last executing test programs: 3.597637701s ago: executing program 3 (id=2634): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000260029002dbd7000f9ffffff8100000008005e00", @ANYRES32=0x0, @ANYBLOB="788ab1e649474da603ea1c747198613bb7ae5bc3b95a74f59625d3c5bcbe13a7c2569d34d8787f32bac94dd567b44f67ac970e76f29365b427844e9b572ee0b3100046a5b27ac502b36ce66da868e77d49f27b014b45ce5a6791077704c604ff8b4ea7db003d840ebadd61637c6f1426fcbdae7d"], 0x1c}, 0x1, 0x0, 0x0, 0x8c811}, 0x48054) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket(0x200000000000011, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) (async) bind$packet(r3, &(0x7f0000000180)={0x11, 0x2, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) getsockname$packet(r3, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000054000147880000000000000007008209", @ANYRES32=r6, @ANYBLOB="20000100", @ANYRES32=r5, @ANYBLOB="00001000e000030000010001000000000000000008"], 0x38}}, 0x80) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x11000000) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x439, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @local}]}}}, @IFLA_MTU={0x8, 0x4, 0x101}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000c801}, 0x4) (async) close(r1) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c0000002600090122bd7008f9ffffb05e0000000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x10004157}, 0x400c000) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r9) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r11, &(0x7f0000000600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0x6c, 0x2, 0x9, 0x5, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0xc}}, @NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x8000}}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x7be366ba}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0xfba}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x101}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20048000}, 0x20000005) (async) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x1d}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000855}, 0x40) (async) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 3.254914888s ago: executing program 0 (id=2639): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$[\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r4, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000400)={'syztnl2\x00', &(0x7f0000000380)={'syztnl1\x00', 0x0, 0x2f, 0x5e, 0xed, 0x40, 0x1a, @private1={0xfc, 0x1, '\x00', 0x1}, @local, 0x700, 0x10, 0x4, 0x4}}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x0, 0xffff}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0xfffffffe, 0x5}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r9, {0xffff}, {}, {0x9, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x4009c}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000500)={'erspan0\x00', &(0x7f0000000440)={'syztnl2\x00', 0x0, 0x40, 0x700, 0x5, 0x1ff, {{0x1c, 0x4, 0x0, 0x3c, 0x70, 0x65, 0x0, 0x96, 0x4, 0x0, @multicast2, @multicast2, {[@noop, @timestamp={0x44, 0x10, 0xfd, 0x0, 0x2, [0x5ac, 0x10001, 0x8]}, @timestamp={0x44, 0x28, 0x3e, 0x0, 0x9, [0x8, 0x9, 0x36ea, 0x9, 0x4, 0xa, 0x3696, 0x7, 0xb]}, @ssrr={0x89, 0x23, 0xd4, [@local, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @remote, @private=0xa010100, @empty, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000540)={'batadv0\x00', 0x0}) getsockname$packet(r0, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000005c0)=0x14) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={0x1, 0x58, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r14 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r15 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r14, r16, 0x25, 0x0, @val=@iter={0x0}}, 0x20) getpeername$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000700)=0x14) r18 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f00000008c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000880)={&(0x7f0000000900)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r5, @ANYBLOB="000826bd7000ffdbdf250400000068000180140002006e723000000000000000000000000000080003000200000008000300030000000800030003000000140002006272696467655f736c6176655f30000008000100", @ANYRES32=r11, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="14000200626f6e643000000000000000000000003000018008000100", @ANYRES32=r6, @ANYBLOB="08000300010000000800030001000000140002006d6163766c616e3100000000000000005000018008000100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="1400020067656e6576653100000000000000000008000100", @ANYRES32=r12, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="dc000100b7354c651458ef182c9db85d3b441e4d65ed6ba28da2659d4818c7752fad2f43c7af65bc41051a1cb0ecc6e206152b28dcb0ce2abf7df234f48b871af9c143d9103cff04a6278061eb26baeaaa93e4b3ff526948dd64242a8fe1cf00538c75ebb36d6a918f50dc163fb05461099ba7894df3270e9e89b83d7ed1000bf71f371165bdf2351473", @ANYRES32=r13, @ANYBLOB="08000100", @ANYRES32=r16, @ANYBLOB="20000180140002007465616d5f736c6176655f300000000008000100", @ANYRES32=r17, @ANYBLOB], 0x11c}, 0x1, 0x0, 0x0, 0x20000004}, 0x800) sendmsg$NFC_CMD_DEACTIVATE_TARGET(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000007c0)=ANY=[@ANYRESOCT=r11, @ANYRES16, @ANYBLOB="01002dbd7008fedbdf251e000000080004000100000008000100", @ANYRES32=0x0, @ANYRES64=r18], 0x24}, 0x1, 0x0, 0x0, 0x4004}, 0x4044084) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'wpan4\x00'}) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=ANY=[@ANYBLOB="a0030000da7cbf4e59327f3367052b2d8c6fc5e4120f4a708f5881584277bbaceaf48a873b13b4cd5336f6286f196297e5e54ce7ea474030858dc74521737272389d45cde581405c97778e698498b2fdc4254d6c10d3d0e2f5a3aad0e5a24e9ccb2f37f9848d3a135eaf124c2c590e08000000ba6ce65813c84a7e4415db4f5c48c855854140b3cad853116db5985956424735df70a2078059a656bb65f6aa32770ea79182d1b1950990ed2bd7273a3a08e6f244f4fbc82a2eda13678538101b3b584670a92b851988d2f6cb33e9d456977d5be319bbb051aa57c8025493102fd53faab018445918fa513fdf0915ab0c9f4e4b6a96a0fc0f1bc505c70079111a5e5836c4657a6c85adf94c4a6acae15d7a6ae7bd7e57ba6b413746dc2eeb056868b84e0000000000000000b5310979edd2b4be822411b3e4fd1194ee2fc434952fb296", @ANYRES16=r3, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r4, @ANYBLOB="58035a80ec0003801400030070000a0001010700ff0701040909040037000200513038123e2006221e4f2f0a06511d512f56444b001d3313491c152a1646231c0105200c0214030f282f4a0f3f07503733103500140005004b0f0700070040000200000002000200140005000400faff0300030003000100050081004d000200320029454e34364b1f323619220d5656573a492656210747382741301319221e464d2e3423470c30552e3e180c4849332c3e004f204806313004201b00401134053a181f1e1b194c3100000005000400020000001100010005590301180c122402090c0c1600000005000700010000009400028024000100166c02040a03000b0b022417180b05021b15361b366c30480c1612120b3000240500060000000000050004000000000014000100020c04241b6c04121800020b04246c183100020057181e303d4d0a2308283f2e3c00310d491423270824322f0a265141308c171c254f3455280c2f4a21564a105700000011000100300b36161b04051301091812040000007c000280510002000049503731202909223a4117484316440c42212c214e434501312741523d04532b3a1b1e30350d001046550756341e090d14201f4222393a56331109144f1d4a203408053831001e3b0615492800000005000700010000001400050005005007190c002c68080500f8ff04000500060000000000cc000280140003006e2106000300070006000400070005001d0001000c0c6c023648031002162c0948033706601648484806166c12000000160001003616061b0b360124040636051b30046c6060000014000300d4000500070008001c6c6e07440004001f00020004464e2149013817162a500455483a4c52005625013a513c173837003f0002001e55161327312f0c1d2b0d190037051f2b564e4a28330e2136402016340f09070142334250054a240e281b163a15491855043311425215230a57530005000400000000002800028005000600020000000500060000000000140005004b5c030004001c00080005001109850b4800038014000300ffff03000700080005000900000004000500060001000000140005000800040001000f0a0600000009007f00140002000d231d55240e4815c7243e3e1a09575110000280090001006c1a1260090000000c000380050004000100000008002600b81500000400460008000d000200000008000c0064000000"], 0x390}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000010000000008000300", @ANYRES32=r4, @ANYBLOB="0a00060008021100000100000600100001000000060012000100000004001300"], 0x40}}, 0x0) sendmsg$NL80211_CMD_START_P2P_DEVICE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="280109", @ANYRES16=r1, @ANYRES8=r4, @ANYRES32=r4, @ANYBLOB="0c009900c97bffff41000000"], 0x28}, 0x1, 0x0, 0x0, 0x4004040}, 0x24084041) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0xce}]}, &(0x7f0000000040)='syzkaller\x00'}, 0x90) 3.201247185s ago: executing program 3 (id=2640): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @loopback}, &(0x7f0000000600)=0x10) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000180)={{{@in=@empty, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@initdev}}, &(0x7f0000000080)=0xe8) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000300)=0x80000005, 0x4) (async) sendmmsg$inet6(r4, &(0x7f0000001b40)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback, 0x4}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000340)="d5", 0x1}], 0x1}}], 0x1, 0x40) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000500)={{{@in=@rand_addr=0x64010101, @in=@multicast2, 0x4e21, 0x8, 0x4e24, 0x8001, 0x2, 0x80, 0x20, 0xa5, r2, r3}, {0x0, 0x8, 0x10, 0xb, 0x8, 0x2335, 0x6, 0x7}, {0x0, 0x7, 0x4, 0xf}, 0xb810, 0x6e6bb3, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x4d4, 0x2b}, 0xa, @in=@rand_addr=0x64010100, 0x3501, 0x5, 0x2, 0x7f, 0x9, 0x645b, 0x8}}, 0xe8) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWSET={0x44, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_POLICY={0x8}]}], {0x14}}, 0x6c}}, 0x0) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@allocspi={0x208, 0x16, 0x400, 0x70bd29, 0x25dfdbff, {{{@in=@remote, @in=@broadcast, 0x4e21, 0x0, 0x4e21, 0xb, 0x2, 0x20, 0xa0, 0x87, 0x0, r3}, {@in=@broadcast, 0x4d5, 0x6c}, @in=@remote, {0x5, 0x10001, 0x7ffffffffffffffe, 0x5, 0xf3, 0xff, 0x401, 0x5}, {0xffff, 0x662, 0x591edd1f, 0x100000000}, {0xd63, 0x3cd, 0x4}, 0x70bd2b, 0x3507, 0x2, 0x1, 0x10}, 0x7fffffff, 0x8}, [@lastused={0xc, 0xf, 0x5}, @sa_dir={0x5, 0x21, 0x1}, @algo_aead={0xf4, 0x12, {{'ccm-aes-ce\x00'}, 0x540, 0x180, "d2f64f7685f530d5c876271cf79f02d0710f1cd6424a4bb59ee35ef714c4320d3550c3e90e652f2a911dafb031e76d96fc82b20e4d1c6127c21d112cf0db0ab26719180ced74810ba02930fc532739a9c2188ed8c1c6bec38bb45e009469dd0ff3e1ebe9f7414c0f0b8edc62acd1c941a7b0839d8954211df9e948e2bded185dfab226566bd8e05b83c98d89d6ed33572feb5447bc890064afda14bf20b50bd0b129a22294353aa3"}}, @iptfs_reorder_window={0x6, 0x25, 0x3}]}, 0x208}, 0x1, 0x0, 0x0, 0x20008801}, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) r6 = socket$inet6(0xa, 0x1, 0x0) r7 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000640)={0x28, 0x0, 0x2710, @hyper}, 0x10, 0x800) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r7, 0x28, 0x6, &(0x7f0000000680)={0x77359400}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x50, &(0x7f0000000000)={0x0, 0x0}, 0x10) (async, rerun: 64) r8 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x4, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@call={0x85, 0x0, 0x0, 0x1c}]}, &(0x7f0000000000)='GPL\x00'}, 0x80) (async) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0xa, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x1c}}, 0x0) socket$alg(0x26, 0x5, 0x0) (async) close(0x3) 2.800986651s ago: executing program 3 (id=2644): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d03000000000000000000000200000000000000000000000a030000000000000063"], 0x0, 0x52}, 0x28) (async) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f00000000c0)=0x10, &(0x7f0000000100)=0x4) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)}, 0x4004810) (async) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001c000107000000000000000007000000", @ANYRES32=r3, @ANYBLOB="80000200080001007f0000010a0002"], 0x38}}, 0x0) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg(r4, &(0x7f0000002e00)=[{{&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0xffffffff}, 0x80, &(0x7f0000000080)=[{&(0x7f00000005c0)="91", 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[{0x10, 0x84}], 0x10}}], 0x2, 0x40000050) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) 2.800598022s ago: executing program 0 (id=2645): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f3317000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4004010) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r4}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000140)={@cgroup, 0xffffffffffffffff, 0x11}, 0x11) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x2a, &(0x7f0000000000)=[{0x0, 0xfffffffffffffed7}], 0x10000000000000b0}, 0x24000000) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000300000000000000000000030000000003000000020000000000000000000000000000010500000010000000010000000000001200000000005f"], 0x0, 0x4f}, 0x20) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r7, &(0x7f0000000140)="01154e00010000112233445588fbca010001160c", 0x14, 0x10004005, &(0x7f0000000040)={0x11, 0x0, r8, 0x0, 0x0, 0x0}, 0x14) r9 = socket$kcm(0x2, 0x3, 0x2) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="64000000020605000a0000000000000000000000100003006269746d61703a706f72740005000400000000000900020073797a3000000000050005000000000005000100060000001c00078008000840000000200600044000000000060005"], 0x64}}, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a24, @remote}, {0x2, 0x4e25, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$tun(r11, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)={0x1c, r12, 0x1, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r13}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000841}, 0x8000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000f020000000000000000000001050000018000000000000000010000850200000000000000010000000000000400000000da"], 0x0, 0x52}, 0x20) 2.330795239s ago: executing program 3 (id=2648): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89fb, 0x0) close(r0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000340)={0x1, 0x1, [@broadcast]}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = socket$inet6(0xa, 0x3, 0x5) socket$nl_route(0x10, 0x3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000}, 0x600) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e22, @remote}, 0x10) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="020d00000a000000000000000000000005000500000000000a0000000000000000000000a6b977df6dc3d91d3439002287c4000000000000000000000001000000000000000003000600000000000200"/94], 0x50}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371c00000069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}], 0x1}, 0x40) 2.228742039s ago: executing program 0 (id=2650): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, 0x0, &(0x7f0000001d80)) (async) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, 0x0, &(0x7f0000001d80)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1001}) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="1d0000001400010000000000000000002d00000002000000050002000a000000"], 0x1d}}, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x8, 0xa5, 0x4, 0xfffffffe, 0xfffffffb}) (async) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x8, 0xa5, 0x4, 0xfffffffe, 0xfffffffb}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="380000001800010000000000000000002d0000000000000001000000050001000a0000000c000f8008000200f40100000800040002000000"], 0x38}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001a00010300000000000000002d000000"], 0x14}}, 0x20000090) 2.228302369s ago: executing program 1 (id=2651): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x7}, @NFT_OBJECT_CT_HELPER=@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x48}, 0x1, 0x0, 0x0, 0x9}, 0x4800) 1.846527837s ago: executing program 1 (id=2654): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, r2, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008810}, 0x80) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a98000000060a0b040000000000000000020000006c00048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000001308000340000000046c0001800a0001006c696d69740000001c0002800c00014000000000000000640c00024000000000000000010900010073797a30000000000900020073797a32"], 0xc0}}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f00000001c0)={{0x2, 0x4e24, @local}, {0x20, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}}, 0x10, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x14}}, 'syzkaller0\x00'}) 1.58796405s ago: executing program 0 (id=2657): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000002b00000002000000ffff000005"], 0x48) r1 = socket(0x40000000015, 0x3, 0x80000001) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) recvmmsg(r1, &(0x7f0000001340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=""/48, 0x30}, 0x400000}], 0x1, 0x20010041, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000140)}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x6f1c, r2}, 0x38) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), r4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r6) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x38, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x24, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x7, 0x2, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'pim6reg1\x00'}}]}]}, 0x38}}, 0x0) sendmsg$TIPC_NL_LINK_RESET_STATS(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000480)={0x18, r5, 0x1, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x4c, r5, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x38, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x9a}}, &(0x7f0000000040)='syzkaller\x00'}, 0x90) r8 = syz_genetlink_get_family_id$gtp(&(0x7f00000095c0), 0xffffffffffffffff) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r1) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000500)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPATH(r3, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x70, r9, 0x2, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000004}, 0x800) sendmsg$GTP_CMD_ECHOREQ(r3, &(0x7f0000009700)={0x0, 0x0, &(0x7f00000096c0)={&(0x7f0000009640)={0x14, r8, 0x3, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8040) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r8, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_PEER_ADDR6={0x14, 0xb, @private0={0xfc, 0x0, '\x00', 0x1}}]}, 0x28}}, 0x90) r11 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet(r11, &(0x7f00000004c0)={&(0x7f0000000100)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="17000000000000000000000007000000890704ac1414bb0011000000000000000000000001"], 0x30}, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) 1.411941431s ago: executing program 1 (id=2661): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) sendto$inet6(r0, &(0x7f0000000040)="421558e10ba4e2efe721e124b513bb76aa0f73ebbff84a0bef13fb994fd2f105882c90efa7", 0x25, 0x4000001, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c000180060006006558000014000280100014800c00", @ANYRES8=r1], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e24, @empty}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0xd, 0x9, &(0x7f0000000200)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}}], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, r0}, 0x94) 1.402127155s ago: executing program 3 (id=2662): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c0000001a0001000000000000000000802000d3fb0b"], 0x1c}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x0, @rand_addr=0x64010100}]}, &(0x7f0000000180)=0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r4, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r3}, 0x20) recvmmsg(r3, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}}], 0x1, 0x12060, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @rand_addr=0x64010100}}, 0x0, 0x0, 0x80000001, 0x0, 0xce03d4}, 0x9c) r5 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) sendto(r8, &(0x7f00000000c0)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080003000000000008000500640000000c000700e803ffe40000eeff", 0x68, 0x0, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="340000001400010000000000000000000a000000", @ANYRES32=r7, @ANYBLOB="14000100ff01000000004000000000000000000108000000eb45a49c248313f36de0cb4bc8ff36ab8042685925c2015e9b2e2bb7d31f04ad943e24610f393cdbd3539c7b44f005711b94b8e2ff0f5daf94ed9f4582ea8abb3d338034d33e0db2beb1b70b1eee0053d88f147ffeb3a2c49dfc783c8c385675c95d323bcaa8da6601b6d8776e74e15b2041e555b9de4731aef3fb74ffb1df71a1495585abd5f5c5b3f5ab6519992448"], 0x34}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1f, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000020000000000000000000085000000c500000095"], &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x32, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000000), 0x0) 1.214505818s ago: executing program 0 (id=2665): r0 = socket$kcm(0x29, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x40, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "ffd7"}]}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x800, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8, 0x6}, {0xffffffffffffffff, 0x0, 0x1f, 0x7}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3502, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x1, 0x717, 0x4e23, 0x5, 0xa, 0x0, 0x20, 0x3a}, {@in6=@mcast2, 0x4d4, 0x3c}, @in=@dev={0xac, 0x14, 0x14, 0x2b}, {0xfe, 0x1000000000000192, 0x1000000000000192, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffe, 0x9}, 0x8070bd2d, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x81}, 0x840) sendmsg$inet(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="28010000000000000100000001e2becef47f18318b0a26bd71fba84a489dab3b3165d25cd0fa264174b7225027e981a10f40df15e4ab599e3f00d95d65c7914715ccf8be9a5f114774735240729225305a3406feb94a2f3f32547eb022932f25b8a421516a0c41591d1f08578875c73c9e4bf2795d608770c4b360f5448477f555af7cbc6aaa4e7b4e4e2b6580c5e86697f16eb3194be45c9fc9f334266b9adf8a", @ANYRES32=r1], 0x128}, 0x5011) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f0000000140)={0x5a88, 0xb764, 0x2, 0x2151}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r11, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=@migrate={0x138, 0x21, 0x1, 0x0, 0x0, {{@in, @in6=@remote}, 0x6e6bb2}, [@migrate={0xe8, 0x11, [{@in=@multicast1, @in=@local, @in=@local, @in=@broadcast}, {@in=@empty, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@multicast2, @in6=@empty}, {@in=@empty, @in=@private, @in6=@remote, @in6=@mcast2}]}]}, 0x138}}, 0x0) r13 = socket$can_raw(0x1d, 0x3, 0x1) accept(r13, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="b4000000000b00007910000000000000db100003a00000009500740000000000079c69dc7ded5dbe11b62ac5ea9fca11027d19e93adb605feb92de3145e8ed7ac5b8902070213cdfdc646c4890cdeb50347c32060581172b94c6dd22a2b589b6cbad46ed6ef790bb41931f9a3d4dd127c1b4e49f7468f5e603950c4f67581c92ef8a7e000017d5f1110ed29d3b2aaf153bcf69bebf18262352ba68d39942c3b567e06411d8879622f74cc431dabd332c4c4702e4c3d41bfb54b574e8947309c7503c3e8ea23e12e0648aa223a1f97a9832f442e8cbeab77cdf1ebd8465593c000000000000000000000000000000ef429b14459ffd88bee4b9d894ddad0980af53202ab155f101b2fcbfb5b81b73035fd5a76985d4710fb6fbfb2a933a09dd6317e77ca962327022fb34017197ff712a35c63cdd0dec053fdbc310f29c6b8be788b559a80135bb7369351b952ade2339eddde60eb16301b0f4640be5852e1cef861b861b7b19ea03dfc83f729d02e9e73db24dd5dfb09d4b1bbbd5dd5daa4615b0845f264f229f9806862e116612ade616b1769e97549d095b0a4d02801406491d77a65fe74f8aa67391e8cb3c"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195}, 0x48) 1.010520439s ago: executing program 2 (id=2667): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000000)={@remote, @empty}, 0x8) r1 = syz_init_net_socket$nfc_raw(0x27, 0x6, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private2, 0x4e24, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0xa0, 0x3c}, {0xff, 0x100000000, 0xd, 0x7a5, 0x0, 0x6, 0x0, 0x8001}, {0x6, 0x3, 0x3, 0x38}, 0x1, 0x0, 0x0, 0x1, 0x3}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d3, 0xff}, 0x2, @in=@local, 0x3500, 0x3, 0x3, 0x8, 0x7, 0x8000, 0xa}}, 0xe8) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f00000001c0)=[0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xb1, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xd, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)=@gettclass={0x24, 0x2a, 0x2, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0xffff, 0x4}, {0x3, 0xfff2}, {0x3, 0x3}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) r5 = getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000540)={{{@in6=@private2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@initdev}}, &(0x7f0000000640)=0xe8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000680)={0x0, 0x0, 0x0}, &(0x7f00000006c0)=0xc) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000700)={r5, r7, r8}, 0xc) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000740)={'wlan0\x00'}) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000780), 0x101200, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r9, 0x5201) sendto$inet6(r2, &(0x7f00000007c0)="f0b00cc73d1a45603761f455e591e805cf2fe59f", 0x14, 0x4000, &(0x7f0000000800)={0xa, 0x4e20, 0x4, @private2, 0x10001}, 0x1c) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000840)={0x0, 'veth0\x00', {0x4}, 0x1}) bind$inet(r0, &(0x7f0000000880)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x37}}, 0x10) r10 = syz_init_net_socket$llc(0x1a, 0x3, 0x0) close(r10) r11 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000008c0), 0x4000, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r10, 0xd0009411, &(0x7f0000000900)={{0x0, 0x7fffffffffffffff, 0x9, 0x8, 0x8, 0x201, 0x10001, 0x9, 0x8, 0xc00, 0x845, 0x7, 0x434, 0x1, 0xffffffffffffff94}}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r11, 0xc0709411, &(0x7f0000001900)={{r12, 0x9, 0x1, 0xfffffffffffffff8, 0x7, 0x1, 0x3ea5, 0xb, 0xffffffff, 0x29a, 0x10001, 0xfffffffffffff000, 0x9, 0xb7b, 0x4}, 0x8, [0x0]}) r13 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001b00)=@generic={&(0x7f0000001ac0)='./file0\x00', 0x0, 0x8}, 0x18) r14 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001b40)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x5a, '\x00', r4, 0xffffffffffffffff, 0x2, 0x2, 0x5}, 0x50) pipe(&(0x7f0000001bc0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r10, 0x4048587b, &(0x7f0000001fc0)={{r11, &(0x7f0000001c00)='_\']*\'\xed&}[]^\x00', 0x800, &(0x7f0000001c40)={@_ha_fsid={[0xfffffffd, 0x2]}, {0x7, 0x1, 0x2, 0xee}}, 0x8, &(0x7f0000001c80), &(0x7f0000001cc0)=0x8000}, 0x3, &(0x7f0000001f40)=[{0x2, 0x1, &(0x7f0000001d00)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', &(0x7f0000001d40)="94850fb2dedc982559f1c49d0e09dc4f0c6bc7c60364c6bbebf7538e4fba0ed7b60c74a5115834e6e48f4693e6f34747d25d022265beb5dcfc4b941aeb832ded6029b8f304704c8ebdc9c2a0150a7eea13eb3f1deff8d0748ce79c51c12617d6dfccd7dc0be96986ba30cdcae5055fcbb0eb45831071b80b92149ef144a1359c19cb4a3dcbd8c0df1a84c7d87bf6a21d9534fe4b27f03c4ba37e1efe58d3037236c4b98dc79984368bc0df4a86dfc7d0813a37745a70b8d3f3ea10b911033eb3aa7a8a34ac6e4cf3726fd15499835d591b0f79628a28e74681328bb482ea2c58285460c5671b8a756ab2d82f59d59d24d1c6978107f344dcb44f", 0xfa, 0x2}, {0x3, 0x4, &(0x7f0000001e40)='/dev/rfkill\x00', &(0x7f0000001e80)="fd", 0x1, 0x2a}, {0x2, 0x80000001, &(0x7f0000001ec0)='.{P/[.,+\xb8/\x00', &(0x7f0000001f00)="37227c512f1eb4d7842e07d8cb04f6badab4b82455aadef233b4f3cb598c17acbf722f2ab541cc05daba7661e1457b3fa56e26be9cabec3a58847f963a52", 0x3e, 0x8}]}) r17 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000002040)={0x1b, 0x0, 0x0, 0x19b55eb1, 0x0, 0x1, 0x5, '\x00', r6, r1, 0x3, 0x3, 0x4}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002100)=@bpf_lsm={0x1d, 0x0, &(0x7f0000001980), &(0x7f00000019c0)='GPL\x00', 0x1, 0xe, &(0x7f0000001a00)=""/14, 0x41100, 0x10, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000001a40)={0x9, 0x3}, 0x8, 0x10, &(0x7f0000001a80)={0x2, 0x0, 0xf7b, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000020c0)=[r13, r14, 0xffffffffffffffff, r0, r15, r16, r17], 0x0, 0x10, 0xd}, 0x94) 907.75279ms ago: executing program 4 (id=2668): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, 0x0, &(0x7f0000000000)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x7c}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) sendmsg$NL80211_CMD_AUTHENTICATE(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xbc, r3, 0x10, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x5e}}}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x3}, @NL80211_ATTR_AUTH_TYPE={0x8}, @key_params=[@NL80211_ATTR_KEY={0x64, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_SEQ={0xf, 0x4, "c6f02aaae31089ded255c6"}, @NL80211_KEY_DEFAULT_TYPES={0x28, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "bdf23b893e"}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x14, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}], @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="982de1b95471"}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4}, 0x4000) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040), 0x10) listen(r4, 0x0) r5 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r5, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r5, 0x1, 0xd, &(0x7f0000000140)={0x1}, 0x8) close(r5) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, 0x0, &(0x7f0000000100)) 896.275849ms ago: executing program 2 (id=2669): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000800)={'bridge0\x00'}) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r3, 0x6, 0x24, &(0x7f0000000240)=0x80000000, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000b40)=0xffffffffffffffff, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r6, 0x0) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000bc0)={0xffffffffffffffff, 0x9}, 0xc) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c00)={0x2, 0x4, 0x8, 0x1, 0x80, r2, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000d80)=@bpf_tracing={0x1a, 0x2a, &(0x7f0000000980)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@jmp={0x5, 0x0, 0xd, 0x6, 0x7, 0x20, 0xfffffffffffffff0}, @initr0={0x18, 0x0, 0x0, 0x0, 0xfffffc00, 0x0, 0x0, 0x0, 0x9}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0xc}, @cb_func={0x18, 0x9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x368c5de3}, @jmp={0x5, 0x1, 0x8, 0x1, 0x3, 0x10, 0x8}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @alu={0x4, 0x1, 0x3, 0x8, 0x5, 0xfffffffffffffff8, 0x4}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}]}, &(0x7f0000000b00)='syzkaller\x00', 0x33, 0x0, 0x0, 0x41000, 0x14, '\x00', 0x0, 0x18, r5, 0x8, &(0x7f0000000b80)={0x4, 0x1}, 0x8, 0x10, 0x0, 0x0, 0xa893, r6, 0x9, &(0x7f0000000c80)=[r7, r8, 0x1], &(0x7f0000000cc0)=[{0x4, 0x5, 0xa, 0x7}, {0x0, 0x5, 0x10, 0x9}, {0x4, 0x4, 0x5, 0x3}, {0x2, 0x4, 0x3, 0xa}, {0x1, 0x1, 0xc, 0x9}, {0x4, 0x3, 0x10, 0x3}, {0x4, 0x5, 0x0, 0xa}, {0x5, 0x3, 0x10, 0x6}, {0x0, 0x5, 0x5, 0x6}], 0x10, 0x73}, 0x94) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4004}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r9 = bpf$ITER_CREATE(0xb, &(0x7f00000001c0), 0x49) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000480)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x0, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x7, 0x0, 0x40, 0x4, 0x0, @local, @loopback}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x5, &(0x7f0000000300)=@framed={{}, [@cb_func={0x18, 0x6, 0x4, 0x0, 0x3}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r10 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOFFLOAD(r10, 0x400454c9, 0xba98575a95aeb70d) ioctl$TUNSETGROUP(r10, 0x400454ce, 0x0) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r9) sendmsg$TIPC_NL_BEARER_ENABLE(r9, &(0x7f0000000700)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)={0xf0, r11, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x200}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_MEDIA={0x60, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffff7c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x35e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xe72}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x58}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfb1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000001}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfffffff9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xffffffff}]}]}, 0xf0}}, 0x1) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000740)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x5, [@struct={0x1, 0x2, 0x0, 0x4, 0x1, 0x4, [{0x0, 0x4, 0x9}, {0xc, 0x5, 0x7}]}]}, {0x0, [0x61, 0x2e, 0x5f]}}, &(0x7f0000000f40)=""/4089, 0x41, 0xff9, 0x1}, 0x20) sendmsg$NFT_BATCH(r12, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000068000000060a010400000000000000000100000008000b4000000000400004802800018007000100637400001c000280080001400000000108000240000000090500030000000000140001800a0001007265646972000000040002800900010073797a30"], 0xdc}, 0x1, 0x0, 0x0, 0x4005890}, 0x4000000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x0, 0x0, 0x1, 0x0, {{0x5, 0x4, 0x0, 0x6, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @local, @loopback}}}}) syz_emit_ethernet(0x67, &(0x7f00000000c0)={@local, @broadcast, @val={@val={0x88a8, 0x6, 0x1}, {0x8100, 0x2, 0x0, 0x1}}, {@ipv4={0x800, @tipc={{0x9, 0x4, 0x3, 0x4, 0x51, 0x67, 0x0, 0x2, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, {[@rr={0x7, 0xf, 0xfd, [@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}, @payload_mcast={{{{{{0x2d, 0x0, 0x1, 0x1, 0x1, 0xb, 0x1, 0x2, 0x0, 0x0, 0x1, 0x6, 0x0, 0x1, 0x6, 0xf8, 0x4, 0x4e21, 0x4e22}, 0x3, 0x4}, 0x0, 0x4}, 0x2}}, [0x0]}}}}}, 0x0) 707.727058ms ago: executing program 4 (id=2670): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r2, @ANYBLOB="0c00990000000000000000000800a000ea15000008009f000c000000080026000816"], 0x40}}, 0x0) r3 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000007c0)={&(0x7f0000000580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELOBJ={0x138, 0x14, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x4}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_USERDATA={0xfc, 0x8, "0349b06ea36ea02cfc7e6e1904129f3e24e63cf4a5c901d1e121e57d4976ac9feaa64cdb6e52b16dbb5296c155d031835219ad8a87176782052e319cec84fa297a3a7e55d23e9e4fb9f31c36f06279fab3c5e4373519f8c399385ec1727947fe34116fd76397ba5fa0a0f6014807528f2a06a59cd38d4942dbea36ab09812f761c407831b0be6d6458451244f158f2ab4ac8a744e4d4029fb30768a497485bfcae7113dd55232d68ad1c6b3a79e9d10ae68fd86c0eac3a7dc8bc5fa388a2724804db5f6dc6efa4aa882bdbe71140b7b818257315af729e2a54d00f101663632d89f2ee78285168dabdb3ee0d83b4c2cf6304796edb7a8ca0"}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELCHAIN={0xcc, 0x5, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_CHAIN_HOOK={0x4c, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5d71e4d7}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_DEV={0x14, 0x3, 'hsr0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'erspan0\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_HOOK={0x18, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'macvtap0\x00'}]}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x22c}}, 0x4008018) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x8000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d800000004021dff0010000000e8fe55a1180015000600144003600e1205875d000008000000000000000001402000", 0x2f}], 0x1}, 0x8800) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x40, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x102}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x42) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)='\x00\x00', 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) 678.283137ms ago: executing program 4 (id=2671): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x4, 0x6, 0x80, 0x30a}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000017c0)={r0, &(0x7f0000001700), &(0x7f0000001780), 0x3}, 0x20) ioctl$BTRFS_IOC_LOGICAL_INO(r0, 0xc0389424, &(0x7f00000000c0)={0x800, 0x18, '\x00', 0x1, &(0x7f0000000080)=[0x0, 0x0, 0x0]}) (async) ioctl$BTRFS_IOC_LOGICAL_INO(r0, 0xc0389424, &(0x7f00000000c0)={0x800, 0x18, '\x00', 0x1, &(0x7f0000000080)=[0x0, 0x0, 0x0]}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x2, 0x3, 0x1, 0x0, 0x9a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x42072, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000180)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x4ca31, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x4ca31, 0xffffffffffffffff, 0x0) 624.583255ms ago: executing program 2 (id=2672): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r1, 0x6, 0x2b, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, 0x17, 0x1, 0x70bd26, 0x25dfdbfd, {0x8}, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0x7}]}, 0xff2e}}, 0x0) 567.845667ms ago: executing program 4 (id=2673): socket$packet(0x11, 0x3, 0x300) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x108) setsockopt$inet_group_source_req(r0, 0x0, 0x2b, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000000)={0x2e, @empty, 0x4e23, 0x1, 'dh\x00', 0x11, 0x6, 0x77}, 0x2c) socket$netlink(0x10, 0x3, 0x4) r1 = socket$phonet(0x23, 0x2, 0x1) write(r1, &(0x7f0000000080)="2700000014000707030e0000120f0a0011000e000000000000000000078a151f7508003900050021c5a6f0220c7cba571ce2c2d80ec924e1e88fc44896a12891f33c07d0e84dcf37cc40e436725d2b7a3528230e1909d164a510229dde849725a7de45561dcb2fcd3dfc50eb7db81f1f921dfa9c6fac35e81329800af9bac5a7d28eac282ae79fd5687da47823f8c53c9610b68348c0fd0d193a5ced4b265f0e524dabd81f4bb5a63854c71c858182782d96a898bc615b3301cbbc62618c09b9ff965301f6f9abcce0f5d971f1d81666007a79d5d7dda463000000", 0xdb) 556.793927ms ago: executing program 1 (id=2674): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x2, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0xfff9, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000080)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009112d9000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 521.977729ms ago: executing program 4 (id=2675): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x70bd27, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x74, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x36, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @val={0x5, 0x3, {0x4, 0x51, 0x1}}, @void, @void, @void, @void, @void, @val={0x71, 0x7, {0x1, 0x0, 0x1, 0xffffffffffffffff, 0x2, 0x1, 0x41}}, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SMPS_MODE={0x5}]}, 0x74}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = socket$unix(0x1, 0x5, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000002040)=0xe5, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xfffbffff, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x24, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xff}]}]}, @TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x10}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000001300)=@ethtool_rxfh={0x39, 0x8, 0x0, 0x9, 0x4, "226ac5", 0x5}}) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x2f, 0xf7, 0x4, 0x3, 0x40, @rand_addr=' \x01\x00', @private0, 0x700, 0x7800, 0x5, 0xfffffffd}}) sendmsg$ETHTOOL_MSG_STRSET_GET(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0xf0, r8, 0x3141e0b2751b0f9b, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0xb0, 0x2, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x5e, 0x1, 0x3}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x14}]}, @ETHTOOL_A_STRSET_HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x60c5}, 0x80) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$inet6_udp(0xa, 0x2, 0x0) r13 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$SO_J1939_SEND_PRIO(r13, 0x6b, 0x5, 0x0, &(0x7f00000023c0)) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000f80)=@mangle={'mangle\x00', 0x2, 0x6, 0x8d8, 0x368, 0x0, 0x808, 0x0, 0x490, 0x808, 0x808, 0x808, 0x808, 0x808, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {}, 0x33}, 0x0, 0x270, 0x298, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [0xffffffff], [0xffffff00, 0xffffffff], [], 0x0, 0x10}}, @common=@rt={{0x138}, {0x4, [0xf34e, 0x2], 0xb3a2, 0x20, 0x4c652f8a3ca82a36, [@empty, @local, @remote, @dev={0xfe, 0x80, '\x00', 0x3f}, @private2, @private0, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, @mcast2, @private0={0xfc, 0x0, '\x00', 0x2}, @loopback, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @remote}, @private1, @remote], 0xd}}]}, @HL={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @remote}, @dev={0xfe, 0x80, '\x00', 0x2}, [], [], 'bridge0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0xc, 0xe}}}, {{@ipv6={@ipv4, @local, [], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}, {}, 0x0, 0x0, 0x1}, 0x0, 0x100, 0x128, 0x48000000, {}, [@common=@srh={{0x30}, {0x3a, 0xf7, 0xfa, 0x0, 0xfffc, 0x500, 0x3008}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0x100, 0x148, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @common=@ah={{0x30}, {[0x20004d5, 0x4d3], 0x6, 0xeb}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@remote, @ipv6=@private1, 0x0, 0x17}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x2, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @mcast2, @mcast2, @private0, @dev={0xfe, 0x80, '\x00', 0xa}, @loopback, @ipv4={'\x00', '\xff\xff', @empty}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x938) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_USE_CARRIER={0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) 459.927513ms ago: executing program 2 (id=2676): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)="5c00000013006bcd9e3fe3dc6e48aa310b6b8703100000001f03000000020000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0xfffffffffffffe69, 0x1f00c00e}, 0x4008810) 388.93391ms ago: executing program 3 (id=2677): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x0, 0xfffffffb}, 0x48) r1 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="33fe00006600"], 0xfe33) (async) write$cgroup_subtree(r1, &(0x7f00000004c0)=ANY=[@ANYBLOB="33fe00006600"], 0xfe33) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket(0xa, 0x3, 0xff) sendmsg$unix(r3, &(0x7f0000001b40)={&(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000001600)=[{&(0x7f0000000280)="c0beeda5a486001300f2ceff3bcd14ee4a98a520780c268eef47650f17d0e9a03233378888c474c5", 0x28}], 0x1, &(0x7f0000001a00)=[@rights={{0x10}}], 0x10, 0x448f569fa84bd46c}, 0x20000840) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) (async) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f00000000c0)={r7, 0x5}, 0x8) (async) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f00000000c0)={r7, 0x5}, 0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000003c0)={r7, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, &(0x7f0000000480)=0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) (async) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r8, &(0x7f00000005c0)=ANY=[@ANYBLOB="016f0800010000000000140000004600002400000000008490783fffffffac1414aa00000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="ba000000907800000002d58838068b9100"/33], 0xfd6c) socket$nl_route(0x10, 0x3, 0x0) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000580)={0x0, 0xfffffffffffffe3a, &(0x7f0000000540)={&(0x7f0000002000)=ANY=[@ANYBLOB="54000000210001002dbd7000fedbdf250a20800208000003e800000014000200fe8008000000000000000000000000aa14000100fc02000000000000000000000000000008260d000500"/84], 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x800) r11 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x400, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0xffff, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @payload={{0xc}, @void}}]}], {0x14, 0x10}}, 0x94}}, 0x0) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5000009, 0x10012, r14, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x10, 0x4, &(0x7f0000000080)=ANY=[@ANYRESOCT=0x0], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x8, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$BTRFS_IOC_SCRUB_CANCEL(r0, 0x941c, 0x0) 369.318929ms ago: executing program 2 (id=2678): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380), &(0x7f0000000380), 0x2, r1}, 0x38) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'dummy0\x00', 0x0}) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000040)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010026bd6000000000002d9300000c00018008000100", @ANYRES32=r4], 0x20}, 0x1, 0x0, 0x0, 0xd4}, 0x24008000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_1\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f00000000c0)=@getchain={0x24, 0x66, 0x301, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x1}}}, 0x24}}, 0x0) 114.947966ms ago: executing program 2 (id=2679): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000007ac0)=[{{&(0x7f0000000180)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000240)="2a69c258ca", 0x34000}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000480)="7349b402ed", 0x5}, {0x0, 0x11}], 0x2}}, {{0x0, 0x0, &(0x7f0000000b40)}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x40) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendmmsg(r1, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)={0x1c, 0x52, 0x1, 0x2, 0xfffffffd, {0x2, 0x3}, [@typed={0x8, 0x2, 0x0, 0x0, @binary="edcaf499"}]}, 0x1c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x28, 0x10, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_LINKMODE={0x5, 0x11, 0x5}]}, 0x28}}, 0x40010) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000018000506000000000000000023000000fe00000100000000050001000400000008000400", @ANYRES32=r4], 0x2c}}, 0x0) listen(r3, 0x1000) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=@dellink={0x20, 0x11, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, r5}}, 0x20}}, 0x0) 114.472622ms ago: executing program 1 (id=2680): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x20043, &(0x7f0000000040)={@_ha_fsid={[0x10000, 0x8]}, {0x12f2, 0x4, 0xfff, 0x5}}, 0x2, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x9}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000300)={'gretap0\x00', &(0x7f0000000180)={'tunl0\x00', r1, 0x8000, 0x10, 0x2, 0x9, {{0x4b, 0x4, 0x0, 0x2, 0x12c, 0x66, 0x0, 0x85, 0x2f, 0x0, @broadcast, @local, {[@cipso={0x86, 0x4f, 0x2, [{0x1, 0x3, "d6"}, {0x3, 0x5, 'Djk'}, {0x2, 0x4, "5106"}, {0x5, 0x5, "8261ad"}, {0x0, 0xe, "9d4093a90fcda8bd85f33bf9"}, {0x0, 0xa, "1eda77b60690e2cb"}, {0x0, 0xd, "f110f28e3c76cd0f3f03f3"}, {0x6, 0x2}, {0x1, 0x11, "20dc4d6a6ed5afb05d2398911c80a0"}]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x1c, 0xf2, 0x0, 0x1, [0x4, 0x9, 0xa, 0x2, 0x8000, 0x5]}, @noop, @rr={0x7, 0xf, 0xcb, [@private=0xa010100, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp_prespec={0x44, 0x44, 0xe4, 0x3, 0x0, [{@remote, 0x2}, {@multicast2, 0x1000}, {@loopback, 0x4}, {@empty, 0xfffffeff}, {@remote, 0x1}, {@initdev={0xac, 0x1e, 0x2, 0x0}, 0x9}, {@broadcast}, {@dev={0xac, 0x14, 0x14, 0x20}, 0x9}]}, @end, @generic={0x89, 0x5, "1b162c"}, @timestamp_prespec={0x44, 0x4c, 0xf1, 0x3, 0x5, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xe}, {@empty, 0x8001}, {@empty, 0x7f}, {@empty, 0x2000000}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x6}, {@local, 0x1}, {@private=0xa010101, 0x8}, {@broadcast, 0xcd}, {@dev={0xac, 0x14, 0x14, 0x2a}, 0x9}]}]}}}}}) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x9) 111.811495ms ago: executing program 0 (id=2681): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000080), 0x2, 0x0) write$cgroup_type(r1, &(0x7f00000000c0), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mq={0x7}, @qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x4}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x1}, @TCA_CAKE_RAW={0x8, 0xc, 0x1}]}}]}, 0x58}}, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x83, &(0x7f00000001c0)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r7, 0x84, 0x6c, &(0x7f00000007c0)={r9}, &(0x7f00000008c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000300)={r9, @in6={{0xa, 0x4e21, 0x7, @empty, 0x9}}, [0xa5, 0x4, 0x1ff, 0x4, 0x2, 0x7f, 0xffff, 0x7, 0x1, 0x4, 0x80, 0xffffffffffffc390, 0x9, 0x7fff, 0x5]}, &(0x7f0000000400)=0x100) r10 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) listen(r10, 0xf5f) accept(r10, 0x0, 0x0) r11 = openat$cgroup_ro(r6, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r11, &(0x7f0000000140)=0xfffffc, 0x9) r12 = socket(0x1e, 0x805, 0x0) connect$tipc(r12, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{}, 0x2}}, 0x10) connect$tipc(r12, &(0x7f0000000600)=@id={0x1e, 0x3, 0x3}, 0x10) close(r12) r13 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r13) r14 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) socket(0xa, 0x3, 0x4) 102.325289ms ago: executing program 4 (id=2682): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xc, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x8d80}, [@call={0x85, 0x0, 0x0, 0x18}]}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0xe, 0x0, &(0x7f0000000040)="f4b84de4115d64244a0e839e9900", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000007c0000007c00000002000000000000000000000e0000000000000000000000000600000d00000000000000000000000000000000000000000000000000000000000000000000000003000000fdfffffffeffffff0000000000000000000000070000000000000000000000090000000000000000000000090400000000000000000000090600000001"], 0x0, 0x96}, 0x28) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000851000000300000018000000", @ANYRES32, @ANYBLOB="000000000000000095000000000000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x2}, 0x94) 0s ago: executing program 1 (id=2683): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1, 0x0, 0x0, {0x54}}, 0x14}}, 0x0) close(r0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_NET_NS_PID={0x0, 0x13, 0xffffffffffffffff}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000000}, 0x0) kernel console output (not intermixed with test programs): ][ T7904] bond1: option xmit_hash_policy: invalid value (64) [ 146.334839][ T7904] bond1 (unregistering): Released all slaves [ 146.381611][ T7914] netlink: 8 bytes leftover after parsing attributes in process `syz.1.485'. [ 146.442887][ T7918] netlink: 'syz.4.486': attribute type 9 has an invalid length. [ 146.637885][ T7925] netlink: 'syz.2.487': attribute type 1 has an invalid length. [ 146.652061][ T7925] netlink: 4 bytes leftover after parsing attributes in process `syz.2.487'. [ 146.718001][ T7925] tipc: Enabling of bearer rejected, media not registered [ 146.828376][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828376][ T7938] Use struct sctp_assoc_value instead [ 146.828419][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828419][ T7938] Use struct sctp_assoc_value instead [ 146.828442][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828442][ T7938] Use struct sctp_assoc_value instead [ 146.828464][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828464][ T7938] Use struct sctp_assoc_value instead [ 146.828486][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828486][ T7938] Use struct sctp_assoc_value instead [ 146.828508][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828508][ T7938] Use struct sctp_assoc_value instead [ 146.828530][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828530][ T7938] Use struct sctp_assoc_value instead [ 146.828551][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828551][ T7938] Use struct sctp_assoc_value instead [ 146.828572][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828572][ T7938] Use struct sctp_assoc_value instead [ 146.828592][ T7938] sctp: [Deprecated]: syz.4.489 (pid 7938) Use of int in max_burst socket option. [ 146.828592][ T7938] Use struct sctp_assoc_value instead [ 146.850390][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.850487][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.850566][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.850623][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.850681][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.850744][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.850801][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.850859][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.891743][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.891872][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.891942][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.892004][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.892072][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.892140][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.892202][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.892269][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.892331][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.892408][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.893764][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.896080][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.896169][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.896239][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.896307][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.896369][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.909859][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.909943][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910011][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910079][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910141][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910209][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910271][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910339][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910409][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910463][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910529][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910590][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910673][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.910747][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.914610][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.914699][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.914767][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.914904][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.914979][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940548][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940583][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940608][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940631][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940672][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940696][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940721][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940745][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940769][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940794][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940818][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940843][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.940867][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941076][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941103][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941127][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941152][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941177][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941201][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941226][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941250][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 146.941274][ T7939] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 148.162927][ T7985] netlink: 'syz.0.501': attribute type 1 has an invalid length. [ 148.162970][ T7985] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 148.331258][ T7994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.504'. [ 148.331287][ T7994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.504'. [ 148.432401][ T7998] syzkaller1: entered promiscuous mode [ 148.432426][ T7998] syzkaller1: entered allmulticast mode [ 148.932224][ T8019] xt_hashlimit: size too large, truncated to 1048576 [ 148.998713][ T8019] netlink: 12 bytes leftover after parsing attributes in process `syz.0.509'. [ 149.087731][ T8027] netlink: 'syz.3.510': attribute type 1 has an invalid length. [ 149.135960][ T8031] netlink: 'syz.1.511': attribute type 1 has an invalid length. [ 149.135982][ T8031] netlink: 5120 bytes leftover after parsing attributes in process `syz.1.511'. [ 149.215989][ T8027] 8021q: adding VLAN 0 to HW filter on device bond3 [ 149.391650][ T8032] bond3: (slave veth7): Enslaving as an active interface with a down link [ 149.445323][ T8035] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 149.460688][ T8035] bond3: (slave batadv1): making interface the new active one [ 149.471918][ T8035] batadv1: entered promiscuous mode [ 149.472511][ T8035] bond3: (slave batadv1): Enslaving as an active interface with an up link [ 149.539528][ T8027] bond3: (slave veth9): Enslaving as an active interface with a down link [ 149.645631][ T8052] netlink: 'syz.3.515': attribute type 1 has an invalid length. [ 150.144219][ T8078] netlink: 'syz.3.521': attribute type 21 has an invalid length. [ 150.412565][ T30] audit: type=1800 audit(1789152671.397:4): pid=8093 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.525" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC0430872FC91C4EC1B1B01993E2CDF65BC07D6BFE9DE254C4BC0696D656D6F72792E6576656E7473 dev="tmpfs" ino=505 res=0 errno=0 [ 150.508802][ T8097] xt_hashlimit: size too large, truncated to 1048576 [ 150.786694][ T8097] xt_hashlimit: size too large, truncated to 1048576 [ 150.815924][ T8112] __nla_validate_parse: 6 callbacks suppressed [ 150.815943][ T8112] netlink: 8 bytes leftover after parsing attributes in process `syz.3.530'. [ 150.815965][ T8112] netlink: 4 bytes leftover after parsing attributes in process `syz.3.530'. [ 151.015539][ T8097] xt_hashlimit: size too large, truncated to 1048576 [ 151.093521][ T8116] netlink: 32 bytes leftover after parsing attributes in process `syz.3.531'. [ 151.167722][ T8121] netlink: 'syz.4.532': attribute type 16 has an invalid length. [ 151.167745][ T8121] netlink: 20 bytes leftover after parsing attributes in process `syz.4.532'. [ 151.236184][ T8097] xt_hashlimit: size too large, truncated to 1048576 [ 151.707424][ T8134] xt_hashlimit: size too large, truncated to 1048576 [ 151.888602][ T8140] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.010042][ T8140] bridge_slave_0 (unregistering): left allmulticast mode [ 152.010070][ T8140] bridge_slave_0 (unregistering): left promiscuous mode [ 152.010137][ T8140] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.185334][ T8153] netlink: 16 bytes leftover after parsing attributes in process `syz.1.542'. [ 152.559288][ T8165] Bluetooth: MGMT ver 1.23 [ 152.598668][ T8164] netlink: 8 bytes leftover after parsing attributes in process `syz.2.543'. [ 152.634386][ T5624] block nbd2: Receive control failed (result -32) [ 152.805489][ T8173] veth11: entered allmulticast mode [ 152.870361][ T8179] netlink: 'syz.2.548': attribute type 1 has an invalid length. [ 152.899159][ T8173] veth13: entered allmulticast mode [ 153.003581][ T8189] netlink: 'syz.0.552': attribute type 21 has an invalid length. [ 153.003605][ T8189] netlink: 128 bytes leftover after parsing attributes in process `syz.0.552'. [ 153.060781][ T8187] netlink: 24 bytes leftover after parsing attributes in process `syz.0.552'. [ 153.103142][ T8173] veth15: entered allmulticast mode [ 153.196068][ T8173] veth17: entered allmulticast mode [ 153.196619][ T8201] netlink: NAT attribute has 4 unknown bytes [ 153.196649][ T8201] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 153.196936][ T8189] netlink: 'syz.0.552': attribute type 4 has an invalid length. [ 153.196951][ T8189] netlink: 'syz.0.552': attribute type 5 has an invalid length. [ 153.196964][ T8189] netlink: 3 bytes leftover after parsing attributes in process `syz.0.552'. [ 153.248916][ T8201] netlink: 28 bytes leftover after parsing attributes in process `syz.1.553'. [ 153.427637][ T8173] veth19: entered allmulticast mode [ 153.544881][ T8173] veth21: entered allmulticast mode [ 153.680011][ T8217] netlink: 'syz.2.555': attribute type 4 has an invalid length. [ 153.697306][ T8173] veth23: entered allmulticast mode [ 153.979293][ T8227] bridge0: port 4(ipvlan2) entered blocking state [ 153.988604][ T8227] bridge0: port 4(ipvlan2) entered disabled state [ 153.988774][ T8227] ipvlan2: entered allmulticast mode [ 153.988791][ T8227] bridge0: entered allmulticast mode [ 154.054534][ T8227] ipvlan2: left allmulticast mode [ 154.054557][ T8227] bridge0: left allmulticast mode [ 154.332479][ T8236] geneve3: entered promiscuous mode [ 154.371110][ T50] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 47351 - 0 [ 154.371194][ T50] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 47351 - 0 [ 154.371242][ T50] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 47351 - 0 [ 154.371279][ T50] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 47351 - 0 [ 154.856929][ T8272] netlink: NAT attribute has 5 unknown bytes [ 154.856979][ T8272] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 155.359013][ T8297] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.379392][ T8297] IPVS: set_ctl: invalid protocol: 158 172.20.20.187:20003 [ 155.831017][ T8309] tap0: tun_chr_ioctl cmd 1074025672 [ 155.831044][ T8309] tap0: ignored: set checksum disabled [ 155.877861][ T8311] netlink: 'syz.0.583': attribute type 1 has an invalid length. [ 155.877884][ T8311] __nla_validate_parse: 1 callbacks suppressed [ 155.877895][ T8311] netlink: 224 bytes leftover after parsing attributes in process `syz.0.583'. [ 156.030832][ T8311] pim6reg: entered allmulticast mode [ 156.037525][ T8312] pim6reg: left allmulticast mode [ 156.489690][ T8351] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 156.509707][ T8354] netlink: 284 bytes leftover after parsing attributes in process `syz.3.593'. [ 156.564214][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.570165][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.576464][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.577069][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.577561][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.588378][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.589059][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.599798][ T8351] netlink: 4 bytes leftover after parsing attributes in process `syz.1.592'. [ 156.815133][ T8370] openvswitch: netlink: Missing valid actions attribute. [ 156.815167][ T8370] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 156.907614][ T8376] xt_hashlimit: invalid interval [ 156.951490][ T8378] xt_hashlimit: invalid interval [ 157.176269][ T8387] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 157.177187][ T8387] bridge0: port 4(syz_tun) entered blocking state [ 157.178700][ T8387] bridge0: port 4(syz_tun) entered disabled state [ 157.178867][ T8387] syz_tun: entered allmulticast mode [ 157.192405][ T8387] syz_tun: entered promiscuous mode [ 157.196086][ T8387] bridge0: port 4(syz_tun) entered blocking state [ 157.196382][ T8387] bridge0: port 4(syz_tun) entered forwarding state [ 157.531624][ T8402] IPVS: set_ctl: invalid protocol: 44 224.0.0.1:20002 [ 157.665102][ T8408] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 157.726584][ T8413] syz.3.606 (8413) used obsolete PPPIOCDETACH ioctl [ 158.072842][ T8431] sctp: [Deprecated]: syz.3.614 (pid 8431) Use of int in maxseg socket option. [ 158.072842][ T8431] Use struct sctp_assoc_value instead [ 158.100483][ T8438] veth2: entered promiscuous mode [ 158.100579][ T8438] veth2: entered allmulticast mode [ 158.626928][ T8457] netlink: 'syz.0.621': attribute type 23 has an invalid length. [ 158.627022][ T8457] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 158.627034][ T8457] IPv6: NLM_F_CREATE should be set when creating new route [ 158.627108][ T8457] IPv6: NLM_F_CREATE should be set when creating new route [ 158.861253][ T8465] syzkaller0: entered promiscuous mode [ 158.861277][ T8465] syzkaller0: entered allmulticast mode [ 158.923428][ T8343] wlan1: Trigger new scan to find an IBSS to join [ 158.986650][ T8463] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 159.212529][ T8486] netlink: 'syz.0.630': attribute type 7 has an invalid length. [ 159.212554][ T8486] netlink: 'syz.0.630': attribute type 8 has an invalid length. [ 159.275621][ T8486] ip6gretap0: entered promiscuous mode [ 159.278059][ T8486] gretap0: entered promiscuous mode [ 159.278801][ T8486] debugfs: 'hsr1' already exists in 'hsr' [ 159.278840][ T8486] Cannot create hsr debugfs directory [ 159.623899][ T8504] netlink: 'syz.3.636': attribute type 1 has an invalid length. [ 159.775749][ T8504] 8021q: adding VLAN 0 to HW filter on device bond4 [ 159.812795][ T8508] bond4: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 159.816851][ T8508] bond4: entered allmulticast mode [ 160.138828][ T8521] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 160.741077][ T8345] batadv1: left promiscuous mode [ 160.745042][ T8559] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 161.219483][ T8577] __nla_validate_parse: 48 callbacks suppressed [ 161.219498][ T8577] netlink: 40 bytes leftover after parsing attributes in process `syz.0.653'. [ 161.289916][ T8579] netlink: 'syz.0.654': attribute type 15 has an invalid length. [ 161.289933][ T8579] netlink: 4 bytes leftover after parsing attributes in process `syz.0.654'. [ 161.315892][ T8579] netlink: 'syz.0.654': attribute type 15 has an invalid length. [ 161.315915][ T8579] netlink: 4 bytes leftover after parsing attributes in process `syz.0.654'. [ 161.338845][ T50] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 2816 - 0 [ 161.339155][ T50] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 161.354705][ T50] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 161.354821][ T50] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 2816 - 0 [ 161.523497][ T8584] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 162.922804][ T8342] wlan1: Trigger new scan to find an IBSS to join [ 163.628043][ T8557] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 164.035816][ T8622] netlink: 'syz.0.662': attribute type 3 has an invalid length. [ 164.871952][ T50] wlan1: Creating new IBSS network, BSSID 9a:96:9f:fb:c8:e4 [ 165.179934][ T8675] netlink: 'syz.3.678': attribute type 97 has an invalid length. [ 165.179956][ T8675] netlink: 8 bytes leftover after parsing attributes in process `syz.3.678'. [ 165.179973][ T8675] netlink: 'syz.3.678': attribute type 97 has an invalid length. [ 165.179987][ T8675] netlink: 8 bytes leftover after parsing attributes in process `syz.3.678'. [ 165.739282][ T8695] netlink: 4 bytes leftover after parsing attributes in process `syz.4.682'. [ 166.523813][ T8709] syzkaller1: entered promiscuous mode [ 166.523837][ T8709] syzkaller1: entered allmulticast mode [ 166.624040][ T8741] netlink: 16 bytes leftover after parsing attributes in process `syz.3.694'. [ 166.936172][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 166.936381][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 166.936569][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 166.936756][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 166.938671][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 166.938883][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 166.939083][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 167.017290][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 167.017489][ T8753] netlink: 76 bytes leftover after parsing attributes in process `syz.0.697'. [ 167.140811][ T8762] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 136 [ 168.573900][ T8796] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 168.925677][ T8849] syzkaller1: entered promiscuous mode [ 168.925701][ T8849] syzkaller1: entered allmulticast mode [ 169.157011][ T8868] netlink: 'syz.0.731': attribute type 1 has an invalid length. [ 169.195438][ T8853] netlink: 'syz.3.725': attribute type 1 has an invalid length. [ 169.348422][ T8868] 8021q: adding VLAN 0 to HW filter on device bond4 [ 169.443723][ T8871] bond4: (slave veth3): Enslaving as an active interface with a down link [ 169.462060][ T8874] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 169.465091][ T8874] bond4: (slave batadv1): making interface the new active one [ 169.466228][ T8874] batadv1: entered promiscuous mode [ 169.466594][ T8874] bond4: (slave batadv1): Enslaving as an active interface with an up link [ 169.636076][ T8871] bond4: (slave veth5): Enslaving as an active interface with a down link [ 169.801064][ T5624] Bluetooth: hci0: command 0x0401 tx timeout [ 170.288668][ T8922] netlink: 'syz.1.748': attribute type 2 has an invalid length. [ 170.465519][ T8933] netlink: 'syz.4.752': attribute type 7 has an invalid length. [ 170.467342][ T8933] netlink: 'syz.4.752': attribute type 7 has an invalid length. [ 170.504358][ T8935] x_tables: duplicate underflow at hook 1 [ 170.579251][ T8940] netlink: 'syz.0.754': attribute type 5 has an invalid length. [ 170.580040][ T8940] netlink: 'syz.0.754': attribute type 5 has an invalid length. [ 170.580317][ T8940] netlink: 'syz.0.754': attribute type 5 has an invalid length. [ 170.580572][ T8940] netlink: 'syz.0.754': attribute type 5 has an invalid length. [ 170.580833][ T8940] netlink: 'syz.0.754': attribute type 5 has an invalid length. [ 171.064248][ T8958] ip6t_srh: unknown srh invflags 4000 [ 171.068729][ T8960] IPv6: NLM_F_CREATE should be specified when creating new route [ 171.382651][ T8973] bridge3: entered promiscuous mode [ 171.382677][ T8973] bridge3: entered allmulticast mode [ 171.429894][ T8973] team0: Port device bridge3 added [ 171.444593][ T8980] bridge0: port 3(team0) entered blocking state [ 171.444695][ T8980] bridge0: port 3(team0) entered disabled state [ 171.444850][ T8980] team0: entered allmulticast mode [ 171.444868][ T8980] team_slave_0: entered allmulticast mode [ 171.444915][ T8980] team_slave_1: entered allmulticast mode [ 171.503830][ T8980] team0: entered promiscuous mode [ 171.503855][ T8980] team_slave_0: entered promiscuous mode [ 171.504051][ T8980] team_slave_1: entered promiscuous mode [ 171.507312][ T8980] bridge0: port 3(team0) entered blocking state [ 171.507445][ T8980] bridge0: port 3(team0) entered forwarding state [ 172.305600][ T9017] team0 (unregistering): Port device team_slave_0 removed [ 172.335987][ T9017] team0 (unregistering): Port device team_slave_1 removed [ 172.538172][ T1736] block nbd1: Possible stuck request ffff888027a7e000: control (read@0,1024B). Runtime 30 seconds [ 172.538552][ T1736] block nbd1: Possible stuck request ffff888027a7e1c0: control (read@1024,1024B). Runtime 30 seconds [ 172.538586][ T1736] block nbd1: Possible stuck request ffff888027a7e380: control (read@2048,1024B). Runtime 30 seconds [ 172.538616][ T1736] block nbd1: Possible stuck request ffff888027a7e540: control (read@3072,1024B). Runtime 30 seconds [ 172.652127][ T9039] __nla_validate_parse: 69 callbacks suppressed [ 172.652151][ T9039] netlink: 52 bytes leftover after parsing attributes in process `syz.2.781'. [ 172.692728][ T9040] netlink: 144 bytes leftover after parsing attributes in process `syz.0.779'. [ 172.752844][ T9043] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 172.824335][ T9047] netlink: 4 bytes leftover after parsing attributes in process `syz.0.779'. [ 173.126664][ T9053] xt_ipcomp: unknown flags 1D [ 175.358997][ T9029] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 175.637492][ T9062] validate_nla: 60 callbacks suppressed [ 175.637512][ T9062] netlink: 'syz.2.788': attribute type 1 has an invalid length. [ 175.768993][ T9071] netlink: 28 bytes leftover after parsing attributes in process `syz.2.788'. [ 175.769030][ T9071] netlink: 'syz.2.788': attribute type 8 has an invalid length. [ 175.769044][ T9071] netlink: 16 bytes leftover after parsing attributes in process `syz.2.788'. [ 175.820422][ T9062] bond2: entered promiscuous mode [ 175.827415][ T9062] 8021q: adding VLAN 0 to HW filter on device bond2 [ 175.864836][ T9067] bond2: (slave bridge1): making interface the new active one [ 175.864861][ T9067] bridge1: entered promiscuous mode [ 175.865734][ T9067] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 176.662803][ T9133] netlink: 'syz.4.791': attribute type 5 has an invalid length. [ 176.669354][ T30] audit: type=1804 audit(1789152697.647:5): pid=9130 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.800" name="/newroot/179/cgroup.controllers" dev="tmpfs" ino=933 res=1 errno=0 [ 176.669433][ T30] audit: type=1800 audit(1789152697.647:6): pid=9130 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.800" name="cgroup.controllers" dev="tmpfs" ino=933 res=0 errno=0 [ 177.056965][ T9142] netlink: 8 bytes leftover after parsing attributes in process `syz.4.802'. [ 179.249080][ T9093] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 179.251902][ T9102] tipc: Started in network mode [ 179.251934][ T9102] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 179.252144][ T9102] tipc: Enabled bearer , priority 0 [ 179.596249][ T9157] netlink: 4 bytes leftover after parsing attributes in process `syz.3.805'. [ 179.597093][ T9158] netlink: 4 bytes leftover after parsing attributes in process `syz.3.805'. [ 179.659218][ T9163] geneve4: entered allmulticast mode [ 179.906179][ T9175] netlink: 216 bytes leftover after parsing attributes in process `syz.4.814'. [ 179.906234][ T9175] netlink: 8 bytes leftover after parsing attributes in process `syz.4.814'. [ 179.950776][ T9182] netlink: 'syz.1.813': attribute type 1 has an invalid length. [ 179.994053][ T9186] netlink: 36 bytes leftover after parsing attributes in process `syz.1.813'. [ 179.997771][ T9181] xt_hashlimit: size too large, truncated to 1048576 [ 180.141159][ T9182] 8021q: adding VLAN 0 to HW filter on device bond3 [ 180.141718][ T9198] ipt_ah: unknown flags FF [ 180.382521][ T9103] tipc: Node number set to 43690 [ 180.523483][ T9204] x_tables: duplicate underflow at hook 1 [ 180.554716][ T1430] batadv1: left promiscuous mode [ 180.570419][ T9201] netlink: 20 bytes leftover after parsing attributes in process `syz.1.818'. [ 180.755267][ T9213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.823'. [ 180.796484][ T9216] xt_hashlimit: size too large, truncated to 1048576 [ 180.902987][ T9218] nftables ruleset with unbound chain [ 181.285370][ T9237] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 181.285413][ T9237] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 181.285434][ T9237] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 181.790199][ T9267] syzkaller0: entered promiscuous mode [ 181.790224][ T9267] syzkaller0: entered allmulticast mode [ 182.439099][ T9299] netlink: 4 bytes leftover after parsing attributes in process `syz.2.845'. [ 182.452377][ T9299] netlink: 'syz.2.845': attribute type 1 has an invalid length. [ 182.495304][ T9299] 8021q: adding VLAN 0 to HW filter on device bond3 [ 182.736954][ T9313] netlink: 24 bytes leftover after parsing attributes in process `syz.2.848'. [ 182.995003][ T9320] netlink: 'syz.2.850': attribute type 1 has an invalid length. [ 182.995636][ T9320] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 183.019641][ T9320] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 184.351226][ T9244] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 184.395439][ T9317] netlink: 'syz.2.850': attribute type 23 has an invalid length. [ 184.654908][ T9331] netlink: 192 bytes leftover after parsing attributes in process `syz.4.853'. [ 184.656850][ T9335] netlink: 192 bytes leftover after parsing attributes in process `syz.4.853'. [ 184.718693][ T9334] netlink: 'syz.3.854': attribute type 2 has an invalid length. [ 184.735382][ T9334] netlink: 4 bytes leftover after parsing attributes in process `syz.3.854'. [ 184.755646][ T9334] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 184.755672][ T9334] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 184.774516][ T9334] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 184.774540][ T9334] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 184.807253][ T9333] netlink: 32 bytes leftover after parsing attributes in process `syz.0.855'. [ 184.868067][ T9344] netlink: 408 bytes leftover after parsing attributes in process `syz.0.855'. [ 184.900070][ T9343] netlink: 8 bytes leftover after parsing attributes in process `syz.4.853'. [ 185.000522][ T9347] openvswitch: netlink: IP tunnel attribute has 5393 unknown bytes. [ 185.233511][ T9355] netlink: 8 bytes leftover after parsing attributes in process `syz.1.861'. [ 185.347207][ T9360] netlink: 4 bytes leftover after parsing attributes in process `syz.2.865'. [ 185.488184][ T9366] Cannot find add_set index 65532 as target [ 186.221357][ T9391] netlink: 12 bytes leftover after parsing attributes in process `syz.1.873'. [ 186.578697][ T9397] netlink: 'syz.4.875': attribute type 39 has an invalid length. [ 186.794583][ T9407] netlink: 20 bytes leftover after parsing attributes in process `syz.0.879'. [ 186.889303][ T9409] bond4: option all_slaves_active: invalid value (179) [ 186.898174][ T9409] bond4 (unregistering): Released all slaves [ 186.918665][ T9413] netlink: 'syz.3.880': attribute type 1 has an invalid length. [ 187.327839][ T9437] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 187.327876][ T9437] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 187.578948][ T9478] nft_compat: unsupported protocol 5 [ 188.070340][ T9512] team0: Device gtp0 is up. Set it down before adding it as a team port [ 188.186526][ T9513] hsr_slave_0: left promiscuous mode [ 188.189259][ T9513] hsr_slave_1: left promiscuous mode [ 188.215673][ T9542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 188.216003][ T9542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 188.217225][ T9542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 188.217709][ T9542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 188.218027][ T9542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 188.218341][ T9542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 188.219905][ T9542] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 188.714629][ T9574] x_tables: ip_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 189.331267][ T9589] netlink: 'syz.1.904': attribute type 29 has an invalid length. [ 189.338881][ T9589] netlink: 'syz.1.904': attribute type 29 has an invalid length. [ 189.519527][ T9587] xt_CT: No such helper "snmp_trap" [ 189.838748][ T9602] bridge0: port 1(bridge_slave_0) entered forwarding state [ 189.839063][ T9603] bridge0: port 1(bridge_slave_0) entered forwarding state [ 189.889793][ T9602] sctp: [Deprecated]: syz.2.909 (pid 9602) Use of struct sctp_assoc_value in delayed_ack socket option. [ 189.889793][ T9602] Use struct sctp_sack_info instead [ 189.999260][ T9613] ovs-s: entered promiscuous mode [ 190.010714][ T9616] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 190.013608][ T9616] tipc: Can't bind to reserved service type 0 [ 190.156018][ T9618] veth1_macvtap: left promiscuous mode [ 190.156047][ T9618] macsec0: entered allmulticast mode [ 190.387181][ T9634] __nla_validate_parse: 12 callbacks suppressed [ 190.387202][ T9634] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.916'. [ 190.392293][ T9634] netlink: 252 bytes leftover after parsing attributes in process `syz.4.916'. [ 191.144172][ T9647] syzkaller0: create flow: hash 63905988 index 1 [ 191.327627][ T9681] netlink: 16 bytes leftover after parsing attributes in process `syz.4.925'. [ 191.327686][ T9681] netlink: 16 bytes leftover after parsing attributes in process `syz.4.925'. [ 191.356842][ T9683] netlink: 16 bytes leftover after parsing attributes in process `syz.4.925'. [ 191.356900][ T9683] netlink: 16 bytes leftover after parsing attributes in process `syz.4.925'. [ 191.375910][ T8343] syzkaller0: tun_net_xmit 76 [ 191.376094][ T8343] syzkaller0: tun_net_xmit 48 [ 191.388519][ T9641] syzkaller0: delete flow: hash 63905988 index 1 [ 191.470047][ T9682] netlink: 220 bytes leftover after parsing attributes in process `syz.1.926'. [ 191.514411][ T9690] trusted_key: syz.0.929 sent an empty control message without MSG_MORE. [ 193.370623][ T9708] netlink: 'syz.2.933': attribute type 10 has an invalid length. [ 193.376119][ T9717] netlink: 'syz.2.933': attribute type 10 has an invalid length. [ 193.395985][ T9710] netlink: 'syz.3.934': attribute type 39 has an invalid length. [ 193.413277][ T9708] vxcan1: entered promiscuous mode [ 193.413460][ T9708] vxcan1: entered allmulticast mode [ 193.413478][ T9708] team0: Device vxcan1 is of different type [ 193.482953][ T9717] team0: Device vxcan1 is of different type [ 193.520183][ T9722] netlink: 4 bytes leftover after parsing attributes in process `syz.4.936'. [ 193.574819][ T9728] netlink: 8 bytes leftover after parsing attributes in process `syz.0.937'. [ 193.934692][ T9738] netlink: 16 bytes leftover after parsing attributes in process `syz.2.939'. [ 194.045298][ T9740] net_ratelimit: 60 callbacks suppressed [ 194.045318][ T9740] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 194.286778][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.286836][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.208019][ T9799] netlink: 'syz.2.957': attribute type 1 has an invalid length. [ 195.316235][ T9799] 8021q: adding VLAN 0 to HW filter on device bond4 [ 195.317887][ T9804] tipc: Resetting bearer [ 195.443531][ T9804] tipc: Disabling bearer [ 195.512063][ T9813] __nla_validate_parse: 5 callbacks suppressed [ 195.512084][ T9813] netlink: 4 bytes leftover after parsing attributes in process `syz.0.961'. [ 195.548704][ T9799] bond4: (slave gretap1): making interface the new active one [ 195.550494][ T9799] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 195.799123][ T9825] ip_tables: iptables: counters copy to user failed while replacing table [ 195.932452][ T9827] netlink: 'syz.2.957': attribute type 1 has an invalid length. [ 196.145219][ T9841] bond5: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 196.229366][ T9841] bond5 (unregistering): Released all slaves [ 196.862341][ T9869] syzkaller0: entered promiscuous mode [ 196.862366][ T9869] syzkaller0: entered allmulticast mode [ 196.864470][ T9856] netlink: 132 bytes leftover after parsing attributes in process `syz.0.973'. [ 196.952632][ T9869] syzkaller0: left promiscuous mode [ 196.952655][ T9869] syzkaller0: left allmulticast mode [ 197.008467][ T9884] netlink: Setting conntrack mark requires 'commit' flag. [ 197.008501][ T9884] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 197.169200][ T9892] netlink: 'syz.2.978': attribute type 23 has an invalid length. [ 197.675234][ T9905] netlink: 'syz.0.982': attribute type 1 has an invalid length. [ 197.731619][ T9909] netlink: 8 bytes leftover after parsing attributes in process `syz.4.983'. [ 197.898523][ T9909] xfrm2: entered allmulticast mode [ 197.915613][ T9922] netlink: 8 bytes leftover after parsing attributes in process `syz.4.983'. [ 197.965486][ T9930] netlink: 36 bytes leftover after parsing attributes in process `syz.2.985'. [ 198.273071][ T9956] netlink: 'syz.4.988': attribute type 11 has an invalid length. [ 198.273094][ T9956] netlink: 'syz.4.988': attribute type 4 has an invalid length. [ 198.273109][ T9956] netlink: 224 bytes leftover after parsing attributes in process `syz.4.988'. [ 198.273363][ T9956] tipc: Failed to remove unknown binding: 66,0,0/0:1468462405/1468462406 [ 198.278772][ T9957] tipc: Failed to remove unknown binding: 66,0,0/0:1468462405/1468462406 [ 198.510620][ T9966] netlink: 45349 bytes leftover after parsing attributes in process `syz.4.991'. [ 198.510802][ T9966] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 198.536417][ T9966] 0ªX¹¦Dö»: entered allmulticast mode [ 198.623202][ T9968] x_tables: duplicate underflow at hook 1 [ 198.868970][ T9983] netlink: 8 bytes leftover after parsing attributes in process `syz.1.996'. [ 198.869006][ T9983] netlink: 20 bytes leftover after parsing attributes in process `syz.1.996'. [ 198.997091][ T9995] netlink: 8 bytes leftover after parsing attributes in process `syz.1.996'. [ 199.009758][ T9983] xt_l2tp: unknown flags: 10 [ 199.060060][T10003] Bluetooth: hci0: unsupported parameter 5161 [ 199.060084][T10003] Bluetooth: hci0: unsupported parameter 8192 [ 199.060117][T10003] Bluetooth: hci0: unsupported parameter 5161 [ 199.060132][T10003] Bluetooth: hci0: unsupported parameter 8192 [ 199.198405][T10004] netdevsim netdevsim2: Direct firmware load for ÿ failed with error -2 [ 199.208191][T10004] netdevsim netdevsim2: Falling back to sysfs fallback for: ÿ [ 199.293295][T10014] netlink: 'syz.2.998': attribute type 1 has an invalid length. [ 201.801453][ T9983] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 202.189896][T10042] __nla_validate_parse: 4 callbacks suppressed [ 202.189917][T10042] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1008'. [ 202.574621][T10065] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1014'. [ 202.602714][ T1736] block nbd1: Possible stuck request ffff888027a7e000: control (read@0,1024B). Runtime 60 seconds [ 202.602759][ T1736] block nbd1: Possible stuck request ffff888027a7e1c0: control (read@1024,1024B). Runtime 60 seconds [ 202.602802][ T1736] block nbd1: Possible stuck request ffff888027a7e380: control (read@2048,1024B). Runtime 60 seconds [ 202.602832][ T1736] block nbd1: Possible stuck request ffff888027a7e540: control (read@3072,1024B). Runtime 60 seconds [ 202.674771][T10065] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1014'. [ 202.716536][T10071] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1014'. [ 202.785184][T10080] netlink: 'syz.2.1019': attribute type 23 has an invalid length. [ 202.872819][T10069] bond6: Removing last arp target with arp_interval on [ 203.538830][T10118] netlink: 'syz.4.1026': attribute type 4 has an invalid length. [ 204.575679][T10168] veth1_macvtap: left promiscuous mode [ 204.575709][T10168] macsec0: entered promiscuous mode [ 204.745070][T10173] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1038'. [ 206.579343][T10242] netlink: 'syz.3.1050': attribute type 4 has an invalid length. [ 206.737305][T10250] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1053'. [ 206.778160][T10255] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1054'. [ 207.203620][T10281] netlink: 136 bytes leftover after parsing attributes in process `syz.1.1057'. [ 207.746753][T10306] netlink: zone id is out of range [ 207.747411][T10307] netlink: zone id is out of range [ 207.747426][T10307] netlink: del zone limit has 4 unknown bytes [ 207.748327][T10306] netlink: del zone limit has 4 unknown bytes [ 207.928161][T10314] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 208.663461][T10219] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 209.422486][T10368] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1073'. [ 209.490994][T10371] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1074'. [ 209.814034][T10350] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 209.895388][T10380] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 210.236124][T10403] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1083'. [ 210.236502][T10404] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1083'. [ 210.284113][T10403] bond5: Invalid ad_actor_system MAC address. [ 210.284155][T10403] bond5: option ad_actor_system: invalid value (1) [ 210.285832][T10403] bond5 (unregistering): Released all slaves [ 210.350372][T10404] bond5: Invalid ad_actor_system MAC address. [ 210.350392][T10404] bond5: option ad_actor_system: invalid value (1) [ 210.365701][T10404] bond5 (unregistering): Released all slaves [ 210.894337][T10432] x_tables: unsorted underflow at hook 2 [ 210.895049][T10432] netlink: 'syz.3.1089': attribute type 1 has an invalid length. [ 211.735083][T10375] Bluetooth: hci0: command 0x0401 tx timeout [ 211.735123][T10375] Bluetooth: hci2: command 0x0406 tx timeout [ 211.735160][T10375] Bluetooth: hci1: command 0x0406 tx timeout [ 211.735185][T10375] Bluetooth: hci4: command 0x0406 tx timeout [ 212.133393][ T8345] IPVS: starting estimator thread 0... [ 212.182480][T10453] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1097'. [ 212.221151][T10451] IPVS: using max 25 ests per chain, 60000 per kthread [ 212.743103][T10380] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 213.049479][T10471] netlink: 136 bytes leftover after parsing attributes in process `syz.4.1101'. [ 213.417847][T10489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1109'. [ 213.533143][T10489] 8021q: adding VLAN 0 to HW filter on device bond4 [ 213.553938][T10498] tipc: Started in network mode [ 213.553982][T10498] tipc: Node identity 78563412785634122143658721436587, cluster identity 4711 [ 213.675495][T10505] ip_tables: iptables: counters copy to user failed while replacing table [ 213.860094][T10515] Bluetooth: hci0: unsupported parameter 5135 [ 213.860118][T10515] Bluetooth: hci0: unsupported parameter 8192 [ 213.860132][T10515] Bluetooth: hci0: unsupported parameter 5135 [ 213.860146][T10515] Bluetooth: hci0: unsupported parameter 8192 [ 213.860220][T10513] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1114'. [ 213.896377][T10516] bond0: entered promiscuous mode [ 213.896415][T10516] bond_slave_0: entered promiscuous mode [ 213.897008][T10516] bond_slave_1: entered promiscuous mode [ 213.910812][T10516] batadv0: entered promiscuous mode [ 213.932452][T10516] debugfs: 'hsr1' already exists in 'hsr' [ 213.932476][T10516] Cannot create hsr debugfs directory [ 213.935987][T10516] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 214.159641][T10530] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 214.420383][T10535] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 214.879362][T10558] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1127'. [ 215.600225][T10582] vlan2: entered promiscuous mode [ 215.600249][T10582] bridge0: entered promiscuous mode [ 215.612778][T10582] vlan2: entered allmulticast mode [ 215.612799][T10582] bridge0: entered allmulticast mode [ 215.792639][T10586] xt_CT: You must specify a L4 protocol and not use inversions on it [ 215.847111][T10560] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1126'. [ 215.885322][T10591] syzkaller1: entered promiscuous mode [ 215.885344][T10591] syzkaller1: entered allmulticast mode [ 215.916502][T10593] openvswitch: netlink: nsh attr 0 has unexpected len 4 expected 0 [ 215.997646][T10604] openvswitch: netlink: nsh attr 0 has unexpected len 4 expected 0 [ 216.277239][T10615] netlink: 21 bytes leftover after parsing attributes in process `syz.1.1143'. [ 216.407012][T10620] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 216.407032][T10620] IPv6: NLM_F_CREATE should be set when creating new route [ 216.589991][T10629] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1147'. [ 216.657143][T10630] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1148'. [ 216.670235][T10632] veth0: entered promiscuous mode [ 216.678792][T10632] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1149'. [ 216.766578][T10631] veth0: left promiscuous mode [ 217.043928][T10646] netlink: 'syz.4.1154': attribute type 2 has an invalid length. [ 217.043952][T10646] netlink: 'syz.4.1154': attribute type 8 has an invalid length. [ 217.043966][T10646] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1154'. [ 218.460155][T10700] __nla_validate_parse: 2 callbacks suppressed [ 218.460174][T10700] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1171'. [ 218.565086][T10704] netlink: 216 bytes leftover after parsing attributes in process `syz.2.1173'. [ 218.565150][T10704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1173'. [ 218.712939][T10709] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1174'. [ 218.754138][T10716] ip_tables: iptables: counters copy to user failed while replacing table [ 218.881411][T10716] syzkaller1: entered promiscuous mode [ 218.881438][T10716] syzkaller1: entered allmulticast mode [ 218.905775][T10722] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1178'. [ 219.075506][T10727] netlink: 'syz.1.1179': attribute type 1 has an invalid length. [ 219.215596][T10724] macvlan3: entered promiscuous mode [ 219.215621][T10724] macvlan3: entered allmulticast mode [ 219.216629][T10724] bond5: entered promiscuous mode [ 219.217459][T10724] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 219.252904][T10724] bond5: left promiscuous mode [ 219.268631][T10735] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1183'. [ 219.291635][T10736] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 219.524177][T10747] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1185'. [ 219.527590][T10747] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1185'. [ 219.589859][T10751] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1187'. [ 219.755056][T10756] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1185'. [ 221.214949][T10825] syzkaller0: entered promiscuous mode [ 221.214974][T10825] syzkaller0: entered allmulticast mode [ 221.469789][T10832] Bluetooth: MGMT ver 1.23 [ 221.553860][T10834] erspan0: entered promiscuous mode [ 221.556748][T10834] gretap0: entered promiscuous mode [ 221.561806][T10834] debugfs: 'hsr0' already exists in 'hsr' [ 221.561864][T10834] Cannot create hsr debugfs directory [ 221.646207][T10834] netlink: 'syz.2.1208': attribute type 1 has an invalid length. [ 221.646232][T10834] netlink: 'syz.2.1208': attribute type 3 has an invalid length. [ 221.685935][T10846] netlink: 'syz.4.1212': attribute type 83 has an invalid length. [ 222.093539][T10869] erspan0: entered promiscuous mode [ 222.509747][T10873] 8021q: VLANs not supported on gre0 [ 222.569789][T10881] macvlan0: entered promiscuous mode [ 222.889198][T10909] ip_tables: iptables: counters copy to user failed while replacing table [ 223.685425][T10942] netlink: 'syz.4.1238': attribute type 1 has an invalid length. [ 223.758812][T10950] openvswitch: netlink: Unknown key attributes 1 [ 223.783338][T10942] bond7: entered promiscuous mode [ 223.783837][T10942] 8021q: adding VLAN 0 to HW filter on device bond7 [ 224.233546][T10967] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.289804][T10972] macvlan0: entered promiscuous mode [ 224.303859][T10972] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 224.482475][T10980] netlink: get zone limit has 8 unknown bytes [ 224.646117][T10982] __nla_validate_parse: 19 callbacks suppressed [ 224.646142][T10982] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1253'. [ 224.842744][T10991] veth1_macvtap: entered promiscuous mode [ 224.842768][T10991] veth1_macvtap: entered allmulticast mode [ 224.842923][T10991] macsec0: left allmulticast mode [ 224.842937][T10991] veth1_macvtap: left allmulticast mode [ 224.877283][T10993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1258'. [ 225.148326][T11007] ip_tables: iptables: counters copy to user failed while replacing table [ 225.188683][T11007] ip_tables: iptables: counters copy to user failed while replacing table [ 225.202817][T11007] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1261'. [ 225.428098][T11016] macsec1: entered promiscuous mode [ 225.762082][T11032] tun0: tun_chr_ioctl cmd 1074025675 [ 225.762107][T11032] tun0: persist enabled [ 225.765025][T11037] veth0: mtu less than device minimum [ 225.765898][T11032] tun0: tun_chr_ioctl cmd 35108 [ 225.767799][T11037] netlink: 'syz.0.1273': attribute type 10 has an invalid length. [ 225.805011][T11037] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 225.987126][T11040] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1274'. [ 226.376339][T11063] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1280'. [ 226.449766][T11063] syzkaller1: entered promiscuous mode [ 226.449790][T11063] syzkaller1: entered allmulticast mode [ 226.477083][T11063] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1280'. [ 226.508036][T11077] ip_tables: iptables: counters copy to user failed while replacing table [ 226.508345][T11077] ip_tables: iptables: counters copy to user failed while replacing table [ 226.508644][T11077] ip_tables: iptables: counters copy to user failed while replacing table [ 226.508986][T11077] ip_tables: iptables: counters copy to user failed while replacing table [ 226.529851][T11077] ip_tables: iptables: counters copy to user failed while replacing table [ 226.775506][T11093] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1286'. [ 227.341862][T11081] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 227.553082][T11113] netdevsim netdevsim0: Direct firmware load for . failed with error -2 [ 227.553111][T11113] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 227.607490][T11117] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1290'. [ 227.781316][T11124] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1294'. [ 228.034133][T11132] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1297'. [ 228.034179][T11132] netlink: 'syz.3.1297': attribute type 4 has an invalid length. [ 228.150827][T11137] netlink: 'syz.1.1300': attribute type 12 has an invalid length. [ 228.237268][T11139] gretap0: entered promiscuous mode [ 228.253939][T11139] 0ªî{X¹¦: renamed from gretap0 [ 228.268172][T11139] 0ªî{X¹¦: left promiscuous mode [ 228.268195][T11139] 0ªî{X¹¦: entered allmulticast mode [ 228.285195][T11141] netlink: 'syz.2.1301': attribute type 2 has an invalid length. [ 229.040445][T11171] syzkaller1: entered promiscuous mode [ 229.040470][T11171] syzkaller1: entered allmulticast mode [ 229.166641][T11144] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 229.682696][T11200] netlink: 'syz.3.1311': attribute type 16 has an invalid length. [ 229.682719][T11200] netlink: 'syz.3.1311': attribute type 17 has an invalid length. [ 230.026517][T11200] 0ªî{X¹¦: left allmulticast mode [ 230.248521][T11200] wg0: left allmulticast mode [ 230.444547][T11200] vlan0: left promiscuous mode [ 230.473942][T11200] macvlan0: left promiscuous mode [ 230.529758][T11200] geneve0: left allmulticast mode [ 230.580273][T11200] bond2: left promiscuous mode [ 230.580299][T11200] bond2: left allmulticast mode [ 230.594103][T11200] 8021q: adding VLAN 0 to HW filter on device bond2 [ 230.628314][T11200] macsec1: left promiscuous mode [ 230.650818][T11200] veth11: left allmulticast mode [ 230.668518][T11200] veth13: left allmulticast mode [ 230.676847][T11200] veth15: left allmulticast mode [ 230.679534][T11200] veth17: left allmulticast mode [ 230.696954][T11200] veth19: left allmulticast mode [ 230.699372][T11200] veth21: left allmulticast mode [ 230.713342][T11200] veth23: left allmulticast mode [ 230.714690][T11200] bond4: left allmulticast mode [ 230.715096][T11200] 8021q: adding VLAN 0 to HW filter on device bond4 [ 230.763399][T11200] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 230.765282][T11200] vlan2: left promiscuous mode [ 230.765303][T11200] bridge0: left promiscuous mode [ 230.765560][T11200] vlan2: left allmulticast mode [ 230.765575][T11200] bridge0: left allmulticast mode [ 230.825279][ T1371] bond3: (slave veth7): link status definitely up, 10000 Mbps full duplex [ 230.825503][ T1371] bond3: (slave veth9): link status definitely up, 10000 Mbps full duplex [ 231.075031][ T978] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.075163][ T978] bridge0: port 1(bridge_slave_0) entered forwarding state [ 231.107149][ T978] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.107272][ T978] bridge0: port 2(bridge_slave_1) entered forwarding state [ 231.311699][T11244] net_ratelimit: 36 callbacks suppressed [ 231.311719][T11244] openvswitch: netlink: Message has 16 unknown bytes. [ 232.168852][T11256] xt_cgroup: path and classid specified [ 232.697621][T11268] bond5: option arp_all_targets: invalid value (18446744073709551613) [ 232.718230][T11268] bond5 (unregistering): Released all slaves [ 232.736204][ T1736] block nbd1: Possible stuck request ffff888027a7e000: control (read@0,1024B). Runtime 90 seconds [ 232.736246][ T1736] block nbd1: Possible stuck request ffff888027a7e1c0: control (read@1024,1024B). Runtime 90 seconds [ 232.736286][ T1736] block nbd1: Possible stuck request ffff888027a7e380: control (read@2048,1024B). Runtime 90 seconds [ 232.736312][ T1736] block nbd1: Possible stuck request ffff888027a7e540: control (read@3072,1024B). Runtime 90 seconds [ 233.544076][T11281] __nla_validate_parse: 6 callbacks suppressed [ 233.544097][T11281] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1325'. [ 233.962903][T11284] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1326'. [ 233.988547][T11284] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.098759][T11291] netlink: 1196 bytes leftover after parsing attributes in process `syz.4.1328'. [ 234.098784][T11291] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1328'. [ 235.167291][T11301] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1329'. [ 235.370109][T11314] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1334'. [ 235.672613][T11322] netlink: 'syz.1.1335': attribute type 1 has an invalid length. [ 235.672637][T11322] netlink: 228 bytes leftover after parsing attributes in process `syz.1.1335'. [ 235.795269][T11326] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1337'. [ 235.795295][T11326] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1337'. [ 236.154609][T11332] netlink: 'syz.1.1339': attribute type 9 has an invalid length. [ 236.159067][T11336] netlink: 'syz.1.1339': attribute type 9 has an invalid length. [ 236.310788][T11340] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1339'. [ 237.307109][T11369] bond5: option resend_igmp: invalid value (32767) [ 237.307137][T11369] bond5: option resend_igmp: allowed values 0 - 255 [ 237.554334][T11369] bond5 (unregistering): Released all slaves [ 238.898050][T11396] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 238.899438][T11396] netlink: 'syz.2.1354': attribute type 21 has an invalid length. [ 238.899459][T11396] IPv6: NLM_F_CREATE should be specified when creating new route [ 238.899535][T11396] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 238.899545][T11396] IPv6: NLM_F_CREATE should be set when creating new route [ 238.899586][T11396] IPv6: NLM_F_CREATE should be set when creating new route [ 238.899618][T11396] IPv6: NLM_F_CREATE should be set when creating new route [ 239.029323][ T50] IPVS: starting estimator thread 0... [ 239.068901][T11400] __nla_validate_parse: 4 callbacks suppressed [ 239.068919][T11400] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1356'. [ 239.137940][T11401] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1355'. [ 239.180953][T11397] IPVS: using max 27 ests per chain, 64800 per kthread [ 239.528433][T11409] netlink: 'syz.2.1359': attribute type 1 has an invalid length. [ 239.528457][T11409] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1359'. [ 239.528473][T11409] netlink: 'syz.2.1359': attribute type 1 has an invalid length. [ 239.573675][T11409] sctp: [Deprecated]: syz.2.1359 (pid 11409) Use of struct sctp_assoc_value in delayed_ack socket option. [ 239.573675][T11409] Use struct sctp_sack_info instead [ 239.633095][T11409] IPVS: set_ctl: invalid protocol: 51 172.20.20.187:20004 [ 241.508988][T11445] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1369'. [ 241.509836][T11448] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1369'. [ 241.695001][T11450] xt_hashlimit: size too large, truncated to 1048576 [ 241.738463][T11452] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1370'. [ 242.082699][T11455] netlink: 'syz.1.1372': attribute type 25 has an invalid length. [ 242.375931][T11458] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1373'. [ 244.309688][T11480] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1379'. [ 244.389156][T11479] netlink: 'syz.2.1379': attribute type 1 has an invalid length. [ 245.370868][ C1] sched: DL replenish lagged too much [ 245.454248][T11460] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 247.221235][T11532] netlink: 180 bytes leftover after parsing attributes in process `syz.0.1389'. [ 247.484797][T11542] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1391'. [ 247.662099][T11546] netlink: 236 bytes leftover after parsing attributes in process `syz.4.1392'. [ 247.723706][T11546] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 247.820582][T11549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1393'. [ 247.910616][T11554] openvswitch: netlink: IP tunnel dst address not specified [ 247.991389][T11554] openvswitch: netlink: IP tunnel dst address not specified [ 248.598377][T11570] netlink: 'syz.3.1398': attribute type 1 has an invalid length. [ 249.078452][T11584] ip_tables: iptables: counters copy to user failed while replacing table [ 249.164121][T11581] can: request_module (can-proto-0) failed. [ 249.297720][T11585] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1402'. [ 250.083308][T11604] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1406'. [ 250.276223][T11614] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1408'. [ 250.305105][T11616] openvswitch: netlink: Flow key attribute not present in set flow. [ 250.310222][T11616] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1409'. [ 250.736052][T11627] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1412'. [ 250.736397][T11627] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1412'. [ 251.486675][T11642] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.1418'. [ 251.599358][T11644] netlink: 'syz.2.1419': attribute type 23 has an invalid length. [ 252.078290][T11653] netlink: 'syz.2.1423': attribute type 1 has an invalid length. [ 252.137072][T11653] 8021q: adding VLAN 0 to HW filter on device bond5 [ 252.307477][T11653] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1423'. [ 252.425654][T11653] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1423'. [ 252.628128][T11654] bond5: (slave geneve2): making interface the new active one [ 252.689092][T11654] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 252.747358][T11653] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1423'. [ 252.765405][T11653] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1423'. [ 253.691198][T11699] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 255.383247][T11668] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 255.803852][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.803913][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.098615][T11734] __nla_validate_parse: 5 callbacks suppressed [ 256.098635][T11734] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1439'. [ 256.319953][T11736] sctp: [Deprecated]: syz.0.1440 (pid 11736) Use of int in max_burst socket option deprecated. [ 256.319953][T11736] Use struct sctp_assoc_value instead [ 256.510072][T11740] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 256.541537][T11739] netlink: 9 bytes leftover after parsing attributes in process `syz.2.1441'. [ 257.022404][T11756] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1445'. [ 257.609258][T11767] netlink: 'syz.1.1451': attribute type 178 has an invalid length. [ 257.714215][T11773] netlink: 'syz.3.1452': attribute type 1 has an invalid length. [ 257.815179][T11773] netlink: 9 bytes leftover after parsing attributes in process `syz.3.1452'. [ 257.916008][T11773] 0ªî{X¹¦: entered promiscuous mode [ 258.032822][T11775] netlink: 5 bytes leftover after parsing attributes in process `syz.3.1452'. [ 258.036641][T11789] netlink: 5 bytes leftover after parsing attributes in process `syz.3.1452'. [ 258.155257][T11775] 1ªî{X¹¦: renamed from 30ªî{X¹¦ [ 258.209542][T11775] 1ªî{X¹¦: left promiscuous mode [ 258.209578][T11775] 1ªî{X¹¦: entered allmulticast mode [ 258.244395][T11775] A link change request failed with some changes committed already. Interface 31ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 258.268973][T11789] 0ªî{X¹¦: renamed from 31ªî{X¹¦ (while UP) [ 258.299379][T11789] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 258.659542][T11792] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1455'. [ 259.103243][T11808] sctp_getsockopt_maxburst: 55 callbacks suppressed [ 259.103264][T11808] sctp: [Deprecated]: syz.1.1459 (pid 11808) Use of int in max_burst socket option. [ 259.103264][T11808] Use struct sctp_assoc_value instead [ 259.425144][T11815] netlink: 'syz.1.1461': attribute type 2 has an invalid length. [ 259.871424][T11821] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1463'. [ 259.871447][T11821] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1463'. [ 259.871461][T11821] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1463'. [ 260.055396][T11814] tipc: Enabling of bearer rejected, failed to enable media [ 260.402336][T11836] lo: entered promiscuous mode [ 260.419929][T11836] tunl0: entered promiscuous mode [ 260.503906][T11836] gre0: entered promiscuous mode [ 260.636142][T11836] 0ªî{X¹¦: entered promiscuous mode [ 260.636167][T11836] 0ªî{X¹¦: left allmulticast mode [ 260.981207][T11836] ip_vti0: entered promiscuous mode [ 261.312920][T11858] netlink: 'syz.3.1472': attribute type 1 has an invalid length. [ 261.404125][T11860] __nla_validate_parse: 36 callbacks suppressed [ 261.404146][T11860] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1470'. [ 261.487065][T11858] 8021q: adding VLAN 0 to HW filter on device bond6 [ 261.511790][T11866] xt_hashlimit: size too large, truncated to 1048576 [ 261.608351][T11862] bond6: (slave geneve2): making interface the new active one [ 261.610776][T11862] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 261.611511][T11863] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1471'. [ 261.640694][T11864] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1471'. [ 261.747755][T11870] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.750413][T11870] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.001734][T11880] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1475'. [ 262.129017][T11891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1477'. [ 262.129045][T11891] block nbd3: Unsupported socket: should be TCP or UNIX. [ 262.197161][T11893] netlink: 'syz.3.1478': attribute type 1 has an invalid length. [ 262.230571][T11897] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 262.242789][T11893] 8021q: adding VLAN 0 to HW filter on device bond7 [ 262.267407][T11893] bond7: (slave veth0_to_bond): making interface the new active one [ 262.269148][T11893] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 262.316790][T11893] bond7: entered promiscuous mode [ 262.316813][T11893] veth0_to_bond: entered promiscuous mode [ 262.317055][T11893] bond7: entered allmulticast mode [ 262.317072][T11893] veth0_to_bond: entered allmulticast mode [ 262.409912][T11902] macvlan2: entered promiscuous mode [ 262.409940][T11902] macvlan2: entered allmulticast mode [ 262.423640][T11902] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 262.429562][T11902] bond7: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 262.670762][T11913] openvswitch: netlink: IP tunnel attribute has 5365 unknown bytes. [ 262.773527][ T1736] block nbd1: Possible stuck request ffff888027a7e000: control (read@0,1024B). Runtime 120 seconds [ 262.773574][ T1736] block nbd1: Possible stuck request ffff888027a7e1c0: control (read@1024,1024B). Runtime 120 seconds [ 262.773604][ T1736] block nbd1: Possible stuck request ffff888027a7e380: control (read@2048,1024B). Runtime 120 seconds [ 262.773632][ T1736] block nbd1: Possible stuck request ffff888027a7e540: control (read@3072,1024B). Runtime 120 seconds [ 263.545438][T11958] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1492'. [ 263.596488][T11961] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1493'. [ 263.872338][T11965] netlink: 'syz.0.1494': attribute type 1 has an invalid length. [ 264.031910][T11965] 8021q: adding VLAN 0 to HW filter on device bond5 [ 264.038871][T11979] netlink: 'syz.3.1495': attribute type 2 has an invalid length. [ 264.106430][T11967] bond5: (slave gretap1): making interface the new active one [ 264.134915][T11967] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 264.179937][T11985] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1496'. [ 264.429600][T11995] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 264.429600][T11995] Please contact the netfilter-devel mailing list or update your nftables rules. [ 264.485954][T11995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1499'. [ 265.038299][T12009] netlink: 'syz.1.1504': attribute type 10 has an invalid length. [ 265.482480][T12045] netlink: 'syz.2.1515': attribute type 11 has an invalid length. [ 265.624640][T12049] netlink: 'syz.3.1516': attribute type 1 has an invalid length. [ 265.624837][T12049] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1516'. [ 266.102925][T12068] netlink: 'syz.1.1522': attribute type 12 has an invalid length. [ 266.102948][T12068] netlink: 'syz.1.1522': attribute type 29 has an invalid length. [ 266.275377][T12078] IPVS: set_ctl: invalid protocol: 60 224.0.0.1:20002 [ 266.289264][ T8335] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 266.289310][ T8335] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 266.491070][T12094] xt_socket: unknown flags 0xc [ 266.715595][T12103] __nla_validate_parse: 3 callbacks suppressed [ 266.715616][T12103] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1529'. [ 266.717267][T12111] netlink: 108 bytes leftover after parsing attributes in process `syz.3.1532'. [ 267.302898][T12141] ip_tables: iptables: counters copy to user failed while replacing table [ 267.443623][ T4935] Bluetooth: hci1: ISO packet too small [ 267.559190][T12150] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 268.180545][T12173] IPVS: set_ctl: invalid protocol: 13 100.1.1.0:20004 [ 268.393699][T12189] netlink: 'syz.4.1553': attribute type 2 has an invalid length. [ 268.406649][T12189] : entered promiscuous mode [ 268.618755][T12193] syzkaller0: entered promiscuous mode [ 268.619766][T12193] syzkaller0: entered allmulticast mode [ 269.427039][T12229] ip_tables: iptables: counters copy to user failed while replacing table [ 269.444013][T12213] netlink: 'syz.0.1558': attribute type 4 has an invalid length. [ 270.323137][T12254] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 272.812611][T12258] xt_l2tp: missing protocol rule (udp|l2tpip) [ 273.078032][T12272] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1573'. [ 273.078054][T12272] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1573'. [ 273.191504][ T6424] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.193467][ T8344] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.193572][ T8344] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.193667][ T8344] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 273.369136][T12281] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1577'. [ 273.546294][T12292] syzkaller1: entered promiscuous mode [ 273.546319][T12292] syzkaller1: entered allmulticast mode [ 273.665411][T12299] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1584'. [ 273.941197][T12314] netlink: 'syz.1.1587': attribute type 1 has an invalid length. [ 274.006215][T12314] netlink: 'syz.1.1587': attribute type 23 has an invalid length. [ 274.158750][T12321] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1592'. [ 274.316456][T12327] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1596'. [ 274.398554][T12335] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1595'. [ 274.398577][T12335] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1595'. [ 274.430644][T12337] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1597'. [ 275.108015][T12369] xt_hashlimit: overflow, try lower: 3/0 [ 275.114917][T12371] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1608'. [ 275.913458][T12399] netlink: 'syz.2.1617': attribute type 10 has an invalid length. [ 275.919585][T12399] bridge0: port 3(team0) entered disabled state [ 275.935832][T12399] team0: left allmulticast mode [ 275.935849][T12399] team_slave_0: left allmulticast mode [ 275.935864][T12399] team_slave_1: left allmulticast mode [ 275.935895][T12399] team0: left promiscuous mode [ 275.935907][T12399] team_slave_0: left promiscuous mode [ 275.936124][T12399] team_slave_1: left promiscuous mode [ 275.936477][T12399] bridge0: port 3(team0) entered disabled state [ 275.999458][T12407] netlink: 'syz.2.1617': attribute type 10 has an invalid length. [ 276.014084][T12399] 8021q: adding VLAN 0 to HW filter on device team0 [ 276.016144][T12399] team0: entered promiscuous mode [ 276.016160][T12399] team_slave_0: entered promiscuous mode [ 276.016373][T12399] team_slave_1: entered promiscuous mode [ 276.052483][T12399] bond0: (slave team0): Enslaving as an active interface with an up link [ 276.341164][T12414] syzkaller0: entered promiscuous mode [ 276.341200][T12414] syzkaller0: entered allmulticast mode [ 276.342305][T12413] tipc: Enabled bearer , priority 0 [ 276.369415][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.369881][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.370361][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.403257][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.407964][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.408405][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.410080][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.410591][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.437629][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.467078][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.467475][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.474770][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.480530][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.481328][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.500687][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.505812][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.530103][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.639854][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.640379][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.640813][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.647018][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.648062][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.649079][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.649825][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.665061][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.666108][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.668842][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.673152][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.674293][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.677660][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.687497][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.688762][T12413] tipc: Enabling of bearer rejected, already enabled [ 276.926015][ T1371] tipc: Resetting bearer [ 276.926994][T12414] tipc: Resetting bearer [ 278.751288][T12414] tipc: Disabling bearer [ 279.083608][T12488] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1637'. [ 279.112976][T12489] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1637'. [ 279.138358][T12496] netlink: 84 bytes leftover after parsing attributes in process `syz.4.1636'. [ 279.486357][T12509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1641'. [ 279.569409][T12517] netlink: 'syz.4.1643': attribute type 32 has an invalid length. [ 279.752893][T12521] netlink: 'syz.0.1644': attribute type 4 has an invalid length. [ 279.776995][T12521] netlink: 'syz.0.1644': attribute type 4 has an invalid length. [ 279.842375][T12531] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1650'. [ 279.855351][T12528] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 280.065574][T12539] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1652'. [ 280.185250][T12543] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1654'. [ 280.209813][T12535] netlink: 11391 bytes leftover after parsing attributes in process `syz.1.1651'. [ 280.406936][T12555] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1657'. [ 281.051966][T12591] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1667'. [ 281.156392][T12597] x_tables: duplicate underflow at hook 2 [ 281.755543][T12626] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.778285][T12628] netlink: 'syz.1.1679': attribute type 11 has an invalid length. [ 282.916634][T12694] bond6: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-alb(6) [ 282.918406][T12694] bond6 (unregistering): Released all slaves [ 283.358198][T12730] netlink: 'syz.1.1707': attribute type 62 has an invalid length. [ 283.435324][T12733] syzkaller0: entered promiscuous mode [ 283.435347][T12733] syzkaller0: entered allmulticast mode [ 283.502366][T12733] vlan3: entered promiscuous mode [ 283.705475][T12742] netlink: 'syz.4.1711': attribute type 21 has an invalid length. [ 283.705528][T12742] netlink: 'syz.4.1711': attribute type 6 has an invalid length. [ 284.242547][T12760] __nla_validate_parse: 11 callbacks suppressed [ 284.242568][T12760] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1717'. [ 284.326100][T12762] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1716'. [ 284.353174][T12766] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1719'. [ 284.376927][T12763] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1718'. [ 284.469229][T12768] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1720'. [ 285.057306][T12783] 8021q: VLANs not supported on wg0 [ 285.295771][T12796] can: request_module (can-proto-0) failed. [ 285.316738][T12796] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1726'. [ 286.236561][T12847] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1743'. [ 286.347570][T12853] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 286.347598][T12853] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 286.770676][T12866] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1748'. [ 286.794076][T12845] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1742'. [ 287.185589][T12885] Bluetooth: hci0: unsupported parameter 5134 [ 287.185611][T12885] Bluetooth: hci0: unsupported parameter 8192 [ 287.185624][T12885] Bluetooth: hci0: unsupported parameter 5134 [ 287.185636][T12885] Bluetooth: hci0: unsupported parameter 8192 [ 287.251296][T12883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1753'. [ 288.489974][T12957] ip_tables: iptables: counters copy to user failed while replacing table [ 291.218342][T12945] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 291.393081][T12991] __nla_validate_parse: 7 callbacks suppressed [ 291.393101][T12991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1782'. [ 291.393116][T12991] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1782'. [ 291.393141][T12991] netlink: 'syz.0.1782': attribute type 12 has an invalid length. [ 291.393159][T12991] netlink: 'syz.0.1782': attribute type 11 has an invalid length. [ 291.749324][T13009] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1786'. [ 291.790694][T13013] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1789'. [ 291.909593][T13013] netlink: 5812 bytes leftover after parsing attributes in process `syz.2.1789'. [ 291.909713][T13013] netlink: 5812 bytes leftover after parsing attributes in process `syz.2.1789'. [ 292.147189][T13034] openvswitch: netlink: IP tunnel dst address not specified [ 292.176362][T13036] batman_adv: batadv0: Adding interface: veth0 [ 292.176379][T13036] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 292.176409][T13036] batman_adv: batadv0: Interface activated: veth0 [ 292.180037][T13031] netlink: 'syz.2.1793': attribute type 24 has an invalid length. [ 292.294044][T13036] smc: net device lo applied user defined pnetid SYZ0 [ 292.294199][T13036] smc: smcd device lo applied user defined pnetid SYZ0 [ 292.297742][T13036] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1797'. [ 292.297763][T13036] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 292.297782][T13036] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 292.310171][T13036] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 292.310222][T13036] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 292.328616][T13036] batman_adv: batadv0: Interface deactivated: veth0 [ 292.328687][T13036] batman_adv: batadv0: Removing interface: veth0 [ 292.437700][T13036] batadv0 (unregistering): left promiscuous mode [ 292.528757][T13043] netlink: 300 bytes leftover after parsing attributes in process `syz.1.1798'. [ 292.582015][T13045] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 292.582054][T13045] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 292.582073][T13045] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 292.834711][T13062] netlink: 'syz.1.1806': attribute type 12 has an invalid length. [ 292.852205][ T1736] block nbd1: Possible stuck request ffff888027a7e000: control (read@0,1024B). Runtime 150 seconds [ 292.852249][ T1736] block nbd1: Possible stuck request ffff888027a7e1c0: control (read@1024,1024B). Runtime 150 seconds [ 292.852276][ T1736] block nbd1: Possible stuck request ffff888027a7e380: control (read@2048,1024B). Runtime 150 seconds [ 292.852302][ T1736] block nbd1: Possible stuck request ffff888027a7e540: control (read@3072,1024B). Runtime 150 seconds [ 292.853560][T13065] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1804'. [ 292.853593][T13065] netlink: 'syz.3.1804': attribute type 7 has an invalid length. [ 292.853619][T13065] netlink: 'syz.3.1804': attribute type 8 has an invalid length. [ 292.853633][T13065] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1804'. [ 293.012446][T13078] netlink: 'syz.3.1804': attribute type 7 has an invalid length. [ 293.012470][T13078] netlink: 'syz.3.1804': attribute type 8 has an invalid length. [ 293.046596][T13069] netlink: 'syz.1.1806': attribute type 12 has an invalid length. [ 293.375219][T13093] netlink: Failed to add ¦â—k\ helper -22 [ 293.375269][T13093] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 293.778564][T13115] block nbd3: Unsupported socket: should be TCP or UNIX. [ 293.991979][T13123] 8021q: adding VLAN 0 to HW filter on device bond8 [ 294.299600][T13141] netlink: zone id is out of range [ 294.299615][T13141] netlink: zone id is out of range [ 294.299623][T13141] netlink: zone id is out of range [ 294.299631][T13141] netlink: zone id is out of range [ 294.299639][T13141] netlink: zone id is out of range [ 294.299646][T13141] netlink: zone id is out of range [ 294.300092][T13141] netlink: zone id is out of range [ 294.351455][T13135] netlink: 'syz.2.1823': attribute type 32 has an invalid length. [ 295.178820][T13174] syzkaller0: entered promiscuous mode [ 295.178841][T13174] syzkaller0: entered allmulticast mode [ 296.257342][T13215] xt_limit: Overflow, try lower: 536871034/127 [ 296.291896][T13217] bond6: (slave bond_slave_0): Device is not our slave [ 296.291917][T13217] bond6: option active_slave: invalid value (bond_slave_0) [ 296.595836][T13231] __nla_validate_parse: 9 callbacks suppressed [ 296.595855][T13231] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1846'. [ 297.075159][T13217] bond6 (unregistering): Released all slaves [ 297.269228][T13235] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1849'. [ 297.281040][T13235] macvlan0: left promiscuous mode [ 297.299985][T13235] validate_nla: 1 callbacks suppressed [ 297.300005][T13235] netlink: 'syz.4.1849': attribute type 1 has an invalid length. [ 297.300020][T13235] netlink: 'syz.4.1849': attribute type 2 has an invalid length. [ 297.429566][T13245] net_ratelimit: 9 callbacks suppressed [ 297.429587][T13245] openvswitch: netlink: Missing key (keys=50, expected=80) [ 297.465171][T13247] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1853'. [ 297.726500][T13259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1855'. [ 297.756266][T13259] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1855'. [ 297.794945][T13265] netlink: 'syz.2.1858': attribute type 1 has an invalid length. [ 297.794966][T13265] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1858'. [ 297.972833][T13273] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1860'. [ 298.006552][T13275] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1860'. [ 298.245978][T13281] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1863'. [ 298.246442][T13289] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1867'. [ 298.349576][ T30] audit: type=1800 audit(1789152819.327:7): pid=13291 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1866" name=680B20 dev="tmpfs" ino=1838 res=0 errno=0 [ 298.638840][T13302] netlink: 'syz.3.1869': attribute type 1 has an invalid length. [ 298.686880][T13302] bond8: entered promiscuous mode [ 298.688453][T13302] 8021q: adding VLAN 0 to HW filter on device bond8 [ 298.878706][T13310] veth7: entered allmulticast mode [ 299.080329][T13311] bond6: entered promiscuous mode [ 299.089774][T13311] 8021q: adding VLAN 0 to HW filter on device bond6 [ 299.824281][T13372] gre1: entered promiscuous mode [ 299.824306][T13372] gre1: entered allmulticast mode [ 300.067923][ T5620] block nbd3: Receive control failed (result -32) [ 300.068396][ T4935] block nbd3: Receive control failed (result -32) [ 300.070627][T10448] block nbd4: Receive control failed (result -32) [ 300.071167][ T5624] block nbd4: Receive control failed (result -32) [ 300.159238][T13384] netlink: 'syz.4.1889': attribute type 1 has an invalid length. [ 300.289555][T13384] bond9: entered promiscuous mode [ 300.289953][T13384] 8021q: adding VLAN 0 to HW filter on device bond9 [ 300.326926][T13396] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 300.326952][T13396] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 301.100771][T13423] hsr_slave_1 (unregistering): left promiscuous mode [ 301.664053][T13434] __nla_validate_parse: 14 callbacks suppressed [ 301.664075][T13434] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1902'. [ 301.664684][T13434] Bluetooth: hci0: invalid length 0, exp 1 for type 31 [ 301.885050][T13460] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1908'. [ 301.988303][T13464] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1909'. [ 302.287816][T13478] netlink: 'syz.3.1912': attribute type 1 has an invalid length. [ 302.287838][T13478] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1912'. [ 302.459403][T13493] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1915'. [ 302.476545][T13495] bridge3: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 302.500564][T13496] bridge4: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 303.143063][T13526] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1925'. [ 303.240714][T13531] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1926'. [ 303.360560][T13536] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1928'. [ 303.518927][T13541] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1929'. [ 303.568762][T13541] SET target dimension over the limit! [ 303.635523][T13544] netlink: 'syz.3.1930': attribute type 1 has an invalid length. [ 303.800122][T13558] netlink: 'syz.2.1936': attribute type 1 has an invalid length. [ 303.830355][T13544] 8021q: adding VLAN 0 to HW filter on device bond9 [ 303.859276][T13558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1936'. [ 303.860706][T10448] block nbd5: Receive control failed (result -32) [ 304.172338][T13572] openvswitch: netlink: Duplicate or invalid key (type 0). [ 304.407458][T13587] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.939543][T13620] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 304.939563][T13620] IPv6: NLM_F_CREATE should be set when creating new route [ 305.694395][T13657] 8021q: adding VLAN 0 to HW filter on device bond6 [ 305.726642][T13660] 8021q: adding VLAN 0 to HW filter on device bond0 [ 305.748856][T13660] bond6: (slave bond0): making interface the new active one [ 305.750653][T13660] bond6: (slave bond0): Enslaving as an active interface with an up link [ 305.964836][T13670] netlink: 'syz.4.1970': attribute type 12 has an invalid length. [ 305.964857][T13670] netlink: 'syz.4.1970': attribute type 29 has an invalid length. [ 306.407202][T13699] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 306.407221][T13699] IPv6: NLM_F_CREATE should be set when creating new route [ 306.559159][T13701] netlink: 'syz.3.1978': attribute type 5 has an invalid length. [ 306.931412][T13728] wireguard: wg2: Could not create IPv4 socket [ 307.017084][T13731] __nla_validate_parse: 14 callbacks suppressed [ 307.017105][T13731] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1991'. [ 307.082601][T13736] netlink: 'syz.1.1993': attribute type 1 has an invalid length. [ 307.082639][T13736] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1993'. [ 307.142369][T13737] netlink: 'syz.4.1992': attribute type 3 has an invalid length. [ 307.183797][T13737] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1992'. [ 307.189029][T13731] bond10: entered promiscuous mode [ 307.200441][T13731] 8021q: adding VLAN 0 to HW filter on device bond10 [ 307.271704][T13731] 8021q: adding VLAN 0 to HW filter on device bond10 [ 307.276186][T13731] bond10: (slave sit1): The slave device specified does not support setting the MAC address [ 307.277194][T13731] bond10: (slave sit1): Error -95 calling set_mac_address [ 307.306762][T13746] netlink: 'syz.2.1996': attribute type 1 has an invalid length. [ 307.327858][T13745] vxcan0: tx address claim with different name [ 307.328061][T13745] netlink: 'syz.1.1995': attribute type 6 has an invalid length. [ 307.406529][T13747] veth9: entered allmulticast mode [ 307.418833][T13747] bond7: (slave veth9): Enslaving as an active interface with a down link [ 307.446940][T13748] bond7: (slave veth0_to_bond): making interface the new active one [ 307.448077][T13748] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 307.451981][T13753] team0: entered promiscuous mode [ 307.452053][T13753] team_slave_0: entered promiscuous mode [ 307.452499][T13753] team_slave_1: entered promiscuous mode [ 307.512903][T13752] team0: left promiscuous mode [ 307.512926][T13752] team_slave_0: left promiscuous mode [ 307.513127][T13752] team_slave_1: left promiscuous mode [ 308.266222][T13794] A link change request failed with some changes committed already. Interface gre2 may have been left with an inconsistent configuration, please check. [ 308.330246][T13797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2012'. [ 308.367506][T13797] netlink: 'syz.2.2012': attribute type 1 has an invalid length. [ 308.383932][T13797] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2012'. [ 308.510740][T13809] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2013'. [ 308.529611][T13810] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2013'. [ 308.556844][T13802] batadv_slave_0: entered promiscuous mode [ 308.667554][T13809] batadv_slave_0 (unregistering): left promiscuous mode [ 308.819142][T13822] netlink: 288 bytes leftover after parsing attributes in process `syz.3.2017'. [ 309.282487][T13847] syzkaller0: entered promiscuous mode [ 309.282512][T13847] syzkaller0: entered allmulticast mode [ 309.497863][T13855] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 2, id = 0 [ 310.262539][T13888] netlink: 9 bytes leftover after parsing attributes in process `syz.4.2031'. [ 310.287866][T13888] 0ªX¹¦Dö»: entered promiscuous mode [ 310.287891][T13888] 0ªX¹¦Dö»: left allmulticast mode [ 310.309063][T13878] team0: entered promiscuous mode [ 310.309083][T13878] team_slave_0: entered promiscuous mode [ 310.309244][T13878] team_slave_1: entered promiscuous mode [ 310.338423][T13885] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2031'. [ 310.338528][T13885] 0ªî{X¹¦: renamed from 00ªX¹¦Dö» [ 310.359471][T13885] 0ªî{X¹¦: left promiscuous mode [ 310.359494][T13885] 0ªî{X¹¦: entered allmulticast mode [ 310.382421][T13885] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 310.387296][T13884] 1ªî{X¹¦: renamed from 30ªî{X¹¦ (while UP) [ 310.421859][T13884] A link change request failed with some changes committed already. Interface 31ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 310.733771][T13881] team0: left promiscuous mode [ 310.733822][T13881] team_slave_0: left promiscuous mode [ 310.734037][T13881] team_slave_1: left promiscuous mode [ 311.192338][T13943] ieee802154 phy0 wpan0: encryption failed: -22 [ 311.352843][T13956] validate_nla: 1 callbacks suppressed [ 311.352862][T13956] netlink: 'syz.4.2046': attribute type 1 has an invalid length. [ 311.358924][T13945] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 311.358946][T13945] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 311.873076][T13983] sctp: [Deprecated]: syz.3.2057 (pid 13983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 311.873076][T13983] Use struct sctp_sack_info instead [ 312.217644][T13997] __nla_validate_parse: 9 callbacks suppressed [ 312.217665][T13997] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2062'. [ 312.388389][T14016] netlink: 'syz.3.2063': attribute type 8 has an invalid length. [ 312.388412][T14016] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2063'. [ 312.388987][T14016] bridge0: port 3(team0) entered disabled state [ 312.396075][T14016] bridge0: port 2(bridge_slave_1) entered disabled state [ 312.396538][T14016] bridge0: port 1(bridge_slave_0) entered disabled state [ 312.610722][T14022] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2066'. [ 312.797405][T14036] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2071'. [ 313.148088][T14048] netlink: 'syz.4.2075': attribute type 61 has an invalid length. [ 313.511886][T14059] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2079'. [ 313.583258][T14062] netlink: 192 bytes leftover after parsing attributes in process `syz.3.2080'. [ 314.336924][T14095] syzkaller0: entered promiscuous mode [ 314.336947][T14095] syzkaller0: entered allmulticast mode [ 314.407767][T14095] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 314.424509][T14102] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2088'. [ 314.424532][T14102] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2088'. [ 314.659436][T14110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2091'. [ 314.659472][T14110] netlink: 'syz.2.2091': attribute type 3 has an invalid length. [ 314.814507][T14117] Cannot find add_set index 4 as target [ 314.838094][T14120] netlink: 596 bytes leftover after parsing attributes in process `syz.4.2094'. [ 314.896684][T14114] bond11: entered allmulticast mode [ 314.897103][T14114] 8021q: adding VLAN 0 to HW filter on device bond11 [ 315.437861][T14149] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20003 [ 315.788166][T14163] bond6: option mode: unable to set because the bond device has slaves [ 315.865613][T14163] netlink: 'syz.1.2107': attribute type 4 has an invalid length. [ 315.973411][T14163] .`: renamed from bond0 [ 316.004230][T14163] bond6: Primary slave changed to .`, reselecting active slave [ 316.073628][T14174] bond7: option packets_per_slave: mode dependency failed, not supported in mode balance-xor(2) [ 316.118402][T14174] bond7 (unregistering): Released all slaves [ 316.377755][T14192] openvswitch: netlink: Message has 8 unknown bytes. [ 316.513115][T13499] bond6: (slave .`): link status definitely down, disabling slave [ 316.536567][T13499] bond6: now running without any active interface! [ 316.755839][T14207] veth0_macvtap: entered allmulticast mode [ 316.755992][T14207] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 317.164559][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.422696][T14239] netlink: 'syz.4.2123': attribute type 3 has an invalid length. [ 317.602387][T14240] syzkaller1: entered promiscuous mode [ 317.602412][T14240] syzkaller1: entered allmulticast mode [ 317.716038][T14255] netlink: 'syz.2.2128': attribute type 12 has an invalid length. [ 317.753410][T14260] __nla_validate_parse: 10 callbacks suppressed [ 317.753432][T14260] netlink: 3944 bytes leftover after parsing attributes in process `syz.3.2126'. [ 317.816187][T14255] bond8: option primary_reselect: invalid value (255) [ 317.822770][T14255] bond8 (unregistering): Released all slaves [ 317.861860][T14259] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 318.002093][T14265] openvswitch: netlink: Multiple metadata blocks provided [ 318.213453][T14277] netlink: 'syz.1.2135': attribute type 23 has an invalid length. [ 318.255616][T14278] netlink: 'syz.2.2133': attribute type 21 has an invalid length. [ 318.255702][T14278] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 318.519115][T14297] xt_ecn: cannot match TCP bits for non-tcp packets [ 318.795065][T14319] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2141'. [ 318.986897][T14322] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2144'. [ 318.996805][T14325] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2142'. [ 319.164282][T14334] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2147'. [ 319.465210][T14347] IPVS: set_ctl: invalid protocol: 60 172.20.20.187:20001 [ 319.600343][T14358] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2153'. [ 319.652102][T14360] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 319.725279][T14365] netlink: 'syz.1.2156': attribute type 5 has an invalid length. [ 319.725313][T14365] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2156'. [ 319.745142][T14353] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2151'. [ 320.048208][T14383] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2160'. [ 320.350093][T14402] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2163'. [ 320.635984][T14412] veth1_vlan: entered promiscuous mode [ 320.903961][T14429] netlink: 'syz.3.2173': attribute type 1 has an invalid length. [ 320.904196][T14429] netlink: 'syz.3.2173': attribute type 1 has an invalid length. [ 321.606993][T14455] netlink: 'syz.1.2182': attribute type 1 has an invalid length. [ 321.740377][T14455] bond0: entered promiscuous mode [ 321.740740][T14455] 8021q: adding VLAN 0 to HW filter on device bond0 [ 322.922554][ T1736] block nbd1: Possible stuck request ffff888027a7e000: control (read@0,1024B). Runtime 180 seconds [ 322.927359][ T1736] block nbd1: Possible stuck request ffff888027a7e1c0: control (read@1024,1024B). Runtime 180 seconds [ 322.927394][ T1736] block nbd1: Possible stuck request ffff888027a7e380: control (read@2048,1024B). Runtime 180 seconds [ 322.927424][ T1736] block nbd1: Possible stuck request ffff888027a7e540: control (read@3072,1024B). Runtime 180 seconds [ 323.227001][T14544] __nla_validate_parse: 7 callbacks suppressed [ 323.227048][T14544] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2203'. [ 323.292100][T14546] netdevsim netdevsim2: Direct firmware load for ÿ failed with error -2 [ 323.292128][T14546] netdevsim netdevsim2: Falling back to sysfs fallback for: ÿ [ 323.503619][T14549] syzkaller1: entered promiscuous mode [ 323.503643][T14549] syzkaller1: entered allmulticast mode [ 323.636598][T14560] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 323.672913][T14561] netlink: 'syz.4.2208': attribute type 32 has an invalid length. [ 323.678330][T14564] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 323.763401][ T6424] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 323.920390][T14579] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2211'. [ 323.920414][T14579] openvswitch: netlink: Flow actions attr not present in new flow. [ 324.028073][T14560] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.336274][T14600] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2214'. [ 324.355206][T14557] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 324.469462][T14560] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.715791][T14614] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2216'. [ 324.942010][T14621] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2218'. [ 325.007388][T14560] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.011478][T14626] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2219'. [ 325.303454][T14560] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.932791][ T8345] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.008964][T14676] xt_CT: You must specify a L4 protocol and not use inversions on it [ 326.011179][T14676] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2230'. [ 326.021278][ T8348] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.031405][ T8345] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.068447][T14671] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.157770][T14686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.198542][ T8343] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.231928][T14692] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.324306][T14695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2232'. [ 326.324336][T14695] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2232'. [ 326.408025][T14696] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.547847][T14712] openvswitch: netlink: IPv4 tun info is not correct [ 326.652892][T14714] syzkaller0: entered promiscuous mode [ 326.652915][T14714] syzkaller0: entered allmulticast mode [ 327.048511][T14727] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2241'. [ 327.204822][T14741] 8021q: VLANs not supported on gre0 [ 330.565148][ T4985] udevd[4985]: worker [5636] /devices/virtual/block/nbd1 timeout; kill it [ 330.565239][ T4985] udevd[4985]: seq 12279 '/devices/virtual/block/nbd1' killed [ 331.431082][T14764] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2250'. [ 331.698212][T14776] netlink: 'syz.2.2254': attribute type 1 has an invalid length. [ 332.418120][T14811] netlink: 'syz.4.2264': attribute type 1 has an invalid length. [ 332.775825][T14822] syzkaller1: entered promiscuous mode [ 332.775849][T14822] syzkaller1: entered allmulticast mode [ 332.810404][T14822] netlink: 'syz.3.2268': attribute type 4 has an invalid length. [ 332.810426][T14822] netlink: 17 bytes leftover after parsing attributes in process `syz.3.2268'. [ 332.880605][T14830] netlink: 'syz.0.2270': attribute type 10 has an invalid length. [ 332.996865][T14830] syz_tun: entered promiscuous mode [ 333.218030][T14838] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2273'. [ 333.218063][T14838] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2273'. [ 333.304607][T14847] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2276'. [ 333.768581][T14870] netlink: 'syz.4.2278': attribute type 2 has an invalid length. [ 333.782304][T14869] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2278'. [ 334.106148][T14884] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 334.108334][T14886] dvmrp0: left allmulticast mode [ 334.143698][T14881] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input5 [ 334.246102][T14896] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2284'. [ 334.380358][T14902] netlink: 'syz.1.2286': attribute type 5 has an invalid length. [ 334.398378][T14902] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2286'. [ 334.830099][T14923] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2293'. [ 334.869184][T14925] x_tables: ip_tables: osf match: only valid for protocol 6 [ 334.933075][T14930] netlink: 'syz.0.2296': attribute type 4 has an invalid length. [ 335.697479][T14958] netdevsim netdevsim2: Direct firmware load for ÿ failed with error -2 [ 335.697525][T14958] netdevsim netdevsim2: Falling back to sysfs fallback for: ÿ [ 335.775591][T14964] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2310'. [ 335.803920][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804082][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804201][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804305][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804405][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804513][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804613][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804719][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804821][T14966] ip6t_srh: unknown srh match flags 5F28 [ 335.804946][T14966] ip6t_srh: unknown srh match flags 5F28 [ 336.052327][T14976] ipt_ECN: cannot use operation on non-tcp rule [ 336.549232][T15008] __nla_validate_parse: 3 callbacks suppressed [ 336.549252][T15008] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2323'. [ 336.659079][T15003] bond0: invalid NS target :: specified for addition [ 336.659110][T15003] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 336.914443][T15018] vlan3: entered allmulticast mode [ 336.914472][T15018] bond0: entered allmulticast mode [ 336.914487][T15018] bond_slave_0: entered allmulticast mode [ 336.914504][T15018] bond_slave_1: entered allmulticast mode [ 336.914519][T15018] team0: entered allmulticast mode [ 336.914532][T15018] team_slave_0: entered allmulticast mode [ 336.914548][T15018] team_slave_1: entered allmulticast mode [ 337.100233][T15026] openvswitch: netlink: Unknown key attributes 1 [ 337.334787][T15039] netlink: 'syz.2.2335': attribute type 21 has an invalid length. [ 337.334836][T15039] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2335'. [ 337.339664][T15041] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 337.392381][T15037] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2333'. [ 337.400395][T15037] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2333'. [ 337.400432][T15037] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2333'. [ 337.558212][T15056] netlink: 1 bytes leftover after parsing attributes in process `syz.3.2337'. [ 337.771761][T15062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2340'. [ 337.904621][T15033] syzkaller1: entered promiscuous mode [ 337.904646][T15033] syzkaller1: entered allmulticast mode [ 337.957138][T15070] x_tables: duplicate underflow at hook 2 [ 337.974256][T15071] x_tables: duplicate underflow at hook 2 [ 338.174437][T15083] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2346'. [ 338.174471][T15083] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 338.373688][T15092] bond7: option arp_validate: mode dependency failed, not supported in mode balance-tlb(5) [ 338.398251][T15092] bond7 (unregistering): Released all slaves [ 338.499577][T15097] hsr0: entered allmulticast mode [ 338.499599][T15097] erspan0: entered allmulticast mode [ 338.499616][T15097] gretap0: entered allmulticast mode [ 338.527719][T15107] xt_l2tp: invalid flags combination: 8 [ 338.823771][T15120] netlink: 'syz.0.2355': attribute type 1 has an invalid length. [ 338.823796][T15120] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2355'. [ 338.855088][T15124] openvswitch: netlink: IP tunnel dst address not specified [ 338.855118][T15124] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 339.081516][T15131] x_tables: duplicate entry at hook 2 [ 339.082300][T15131] ªªªªª»: renamed from dummy0 (while UP) [ 339.200665][T15136] openvswitch: netlink: EtherType 300 is less than min 600 [ 339.436905][T15148] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 339.436932][T15148] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 339.651954][T15157] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 339.743903][T15169] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2374'. [ 340.496371][T15197] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 340.496410][T15197] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.518783][T15205] nftables ruleset with unbound set [ 340.590219][T15210] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 340.627207][T15216] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 340.699344][T15204] netlink: 'syz.2.2386': attribute type 1 has an invalid length. [ 340.702874][ T1348] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.861380][T15222] netlink: 'syz.1.2388': attribute type 39 has an invalid length. [ 341.479151][T15253] netlink: 'syz.1.2397': attribute type 1 has an invalid length. [ 341.479175][T15253] netlink: 'syz.1.2397': attribute type 2 has an invalid length. [ 341.719592][T15268] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 341.719792][T15268] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 341.778466][T15268] __nla_validate_parse: 3 callbacks suppressed [ 341.778486][T15268] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2400'. [ 341.791359][T15268] syzkaller1: entered promiscuous mode [ 341.791414][T15268] syzkaller1: entered allmulticast mode [ 341.864272][T15272] netlink: 'syz.3.2402': attribute type 1 has an invalid length. [ 342.123364][T15284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2404'. [ 342.356308][T15295] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2406'. [ 342.387642][ T5280] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 342.425691][T15297] openvswitch: netlink: VXLAN extension message has 5413 unknown bytes. [ 342.523729][T15296] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 343.267720][T15334] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2418'. [ 343.310107][T15340] netlink: 'syz.3.2419': attribute type 3 has an invalid length. [ 343.310133][T15340] netlink: 'syz.3.2419': attribute type 3 has an invalid length. [ 343.469452][T15339] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2420'. [ 343.487626][T15346] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2421'. [ 343.738532][T15362] netlink: zone id is out of range [ 343.738546][T15362] netlink: set zone limit has 4 unknown bytes [ 343.748705][T15362] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2423'. [ 343.828850][T15366] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2427'. [ 343.899391][T15366] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2427'. [ 343.989196][T15374] block nbd3: Unsupported socket: should be TCP or UNIX. [ 344.023062][T15377] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.2431'. [ 344.023088][T15377] openvswitch: netlink: Message has 4 unknown bytes. [ 344.365307][T15393] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 344.366122][T15394] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 344.940318][T15425] netlink: 'syz.2.2447': attribute type 1 has an invalid length. [ 345.144313][T15428] 8021q: adding VLAN 0 to HW filter on device bond10 [ 345.147547][T15428] bond9: (slave bond10): making interface the new active one [ 345.147979][T15428] bond9: (slave bond10): Enslaving as an active interface with an up link [ 345.178129][T15434] bond9: (slave gretap2): Enslaving as a backup interface with an up link [ 345.196950][T15431] netlink: 'syz.0.2446': attribute type 1 has an invalid length. [ 345.196969][T15431] netlink: 'syz.0.2446': attribute type 2 has an invalid length. [ 345.227532][T15425] 8021q: adding VLAN 0 to HW filter on device bond9 [ 345.447559][T15448] tipc: Cannot configure node identity twice [ 345.963807][T15479] netdevsim netdevsim0 : renamed from netdevsim0 [ 346.069536][T15488] netlink: 'syz.1.2465': attribute type 4 has an invalid length. [ 346.254469][T15496] veth1_to_bond: entered allmulticast mode [ 346.482801][T15496] veth1_to_bond (unregistering): left allmulticast mode [ 346.538443][T15496] bond0: (slave bond_slave_1): Releasing backup interface [ 347.489460][T15554] xt_nfacct: accounting object `syz0' does not exist [ 347.734523][T15564] __nla_validate_parse: 9 callbacks suppressed [ 347.734553][T15564] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2484'. [ 347.802108][T15567] netlink: 'syz.1.2485': attribute type 1 has an invalid length. [ 347.937958][T15576] netlink: 148 bytes leftover after parsing attributes in process `syz.3.2488'. [ 348.027829][T15583] netlink: Unknown conntrack attr (type=16134, max=9) [ 348.027868][T15583] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 348.125084][T15587] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2492'. [ 348.411514][T15599] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2495'. [ 348.411547][T15599] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2495'. [ 348.412798][T15598] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2496'. [ 348.412831][T15598] netlink: 'syz.4.2496': attribute type 1 has an invalid length. [ 348.412844][T15598] netlink: 'syz.4.2496': attribute type 2 has an invalid length. [ 348.606526][T15606] bridge7: the hash_elasticity option has been deprecated and is always 16 [ 348.833929][T15617] netlink: 'syz.2.2502': attribute type 19 has an invalid length. [ 348.887746][T15623] blkio.reset_stats is deprecated [ 348.903414][T15623] netlink: 'syz.3.2505': attribute type 83 has an invalid length. [ 349.244928][T15634] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2510'. [ 349.406463][T15636] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2511'. [ 349.539607][T15648] netlink: 'syz.0.2515': attribute type 16 has an invalid length. [ 349.539632][T15648] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2515'. [ 349.539659][T15648] veth0_macvtap: entered allmulticast mode [ 349.593480][T15647] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2514'. [ 349.615187][T15647] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 349.777184][T15653] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 349.862986][T15658] Bluetooth: hci0: unsupported parameter 5135 [ 349.863032][T15658] Bluetooth: hci0: unsupported parameter 8192 [ 349.863047][T15658] Bluetooth: hci0: unsupported parameter 5135 [ 349.863060][T15658] Bluetooth: hci0: unsupported parameter 8192 [ 351.042347][T15734] ip_vti0: entered promiscuous mode [ 351.097610][T15732] sit4: entered promiscuous mode [ 351.097632][T15732] sit4: entered allmulticast mode [ 351.295463][T15741] netlink: 'syz.2.2545': attribute type 8 has an invalid length. [ 351.603491][T15754] ªªªªª»: renamed from bond_slave_0 (while UP) [ 351.622844][T15760] netdevsim netdevsim1: loading /lib/firmware/. failed with error -22 [ 351.622881][T15760] netdevsim netdevsim1: Direct firmware load for . failed with error -22 [ 351.622899][T15760] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 351.844619][T15775] IPVS: ip_vs_add_dest(): server weight less than zero [ 352.167028][T15786] netlink: 'syz.0.2561': attribute type 1 has an invalid length. [ 352.288229][T15786] bond7: entered promiscuous mode [ 352.297625][T15786] 8021q: adding VLAN 0 to HW filter on device bond7 [ 352.400546][T15797] 8021q: adding VLAN 0 to HW filter on device bond7 [ 352.414136][T15797] bond7: (slave ipip0): The slave device specified does not support setting the MAC address [ 352.414159][T15797] bond7: (slave ipip0): Setting fail_over_mac to active for active-backup mode [ 352.442393][T15797] bond7: (slave ipip0): making interface the new active one [ 352.442420][T15797] ipip0: entered promiscuous mode [ 352.445550][T15797] bond7: (slave ipip0): Enslaving as an active interface with an up link [ 352.578359][T15813] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 352.784309][T15821] __nla_validate_parse: 16 callbacks suppressed [ 352.784336][T15821] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2568'. [ 352.878713][T15823] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 352.918580][T10448] block nbd8: Receive control failed (result -107) [ 353.023207][ T1736] block nbd1: Possible stuck request ffff888027a7e000: control (read@0,1024B). Runtime 210 seconds [ 353.023269][ T1736] block nbd1: Possible stuck request ffff888027a7e1c0: control (read@1024,1024B). Runtime 210 seconds [ 353.023299][ T1736] block nbd1: Possible stuck request ffff888027a7e380: control (read@2048,1024B). Runtime 210 seconds [ 353.023329][ T1736] block nbd1: Possible stuck request ffff888027a7e540: control (read@3072,1024B). Runtime 210 seconds [ 353.052018][T15831] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 353.147476][T15835] unsupported nla_type 216 [ 353.271236][T15837] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2575'. [ 353.417404][T15820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 354.760548][T15884] set match dimension is over the limit! [ 355.858085][T15892] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2588'. [ 355.859981][T15896] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2590'. [ 355.917393][T15895] netlink: 'syz.2.2589': attribute type 1 has an invalid length. [ 355.975533][T15895] 8021q: adding VLAN 0 to HW filter on device bond11 [ 355.979696][T15892] syzkaller1: entered promiscuous mode [ 355.979717][T15892] syzkaller1: entered allmulticast mode [ 356.007428][T15900] mac80211_hwsim hwsim3 syzkaller0: Caught tx_queue_len zero misconfig [ 356.055286][T15895] bond7: (slave veth0_to_bond): Releasing active interface [ 356.099832][T15895] bond11: (slave veth0_to_bond): making interface the new active one [ 356.136237][T15895] bond11: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 356.165128][T15914] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2594'. [ 356.165156][T15914] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2594'. [ 356.165171][T15914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2594'. [ 356.165346][T15914] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2594'. [ 356.165366][T15914] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2594'. [ 356.165380][T15914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2594'. [ 356.268265][T15895] openvswitch: netlink: Missing key (keys=c0, expected=1100) [ 356.329275][T15924] netlink: 'syz.4.2597': attribute type 21 has an invalid length. [ 356.383721][T15927] netlink: 'syz.4.2597': attribute type 21 has an invalid length. [ 356.400741][T15905] macvlan2: entered promiscuous mode [ 356.400764][T15905] macvlan2: entered allmulticast mode [ 356.415918][T15905] bond11: entered promiscuous mode [ 356.415939][T15905] veth0_to_bond: entered promiscuous mode [ 356.451149][T15905] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 356.452066][T15905] bond11: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 356.452867][T15905] bond11: left promiscuous mode [ 356.452884][T15905] veth0_to_bond: left promiscuous mode [ 356.537503][T15924] netlink: 'syz.4.2597': attribute type 4 has an invalid length. [ 356.537525][T15924] netlink: 'syz.4.2597': attribute type 5 has an invalid length. [ 356.677324][T15927] netlink: 'syz.4.2597': attribute type 4 has an invalid length. [ 356.677348][T15927] netlink: 'syz.4.2597': attribute type 5 has an invalid length. [ 357.867651][T15990] Bluetooth: hci0: unsupported parameter 5161 [ 357.867686][T15990] Bluetooth: hci0: unsupported parameter 8192 [ 357.867699][T15990] Bluetooth: hci0: unsupported parameter 5161 [ 357.867711][T15990] Bluetooth: hci0: unsupported parameter 8192 [ 358.176592][ T30] audit: type=1804 audit(1789152879.157:8): pid=16003 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2613" name="/newroot/522/cgroup.controllers" dev="tmpfs" ino=2674 res=1 errno=0 [ 358.177398][ T30] audit: type=1800 audit(1789152879.157:9): pid=16003 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2613" name="cgroup.controllers" dev="tmpfs" ino=2674 res=0 errno=0 [ 358.281599][ T30] audit: type=1800 audit(1789152879.257:10): pid=16009 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2613" name="cgroup.controllers" dev="tmpfs" ino=2674 res=0 errno=0 [ 358.336158][T16013] netlink: 'syz.1.2615': attribute type 34 has an invalid length. [ 358.336180][T16013] __nla_validate_parse: 201 callbacks suppressed [ 358.336194][T16013] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2615'. [ 358.394962][T16015] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2615'. [ 358.465380][T16013] netlink: 'syz.1.2615': attribute type 4 has an invalid length. [ 358.465396][T16013] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2615'. [ 358.518405][T16019] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2617'. [ 358.793791][T16019] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2617'. [ 358.902644][T16035] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 358.974201][T16037] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.034258][T16035] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2619'. [ 359.035075][T16035] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2619'. [ 359.047343][T16035] netlink: 'syz.3.2619': attribute type 32 has an invalid length. [ 359.047396][T16035] netlink: 500 bytes leftover after parsing attributes in process `syz.3.2619'. [ 359.076140][T16042] ieee802154 phy0 wpan0: encryption failed: -22 [ 359.077972][T16035] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.189945][T16045] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2622'. [ 359.236098][T16047] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2623'. [ 359.495495][T16053] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 359.495508][T16053] IPv6: NLM_F_CREATE should be set when creating new route [ 359.496932][T16053] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 359.998479][T16063] ip6gretap0: entered promiscuous mode [ 359.998508][T16063] ip6gretap0: entered allmulticast mode [ 361.212483][T16131] syzkaller1: entered promiscuous mode [ 361.212506][T16131] syzkaller1: entered allmulticast mode [ 361.604674][T16162] syzkaller0: entered promiscuous mode [ 361.604696][T16162] syzkaller0: entered allmulticast mode [ 361.620073][T16162] tipc: Started in network mode [ 361.620160][T16162] tipc: Node identity 9a8739e3baec, cluster identity 4711 [ 361.620595][T16162] tipc: Enabled bearer , priority 0 [ 361.644926][T16162] xt_hashlimit: size too large, truncated to 1048576 [ 361.803256][T16178] bridge_slave_0 (unregistering): left allmulticast mode [ 361.803284][T16178] bridge_slave_0 (unregistering): left promiscuous mode [ 361.803358][T16178] bridge0: port 1(bridge_slave_0) entered disabled state [ 362.039694][T16160] tipc: Resetting bearer [ 362.097319][T16160] tipc: Disabling bearer [ 362.405354][T16206] validate_nla: 2 callbacks suppressed [ 362.405373][T16206] netlink: 'syz.0.2657': attribute type 2 has an invalid length. [ 362.923484][T16237] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 362.923508][T16237] syzkaller1: group set to 0 [ 363.338384][T16250] ip6t_rt: unknown flags 36 [ 363.433688][T16250] bond15 (unregistering): Released all slaves [ 363.466621][T16261] __nla_validate_parse: 19 callbacks suppressed [ 363.466640][T16261] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.2677'. [ 363.466802][T16262] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.2677'. [ 363.613364][T16261] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2677'. [ 363.770740][T16273] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2683'. [ 363.836976][T16269] [ 363.839387][T16269] ====================================================== [ 363.846480][T16269] WARNING: possible circular locking dependency detected [ 363.853599][T16269] syzkaller #0 Not tainted [ 363.858050][T16269] ------------------------------------------------------ [ 363.865122][T16269] syz.0.2681/16269 is trying to acquire lock: [ 363.871248][T16269] ffff88801c2f7a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_permission+0x7f/0x430 [ 363.881939][T16269] [ 363.881939][T16269] but task is already holding lock: [ 363.883814][T16275] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2684'. [ 363.898245][T16269] ffffffff8ebe98f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 363.908423][T16269] [ 363.908423][T16269] which lock already depends on the new lock. [ 363.908423][T16269] [ 363.918840][T16269] [ 363.918840][T16269] the existing dependency chain (in reverse order) is: [ 363.927854][T16269] [ 363.927854][T16269] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 363.935659][T16269] cpus_read_lock+0x42/0x160 [ 363.940805][T16269] static_key_slow_inc+0x12/0x30 [ 363.946297][T16269] setup_udp_tunnel_sock+0x2eb/0x4f0 [ 363.952212][T16269] gtp_encap_enable_socket+0x3d3/0x5c0 [ 363.958261][T16269] gtp_newlink+0x636/0x16e0 [ 363.963296][T16269] rtnl_newlink_create+0x305/0x7b0 [ 363.969022][T16269] rtnl_newlink+0x166d/0x1c30 [ 363.974224][T16269] rtnetlink_rcv_msg+0x802/0xc00 [ 363.979689][T16269] netlink_rcv_skb+0x226/0x4a0 [ 363.985060][T16269] netlink_unicast+0x7bd/0x940 [ 363.990375][T16269] netlink_sendmsg+0x813/0xb40 [ 363.995674][T16269] sock_sendmsg_nosec+0x13a/0x180 [ 364.001331][T16269] ____sys_sendmsg+0x54e/0x850 [ 364.006628][T16269] ___sys_sendmsg+0x2a5/0x360 [ 364.011832][T16269] __x64_sys_sendmsg+0x1b1/0x290 [ 364.017306][T16269] do_syscall_64+0x166/0x520 [ 364.022493][T16269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.028945][T16269] [ 364.028945][T16269] -> #7 (sk_lock-AF_INET){+.+.}-{0:0}: [ 364.036602][T16269] lock_sock_nested+0x41/0x100 [ 364.041898][T16269] inet_shutdown+0x6a/0x390 [ 364.047018][T16269] nbd_mark_nsock_dead+0x2cb/0x550 [ 364.052720][T16269] recv_work+0x1cee/0x1e10 [ 364.057663][T16269] process_scheduled_works+0xc3d/0x1630 [ 364.063741][T16269] worker_thread+0xa47/0xfb0 [ 364.068864][T16269] kthread+0x38b/0x480 [ 364.073471][T16269] ret_from_fork+0x514/0xb70 [ 364.078598][T16269] ret_from_fork_asm+0x1a/0x30 [ 364.083905][T16269] [ 364.083905][T16269] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 364.091566][T16269] __mutex_lock+0x19d/0x1550 [ 364.096755][T16269] nbd_queue_rq+0x373/0xff0 [ 364.101787][T16269] blk_mq_dispatch_rq_list+0x499/0x1990 [ 364.107924][T16269] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 364.114802][T16269] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 364.121308][T16269] blk_mq_run_work_fn+0x16c/0x300 [ 364.126872][T16269] process_scheduled_works+0xc3d/0x1630 [ 364.132946][T16269] worker_thread+0xa47/0xfb0 [ 364.138060][T16269] kthread+0x38b/0x480 [ 364.142648][T16269] ret_from_fork+0x514/0xb70 [ 364.147781][T16269] ret_from_fork_asm+0x1a/0x30 [ 364.153081][T16269] [ 364.153081][T16269] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 364.160302][T16269] __mutex_lock+0x19d/0x1550 [ 364.165426][T16269] nbd_queue_rq+0xc1/0xff0 [ 364.170370][T16269] blk_mq_dispatch_rq_list+0x499/0x1990 [ 364.176444][T16269] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 364.183309][T16269] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 364.189830][T16269] blk_mq_run_work_fn+0x16c/0x300 [ 364.195387][T16269] process_scheduled_works+0xc3d/0x1630 [ 364.201463][T16269] worker_thread+0xa47/0xfb0 [ 364.206580][T16269] kthread+0x38b/0x480 [ 364.211184][T16269] ret_from_fork+0x514/0xb70 [ 364.216298][T16269] ret_from_fork_asm+0x1a/0x30 [ 364.221602][T16269] [ 364.221602][T16269] -> #4 (set->srcu){.+.+}-{0:0}: [ 364.228734][T16269] __synchronize_srcu+0xc9/0x2f0 [ 364.234221][T16269] elevator_switch+0x1e8/0x7b0 [ 364.239563][T16269] elevator_change+0x2fa/0x480 [ 364.244851][T16269] elevator_set_default+0x375/0x440 [ 364.250611][T16269] blk_register_queue+0x3f3/0x4e0 [ 364.256197][T16269] __add_disk+0x6b8/0xdb0 [ 364.261064][T16269] add_disk_fwnode+0x100/0x3a0 [ 364.266360][T16269] nbd_dev_add+0x733/0xb60 [ 364.271295][T16269] nbd_init+0x168/0x1f0 [ 364.276078][T16269] do_one_initcall+0x250/0x870 [ 364.281379][T16269] do_initcall_level+0x10a/0x1a0 [ 364.286885][T16269] do_initcalls+0x59/0xa0 [ 364.291759][T16269] kernel_init_freeable+0x29d/0x3e0 [ 364.297497][T16269] kernel_init+0x22/0x1d0 [ 364.302384][T16269] ret_from_fork+0x514/0xb70 [ 364.307507][T16269] ret_from_fork_asm+0x1a/0x30 [ 364.312813][T16269] [ 364.312813][T16269] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 364.320639][T16269] __mutex_lock+0x19d/0x1550 [ 364.325757][T16269] elevator_change+0x1af/0x480 [ 364.331051][T16269] elevator_set_none+0xb5/0x140 [ 364.336440][T16269] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 364.342800][T16269] nbd_start_device+0x189/0xb30 [ 364.348180][T16269] nbd_genl_connect+0x167d/0x1cd0 [ 364.353787][T16269] genl_family_rcv_msg_doit+0x233/0x340 [ 364.359861][T16269] genl_rcv_msg+0x614/0x7a0 [ 364.364891][T16269] netlink_rcv_skb+0x226/0x4a0 [ 364.370191][T16269] genl_rcv+0x28/0x40 [ 364.374700][T16269] netlink_unicast+0x7bd/0x940 [ 364.379997][T16269] netlink_sendmsg+0x813/0xb40 [ 364.385296][T16269] sock_sendmsg_nosec+0x13a/0x180 [ 364.390870][T16269] ____sys_sendmsg+0x54e/0x850 [ 364.396173][T16269] ___sys_sendmsg+0x2a5/0x360 [ 364.401379][T16269] __x64_sys_sendmsg+0x1b1/0x290 [ 364.406847][T16269] do_syscall_64+0x166/0x520 [ 364.411964][T16269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.418383][T16269] [ 364.418383][T16269] -> #2 (&q->q_usage_counter(io)#52){++++}-{0:0}: [ 364.427067][T16269] blk_alloc_queue+0x544/0x690 [ 364.432364][T16269] __blk_mq_alloc_disk+0x194/0x390 [ 364.438029][T16269] nbd_dev_add+0x494/0xb60 [ 364.442980][T16269] nbd_init+0x168/0x1f0 [ 364.447682][T16269] do_one_initcall+0x250/0x870 [ 364.452984][T16269] do_initcall_level+0x10a/0x1a0 [ 364.458454][T16269] do_initcalls+0x59/0xa0 [ 364.463312][T16269] kernel_init_freeable+0x29d/0x3e0 [ 364.469049][T16269] kernel_init+0x22/0x1d0 [ 364.473910][T16269] ret_from_fork+0x514/0xb70 [ 364.479032][T16269] ret_from_fork_asm+0x1a/0x30 [ 364.484331][T16269] [ 364.484331][T16269] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 364.491580][T16269] fs_reclaim_acquire+0x71/0x100 [ 364.497083][T16269] kmem_cache_alloc_noprof+0x5f/0x600 [ 364.502998][T16269] __kernfs_iattrs+0xdd/0x380 [ 364.508233][T16269] kernfs_iop_setattr+0xe6/0x3f0 [ 364.513712][T16269] notify_change+0xbba/0xea0 [ 364.518857][T16269] do_truncate+0x1c2/0x250 [ 364.523815][T16269] path_openat+0x15b5/0x1d60 [ 364.528935][T16269] do_file_open+0x23e/0x4a0 [ 364.533960][T16269] do_sys_openat2+0x115/0x200 [ 364.539173][T16269] __x64_sys_openat+0x138/0x170 [ 364.544558][T16269] do_syscall_64+0x166/0x520 [ 364.549690][T16269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.556141][T16269] [ 364.556141][T16269] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 364.564672][T16269] __lock_acquire+0x164c/0x2de0 [ 364.570069][T16269] lock_acquire+0x115/0x350 [ 364.575111][T16269] down_read+0x4a/0x330 [ 364.579841][T16269] kernfs_iop_permission+0x7f/0x430 [ 364.585588][T16269] inode_permission+0x3de/0x5f0 [ 364.590971][T16269] cgroup_attach_permissions+0x28e/0x9f0 [ 364.597140][T16269] __cgroup_procs_write+0x24b/0x320 [ 364.602870][T16269] cgroup_threads_write+0x24/0x50 [ 364.608424][T16269] cgroup_file_write+0x331/0x8f0 [ 364.613893][T16269] kernfs_fop_write_iter+0x3a4/0x540 [ 364.619712][T16269] vfs_write+0x612/0xba0 [ 364.624490][T16269] ksys_write+0x150/0x270 [ 364.629368][T16269] do_syscall_64+0x166/0x520 [ 364.634493][T16269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.640907][T16269] [ 364.640907][T16269] other info that might help us debug this: [ 364.640907][T16269] [ 364.651137][T16269] Chain exists of: [ 364.651137][T16269] &root->kernfs_iattr_rwsem --> sk_lock-AF_INET --> cpu_hotplug_lock [ 364.651137][T16269] [ 364.665218][T16269] Possible unsafe locking scenario: [ 364.665218][T16269] [ 364.672724][T16269] CPU0 CPU1 [ 364.678091][T16269] ---- ---- [ 364.683473][T16269] rlock(cpu_hotplug_lock); [ 364.688082][T16269] lock(sk_lock-AF_INET); [ 364.695032][T16269] lock(cpu_hotplug_lock); [ 364.702058][T16269] rlock(&root->kernfs_iattr_rwsem); [ 364.707446][T16269] [ 364.707446][T16269] *** DEADLOCK *** [ 364.707446][T16269] [ 364.715654][T16269] locks held by syz.0.2681/16269: 5, last CPU#1: [ 364.722026][T16269] #0: ffff888031a740f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 364.731107][T16269] #1: ffff88807fc06460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 364.740008][T16269] #2: ffff888079c8a480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 364.749778][T16269] #3: ffffffff8ed9c760 (cgroup_mutex){+.+.}-{4:4}, at: cgroup_kn_lock_live+0x13c/0x230 [ 364.759544][T16269] #4: ffffffff8ebe98f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 364.770091][T16269] [ 364.770091][T16269] stack backtrace: [ 364.775999][T16269] CPU: 1 UID: 0 PID: 16269 Comm: syz.0.2681 Not tainted syzkaller #0 PREEMPT(full) [ 364.785378][T16269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 364.795466][T16269] Call Trace: [ 364.798756][T16269] [ 364.801772][T16269] dump_stack_lvl+0xe8/0x150 [ 364.806494][T16269] print_circular_bug+0x2e2/0x300 [ 364.811530][T16269] check_noncircular+0x12f/0x150 [ 364.816504][T16269] __lock_acquire+0x164c/0x2de0 [ 364.821366][T16269] ? __lock_acquire+0x747/0x2de0 [ 364.826336][T16269] lock_acquire+0x115/0x350 [ 364.830853][T16269] ? kernfs_iop_permission+0x7f/0x430 [ 364.836250][T16269] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 364.842177][T16269] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 364.848003][T16269] down_read+0x4a/0x330 [ 364.852172][T16269] ? kernfs_iop_permission+0x7f/0x430 [ 364.857570][T16269] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 364.863396][T16269] kernfs_iop_permission+0x7f/0x430 [ 364.868619][T16269] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 364.874450][T16269] inode_permission+0x3de/0x5f0 [ 364.879330][T16269] cgroup_attach_permissions+0x28e/0x9f0 [ 364.884985][T16269] __cgroup_procs_write+0x24b/0x320 [ 364.890206][T16269] cgroup_threads_write+0x24/0x50 [ 364.895247][T16269] ? __pfx_cgroup_threads_write+0x10/0x10 [ 364.901004][T16269] cgroup_file_write+0x331/0x8f0 [ 364.905958][T16269] ? __pfx_cgroup_file_write+0x10/0x10 [ 364.911442][T16269] ? __kmalloc_noprof+0x38c/0x720 [ 364.916487][T16269] ? __pfx_cgroup_file_write+0x10/0x10 [ 364.921959][T16269] kernfs_fop_write_iter+0x3a4/0x540 [ 364.927260][T16269] vfs_write+0x612/0xba0 [ 364.931517][T16269] ? __pfx_vfs_write+0x10/0x10 [ 364.936313][T16269] ? __fget_files+0x2a/0x420 [ 364.940932][T16269] ksys_write+0x150/0x270 [ 364.945293][T16269] ? __pfx_ksys_write+0x10/0x10 [ 364.950171][T16269] do_syscall_64+0x166/0x520 [ 364.954766][T16269] ? trace_irq_disable+0x3b/0x140 [ 364.959825][T16269] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.965910][T16269] ? clear_bhb_loop+0x70/0xc0 [ 364.970592][T16269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.976501][T16269] RIP: 0033:0x7f559eb9e159 [ 364.980929][T16269] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.000569][T16269] RSP: 002b:00007f559fb2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 365.009084][T16269] RAX: ffffffffffffffda RBX: 00007f559ee25fa0 RCX: 00007f559eb9e159 [ 365.017073][T16269] RDX: 0000000000000012 RSI: 0000200000000c40 RDI: 0000000000000005 [ 365.025053][T16269] RBP: 00007f559ec3503b R08: 0000000000000000 R09: 0000000000000000 [ 365.033123][T16269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 365.041113][T16269] R13: 00007f559ee26038 R14: 00007f559ee25fa0 R15: 00007fff4648f1a8 [ 365.049110][T16269] [ 365.098290][T16277] netlink: 'syz.4.2685': attribute type 9 has an invalid length. [ 365.183806][T16281] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2685'.