous mode [ 237.055596][T10239] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1170'. [ 237.077313][T10228] bond0: entered allmulticast mode [ 237.095137][T10228] 8021q: adding VLAN 0 to HW filter on device bond0 [ 237.712337][T10266] netlink: 212328 bytes leftover after parsing attributes in process `syz.1.1176'. [ 237.730322][T10266] netlink: Unknown conntrack attr (type=2304, max=9) [ 237.758559][T10267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1177'. [ 237.817031][T10279] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1177'. [ 238.119593][T10293] x_tables: duplicate underflow at hook 1 [ 238.340442][T10297] can: request_module (can-proto-0) failed. [ 238.372702][T10304] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1186'. [ 238.484315][T10309] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1187'. [ 238.580382][T10316] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 238.596257][T10316] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 238.649248][T10316] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 238.673171][T10316] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 238.705107][T10316] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 238.733072][T10316] batman_adv: batadv0: Removing interface: ipvlan2 [ 238.942521][T10322] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1189'. [ 239.031634][T10327] syzkaller0: entered promiscuous mode [ 239.052056][T10327] syzkaller0: entered allmulticast mode [ 239.088676][T10340] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 239.096169][T10340] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 239.319171][T10353] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1196'. [ 239.397977][T10357] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1197'. [ 239.421400][T10358] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1197'. [ 239.725224][T10375] netdevsim netdevsim3: Firmware load for '..' refused, path contains '..' component [ 239.845960][ T48] wlan1: Trigger new scan to find an IBSS to join [ 239.960381][T10390] netlink: 'syz.2.1207': attribute type 12 has an invalid length. [ 240.006973][T10390] netem: unknown loss type 0 [ 240.028136][T10390] netem: change failed [ 240.451268][T10405] xt_hashlimit: size too large, truncated to 1048576 [ 240.635602][T10417] netlink: 'syz.1.1211': attribute type 2 has an invalid length. [ 240.744532][ T48] wlan1: Creating new IBSS network, BSSID 3a:a6:55:91:b6:d5 [ 241.314723][T10430] xt_addrtype: ipv6 does not support BROADCAST matching [ 242.067211][T10426] __nla_validate_parse: 6 callbacks suppressed [ 242.067229][T10426] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1213'. [ 242.085787][T10426] bridge: RTM_NEWNEIGH with invalid ether address [ 242.093439][T10430] syz_tun: entered allmulticast mode [ 242.122563][T10430] syz_tun: left allmulticast mode [ 242.144204][T10434] openvswitch: netlink: IP tunnel dst address not specified [ 242.155231][T10434] openvswitch: netlink: IP tunnel dst address not specified [ 242.286940][T10436] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 242.320787][T10440] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.1217'. [ 242.368084][T10444] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1219'. [ 242.456946][T10440] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1217'. [ 242.492309][T10449] ip6t_srh: unknown srh match flags 4000 [ 243.011838][T10477] block nbd0: Unsupported socket: should be TCP or UNIX. [ 243.095002][T10479] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1232'. [ 243.226100][T10487] netlink: 'syz.0.1234': attribute type 11 has an invalid length. [ 243.235952][T10487] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1234'. [ 243.286304][T10493] netlink: 'syz.3.1236': attribute type 39 has an invalid length. [ 243.576551][T10504] syzkaller0: entered promiscuous mode [ 243.584030][T10504] syzkaller0: entered allmulticast mode [ 243.628205][T10507] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1240'. [ 243.637811][T10507] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1240'. [ 243.656015][T10507] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1240'. [ 244.119988][T10532] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1250'. [ 244.695340][T10569] vlan2: entered promiscuous mode [ 244.712513][T10569] bridge0: entered promiscuous mode [ 245.073789][T10588] netlink: zone id is out of range [ 245.091277][T10588] netlink: zone id is out of range [ 245.111727][T10588] netlink: zone id is out of range [ 245.126059][T10588] netlink: zone id is out of range [ 245.132796][T10588] netlink: zone id is out of range [ 245.137982][T10588] netlink: zone id is out of range [ 245.158758][T10588] netlink: zone id is out of range [ 245.185714][ T5825] block nbd0: Receive control failed (result -1) [ 246.421016][T10665] netlink: 'syz.1.1281': attribute type 2 has an invalid length. [ 246.568581][T10631] netlink: 'syz.3.1273': attribute type 1 has an invalid length. [ 246.634023][T10675] netlink: 'syz.2.1284': attribute type 21 has an invalid length. [ 246.643114][T10675] IPv6: NLM_F_CREATE should be specified when creating new route [ 246.729870][T10679] sctp: [Deprecated]: syz.2.1285 (pid 10679) Use of int in max_burst socket option. [ 246.729870][T10679] Use struct sctp_assoc_value instead [ 247.615230][T10732] netlink: 'syz.3.1297': attribute type 72 has an invalid length. [ 247.684705][T10732] __nla_validate_parse: 11 callbacks suppressed [ 247.684727][T10732] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1297'. [ 247.801895][T10738] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1301'. [ 248.478153][T10769] netlink: 'syz.2.1310': attribute type 1 has an invalid length. [ 248.498241][T10769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1310'. [ 248.513489][T10769] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1310'. [ 248.538301][T10769] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1310'. [ 248.876197][T10783] ip6gre1: entered promiscuous mode [ 248.903186][T10783] ip6gre1: entered allmulticast mode [ 249.152215][T10800] syzkaller1: entered promiscuous mode [ 249.174728][T10800] syzkaller1: entered allmulticast mode [ 249.195678][T10801] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1318'. [ 249.418231][T10816] netlink: 'syz.1.1322': attribute type 1 has an invalid length. [ 249.487560][T10820] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1322'. [ 249.582325][T10826] netlink: 'syz.2.1326': attribute type 1 has an invalid length. [ 249.592384][T10826] Cannot find set identified by id 65534 to match [ 249.697597][T10816] 8021q: adding VLAN 0 to HW filter on device bond3 [ 249.735185][T10834] netlink: 'syz.4.1327': attribute type 1 has an invalid length. [ 249.750982][T10820] bond3: (slave geneve3): making interface the new active one [ 249.754823][T10834] netlink: 228 bytes leftover after parsing attributes in process `syz.4.1327'. [ 249.769347][T10820] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 249.772592][T10834] net_ratelimit: 54 callbacks suppressed [ 249.772635][T10834] openvswitch: netlink: IP tunnel dst address not specified [ 250.000799][T10849] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1330'. [ 250.037625][T10849] smc: removing net device team0 with user defined pnetid SYZ2 [ 250.129562][T10849] team0 (unregistering): Port device team_slave_0 removed [ 250.159032][T10849] team0 (unregistering): Port device team_slave_1 removed [ 250.177203][T10856] xt_hashlimit: size too large, truncated to 1048576 [ 250.283755][ T48] bond0: (slave bond_slave_0): interface is now down [ 250.321815][ T48] bond0: (slave bond_slave_1): interface is now down [ 250.351701][T10865] IPVS: set_ctl: invalid protocol: 135 224.0.0.1:20003 [ 250.381450][ T48] bond0: now running without any active interface! [ 250.587480][T10878] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1338'. [ 250.677197][T10878] veth1_to_team: entered promiscuous mode [ 250.703699][T10878] macvtap1: entered promiscuous mode [ 250.738085][T10878] macvtap1: entered allmulticast mode [ 250.753516][T10878] veth1_to_team: entered allmulticast mode [ 250.997344][T10897] netlink: 'syz.3.1343': attribute type 1 has an invalid length. [ 251.146424][T10908] netlink: 'syz.2.1345': attribute type 1 has an invalid length. [ 251.168407][T10897] 8021q: adding VLAN 0 to HW filter on device bond5 [ 252.421220][T10988] netlink: 'syz.0.1361': attribute type 30 has an invalid length. [ 252.472777][T10992] netlink: 'syz.0.1361': attribute type 30 has an invalid length. [ 252.482028][T10991] pimreg: entered allmulticast mode [ 252.739314][T10997] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 252.974422][T10987] netlink: 'syz.3.1363': attribute type 83 has an invalid length. [ 253.088146][T11021] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 253.223434][T11018] syzkaller0: entered promiscuous mode [ 253.241037][T11018] syzkaller0: entered allmulticast mode [ 253.259656][T11017] tipc: Started in network mode [ 253.286413][T11017] tipc: Node identity f6bf91b963e5, cluster identity 4711 [ 253.324258][T11017] tipc: Enabled bearer , priority 0 [ 253.409127][T11017] tipc: Resetting bearer [ 253.544628][T11044] __nla_validate_parse: 13 callbacks suppressed [ 253.544656][T11044] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1378'. [ 253.560219][T11044] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1378'. [ 253.569182][T11044] netlink: 'syz.0.1378': attribute type 3 has an invalid length. [ 253.578190][T11044] netlink: 'syz.0.1378': attribute type 2 has an invalid length. [ 253.586215][T11044] netlink: 'syz.0.1378': attribute type 2 has an invalid length. [ 254.965724][T11017] tipc: Disabling bearer [ 254.984970][T11052] netlink: 196 bytes leftover after parsing attributes in process `syz.1.1381'. [ 255.012000][T11052] netlink: 196 bytes leftover after parsing attributes in process `syz.1.1381'. [ 255.026022][T11052] netlink: 19 bytes leftover after parsing attributes in process `syz.1.1381'. [ 255.038461][ T7170] tipc: Node number set to 2505740729 [ 255.237647][T11065] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1384'. [ 255.340612][T11081] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1387'. [ 255.692176][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.128688][T11109] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1394'. [ 257.143011][T11109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1394'. [ 257.161339][T11109] netlink: 2 bytes leftover after parsing attributes in process `syz.3.1394'. [ 257.498868][T11134] netlink: 'syz.2.1400': attribute type 11 has an invalid length. [ 257.507598][T11134] netlink: 'syz.2.1400': attribute type 11 has an invalid length. [ 258.013239][T11151] bond4: Unable to set up delay as MII monitoring is disabled [ 258.030679][T11151] bond4 (unregistering): Released all slaves [ 258.887616][T11208] __nla_validate_parse: 3 callbacks suppressed [ 258.887633][T11208] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1417'. [ 258.916522][T11210] bond6: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 258.986777][T11214] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.1418'. [ 258.998064][T11214] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 259.042082][T11210] bond6: (slave lo): Enslaving as an active interface with an up link [ 259.066025][T11210] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 259.288042][T11226] team0 (unregistering): Port device team_slave_0 removed [ 259.325113][T11226] team0 (unregistering): Port device team_slave_1 removed [ 259.380337][T11226] team0 (unregistering): Port device dummy0 removed [ 259.973237][T11261] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1429'. [ 260.211826][T11269] tipc: Enabled bearer , priority 0 [ 260.365148][T11272] syzkaller0: entered promiscuous mode [ 260.375025][T11272] syzkaller0: entered allmulticast mode [ 260.382570][T11272] tipc: Resetting bearer [ 260.448664][ T7601] tipc: Resetting bearer [ 260.475505][T11272] tipc: Resetting bearer [ 260.578287][T11291] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1434'. [ 260.596261][T11290] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1434'. [ 260.622521][T11292] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1433'. [ 260.667460][T11294] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1435'. [ 262.049100][T11272] tipc: Disabling bearer [ 262.084137][T11294] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 262.085597][T11292] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1433'. [ 262.128198][ T7170] tipc: Node number set to 548754695 [ 262.405303][T11324] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1439'. [ 262.472184][T11326] netlink: 'syz.2.1444': attribute type 1 has an invalid length. [ 262.543878][T11329] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1444'. [ 262.651829][T11326] 8021q: adding VLAN 0 to HW filter on device bond4 [ 262.689717][T11329] bond4: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 262.742420][T11329] bond4: entered allmulticast mode [ 263.151412][T11362] netlink: 'syz.3.1453': attribute type 64 has an invalid length. [ 265.032995][T11388] __nla_validate_parse: 1 callbacks suppressed [ 265.033016][T11388] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1461'. [ 265.081614][T11393] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1460'. [ 265.385130][T11411] netlink: 35 bytes leftover after parsing attributes in process `syz.2.1466'. [ 265.424146][T11417] ipt_rpfilter: unknown options [ 265.429274][T11411] ipt_rpfilter: unknown options [ 265.444956][T11418] gre0 speed is unknown, defaulting to 1000 [ 265.471876][T11418] gre0 speed is unknown, defaulting to 1000 [ 265.496525][T11418] gre0 speed is unknown, defaulting to 1000 [ 265.605445][T11427] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 266.037183][T11453] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1476'. [ 266.105007][T11418] infiniband syz1: set down [ 266.109595][T11418] infiniband syz1: added gre0 [ 266.122935][ T5890] gre0 speed is unknown, defaulting to 1000 [ 266.350949][T11418] RDS/IB: syz1: added [ 266.359595][T11418] smc: adding ib device syz1 with port count 1 [ 266.367192][T11418] smc: ib device syz1 port 1 has no pnetid [ 266.385588][T11470] bond4: invalid ARP target 0.0.0.0 specified for addition [ 266.393392][T11470] bond4: option arp_ip_target: invalid value (0) [ 266.402495][T11470] bond4 (unregistering): Released all slaves [ 266.426622][ T9450] gre0 speed is unknown, defaulting to 1000 [ 266.506991][T11418] gre0 speed is unknown, defaulting to 1000 [ 266.751953][T11481] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1482'. [ 267.199929][T11502] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 267.243528][T11418] gre0 speed is unknown, defaulting to 1000 [ 267.264971][T11510] netlink: 'syz.1.1492': attribute type 1 has an invalid length. [ 267.278368][T11508] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 267.317670][T11510] netlink: 228 bytes leftover after parsing attributes in process `syz.1.1492'. [ 267.364516][T11510] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1492'. [ 267.578373][ T30] audit: type=1107 audit(1776416839.296:2): pid=11525 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='Ù‹5ž÷Œ•%èÍUýAÊÃËÙ ë0ä™l…t¿Ý•/Öÿ Ž6òŠ¨Šç›' [ 267.792896][T11418] gre0 speed is unknown, defaulting to 1000 [ 267.952571][T11418] gre0 speed is unknown, defaulting to 1000 [ 268.106451][T11418] gre0 speed is unknown, defaulting to 1000 [ 270.821989][ T7597] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 289.741733][T11547] ÿÿÿÿÿÿ: renamed from virt_wifi0 [ 289.761109][T11554] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1498'. [ 289.783398][T11556] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1501'. [ 289.798788][T11554] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 290.303341][T11587] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1511'. [ 290.382112][T11578] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1509'. [ 290.406020][T11586] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1509'. [ 290.499001][T11592] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1512'. [ 291.011877][T11615] syzkaller0: entered promiscuous mode [ 291.017535][T11615] syzkaller0: entered allmulticast mode [ 291.703901][T11662] x_tables: duplicate underflow at hook 3 [ 291.747019][T11664] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.1533'. [ 292.326952][T11699] netlink: 'syz.0.1540': attribute type 1 has an invalid length. [ 292.915076][T11738] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1549'. [ 293.085548][T11744] netlink: 'syz.2.1552': attribute type 1 has an invalid length. [ 293.219120][T11744] bond5: entered promiscuous mode [ 293.228065][T11744] bond5: entered allmulticast mode [ 293.234035][T11744] 8021q: adding VLAN 0 to HW filter on device bond5 [ 293.261482][T11751] netlink: 'syz.1.1553': attribute type 1 has an invalid length. [ 293.288992][T11756] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1555'. [ 293.298248][T11748] macvlan4: entered promiscuous mode [ 293.304524][T11748] macvlan4: entered allmulticast mode [ 293.307628][T11756] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1555'. [ 293.320241][T11748] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 293.362195][T11752] netlink: 'syz.4.1554': attribute type 4 has an invalid length. [ 293.394723][T11751] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 293.705534][T11779] gre2: entered promiscuous mode [ 293.730836][T11781] nbd: nbd0 already in use [ 293.735780][T11781] block nbd0: NBD_DISCONNECT [ 293.746678][T11787] netlink: 'syz.4.1560': attribute type 1 has an invalid length. [ 293.755904][T11781] block nbd0: shutting down sockets [ 293.763006][T11779] gre2: entered allmulticast mode [ 293.781784][T11769] syz.3.1557 (11769) used greatest stack depth: 17560 bytes left [ 294.192267][T11807] syz.0.1566 (11807) used obsolete PPPIOCDETACH ioctl [ 294.329111][T11818] xt_TCPMSS: Only works on TCP SYN packets [ 294.457136][T11824] IPVS: set_ctl: invalid protocol: 136 172.20.20.43:20004 [ 294.552986][T11832] xt_NFQUEUE: number of queues (62232) out of range (got 67565) [ 294.625652][T11830] xfrm1: entered allmulticast mode [ 294.819219][T11836] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 294.866791][T11852] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 295.084998][T11865] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1580'. [ 295.443914][T11886] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1585'. [ 295.511653][T11890] 8021q: VLANs not supported on ip_vti0 [ 295.529117][T11886] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1585'. [ 295.568470][T11886] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1585'. [ 295.611686][T11895] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1585'. [ 295.664885][T11895] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1585'. [ 296.204673][T11929] netlink: 'syz.4.1594': attribute type 3 has an invalid length. [ 296.235624][T11929] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1594'. [ 296.476348][T11945] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 296.555968][T11943] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1598'. [ 296.583910][T11945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1599'. [ 296.611204][T11945] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 296.938673][T11972] netlink: 'syz.2.1604': attribute type 12 has an invalid length. [ 296.967768][T11965] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 296.983998][T11972] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1604'. [ 296.999221][T11963] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 298.078941][T12049] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 298.135920][T12052] netlink: 'syz.0.1623': attribute type 1 has an invalid length. [ 298.432273][T12068] netlink: 'syz.0.1625': attribute type 1 has an invalid length. [ 298.963149][T12093] netlink: 'syz.2.1629': attribute type 1 has an invalid length. [ 299.296865][T12115] netlink: 'syz.0.1634': attribute type 1 has an invalid length. [ 299.769200][T12137] syzkaller1: entered promiscuous mode [ 299.782731][T12137] syzkaller1: entered allmulticast mode [ 299.823336][T12144] syzkaller0: entered promiscuous mode [ 299.840852][T12144] syzkaller0: entered allmulticast mode [ 300.043681][T12152] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 300.199967][T12165] netlink: 'syz.2.1647': attribute type 1 has an invalid length. [ 300.406772][T12173] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 300.661320][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.678920][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.704139][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.723095][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.729609][T12191] netlink: 'syz.0.1655': attribute type 1 has an invalid length. [ 300.739835][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.753786][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.773061][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.780712][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.796042][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.805776][T12191] 8021q: adding VLAN 0 to HW filter on device bond6 [ 300.813506][T12178] "syz.4.1653" (12178) uses obsolete ecb(arc4) skcipher [ 300.828531][T12193] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 300.898127][T12191] 8021q: adding VLAN 0 to HW filter on device bond7 [ 300.917377][T12191] bond6: (slave bond7): Enslaving as an active interface with a down link [ 301.079740][T12205] openvswitch: netlink: Key type 30 is not supported [ 301.432375][T12221] netlink: 'syz.2.1665': attribute type 3 has an invalid length. [ 301.614084][T12238] __nla_validate_parse: 16 callbacks suppressed [ 301.614105][T12238] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1670'. [ 301.637383][T12235] netlink: 'syz.2.1669': attribute type 39 has an invalid length. [ 301.652449][T12236] pim6reg: entered allmulticast mode [ 301.670679][T12237] pim6reg: left allmulticast mode [ 301.681729][T12237] bridge0: left allmulticast mode [ 301.694210][T12240] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1670'. [ 301.705251][T12236] netlink: 'syz.1.1671': attribute type 1 has an invalid length. [ 301.746278][ T7608] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 301.774750][T12235] hsr_slave_1 (unregistering): left promiscuous mode [ 301.821904][T12236] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 301.981717][T12253] netlink: 'syz.1.1674': attribute type 1 has an invalid length. [ 302.106615][T12260] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1677'. [ 302.131968][T12258] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1677'. [ 302.150280][T12218] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 302.397818][T12271] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1682'. [ 302.432788][T12271] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1682'. [ 302.442973][T12272] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1681'. [ 302.460505][T12275] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1683'. [ 302.515395][T12277] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1683'. [ 302.578383][T12275] bond6: entered promiscuous mode [ 302.592459][T12275] 8021q: adding VLAN 0 to HW filter on device bond6 [ 302.927029][T12295] syzkaller1: entered promiscuous mode [ 302.961565][T12295] syzkaller1: entered allmulticast mode [ 303.074866][T12311] IPv6: NLM_F_CREATE should be specified when creating new route [ 303.351480][T12321] SET target dimension over the limit! [ 303.378724][T12321] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1695'. [ 303.839295][T12349] xt_l2tp: missing protocol rule (udp|l2tpip) [ 304.156998][T12374] siw: device registration error -23 [ 304.181707][T12374] macvlan3: entered allmulticast mode [ 304.192309][T12374] hsr0: entered allmulticast mode [ 304.201394][T12374] hsr_slave_0: entered allmulticast mode [ 304.211679][T12374] hsr_slave_1: entered allmulticast mode [ 304.473966][T12391] Cannot find set identified by id 65534 to match [ 304.834437][T12410] xt_hashlimit: size too large, truncated to 1048576 [ 305.210833][T12439] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 305.218194][T12439] IPv6: NLM_F_CREATE should be set when creating new route [ 305.225538][T12439] IPv6: NLM_F_CREATE should be set when creating new route [ 305.795812][T12460] syzkaller0: entered promiscuous mode [ 305.803292][T12460] syzkaller0: entered allmulticast mode [ 306.077568][T12478] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 306.275843][T12490] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 306.457696][T12495] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 306.546476][T12512] sctp: [Deprecated]: syz.3.1749 (pid 12512) Use of int in maxseg socket option. [ 306.546476][T12512] Use struct sctp_assoc_value instead [ 306.805899][T12521] __nla_validate_parse: 17 callbacks suppressed [ 306.805920][T12521] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1753'. [ 307.135077][T12538] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 307.619136][T12559] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1766'. [ 307.673177][T12566] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.1769'. [ 307.694032][T12564] 8021q: VLANs not supported on lo [ 307.704587][T12568] 8021q: VLANs not supported on lo [ 307.779141][T12568] netlink: 'syz.3.1767': attribute type 1 has an invalid length. [ 307.811952][T12568] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1767'. [ 307.821935][T12568] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1767'. [ 307.833191][T12568] netlink: 'syz.3.1767': attribute type 2 has an invalid length. [ 307.842205][T12568] netlink: 'syz.3.1767': attribute type 2 has an invalid length. [ 307.851764][T12568] netlink: 'syz.3.1767': attribute type 2 has an invalid length. [ 307.873985][T12583] macvtap0: entered promiscuous mode [ 307.879679][T12583] macvtap0: entered allmulticast mode [ 307.885423][T12583] veth1_vlan: entered allmulticast mode [ 307.936944][T12583] macvtap1: entered promiscuous mode [ 307.943743][T12583] macvtap1: entered allmulticast mode [ 307.951090][T12588] netlink: 'syz.2.1773': attribute type 11 has an invalid length. [ 307.959107][T12588] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1773'. [ 308.257638][T12597] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1776'. [ 308.360624][T12603] syzkaller0: entered promiscuous mode [ 308.366376][T12603] syzkaller0: entered allmulticast mode [ 308.765877][T12617] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1783'. [ 308.863409][T12620] IPVS: set_ctl: invalid protocol: 180 0.0.0.0:20000 [ 308.906967][T12628] netlink: 'syz.3.1787': attribute type 1 has an invalid length. [ 309.094914][T12640] netlink: 'syz.3.1789': attribute type 1 has an invalid length. [ 309.103994][T12640] netlink: 228 bytes leftover after parsing attributes in process `syz.3.1789'. [ 309.331634][T12657] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1793'. [ 309.376676][T12659] sctp: [Deprecated]: syz.1.1794 (pid 12659) Use of int in max_burst socket option. [ 309.376676][T12659] Use struct sctp_assoc_value instead [ 310.688240][T12609] »»»»»»: renamed from bond_slave_0 (while UP) [ 310.814843][T12629] vxcan1 speed is unknown, defaulting to 1000 [ 310.938891][T12690] xt_hashlimit: size too large, truncated to 1048576 [ 310.964582][T12693] xt_hashlimit: size too large, truncated to 1048576 [ 310.989643][T12697] xt_hashlimit: size too large, truncated to 1048576 [ 311.044711][T12701] –: renamed from vxcan1 (while UP) [ 311.452712][T12629] gre0 speed is unknown, defaulting to 1000 [ 311.757064][T12740] netlink: 'syz.4.1812': attribute type 7 has an invalid length. [ 311.846326][T12740] netlink: 'syz.4.1812': attribute type 7 has an invalid length. [ 311.964693][T12743] netlink: 'syz.2.1813': attribute type 1 has an invalid length. [ 311.982413][T12743] netlink: 'syz.2.1813': attribute type 2 has an invalid length. [ 312.112665][T12748] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 312.226774][T12756] __nla_validate_parse: 54 callbacks suppressed [ 312.226796][T12756] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1818'. [ 312.515768][T12765] bond4: entered promiscuous mode [ 312.526368][T12765] 8021q: adding VLAN 0 to HW filter on device bond4 [ 312.558507][T12769] bond4: (slave bridge3): making interface the new active one [ 312.566285][T12769] bridge3: entered promiscuous mode [ 312.573121][T12769] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 314.378296][ T9450] IPVS: starting estimator thread 0... [ 314.483436][T12793] IPVS: using max 26 ests per chain, 62400 per kthread [ 314.591833][T12804] syzkaller0: entered promiscuous mode [ 314.602026][T12804] syzkaller0: entered allmulticast mode [ 314.938041][T12811] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1834'. [ 315.171815][T12816] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1836'. [ 315.249897][T12818] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1837'. [ 315.259287][T12818] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1837'. [ 315.273797][T12818] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1837'. [ 315.284527][T12818] IPVS: Unknown mcast interface: vcan0 [ 315.708624][T12841] syzkaller1: entered promiscuous mode [ 315.717165][T12841] syzkaller1: entered allmulticast mode [ 315.734404][T12849] netlink: 128 bytes leftover after parsing attributes in process `syz.4.1846'. [ 315.743719][T12849] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1846'. [ 315.765617][T12843] openvswitch: netlink: IPv4 tunnel dst address is zero [ 315.774219][T12840] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1843'. [ 315.778894][T12849] netlink: 128 bytes leftover after parsing attributes in process `syz.4.1846'. [ 315.794432][T12846] openvswitch: netlink: IPv4 tunnel dst address is zero [ 316.094871][T12858] syzkaller0: entered promiscuous mode [ 316.106472][T12858] syzkaller0: entered allmulticast mode [ 316.412618][T12892] netlink: Conntrack attr has 3 unknown bytes [ 316.494495][T12896] validate_nla: 1 callbacks suppressed [ 316.494515][T12896] netlink: 'syz.3.1858': attribute type 3 has an invalid length. [ 317.136586][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.568339][T12903] gtp2: entered promiscuous mode [ 318.579863][T12903] gtp2: entered allmulticast mode [ 319.057111][T12937] __nla_validate_parse: 3 callbacks suppressed [ 319.057129][T12937] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1869'. [ 319.108620][T12937] sit0: entered promiscuous mode [ 319.129380][T12937] netlink: 'syz.0.1869': attribute type 1 has an invalid length. [ 319.147495][T12937] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1869'. [ 319.166436][T12940] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1872'. [ 319.183327][T12940] openvswitch: netlink: IP tunnel dst address not specified [ 319.196195][T12944] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1873'. [ 319.226823][T12946] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1873'. [ 319.248175][T12946] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1873'. [ 319.249212][T12943] netlink: 'syz.4.1872': attribute type 10 has an invalid length. [ 319.301090][T12943] bridge_slave_1: left allmulticast mode [ 319.330520][T12943] bridge_slave_1: left promiscuous mode [ 319.397524][T12943] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.437918][T12943] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 319.575876][T12960] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0x2 [ 319.597657][T12960] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1877'. [ 319.620928][T12962] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1878'. [ 319.645874][ T7613] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 319.669744][ T7613] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 319.681609][ T9451] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 319.839917][T12972] syz_tun: entered allmulticast mode [ 319.874963][T12965] syz_tun: left allmulticast mode [ 319.925287][T12977] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1883'. [ 319.934412][T12977] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1883'. [ 320.101029][T12981] veth1_macvtap: renamed from veth0_vlan [ 320.273373][T12996] IPv6: NLM_F_CREATE should be specified when creating new route [ 320.328321][T12999] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 320.358713][T12989] openvswitch: netlink: Flow actions attr not present in new flow. [ 320.560793][ T9448] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 320.641124][ T9448] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 320.934827][T13039] netlink: 'syz.4.1896': attribute type 1 has an invalid length. [ 322.045204][T13103] netlink: 'syz.2.1911': attribute type 1 has an invalid length. [ 322.732518][T13132] IPVS: length: 8 != 1152 [ 323.435583][T13168] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 323.948802][ T9448] hid-generic 0005:4C4A:0009.0002: unknown main item tag 0x0 [ 324.056938][ T9448] hid-generic 0005:4C4A:0009.0002: hidraw0: BLUETOOTH HID v0.09 Device [syz1] on aa:aa:aa:aa:aa:aa [ 324.090251][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 324.262723][T13205] ipvlan2: entered promiscuous mode [ 324.274476][T13209] __nla_validate_parse: 10 callbacks suppressed [ 324.274496][T13209] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1940'. [ 324.351875][T13205] ipvlan3: entered promiscuous mode [ 324.443188][T13205] ipvlan4: entered promiscuous mode [ 324.517677][T13205] ipvlan5: entered promiscuous mode [ 324.553319][T13209] syzkaller0: entered promiscuous mode [ 324.566389][T13209] syzkaller0: entered allmulticast mode [ 324.634875][T13205] ipvlan6: entered promiscuous mode [ 324.702326][T13205] ipvlan7: entered promiscuous mode [ 324.847403][T13205] ipvlan8: entered promiscuous mode [ 324.923852][T13205] ipvlan9: entered promiscuous mode [ 324.965781][T13205] ipvlan10: entered promiscuous mode [ 325.018116][T13205] ipvlan11: entered promiscuous mode [ 325.324920][T13233] netlink: 27 bytes leftover after parsing attributes in process `syz.3.1946'. [ 325.629856][T13253] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1951'. [ 325.894721][T13268] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1956'. [ 325.931007][T13268] IPv6: NLM_F_CREATE should be specified when creating new route [ 325.950858][T13268] IPv6: Can't replace route, no match found [ 325.958771][T13271] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1958'. [ 326.265413][T13283] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1960'. [ 326.609792][T13292] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1966'. [ 326.637001][T13292] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 326.667754][T13292] netlink: 148 bytes leftover after parsing attributes in process `syz.3.1966'. [ 326.916089][T13305] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1969'. [ 327.631686][T13337] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 328.033959][T13354] RDS: rds_bind could not find a transport for fe88::104, load rds_tcp or rds_rdma? [ 328.323976][T13368] syzkaller1: entered promiscuous mode [ 328.346387][T13368] syzkaller1: entered allmulticast mode [ 328.445649][T13372] ip_vti0: left promiscuous mode [ 329.986950][T13431] netem: incorrect gi model size [ 330.179866][T13445] syzkaller1: entered promiscuous mode [ 330.195932][T13445] syzkaller1: entered allmulticast mode [ 330.221345][T13445] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 324 [ 330.232926][T13453] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2011'. [ 330.251770][T13453] tc_dump_action: action bad kind [ 330.403646][T13463] ip6gre3: entered allmulticast mode [ 330.598123][T13470] sch_fq: defrate 0 ignored. [ 330.681157][T13477] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2015'. [ 330.719441][T13477] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2015'. [ 330.898929][T13491] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 330.906265][T13491] IPv6: NLM_F_CREATE should be set when creating new route [ 330.951688][T13491] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2018'. [ 331.012946][T13485] netlink: 'syz.1.2019': attribute type 3 has an invalid length. [ 331.557868][T13512] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2025'. [ 331.849178][T13532] siw: device registration error -23 [ 331.956757][T13534] x_tables: duplicate entry at hook 3 [ 332.337664][T13556] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2037'. [ 332.703037][T13568] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 333.093148][T13579] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2041'. [ 333.120222][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 333.359851][T13590] netlink: 'syz.0.2043': attribute type 21 has an invalid length. [ 333.390152][T13590] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2043'. [ 333.413738][T13590] netlink: 'syz.0.2043': attribute type 5 has an invalid length. [ 333.445623][T13590] netlink: 'syz.0.2043': attribute type 6 has an invalid length. [ 333.470206][T13590] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2043'. [ 334.112523][T13626] netlink: ct family unspecified [ 334.127237][T13629] nft_compat: unsupported protocol 5 [ 334.970831][T13664] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 334.994430][T13664] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.015113][T13664] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 335.194791][T13664] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 335.236969][T13664] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.264479][T13664] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 335.318390][T13693] netlink: 'syz.0.2067': attribute type 1 has an invalid length. [ 335.436385][T13690] veth0: entered promiscuous mode [ 335.537809][T13664] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 335.576642][T13664] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.621411][T13664] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 335.701739][T13690] veth0: left promiscuous mode [ 335.742644][T13714] __nla_validate_parse: 3 callbacks suppressed [ 335.742665][T13714] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2071'. [ 335.784213][T13712] gtp1: entered promiscuous mode [ 335.799887][T13712] gtp1: entered allmulticast mode [ 335.854960][T13664] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 335.894821][T13664] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 335.927898][T13664] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 336.027032][T13718] tipc: Started in network mode [ 336.043919][T13718] tipc: Node identity bbbbbb01, cluster identity 4711 [ 336.075973][T13718] tipc: Enabled bearer , priority 10 [ 336.339007][ T36] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 336.361641][T13738] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2077'. [ 336.371662][ T36] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 336.405999][ T36] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 336.609301][ T36] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 336.624822][ T36] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 336.652402][ T36] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 336.784337][ T36] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 336.808814][ T36] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 336.836777][ T36] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 336.957522][ T7613] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 336.992737][ T7613] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 337.016688][ T7613] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 337.060200][ T9450] tipc: Node number set to 3149642497 [ 337.174243][ T30] audit: type=1800 audit(1776416908.896:3): pid=13783 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2087" name="memory.events" dev="tmpfs" ino=2099 res=0 errno=0 [ 337.266541][ T30] audit: type=1804 audit(1776416908.926:4): pid=13783 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.2087" name="/newroot/409/memory.events" dev="tmpfs" ino=2099 res=1 errno=0 [ 337.418197][T13799] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2090'. [ 337.431864][T13799] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2090'. [ 337.460980][T13799] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2090'. [ 337.472898][T13799] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2090'. [ 337.507455][T13803] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2092'. [ 337.511813][T13800] IPv6: sit4: Disabled Multicast RS [ 337.835014][T13816] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2095'. [ 337.887277][T13823] xt_limit: Overflow, try lower: 271964/0 [ 338.165275][T13830] vxcan1 speed is unknown, defaulting to 1000 [ 338.193631][T13841] syzkaller0: entered promiscuous mode [ 338.210540][T13841] syzkaller0: entered allmulticast mode [ 338.796705][ T7595] bond0: (slave bond_slave_0): interface is now down [ 338.808404][T13855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 338.819581][ T7595] bond0: (slave bond_slave_1): interface is now down [ 338.828385][ T7595] bond0: (slave wlan1): interface is now down [ 338.857240][T13830] gre0 speed is unknown, defaulting to 1000 [ 338.997812][T13871] netlink: 'syz.3.2108': attribute type 4 has an invalid length. [ 339.093553][T13876] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2110'. [ 339.331927][T13883] unsupported nlmsg_type 40 [ 339.346942][T13883] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2113'. [ 339.378971][T13889] netlink: 'syz.3.2115': attribute type 2 has an invalid length. [ 339.432452][T13889] gtp3: entered promiscuous mode [ 339.443216][T13889] gtp3: entered allmulticast mode [ 339.648670][T13886] vxcan1 speed is unknown, defaulting to 1000 [ 340.024390][T13912] can: request_module (can-proto-0) failed. [ 340.178039][T13921] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 340.252333][T13886] gre0 speed is unknown, defaulting to 1000 [ 340.999772][T13949] __nla_validate_parse: 2 callbacks suppressed [ 340.999791][T13949] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2127'. [ 341.362201][ T7595] bond0: (slave bond_slave_0): interface is now down [ 341.384608][ T7595] bond0: (slave bond_slave_1): interface is now down [ 341.404289][ T7595] bond0: (slave wlan1): interface is now down [ 341.545287][T13940] netlink: 'syz.2.2126': attribute type 10 has an invalid length. [ 342.073657][T13981] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 342.594796][T13998] x_tables: duplicate underflow at hook 1 [ 342.690555][T13999] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2136'. [ 343.054043][T14016] rdma_rxe: rxe_newlink: failed to add lo [ 343.460671][T14033] bond7: entered promiscuous mode [ 343.465926][T14033] bond7: entered allmulticast mode [ 343.472552][T14033] 8021q: adding VLAN 0 to HW filter on device bond7 [ 343.749247][T14061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2152'. [ 343.789314][T14063] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2152'. [ 343.798801][T14059] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2151'. [ 343.946543][T14068] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2153'. [ 343.973216][T14070] tipc: Enabling of bearer rejected, failed to enable media [ 344.003981][ T7608] bond0: (slave bond_slave_0): interface is now down [ 344.023501][ T7608] bond0: (slave bond_slave_1): interface is now down [ 344.029425][T14073] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2154'. [ 344.047251][ T7608] bond0: (slave wlan1): interface is now down [ 344.122246][T14076] syzkaller1: entered promiscuous mode [ 344.149826][T14076] syzkaller1: entered allmulticast mode [ 344.432956][T14090] netlink: 'syz.4.2162': attribute type 10 has an invalid length. [ 344.441686][T14090] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2162'. [ 344.462470][T14090] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 344.487601][T14097] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2163'. [ 344.719070][T14112] set match dimension is over the limit! [ 344.877140][T14113] bond5: Unable to set down delay as MII monitoring is disabled [ 344.916906][T14113] bond5 (unregistering): Released all slaves [ 345.258670][T14134] netlink: 'syz.3.2170': attribute type 12 has an invalid length. [ 345.399027][T14145] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2172'. [ 345.423488][T14141] netlink: 'syz.3.2170': attribute type 12 has an invalid length. [ 345.660504][T14158] netlink: 'syz.1.2177': attribute type 5 has an invalid length. [ 345.719230][T14160] syzkaller0: entered promiscuous mode [ 345.741314][T14160] syzkaller0: entered allmulticast mode [ 346.180456][T14189] __nla_validate_parse: 2 callbacks suppressed [ 346.180478][T14189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2183'. [ 346.235848][T14189] netlink: 'syz.1.2183': attribute type 5 has an invalid length. [ 346.282505][T14189] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2183'. [ 346.373094][T14203] syz.4.2186: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 346.413909][T14203] CPU: 0 UID: 0 PID: 14203 Comm: syz.4.2186 Not tainted syzkaller #0 PREEMPT(full) [ 346.413940][T14203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 346.413966][T14203] Call Trace: [ 346.413975][T14203] [ 346.413984][T14203] dump_stack_lvl+0xe8/0x150 [ 346.414024][T14203] warn_alloc+0x249/0x340 [ 346.414062][T14203] ? stack_trace_save+0xa9/0x100 [ 346.414091][T14203] ? __pfx_warn_alloc+0x10/0x10 [ 346.414133][T14203] ? kasan_save_track+0x4f/0x80 [ 346.414164][T14203] ? kasan_save_track+0x3e/0x80 [ 346.414194][T14203] ? __kasan_kmalloc+0x93/0xb0 [ 346.414211][T14203] ? __kmalloc_cache_noprof+0x31c/0x660 [ 346.414244][T14203] ? xskq_create+0x56/0x170 [ 346.414268][T14203] ? xsk_setsockopt+0x54c/0x990 [ 346.414289][T14203] ? do_sock_setsockopt+0x17c/0x1b0 [ 346.414320][T14203] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 346.414352][T14203] ? do_syscall_64+0x15f/0xf80 [ 346.414384][T14203] __vmalloc_node_range_noprof+0x132/0x1730 [ 346.414453][T14203] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 346.414493][T14203] ? __kasan_kmalloc+0x93/0xb0 [ 346.414521][T14203] vmalloc_user_noprof+0xad/0xe0 [ 346.414554][T14203] ? xskq_create+0xbf/0x170 [ 346.414577][T14203] xskq_create+0xbf/0x170 [ 346.414604][T14203] xsk_init_queue+0x8a/0xe0 [ 346.414629][T14203] xsk_setsockopt+0x54c/0x990 [ 346.414654][T14203] ? __pfx_xsk_setsockopt+0x10/0x10 [ 346.414676][T14203] ? __pfx_aa_sk_perm+0x10/0x10 [ 346.414709][T14203] ? aa_sock_opt_perm+0xff/0x1a0 [ 346.414743][T14203] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 346.414778][T14203] ? __pfx_xsk_setsockopt+0x10/0x10 [ 346.414823][T14203] do_sock_setsockopt+0x17c/0x1b0 [ 346.414861][T14203] __x64_sys_setsockopt+0x13d/0x1b0 [ 346.414901][T14203] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.414925][T14203] do_syscall_64+0x15f/0xf80 [ 346.414962][T14203] ? trace_irq_disable+0x3b/0x140 [ 346.414983][T14203] ? clear_bhb_loop+0x40/0x90 [ 346.415008][T14203] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.415028][T14203] RIP: 0033:0x7f899f59c819 [ 346.415048][T14203] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.415066][T14203] RSP: 002b:00007f89a04cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 346.415089][T14203] RAX: ffffffffffffffda RBX: 00007f899f816090 RCX: 00007f899f59c819 [ 346.415105][T14203] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 346.415118][T14203] RBP: 00007f899f632c91 R08: 0000000000000004 R09: 0000000000000000 [ 346.415131][T14203] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 346.415144][T14203] R13: 00007f899f816128 R14: 00007f899f816090 R15: 00007ffd0c057ff8 [ 346.415178][T14203] [ 346.417507][T14203] Mem-Info: [ 346.566807][ T7608] bond0: (slave bond_slave_0): interface is now down [ 346.695214][T14203] active_anon:6257 inactive_anon:0 isolated_anon:0 [ 346.695214][T14203] active_file:3026 inactive_file:40051 isolated_file:0 [ 346.695214][T14203] unevictable:768 dirty:102 writeback:0 [ 346.695214][T14203] slab_reclaimable:11625 slab_unreclaimable:107735 [ 346.695214][T14203] mapped:29464 shmem:1366 pagetables:3509 [ 346.695214][T14203] sec_pagetables:0 bounce:0 [ 346.695214][T14203] kernel_misc_reclaimable:0 [ 346.695214][T14203] free:1314137 free_pcp:7810 free_cma:0 [ 346.753919][T14203] Node 0 active_anon:25028kB inactive_anon:0kB active_file:12104kB inactive_file:160004kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117856kB dirty:404kB writeback:0kB shmem:3928kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14516kB pagetables:13912kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 346.787542][T14203] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 346.843061][ T7608] bond0: (slave bond_slave_1): interface is now down [ 346.850251][ T7608] bond0: (slave wlan1): interface is now down [ 346.864321][T14197] netlink: 'syz.4.2186': attribute type 5 has an invalid length. [ 346.865437][T14203] Node 0 [ 346.878724][T14211] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2189'. [ 346.898196][ T7608] bond0: now running without any active interface! [ 346.907710][T14203] DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 346.958402][T14203] lowmem_reserve[]: 0 2491 2492 2492 2492 [ 347.008717][T14203] Node 0 DMA32 free:1300736kB boost:0kB min:34184kB low:42728kB high:51272kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25076kB inactive_anon:0kB active_file:12104kB inactive_file:160004kB unevictable:1536kB writepending:404kB zspages:0kB present:3129332kB managed:2551528kB mlocked:0kB bounce:0kB free_pcp:30896kB local_pcp:21340kB free_cma:0kB [ 347.068944][T14203] lowmem_reserve[]: 0 0 0 0 0 [ 347.090892][T14203] Node 0 Normal free:8kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:612kB mlocked:0kB bounce:0kB free_pcp:24kB local_pcp:12kB free_cma:0kB [ 347.127551][T14216] netlink: 'syz.3.2191': attribute type 29 has an invalid length. [ 347.144379][T14203] lowmem_reserve[]: 0 0 0 0 0 [ 347.161706][T14217] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 347.168305][T14203] Node 1 Normal free:3941152kB boost:0kB min:55708kB low:69632kB high:83556kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 347.214922][T14216] netlink: 'syz.3.2191': attribute type 29 has an invalid length. [ 347.237901][T14203] lowmem_reserve[]: 0 0 0 0 0 [ 347.244102][T14216] netlink: 340 bytes leftover after parsing attributes in process `syz.3.2191'. [ 347.260153][T14203] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 347.281157][T14216] netlink: 'syz.3.2191': attribute type 32 has an invalid length. [ 347.290781][T14203] Node 0 DMA32: 7267*4kB (UME) 3998*8kB (UME) 2036*16kB (UM) 1354*32kB (UE) 1011*64kB (U) 767*128kB (UE) 580*256kB (UM) 375*512kB (UME) 209*1024kB (UME) 34*2048kB (UM) 92*4096kB (UM) = 1300796kB [ 347.315469][T14216] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2191'. [ 347.327248][T14203] Node 0 Normal: 0*4kB 1*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 347.342720][T14216] netlink: 'syz.3.2191': attribute type 1 has an invalid length. [ 347.350752][T14203] Node 1 Normal: 0*4kB 10*8kB (UM) 13*16kB (UM) 6*32kB (UM) 3*64kB (UM) 5*128kB (UM) 6*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3941152kB [ 347.367930][T14216] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2191'. [ 347.382567][T14203] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 347.429594][T14203] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 347.468679][T14203] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 347.507085][T14203] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 347.541343][T14203] 44440 total pagecache pages [ 347.561074][T14227] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 347.564853][T14203] 0 pages in swap cache [ 347.568349][T14227] IPv6: NLM_F_CREATE should be set when creating new route [ 347.584674][T14203] Free swap = 124996kB [ 347.600067][T14203] Total swap = 124996kB [ 347.609320][T14203] 2097051 pages RAM [ 347.620632][T14227] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2195'. [ 347.631553][T14203] 0 pages HighMem/MovableOnly [ 347.639387][T14203] 427401 pages reserved [ 347.653843][T14203] 0 pages cma reserved [ 347.722032][T14235] atomic_op ffff88807ccae198 conn xmit_atomic 0000000000000000 [ 347.814025][T14242] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2197'. [ 347.906225][T14248] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.2199'. [ 347.954179][T14248] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 347.964610][T14242] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2197'. [ 348.137696][T14252] geneve2: entered promiscuous mode [ 348.416811][T14274] tc_dump_action: action bad kind [ 348.747748][T14291] batadv1: entered allmulticast mode [ 349.810140][T14348] validate_nla: 1 callbacks suppressed [ 349.810163][T14348] netlink: 'syz.4.2226': attribute type 2 has an invalid length. [ 350.118152][T14368] netlink: 'syz.4.2229': attribute type 1 has an invalid length. [ 350.148032][T14352] vxcan1 speed is unknown, defaulting to 1000 [ 350.205007][T14368] bond6: entered promiscuous mode [ 350.210770][T14368] 8021q: adding VLAN 0 to HW filter on device bond6 [ 350.400394][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 352.058007][T14363] bond6: (slave bridge6): making interface the new active one [ 352.065804][T14363] bridge6: entered promiscuous mode [ 352.072902][T14363] bond6: (slave bridge6): Enslaving as an active interface with an up link [ 352.123925][T14382] : entered promiscuous mode [ 352.136034][T14352] gre0 speed is unknown, defaulting to 1000 [ 352.269353][T14394] : renamed from hsr0 (while UP) [ 352.358052][T14402] tipc: New replicast peer: 255.255.255.255 [ 352.372302][T14402] tipc: Enabled bearer , priority 10 [ 352.832188][T14421] __nla_validate_parse: 15 callbacks suppressed [ 352.832212][T14421] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2243'. [ 352.886419][T14424] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2243'. [ 352.944528][T14430] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2243'. [ 352.966433][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 353.100191][T14424] xfrm2: entered promiscuous mode [ 353.122923][T14424] xfrm2: entered allmulticast mode [ 353.718830][T14456] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2252'. [ 353.794498][T14462] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2254'. [ 353.918997][T14470] netlink: 'syz.4.2257': attribute type 10 has an invalid length. [ 353.919931][T14466] vxcan1 speed is unknown, defaulting to 1000 [ 353.937322][T14470] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2257'. [ 354.702711][T14503] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2266'. [ 354.768438][T14503] syzkaller1: entered promiscuous mode [ 354.778782][T14503] syzkaller1: entered allmulticast mode [ 354.823046][T14511] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2268'. [ 354.845427][T14466] gre0 speed is unknown, defaulting to 1000 [ 355.035157][T14519] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2270'. [ 355.253111][T14526] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2273'. [ 355.316237][T14533] netlink: 'syz.0.2275': attribute type 1 has an invalid length. [ 355.482286][T14526] bridge4: port 1(bond5) entered blocking state [ 355.505789][T14526] bridge4: port 1(bond5) entered disabled state [ 355.527646][T14526] bond5: entered allmulticast mode [ 355.549846][T14526] bond5: entered promiscuous mode [ 356.424970][T14589] syzkaller0: entered promiscuous mode [ 356.432593][T14589] syzkaller0: entered allmulticast mode [ 357.011444][T14610] bond8: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 357.025791][T14615] netlink: 'syz.0.2299': attribute type 4 has an invalid length. [ 357.033816][T14613] netlink: 'syz.1.2298': attribute type 11 has an invalid length. [ 357.042401][T14609] netlink: 'syz.4.2297': attribute type 4 has an invalid length. [ 357.057702][T14609] netlink: 'syz.4.2297': attribute type 4 has an invalid length. [ 357.195289][T14621] syzkaller0: entered promiscuous mode [ 357.201022][T14621] syzkaller0: entered allmulticast mode [ 357.268295][T14621] netlink: 'syz.2.2301': attribute type 32 has an invalid length. [ 357.471925][T14623] vxcan1 speed is unknown, defaulting to 1000 [ 357.833628][T14651] block nbd0: server does not support multiple connections per device. [ 357.859808][T14651] block nbd0: shutting down sockets [ 357.904405][T14648] syzkaller0: entered promiscuous mode [ 357.912785][T14648] syzkaller0: entered allmulticast mode [ 358.057132][T14667] netlink: 'syz.1.2311': attribute type 10 has an invalid length. [ 358.183969][T14672] __nla_validate_parse: 8 callbacks suppressed [ 358.183990][T14672] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2312'. [ 359.846087][T14623] gre0 speed is unknown, defaulting to 1000 [ 359.996606][T14685] netlink: 'syz.1.2315': attribute type 1 has an invalid length. [ 360.017529][T14685] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2315'. [ 360.168764][T14697] netlink: 'syz.4.2318': attribute type 1 has an invalid length. [ 360.183080][T14697] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2318'. [ 360.706382][T14728] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2325'. [ 361.146801][T14747] netlink: 216 bytes leftover after parsing attributes in process `syz.1.2331'. [ 361.169513][T14749] siw: device registration error -23 [ 361.176427][T14747] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2331'. [ 361.300708][T14753] IPVS: length: 25 != 8 [ 361.646846][T14779] veth0: entered promiscuous mode [ 361.666261][T14779] veth0: left promiscuous mode [ 362.158070][T14805] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2346'. [ 362.836614][T14840] tipc: Enabling of bearer rejected, failed to enable media [ 362.840712][T14841] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2357'. [ 362.870317][T14840] tipc: Enabling of bearer rejected, failed to enable media [ 363.225272][T14854] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 363.232593][T14854] IPv6: NLM_F_CREATE should be set when creating new route [ 363.264338][T14854] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2361'. [ 363.357112][T14863] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2365'. [ 363.473087][T14865] netlink: 'syz.2.2366': attribute type 2 has an invalid length. [ 363.523150][T14868] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2367'. [ 363.581844][T14872] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2369'. [ 363.788340][T14880] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2372'. [ 363.820620][T14880] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2372'. [ 363.860241][T14880] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2372'. [ 364.317627][T14915] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2382'. [ 364.336896][T14915] block nbd0: Unsupported socket: should be TCP or UNIX. [ 364.365200][T14916] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2383'. [ 364.434496][T14921] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2383'. [ 364.702532][T14933] netlink: 'syz.1.2387': attribute type 1 has an invalid length. [ 364.896854][T14938] 8021q: adding VLAN 0 to HW filter on device bond7 [ 364.908282][T14938] bond6: (slave bond7): making interface the new active one [ 364.918670][T14938] bond6: (slave bond7): Enslaving as an active interface with an up link [ 364.954733][T14933] bond6: (slave gretap1): Enslaving as a backup interface with an up link [ 364.967626][T14943] 8021q: adding VLAN 0 to HW filter on device bond6 [ 365.043652][T14953] xt_TCPMSS: Only works on TCP SYN packets [ 365.456134][T14977] netlink: 'syz.1.2398': attribute type 2 has an invalid length. [ 365.497599][T14977] netlink: 'syz.1.2398': attribute type 2 has an invalid length. [ 365.524970][T14978] netlink: 'syz.3.2399': attribute type 1 has an invalid length. [ 365.758846][ T5486] veth0_macvtap: left promiscuous mode [ 366.186809][T15011] netlink: 'syz.0.2405': attribute type 3 has an invalid length. [ 366.320867][T15022] x_tables: ip_tables: tcp match: only valid for protocol 6 [ 366.479823][T15025] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 366.577927][T15031] vxcan1 speed is unknown, defaulting to 1000 [ 366.607781][T15032] hsr0: entered promiscuous mode [ 366.614845][T15032] macvlan4: entered allmulticast mode [ 366.620429][T15032] hsr0: entered allmulticast mode [ 366.625622][T15032] hsr_slave_0: entered allmulticast mode [ 366.904549][T15054] netlink: 'syz.2.2414': attribute type 12 has an invalid length. [ 366.955251][T15053] syzkaller1: entered promiscuous mode [ 366.980740][T15053] syzkaller1: entered allmulticast mode [ 367.243375][T15070] 8021q: VLANs not supported on lo [ 367.269809][T15075] ieee802154 phy1 wpan1: encryption failed: -22 [ 367.575890][T15097] batadv0: entered allmulticast mode [ 367.676807][T15096] batadv0: entered allmulticast mode [ 368.232462][T15134] netlink: 'syz.3.2437': attribute type 32 has an invalid length. [ 368.288254][T15149] netlink: 'syz.0.2441': attribute type 4 has an invalid length. [ 368.303366][T15149] __nla_validate_parse: 19 callbacks suppressed [ 368.303384][T15149] netlink: 244 bytes leftover after parsing attributes in process `syz.0.2441'. [ 368.359855][T15150] bridge0: entered allmulticast mode [ 368.482958][T15155] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2442'. [ 368.543578][T15167] netlink: 'syz.2.2446': attribute type 1 has an invalid length. [ 368.613410][T15172] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2446'. [ 368.684119][T15167] 8021q: adding VLAN 0 to HW filter on device bond9 [ 368.692106][T15170] tunl0: entered promiscuous mode [ 368.697688][T15170] netlink: 'syz.0.2447': attribute type 3 has an invalid length. [ 368.708887][T15170] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2447'. [ 368.751760][T15171] 8021q: adding VLAN 0 to HW filter on device bond9 [ 368.783571][T15171] bond9 (unregistering): Released all slaves [ 368.815066][T15175] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2448'. [ 368.938170][T15187] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2452'. [ 368.978298][T15187] vlan2: entered promiscuous mode [ 368.995317][T15187] syz_tun: entered promiscuous mode [ 369.248514][T15205] xt_time: unknown flags 0xf4 [ 369.298505][T15210] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2459'. [ 369.691951][T15231] netlink: 112 bytes leftover after parsing attributes in process `syz.2.2463'. [ 370.130401][T15249] netlink: 404 bytes leftover after parsing attributes in process `syz.1.2471'. [ 370.170771][T15249] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2471'. [ 370.194146][T15253] openvswitch: netlink: IPv4 tun info is not correct [ 370.472265][T15266] netlink: 'syz.3.2477': attribute type 1 has an invalid length. [ 370.691483][T15254] IPVS: Unknown mcast interface: vcan0 [ 371.035493][T15285] netlink: 'syz.3.2482': attribute type 1 has an invalid length. [ 371.163475][T15291] netlink: 'syz.1.2483': attribute type 25 has an invalid length. [ 371.250885][T15301] netlink: zone id is out of range [ 371.256231][T15301] netlink: zone id is out of range [ 371.262281][T15301] netlink: del zone limit has 4 unknown bytes [ 371.593941][T15314] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 372.811246][T15374] team0 (unregistering): Port device team_slave_0 removed [ 372.842248][T15374] team0 (unregistering): Port device team_slave_1 removed [ 372.868284][T15375] vlan0: entered allmulticast mode [ 372.873756][T15375] veth0_vlan: entered allmulticast mode [ 374.784316][T15321] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 375.414199][T15416] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 375.481293][T15418] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 375.547639][T15406] __nla_validate_parse: 7 callbacks suppressed [ 375.547658][T15406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2508'. [ 375.648200][T15427] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2508'. [ 375.680833][T15431] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2516'. [ 375.709803][T15435] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2519'. [ 375.719834][T15435] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2519'. [ 375.731775][T15427] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2508'. [ 375.758840][T15435] gretap1: entered promiscuous mode [ 375.774271][T15435] gretap1: entered allmulticast mode [ 375.810476][T15435] netlink: 196 bytes leftover after parsing attributes in process `syz.4.2519'. [ 375.923197][T15435] netlink: 260 bytes leftover after parsing attributes in process `syz.4.2519'. [ 375.942083][T15444] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2521'. [ 375.969705][T15444] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2521'. [ 376.342651][T15453] vxcan1 speed is unknown, defaulting to 1000 [ 377.085519][T15453] gre0 speed is unknown, defaulting to 1000 [ 378.566225][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.646076][T15557] bridge0: port 2(bridge_slave_1) entered disabled state [ 378.654428][T15557] bridge0: port 1(bridge_slave_0) entered disabled state [ 379.564338][T15587] hsr0: left allmulticast mode [ 379.580433][T15587] hsr_slave_0: left allmulticast mode [ 379.588605][T15587] hsr_slave_1: left allmulticast mode [ 379.600724][T15587] veth1_vlan: left allmulticast mode [ 379.635311][ T1157] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 379.660534][ T1157] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.680991][ T1157] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 379.703935][ T1157] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.754235][ T1157] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 379.795649][ T1157] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.824950][ T1157] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 379.848224][ T1157] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 380.130888][T15621] syzkaller1: entered promiscuous mode [ 380.150261][T15621] syzkaller1: entered allmulticast mode [ 380.317737][T15632] tipc: Enabled bearer , priority 10 [ 380.326975][T15514] mpoa:mpoad_close: () going down [ 380.388616][T15639] ip_tunnel: non-ECT from 10.1.1.0 with TOS=0x3 [ 381.188553][T15681] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 381.205859][T15682] __nla_validate_parse: 9 callbacks suppressed [ 381.205879][T15682] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2578'. [ 381.269579][T15682] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2578'. [ 381.329309][T15689] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2579'. [ 381.367420][T15689] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2579'. [ 381.403967][T15689] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2579'. [ 381.439945][T15689] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2579'. [ 381.644291][T15710] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2583'. [ 381.752372][ T7170] ================================================================== [ 381.760531][ T7170] BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x550 [ 381.768513][ T7170] Read of size 8 at addr ffff88806cb5bcc0 by task kworker/0:9/7170 [ 381.776449][ T7170] [ 381.778911][ T7170] CPU: 0 UID: 0 PID: 7170 Comm: kworker/0:9 Not tainted syzkaller #0 PREEMPT(full) [ 381.778938][ T7170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 381.778953][ T7170] Workqueue: mld mld_ifc_work [ 381.778990][ T7170] Call Trace: [ 381.778999][ T7170] [ 381.779008][ T7170] dump_stack_lvl+0xe8/0x150 [ 381.779040][ T7170] print_report+0xba/0x230 [ 381.779065][ T7170] ? sock_def_readable+0x1cb/0x550 [ 381.779088][ T7170] kasan_report+0x117/0x150 [ 381.779111][ T7170] ? sock_def_readable+0x1cb/0x550 [ 381.779140][ T7170] sock_def_readable+0x1cb/0x550 [ 381.779163][ T7170] ? sock_def_readable+0xae/0x550 [ 381.779187][ T7170] ? send_to_lecd+0x26d/0x830 [ 381.779212][ T7170] send_to_lecd+0x3e7/0x830 [ 381.779248][ T7170] lec_start_xmit+0xe52/0x2890 [ 381.779282][ T7170] dev_hard_start_xmit+0x2cd/0x830 [ 381.779313][ T7170] sch_direct_xmit+0x251/0x4c0 [ 381.779343][ T7170] ? __pfx_sch_direct_xmit+0x10/0x10 [ 381.779376][ T7170] __dev_queue_xmit+0x180f/0x3950 [ 381.779402][ T7170] ? __dev_queue_xmit+0x2b6/0x3950 [ 381.779433][ T7170] ? __pfx___dev_queue_xmit+0x10/0x10 [ 381.779454][ T7170] ? neigh_resolve_output+0x438/0x750 [ 381.779483][ T7170] ? eth_header+0x11b/0x200 [ 381.779503][ T7170] ? __asan_memcpy+0x40/0x70 [ 381.779545][ T7170] ? ip6_output+0x126/0x550 [ 381.779572][ T7170] ip6_output+0x340/0x550 [ 381.779599][ T7170] ? __pfx_ip6_output+0x10/0x10 [ 381.779626][ T7170] NF_HOOK+0x177/0x4f0 [ 381.779654][ T7170] ? __pfx_NF_HOOK+0x10/0x10 [ 381.779680][ T7170] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 381.779703][ T7170] ? __local_bh_enable_ip+0xd0/0x130 [ 381.779732][ T7170] ? lockdep_hardirqs_on+0x7a/0x110 [ 381.779764][ T7170] ? __local_bh_enable_ip+0xd0/0x130 [ 381.779792][ T7170] ? icmp6_dst_alloc+0x3a6/0x440 [ 381.779823][ T7170] mld_sendpack+0x8b4/0xe40 [ 381.779860][ T7170] ? mld_sendpack+0x213/0xe40 [ 381.779887][ T7170] ? __pfx_mld_sendpack+0x10/0x10 [ 381.779927][ T7170] mld_ifc_work+0x835/0xe70 [ 381.779957][ T7170] ? process_scheduled_works+0xa70/0x1860 [ 381.779985][ T7170] process_scheduled_works+0xb5d/0x1860 [ 381.780033][ T7170] ? __pfx_process_scheduled_works+0x10/0x10 [ 381.780067][ T7170] ? assign_work+0x3d5/0x5e0 [ 381.780098][ T7170] worker_thread+0xa53/0xfc0 [ 381.780144][ T7170] kthread+0x388/0x470 [ 381.780165][ T7170] ? __pfx_worker_thread+0x10/0x10 [ 381.780192][ T7170] ? __pfx_kthread+0x10/0x10 [ 381.780214][ T7170] ret_from_fork+0x514/0xb70 [ 381.780245][ T7170] ? __pfx_ret_from_fork+0x10/0x10 [ 381.780273][ T7170] ? __switch_to+0xc79/0x1410 [ 381.780299][ T7170] ? __pfx_kthread+0x10/0x10 [ 381.780321][ T7170] ret_from_fork_asm+0x1a/0x30 [ 381.780363][ T7170] [ 381.780371][ T7170] [ 382.040912][ T7170] Allocated by task 15489: [ 382.045351][ T7170] kasan_save_track+0x3e/0x80 [ 382.050159][ T7170] __kasan_slab_alloc+0x6c/0x80 [ 382.055202][ T7170] kmem_cache_alloc_lru_noprof+0x2b8/0x640 [ 382.061047][ T7170] sock_alloc_inode+0x2c/0x190 [ 382.065839][ T7170] alloc_inode+0x6a/0x1b0 [ 382.070193][ T7170] __sock_create+0x12d/0x9d0 [ 382.074802][ T7170] __sys_socket+0xd6/0x1b0 [ 382.079333][ T7170] __x64_sys_socket+0x7a/0x90 [ 382.084029][ T7170] do_syscall_64+0x15f/0xf80 [ 382.088637][ T7170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.094639][ T7170] [ 382.096979][ T7170] Freed by task 15514: [ 382.101053][ T7170] kasan_save_track+0x3e/0x80 [ 382.105765][ T7170] kasan_save_free_info+0x46/0x50 [ 382.110805][ T7170] __kasan_slab_free+0x5c/0x80 [ 382.115596][ T7170] kmem_cache_free+0x180/0x630 [ 382.120383][ T7170] rcu_core+0x7cd/0x1070 [ 382.124643][ T7170] handle_softirqs+0x22a/0x840 [ 382.129434][ T7170] __irq_exit_rcu+0xca/0x220 [ 382.134048][ T7170] irq_exit_rcu+0x9/0x30 [ 382.138307][ T7170] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 382.143961][ T7170] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 382.149988][ T7170] [ 382.152345][ T7170] Last potentially related work creation: [ 382.158068][ T7170] kasan_save_stack+0x3e/0x60 [ 382.162771][ T7170] kasan_record_aux_stack+0xbd/0xd0 [ 382.167993][ T7170] call_rcu+0xee/0x890 [ 382.172086][ T7170] evict+0x95b/0xb10 [ 382.176012][ T7170] __dentry_kill+0x1a2/0x5e0 [ 382.180643][ T7170] finish_dput+0xc9/0x480 [ 382.185175][ T7170] __fput+0x691/0xa60 [ 382.189180][ T7170] task_work_run+0x1d9/0x270 [ 382.193874][ T7170] get_signal+0x11eb/0x1330 [ 382.198482][ T7170] arch_do_signal_or_restart+0xbc/0x830 [ 382.204141][ T7170] exit_to_user_mode_loop+0x86/0x480 [ 382.209455][ T7170] do_syscall_64+0x33e/0xf80 [ 382.214091][ T7170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.220006][ T7170] [ 382.222344][ T7170] The buggy address belongs to the object at ffff88806cb5bc00 [ 382.222344][ T7170] which belongs to the cache sock_inode_cache of size 1408 [ 382.236938][ T7170] The buggy address is located 192 bytes inside of [ 382.236938][ T7170] freed 1408-byte region [ffff88806cb5bc00, ffff88806cb5c180) [ 382.250833][ T7170] [ 382.253170][ T7170] The buggy address belongs to the physical page: [ 382.259687][ T7170] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806cb5b000 pfn:0x6cb58 [ 382.269768][ T7170] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 382.278278][ T7170] memcg:ffff88806cb5fe01 [ 382.282790][ T7170] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 382.291389][ T7170] page_type: f5(slab) [ 382.295386][ T7170] raw: 00fff00000000240 ffff888140af9c80 ffffea0001e13810 ffffea0001b4a410 [ 382.303985][ T7170] raw: ffff88806cb5b000 0000000800150011 00000000f5000000 ffff88806cb5fe01 [ 382.312583][ T7170] head: 00fff00000000240 ffff888140af9c80 ffffea0001e13810 ffffea0001b4a410 [ 382.321262][ T7170] head: ffff88806cb5b000 0000000800150011 00000000f5000000 ffff88806cb5fe01 [ 382.329961][ T7170] head: 00fff00000000003 ffffea0001b2d601 00000000ffffffff 00000000ffffffff [ 382.338657][ T7170] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 382.347337][ T7170] page dumped because: kasan: bad access detected [ 382.353774][ T7170] page_owner tracks the page as allocated [ 382.359506][ T7170] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5821, tgid 5821 (syz-executor), ts 297394660793, free_ts 262242365895 [ 382.383183][ T7170] post_alloc_hook+0x231/0x280 [ 382.388258][ T7170] get_page_from_freelist+0x24dc/0x2580 [ 382.393826][ T7170] __alloc_frozen_pages_noprof+0x18d/0x380 [ 382.399659][ T7170] allocate_slab+0x77/0x660 [ 382.404175][ T7170] refill_objects+0x331/0x3c0 [ 382.408870][ T7170] __pcs_replace_empty_main+0x2e6/0x730 [ 382.414472][ T7170] kmem_cache_alloc_lru_noprof+0x37c/0x640 [ 382.420311][ T7170] sock_alloc_inode+0x2c/0x190 [ 382.425121][ T7170] alloc_inode+0x6a/0x1b0 [ 382.429478][ T7170] __sock_create+0x12d/0x9d0 [ 382.434105][ T7170] __sys_socket+0xd6/0x1b0 [ 382.438542][ T7170] __x64_sys_socket+0x7a/0x90 [ 382.443236][ T7170] do_syscall_64+0x15f/0xf80 [ 382.447842][ T7170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.453768][ T7170] page last free pid 8027 tgid 8027 stack trace: [ 382.460110][ T7170] __free_frozen_pages+0xc2b/0xdb0 [ 382.465252][ T7170] __slab_free+0x263/0x2b0 [ 382.469705][ T7170] qlist_free_all+0x97/0x100 [ 382.474337][ T7170] kasan_quarantine_reduce+0x148/0x160 [ 382.479824][ T7170] __kasan_slab_alloc+0x22/0x80 [ 382.484696][ T7170] __kmalloc_noprof+0x316/0x760 [ 382.489575][ T7170] tomoyo_realpath_from_path+0xe3/0x5d0 [ 382.495150][ T7170] tomoyo_path_perm+0x283/0x560 [ 382.500033][ T7170] security_inode_getattr+0x12b/0x310 [ 382.505426][ T7170] __x64_sys_newfstat+0x13b/0x270 [ 382.510473][ T7170] do_syscall_64+0x15f/0xf80 [ 382.515101][ T7170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.521028][ T7170] [ 382.523373][ T7170] Memory state around the buggy address: [ 382.529018][ T7170] ffff88806cb5bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 382.537098][ T7170] ffff88806cb5bc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 382.545177][ T7170] >ffff88806cb5bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 382.553256][ T7170] ^ [ 382.559435][ T7170] ffff88806cb5bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 382.567513][ T7170] ffff88806cb5bd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 382.575589][ T7170] ================================================================== [ 382.583784][ T7170] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 382.591008][ T7170] CPU: 0 UID: 0 PID: 7170 Comm: kworker/0:9 Not tainted syzkaller #0 PREEMPT(full) [ 382.600392][ T7170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 382.610491][ T7170] Workqueue: mld mld_ifc_work [ 382.615222][ T7170] Call Trace: [ 382.618520][ T7170] [ 382.621479][ T7170] vpanic+0x56c/0xa60 [ 382.625487][ T7170] ? __pfx_vpanic+0x10/0x10 [ 382.630020][ T7170] panic+0xc5/0xd0 [ 382.633764][ T7170] ? __pfx_panic+0x10/0x10 [ 382.638203][ T7170] ? sock_def_readable+0x1cb/0x550 [ 382.643337][ T7170] ? rcu_is_watching+0x15/0xb0 [ 382.648121][ T7170] ? sock_def_readable+0x1cb/0x550 [ 382.653246][ T7170] ? sock_def_readable+0x1cb/0x550 [ 382.658384][ T7170] check_panic_on_warn+0x89/0xb0 [ 382.663339][ T7170] ? sock_def_readable+0x1cb/0x550 [ 382.668471][ T7170] end_report+0x73/0x170 [ 382.672726][ T7170] ? sock_def_readable+0x1cb/0x550 [ 382.677856][ T7170] kasan_report+0x128/0x150 [ 382.682374][ T7170] ? sock_def_readable+0x1cb/0x550 [ 382.687502][ T7170] sock_def_readable+0x1cb/0x550 [ 382.692545][ T7170] ? sock_def_readable+0xae/0x550 [ 382.697601][ T7170] ? send_to_lecd+0x26d/0x830 [ 382.702309][ T7170] send_to_lecd+0x3e7/0x830 [ 382.706835][ T7170] lec_start_xmit+0xe52/0x2890 [ 382.711627][ T7170] dev_hard_start_xmit+0x2cd/0x830 [ 382.716760][ T7170] sch_direct_xmit+0x251/0x4c0 [ 382.721542][ T7170] ? __pfx_sch_direct_xmit+0x10/0x10 [ 382.726850][ T7170] __dev_queue_xmit+0x180f/0x3950 [ 382.731896][ T7170] ? __dev_queue_xmit+0x2b6/0x3950 [ 382.737032][ T7170] ? __pfx___dev_queue_xmit+0x10/0x10 [ 382.742412][ T7170] ? neigh_resolve_output+0x438/0x750 [ 382.747799][ T7170] ? eth_header+0x11b/0x200 [ 382.752314][ T7170] ? __asan_memcpy+0x40/0x70 [ 382.756940][ T7170] ? ip6_output+0x126/0x550 [ 382.761466][ T7170] ip6_output+0x340/0x550 [ 382.765817][ T7170] ? __pfx_ip6_output+0x10/0x10 [ 382.770688][ T7170] NF_HOOK+0x177/0x4f0 [ 382.774802][ T7170] ? __pfx_NF_HOOK+0x10/0x10 [ 382.779414][ T7170] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 382.785233][ T7170] ? __local_bh_enable_ip+0xd0/0x130 [ 382.790545][ T7170] ? lockdep_hardirqs_on+0x7a/0x110 [ 382.795774][ T7170] ? __local_bh_enable_ip+0xd0/0x130 [ 382.801086][ T7170] ? icmp6_dst_alloc+0x3a6/0x440 [ 382.806049][ T7170] mld_sendpack+0x8b4/0xe40 [ 382.810584][ T7170] ? mld_sendpack+0x213/0xe40 [ 382.815288][ T7170] ? __pfx_mld_sendpack+0x10/0x10 [ 382.820343][ T7170] mld_ifc_work+0x835/0xe70 [ 382.824878][ T7170] ? process_scheduled_works+0xa70/0x1860 [ 382.830619][ T7170] process_scheduled_works+0xb5d/0x1860 [ 382.836188][ T7170] ? __pfx_process_scheduled_works+0x10/0x10 [ 382.842188][ T7170] ? assign_work+0x3d5/0x5e0 [ 382.846826][ T7170] worker_thread+0xa53/0xfc0 [ 382.851453][ T7170] kthread+0x388/0x470 [ 382.855541][ T7170] ? __pfx_worker_thread+0x10/0x10 [ 382.860692][ T7170] ? __pfx_kthread+0x10/0x10 [ 382.865296][ T7170] ret_from_fork+0x514/0xb70 [ 382.869909][ T7170] ? __pfx_ret_from_fork+0x10/0x10 [ 382.875062][ T7170] ? __switch_to+0xc79/0x1410 [ 382.879754][ T7170] ? __pfx_kthread+0x10/0x10 [ 382.884365][ T7170] ret_from_fork_asm+0x1a/0x30 [ 382.889167][ T7170] [ 382.892802][ T7170] Kernel Offset: disabled [ 382.897140][ T7170] Rebooting in 86400 seconds..