last executing test programs: 15.115608682s ago: executing program 4 (id=5982): socket$inet6(0xa, 0x3, 0x2f) r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f00000002c0)={0x10, 0x0, 0x25dfdbfb, 0x400000}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x9) bind$netlink(r7, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r8 = socket$netlink(0x10, 0x3, 0x14) bind$netlink(r8, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x400}, 0xc) r9 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r9, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc) r10 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r10, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r11 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r11, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc) r12 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r12, &(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc) r13 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r13, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc) bind$netlink(r1, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x80020000}, 0x48) socket$netlink(0x10, 0x3, 0x4) 14.879954773s ago: executing program 4 (id=5985): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x0) syz_open_procfs$namespace(r2, 0x0) (async) syz_open_procfs$namespace(r2, 0x0) accept$unix(r1, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) (async) r3 = accept$unix(r1, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) recvmsg$unix(r3, &(0x7f0000000240)={&(0x7f00000000c0), 0x6e, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/52, 0x34}], 0x1, &(0x7f0000000200)=[@cred={{0x1c}}], 0x20}, 0x1) 14.698275523s ago: executing program 4 (id=5986): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000540)="0276dd88a8af7888a8043ec4d20707fd1c40c4d73f3529256502a11cc88cbb789ecbe9d5795699e36e41b37818feaa370f83fcddcf152b9636a72c6c934a7f4b4025957eb74fabbb6be45eb22344df8f1947057a54e2ebadda701e7d8d58360c741a4c51afd31ddfe5005788dabdc1e21bf6a1aeca17213c80d68fd8168abf92c9c8168d43800d91be94edee122356d8af54d21f7cac4ac38a83da026b335b59e19c0ca1aa210543851ef074f5d60366791076f43fcf26dd3b5799948eb679cc68f84e05cba5572acadcbc186df41b044c0d00020343018510e608e08630d7762a882aabac5789f97651f19e704649b8ecbba9c2d27688ad780dabd654fd7c5230ebe0d37f529743f4b03fd1d5", 0x10d}], 0x1}, 0x24004010) listen(r0, 0x2) syz_emit_ethernet(0x8f, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x59, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@exp_fastopen={0xfe, 0xc, 0xf989, "1db8f18404522bbd"}]}}, {"d889ca3254e92c14b360444c00e4e32fbdf09c3e81a8ca2bcc68921908dea901d2a280f11e01ed3b94a6fce602d81f5f70ee3c66eb7b6a0dd5"}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 14.544152259s ago: executing program 4 (id=5988): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000480)="3900000013000318680d07070000000f1801ff3f04000000170a001700000000040037000d00400001312564aa58b9a64411f6bbf44dc48f57", 0x39}], 0x1) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYRESOCT=r1], 0x80}}, 0x0) (async) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYRESOCT=r1], 0x80}}, 0x0) sendmmsg$inet(r0, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}], 0x1, 0x0) (async) sendmmsg$inet(r0, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}], 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'netpci0\x00'}) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f00000004c0)={r0, &(0x7f0000000380)='%!+@-}[\x00', 0x82000, &(0x7f00000003c0)={@align=0x3, {0x8, 0x2, 0x51, 0x1}}, 0x2, &(0x7f0000000400)={@_ha_fsid}, &(0x7f0000000480)=0x4}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x54, r5, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0x54}}, 0x0) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x54, r5, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0x54}}, 0x0) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)={0x44, r4, 0x1, 0x0, 0x0, {0x34}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x73}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8}]}, 0x44}}, 0x0) sendmsg$DEVLINK_CMD_TRAP_GET(r2, &(0x7f00000006c0)={&(0x7f0000000500), 0xc, &(0x7f0000000540)={&(0x7f0000000a40)=ANY=[@ANYBLOB="8701000082a6d44da59683f858dc07ba8128a91216c054e3a42b0fde648e6d15c4bb972c624783810b983b144388c3c24cc7e47b28e8c78f702b29b2", @ANYRESOCT=0x0, @ANYBLOB="00012dbd7000fcdbdf253d000000080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c74696361737400000001006e657464657673696d000000000002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c74696361737400080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c74696361737400", @ANYBLOB="b0668a5fe06e7a118808a4f20bbbea52f57a6ed44a2a8e55ddb31e2da30bab627fd4261d5c2dbe6a1a16f5c8c4b525a895f580e1e05e5eb76851b4f107ecbbed76db98db7b7e089fd13bbee478c2b4b19eba53680ccde679ed020c4041331d48cb57184c5553295cd0d5be381d99a586d930ce904ed0179b0de0684685ceade745562be2368f12d6e2ca5af797ba2466289ec7ecba5d3c67bcf52dad99c21434f933ec52f36cae6ac2ddeef668b69ab47312a1cb3267e7ed05a7ae7a35f2350b2a648a26fa4b3248304d3528"], 0x138}, 0x1, 0x0, 0x0, 0x2840}, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000791038000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000791038000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x12, 0x4, &(0x7f0000000340)=ANY=[@ANYRES64=0x0], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe8a, 0x0, 0x0}, 0x94) 13.108300079s ago: executing program 4 (id=5991): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r0) sendmsg$DEVLINK_CMD_PORT_GET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x3c, r1, 0x1, 0xffffffff, 0x0, {0x39}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x3c}}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x7}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0xffffffff}, [@TCA_NETEM_RATE={0x14, 0x6, {0x7, 0xc, 0x0, 0xaf}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40400}, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000000900)="bada30fbc99b5400040000ea0756", 0xe, 0x8040, &(0x7f00000001c0)={0x11, 0x86dd, r5, 0x1, 0xd8, 0x6, @multicast}, 0x14) getgid() 11.975187127s ago: executing program 4 (id=6000): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000040)=0x7, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf250400000004000d8008000c"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$SIOCRSACCEPT(r2, 0x89e3) socket$netlink(0x10, 0x3, 0x10) (async) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000040)=0x7, 0x4) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002e00010026bdf000fcdbdf250400000004000d8008000c"], 0x20}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) (async) syz_init_net_socket$rose(0xb, 0x5, 0x0) (async) ioctl$SIOCRSACCEPT(r2, 0x89e3) (async) 3.808121041s ago: executing program 3 (id=6073): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x4c, &(0x7f0000000140)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0x0, @remote, @local, {[], {0x3, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, "ffb00afe4e70"}}}}}}}, 0x0) 3.704874034s ago: executing program 3 (id=6074): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000003000000000000000000000903000000010000000000000f03000000000000000000000202000000005f"], 0x0, 0x3f}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}, @IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x48}}, 0x0) 3.625841157s ago: executing program 2 (id=6077): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'pimreg0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r5, r4, 0x25, 0x2, @val=@target_btf_id=0xffffffffffffffff}, 0x14) close(r2) bpf$LINK_DETACH(0x22, &(0x7f0000000840)=r6, 0x4) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) splice(r7, 0x0, r8, &(0x7f00000002c0), 0x6, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000006800010000000000fddbdf25020000000400000006000700040000000c000880050004000100000008000600f200000008000500", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4402}, 0x0) socket(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00'}) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'pimreg0\x00'}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r5, r4, 0x25, 0x2, @val=@target_btf_id=0xffffffffffffffff}, 0x14) (async) close(r2) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000840)=r6, 0x4) (async) pipe(&(0x7f0000000000)) (async) close(r8) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) (async) splice(r7, 0x0, r8, &(0x7f00000002c0), 0x6, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000006800010000000000fddbdf25020000000400000006000700040000000c000880050004000100000008000600f200000008000500", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4402}, 0x0) (async) 3.517512031s ago: executing program 3 (id=6080): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$int_in(r1, 0x5452, &(0x7f0000000c80)=0xf4e) readv(r1, &(0x7f0000000300)=[{&(0x7f0000000080)=""/107, 0x6b}], 0x1) writev(r1, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0x1}, {&(0x7f00000197c0)="1902e902d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5c2df6b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}], 0x2) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = socket(0xb, 0x80000, 0x1f69153a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xc, 0xa}, {0x0, 0x9}, {0xffff, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x18, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x14, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_MPLS_OPT_LSE_BOS={0x5, 0x3, 0x40}, @TCA_FLOWER_KEY_MPLS_OPT_LSE_DEPTH={0x5, 0x1, 0x2}]}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[@ANYBLOB="340000001800010000000000000000000200000000000009000000000600150002000009100016800c00038008000100", @ANYRES32, @ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 3.242885656s ago: executing program 0 (id=6083): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x4c, &(0x7f0000000140)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0x0, @remote, @local, {[], {0x3, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, "ffb00afe4e70"}}}}}}}, 0x0) 3.143497811s ago: executing program 0 (id=6084): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000000000000000009112c7000000000095a6f141e1a828fdc756a7acaa9d487f4f80fd406338b8679b343bfd98e173adc79c93e6432fc4c89dd560a02114eeca0cb74fd773b66dec1c064e6933127cc04b2e76f559544fa0acd538e763090ee46b4944a063ba231ddabdee8d0e00000000000000fae50ebfc8cab599e41aeb5d9e68e20424a553c4ce9fd398576371de0f163bcb76d300e727"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x70, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='blkio.throttle.io_serviced\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0x13, &(0x7f0000000000)=ANY=[@ANYRESOCT=0x0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0}, 0x94) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, 0x0) preadv(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/140, 0x8c}], 0x1, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'dummy0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001180)=@newlink={0x48, 0x10, 0x503, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x140}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCI={0xc, 0x1, 0xffffffffffffffff}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x48}, 0x1, 0x0, 0x0, 0x8004}, 0x0) setsockopt$inet_group_source_req(r3, 0x0, 0x2e, &(0x7f0000000480)={0x5, {{0x2, 0x0, @multicast1}}}, 0x108) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000a40)={0x3, {{0x2, 0x0, @multicast1}}, 0x1}, 0x90) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={&(0x7f0000000000)="d82117307adf3abf9ed853d7bfcf511fe9485d8b369fa5a920d5ea5bd8d4afdbea2c0136b5bb91907055c39865c7168d225ea98b92d5680067bd9a3c80ddab4e52e0287ca814e366b7f013b3689bafacdd4937383254e57fac6cf53161b8b14fb70441adb7dd9ee3738affde5e2a3405a88be13570f79d5226ed2e42a0b37a0724aceb1d0058ca14f53a942406005c8e02938ec6c94c6df3a3fba5b4a81bca4a16916f6c70199dd95a65fa2e", &(0x7f00000002c0)=""/157, &(0x7f0000000380)="2bbc4fa16f7807dc52421baf8f3da800aa3b47b85fd6e0446a21e8c44374dea5a59f3d5f7713d87bd27552355e2f9446bf0cc78d5242be7e71e671433048cc695f72002364469490e55421b571ccae2fbced5736f596fec09ff86354bf74925ebc715f6d891090098ba3222a270417403039eedc9f9b38fd781eed47eb659a831212f0b78c39ca759bedfcda29eed7f913d57cc0defa7d49d55ae489d05ae81c7b134a01cdd26dd82abf517b", &(0x7f0000000440)="1de00243811865a04b3dd36953127527e542fdd55f5f566d6146dec2fc83609ea22445dc61397e164febf598485f25a56d1b3a9dfe982e4dada12f5941fdf470764034266236084fdc942719ce8b3cf9ff590cff5764cc9d2302d08e38a74c075f7316338809000611d9f43e94da44ddca1499055470afad54fbd80e04cb92dd12b7225f888ded0931d02115fe0b9617f74fcdf032d797", 0x4, r1, 0x4}, 0x38) 2.568194917s ago: executing program 2 (id=6085): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000001925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000600)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r2, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000000)={0x24, r3, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x20040002) r5 = socket(0x22, 0x2, 0x3) ioctl$IMGETCOUNT(r5, 0x80044943, &(0x7f00000003c0)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x14, 0x3a, 0x229, 0x0, 0x25dfdbfc, {0xa}}, 0x14}}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="840000001000f5a400000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000000000006400128009000100626f6e640000000054000280050001000500000005000d000200000008000200", @ANYRESHEX], 0x84}}, 0x0) 2.566814142s ago: executing program 1 (id=6086): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa13ffffffffffff0800450000380000000000019078ac1e0001ac1414aa0b009078030000004500000000000000002f0000ac14140ae0000001040065580000ffff"], 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000008b40)=ANY=[@ANYBLOB="3800000040000100fcff070004000000010000000400488014000180100010800400058005000300000000000c0002"], 0x38}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 2.500844014s ago: executing program 0 (id=6087): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000640)={'gre0\x00', &(0x7f00000005c0)={'syztnl2\x00', 0x0, 0x7, 0x7800, 0x0, 0x8001, {{0x6, 0x4, 0x1, 0x11, 0x18, 0x68, 0x0, 0x5, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}, @private=0xa010100, {[@lsrr={0x83, 0x3, 0xfc}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071103100000000001d400500000000004704000001ed00000f030000000000006f44000000000000730a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'ip_vti0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x40, 0x10, 0x1, 0x3, {{0x5, 0x4, 0x0, 0x7, 0x14, 0x68, 0x0, 0x8e, 0x0, 0x0, @local, @private=0xa010102}}}}) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="2800000010000108fdffffff0000000800000000", @ANYRES32=0x0, @ANYBLOB="0280000000002104020008001b00000000005c5f472bd8a4abbc7987bdf02b4bfe75342da7c13b916fdf62626087214d59ca3722c455843e810e53cc123f619b9845eff34bc55310e22b2f2fb98fcbbedc81e97138ba129f0c4c0f03e2bb2fa74016ca7ff7143dec68dec9891be10ef5d6ecb2830e8a1f9160becefb1bc0d74d522ffb416c7c7870285f24212c51a7718618cbc98112ca4f3cb2ecf1f6f96ffd06ec4a6d1955ea0f152937747b5300be078094d6e6d079ee0e3166f644f01f244b021039f664bdcc809ceec2917263cccc671590e183af058882ef17e5fac1691ca6c8071b431aaee812ed3fa449a96c82ebd162a374581402e00e3b91f05d00a2e183bd610dbb3ad665740f2bd514e3d5d7c9672d7b2eabf9c1da00727a52727a9e2659a93286d41a498fdd5b7f57fdeffe0697f7b612ba8ed9"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c00028008000100010000001400070000000000"], 0x74}}, 0x0) 2.49976855s ago: executing program 1 (id=6088): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e6400000008000240"], 0x10c}}, 0x0) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x3000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x100, r1, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x7}, {0x6, 0x16, 0x4}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x2}, {0x8, 0xb, 0x4}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x1000}, {0x6, 0x16, 0x3}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x8}, {0x8, 0xb, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x1}, {0x6, 0x16, 0x1}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x2}, {0x8, 0xb, 0xcad}}]}, 0x100}, 0x1, 0x0, 0x0, 0xc044}, 0x20000804) 2.419632232s ago: executing program 3 (id=6089): bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x9c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000854}, 0x20000040) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x20000, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x183081, 0x0) close(r3) socket$kcm(0x10, 0x400000002, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) ioctl$SIOCSIFHWADDR(r2, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c9, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00\x00\v\x00'}) 2.219626171s ago: executing program 1 (id=6090): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000480)=0x2, 0x4) (async) getsockopt$WPAN_SECURITY(r0, 0x0, 0x1, 0x0, &(0x7f0000000040)) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r1, 0x29, 0x21, &(0x7f00000000c0)=0x46, 0x4) (async) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0xb, @local}, 0x1c) (async) r2 = socket(0x15, 0x5, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000880)={'bridge_slave_0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ec0), 0x301, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000040)=0x1) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000020c0)=[@in6={0xa, 0x0, 0x0, @remote, 0x34}]}, &(0x7f0000002100)=0x10) (async) setsockopt$inet6_int(r8, 0x29, 0x2b, 0x0, 0xfff3) (async) ioctl$PPPIOCSMAXCID(r7, 0x4004743c, 0x0) (async) sendmsg$nl_route(r6, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001e000100000000001000000007000000", @ANYRES32=r5, @ANYBLOB="000004000a000200aaaaaaaaaa0c"], 0x28}}, 0x200080c2) (async) sendmsg$DEVLINK_CMD_SB_GET(0xffffffffffffffff, 0x0, 0x4008800) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000150001000000000000000000e0000002000000000000000000000000000000000000000000000000000000004e230080000000000200108000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000b86b6e000000030200"/112], 0xb8}}, 0x0) (async) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r2) sendmsg$DEVLINK_CMD_TRAP_SET(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40002}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="98000000", @ANYRES16=r9, @ANYBLOB="040027bd7000fedbdf253e0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c7469636173740005008300000000000800010070636900110002003030303a30303a31302e30000000001c008200766f757263655f6d61635f69735f6d756c746963617374000500830001000000"], 0x98}, 0x1, 0x0, 0x0, 0x24000804}, 0x2000c100) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newtaction={0xf8, 0x30, 0x1, 0x0, 0x0, {}, [{0xe4, 0x1, [@m_ct={0x98, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x6d, 0x6, "9b3788c915fd2d9a38ca2e69c2063b573e211d1971032b52dc14d143152c2717488a141a30dc4ef50a32e5cf5514d3a79216b69ba64d3a70fc4b588b28335e6f1018e3f835ed9ea70fb9352304a19727986c9fbfe682f71370b5283b088f4ca893b21200ff63c59891"}, {0xc}, {0xc}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xf8}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) 2.07531298s ago: executing program 2 (id=6091): r0 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r3, @ANYBLOB="00000000000000001c001a80080002800800e500080000003e120000080002001040e5"], 0x44}}, 0x0) 2.058876984s ago: executing program 1 (id=6092): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0x7}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x30000000}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}}, 0x0) (async, rerun: 64) syz_emit_ethernet(0x3a, &(0x7f0000001d80)={@link_local, @empty, @val={@void}, {@ipv6={0x86dd, @generic={0x0, 0x6, "062111", 0x0, 0x3c, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast2}}}}, 0x0) (rerun: 64) 2.008299221s ago: executing program 0 (id=6093): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x4c, &(0x7f0000000140)={@link_local, @random="ece65fbcee55", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0x0, @remote, @local, {[], {0x3, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, "ffb00afe4e70"}}}}}}}, 0x0) 1.915590154s ago: executing program 0 (id=6094): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r1, &(0x7f00000004c0)={0x2, 0x0, @multicast2, 0x2}, 0x10) syz_emit_ethernet(0x74, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0xfffffe9a, 0x0, @gue={{0x2}}}}}}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x80, 0x0, 0x0, 0x1, 0x0, 0x6}, [@RTA_GATEWAY={0x8, 0x5, @private=0xa010101}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x4040000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x8, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x48) syz_emit_ethernet(0x46, &(0x7f0000000600)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}, @empty, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x10, 0x67, 0x0, @dev, @loopback, {[@fragment={0x67}, @hopopts={0x0, 0x24}]}}}}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0xb) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, 0x0, 0x0) close(r4) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r3, 0x58, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f00000007c0)={0x150, 0x12, 0x1, 0x70bd2b, 0x25dfdbfd, {0xf, 0x7, 0x3, 0xa, {0x4e20, 0x4e21, [0x3ff, 0x4, 0x5, 0x34], [0x10, 0x3, 0x3, 0x7], r6, [0xb95, 0x8]}, 0xfffffffe, 0x800}, [@INET_DIAG_REQ_BYTECODE={0xd3, 0x1, "577513fd098a6cb2663fd3b857a51188c96fc70ff0e7d923eb66b10318846451dc46265155eb5c0b174123b358c1c36b43317a141dd79efb1080d051da823a924eabc4455e5207784be395bc293f3d1f158c328b86f305342b531cb19f4c8e38b9a47d11bc3890b8ea1213dbbd2891a0155acd989674dd1d57d07d16ac06d5e2fac8a1918629cc9eedd800c7c33b8d639d25f418562ddc70be814fab2317cc6de629dc2efa4c0c421ed1857bbbbd5e2e7411424f402066893b092820f989701b8abfcabcb40a6f097a25ebc6fefe78"}, @INET_DIAG_REQ_BYTECODE={0x30, 0x1, "3d10107147d909777ef77651e301ebd480477212072e5410e273f84ffc2f3512a414c7f18bd7148ad73fe58f"}]}, 0x150}, 0x1, 0x0, 0x0, 0x4000000}, 0x30000010) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000640)={r7}, 0x70) r8 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed}, &(0x7f0000000080)=0xe, 0x800) getsockopt$bt_l2cap_L2CAP_CONNINFO(r8, 0x6, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x6) shutdown(r0, 0x1) 1.833450498s ago: executing program 2 (id=6095): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000440)=@framed={{}, [@printk={@lu, {0x3, 0x3, 0x3, 0xa, 0x1, 0xfff8, 0x17000000}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'wlan1\x00', &(0x7f0000000000)=@ethtool_ringparam={0x34}}) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x18, r2, 0x1, 0x0, 0xffffffff, {{}, {@void, @void}}, [@NL80211_ATTR_TX_RATES={0x4, 0x10d}]}, 0x18}}, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) (async) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x40, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x15, 0x2, [@TCA_FQ_CODEL_FLOWS={0x8}]}}]}, 0x40}}, 0x0) 327.930203ms ago: executing program 1 (id=6096): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x29}, @printk={@lx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x22}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r0, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r2, 0x6, 0x3, &(0x7f0000000040)=0x20, 0x4) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r4 = accept$alg(r3, 0x0, 0x0) recvmsg(r4, &(0x7f0000007140)={0x0, 0x0, &(0x7f0000007100)=[{&(0x7f0000005600)=""/49, 0x31}], 0x39}, 0x40000102) sendmmsg$alg(r4, &(0x7f00000007c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4001044}], 0x1, 0x24008844) sendmmsg$inet(r4, &(0x7f0000005d00)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000140)="ec0767137af7e7d890debdedb6aba1a8b4ede604461087e87bc1e54d08a4c58d94481c59aaedb0d8e7dcf67b286f2eb812797a31410d9f1522c112a7fa390a471160d1c4d0832a4639", 0x49}, {&(0x7f0000000100)="4dea2e9fc630f1670cf70c207e43667030bf092497c42179b09807f9b234acd0e2", 0x21}], 0x2}}], 0x1, 0x8058) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @random="08c82553c54d", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local}, {{0x1, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "b3e480a7613088fd71106c027deb3b11"}]}}}}}}}, 0x0) 313.482204ms ago: executing program 3 (id=6097): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) r1 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000240), 0x800) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f0000000280)) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="0bc3a6168654", 0x6}, {&(0x7f0000000a80)='\x00\x00\x00egS!\x00', 0x8}], 0x2) (async) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="0bc3a6168654", 0x6}, {&(0x7f0000000a80)='\x00\x00\x00egS!\x00', 0x8}], 0x2) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r3, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x8, 0x3, 0x5}]}}]}, 0x38}}, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000180)={{0xffffffffffffffff, &(0x7f0000000000)='**\x00', 0x2c0000, &(0x7f0000000040)={@align, {0x1, 0x5, 0x8, 0x9}}, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=0x9bd}, {[0x80000001, 0x7, 0x7, 0x4]}, 0xf5, 0x68, &(0x7f0000000100)=""/104}) read$rfkill(r5, &(0x7f0000000200), 0x8) 259.955333ms ago: executing program 0 (id=6098): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) syz_emit_ethernet(0x56, &(0x7f0000000880)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010448", 0x20, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x43}, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2, 0x1, "36dad83aea8d"}]}}}}}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="760a00000000000061109800000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ad060000", 0x4) sendmmsg$inet(r1, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000140)="17", 0x1}, {&(0x7f0000002a40)="0d5ebfd6dfe98a01b2fb5b0eb19a417353a0833d961a98422333bb10a75289", 0x1f}], 0x2, &(0x7f0000003840)=ANY=[@ANYBLOB='@'], 0x40}}], 0x1, 0x715076165a76ad26) vmsplice(r0, &(0x7f0000000280)=[{&(0x7f0000000480)="4ec5bc8d105e8ddb9c4c92611bcdb192ad3b3501c544432d185a16e6576fb61f1946649acf5c9206c4e6fd5ee6fcdbbde9eb683b1fc554bdf41e449f43dda509ccb6f1dddf5b727843f9c6ec276bf7ca5f9558a1241f53a694114f0b2105456e3b2aa843a672c0cc9d53c689fd4967fa430fa290d79ef7ae2935a1bd", 0x7c}], 0x1, 0xa) recvmmsg(r1, &(0x7f0000001ec0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000005c0)=""/199, 0xc7}], 0x1}, 0xdac}], 0x1, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup/syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000200)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f00000000c0), 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r5, 0x0, 0x94, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f0000000240)=0x2, 0x4) sendto$inet6(r4, &(0x7f00000002c0)="aa69c2eb87", 0x5, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x13}, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x2}, 0x8) 195.804179ms ago: executing program 2 (id=6099): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 188.675038ms ago: executing program 1 (id=6100): r0 = socket$nl_route(0x10, 0x3, 0x0) recvfrom$packet(0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5800000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000300012800b00010067656e6576650000200002801400070020010000000000000000000000000000080001000100000008000a00", @ANYRES32], 0x58}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) (rerun: 32) 126.834847ms ago: executing program 2 (id=6101): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000046000701fcffffff02000000017c0000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x9000, @rand_addr=' \x01\x00'}], 0x1c) r1 = socket$kcm(0x29, 0x5, 0x0) sendmsg$rds(r1, &(0x7f0000002940)={0x0, 0x0, &(0x7f0000002800)=[{&(0x7f0000002980)=""/4112, 0xfffffe09}], 0x1}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000001040300000000000000000000000007050001000100"], 0x1c}}, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) getsockopt(r4, 0x1, 0xe, 0x0, &(0x7f0000000080)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x200000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x200000, 0x2, 0x0, 0x0, 0xfff9, 0x99}, 0x20) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000040)=@dellink={0x34, 0x11, 0x1, 0x70bd26, 0x5dfdbff, {0x0, 0x0, 0x0, 0x0, 0x42008, 0x40000}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x200000000000000, 0x0, 0x240040c4}, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000200)={'ipvlan1\x00', 0x0}) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_SET(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01002dbd7000fedbdd25060000000c00018008000100", @ANYRES32=r10], 0x20}, 0x1, 0x0, 0x0, 0x20000050}, 0x30008010) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f00000002c0)={0xffffffffffffffff, &(0x7f0000000080)=' \x01\x00', 0x202, &(0x7f0000000200)={@align=0x80000000, {0x7, 0x9, 0xff, 0x200}}, 0x89, &(0x7f0000000240), &(0x7f0000000280)=0x4}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x10, 0xe, &(0x7f00000003c0)=ANY=[@ANYBLOB="b700000028d80000bca30000000000003403000040feffff720af0ff0000000071a4f0ff000000001f030000000000002e0a0200000000002604fdffffff000e61144400000000001d430000000000007a0a00fe0000001f61141c0000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fd79153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637f7219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7ed9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f45e3f10857038a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b6", @ANYRESHEX=r6, @ANYRESDEC=r12, @ANYRES16=r5], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x9}, 0x8, 0x10, &(0x7f00000000c0)={0x0, 0x2}, 0x10}, 0x94) 0s ago: executing program 3 (id=6102): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1) kernel console output (not intermixed with test programs): el attr 12 has unexpected len 0 expected 16 [ 410.334916][T21760] xt_ecn: cannot match TCP bits for non-tcp packets [ 410.438128][T21770] netlink: 'syz.1.4394': attribute type 10 has an invalid length. [ 410.449663][T21770] netlink: 228 bytes leftover after parsing attributes in process `syz.1.4394'. [ 410.599998][T21784] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4398'. [ 410.774628][T21798] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4400'. [ 410.878301][T21804] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4401'. [ 411.089250][T21821] syz_tun: entered allmulticast mode [ 411.152662][T21819] syz_tun: left allmulticast mode [ 411.440362][T21855] netlink: 'syz.4.4415': attribute type 1 has an invalid length. [ 411.496297][T21855] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 411.839105][T21879] netlink: 'syz.0.4423': attribute type 11 has an invalid length. [ 412.207679][T21908] ip6_vti0 speed is unknown, defaulting to 1000 [ 412.448779][T21925] bond3: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 412.496058][T21935] netlink: 'syz.1.4434': attribute type 1 has an invalid length. [ 412.506726][T21925] bond3 (unregistering): Released all slaves [ 412.659793][T21935] 8021q: adding VLAN 0 to HW filter on device bond6 [ 412.687084][T21940] bond6: (slave geneve3): making interface the new active one [ 412.697205][T21940] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 412.709388][ T3514] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.723376][ T3514] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.755899][ T3514] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.783629][ T3514] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.895328][T21953] vlan1: entered allmulticast mode [ 412.904147][T21953] veth0_vlan: entered allmulticast mode [ 413.006486][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 413.014531][ C1] lec:lec_tx_timeout: lec0 [ 413.019204][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 413.026311][T21958] syzkaller0: entered promiscuous mode [ 413.031790][T21958] syzkaller0: entered allmulticast mode [ 413.079846][T21961] Bluetooth: MGMT ver 1.23 [ 413.085988][T21961] "syz.4.4442" (21961) uses obsolete ecb(arc4) skcipher [ 413.123983][T21963] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4443'. [ 413.175337][T21968] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4443'. [ 413.207405][T21963] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 413.225228][T21963] batman_adv: batadv0: Interface activated: netdevsim0 [ 413.239111][T21971] IPVS: set_ctl: invalid protocol: 1 127.0.0.1:20004 [ 413.251201][T21967] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.4445'. [ 413.368898][T21974] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4447'. [ 413.405110][T21908] lo speed is unknown, defaulting to 1000 [ 413.409271][T21975] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4448'. [ 413.512054][T21986] sock: sock_timestamping_bind_phc: sock not bind to device [ 413.717491][T21999] FAULT_INJECTION: forcing a failure. [ 413.717491][T21999] name failslab, interval 1, probability 0, space 0, times 0 [ 413.727865][T21995] bond3: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 413.730205][T21999] CPU: 0 UID: 0 PID: 21999 Comm: syz.1.4455 Not tainted syzkaller #0 PREEMPT(full) [ 413.730227][T21999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 413.730241][T21999] Call Trace: [ 413.730248][T21999] [ 413.730255][T21999] dump_stack_lvl+0xe8/0x150 [ 413.730281][T21999] should_fail_ex+0x412/0x560 [ 413.730307][T21999] should_failslab+0xa8/0x100 [ 413.730332][T21999] kmem_cache_alloc_bulk_noprof+0x8d/0x7e0 [ 413.730352][T21999] ? pfn_valid+0x125/0x4c0 [ 413.730378][T21999] bpf_test_run_xdp_live+0x179c/0x1cf0 [ 413.730411][T21999] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 413.730436][T21999] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 413.730472][T21999] ? 0xffffffffa0201a10 [ 413.730510][T21999] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 413.730537][T21999] ? _copy_from_user+0x94/0xb0 [ 413.730555][T21999] ? bpf_test_init+0x113/0x150 [ 413.730569][T21999] ? xdp_convert_md_to_buff+0x5b/0x330 [ 413.730589][T21999] bpf_prog_test_run_xdp+0x81c/0x1160 [ 413.730619][T21999] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 413.730640][T21999] ? __fget_files+0x2a/0x420 [ 413.730661][T21999] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 413.730679][T21999] bpf_prog_test_run+0x2c7/0x340 [ 413.730703][T21999] __sys_bpf+0x643/0x950 [ 413.730724][T21999] ? __pfx___sys_bpf+0x10/0x10 [ 413.730757][T21999] ? ksys_write+0x242/0x270 [ 413.730777][T21999] ? __pfx_ksys_write+0x10/0x10 [ 413.730803][T21999] __x64_sys_bpf+0x7c/0x90 [ 413.730820][T21999] do_syscall_64+0x14d/0xf80 [ 413.730840][T21999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.730855][T21999] ? trace_irq_disable+0x37/0x100 [ 413.730872][T21999] ? clear_bhb_loop+0x40/0x90 [ 413.730891][T21999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.730911][T21999] RIP: 0033:0x7f79d5d9c629 [ 413.730926][T21999] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 413.730940][T21999] RSP: 002b:00007f79d6b97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 413.730959][T21999] RAX: ffffffffffffffda RBX: 00007f79d6015fa0 RCX: 00007f79d5d9c629 [ 413.730971][T21999] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 413.730981][T21999] RBP: 00007f79d6b97090 R08: 0000000000000000 R09: 0000000000000000 [ 413.730991][T21999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 413.731001][T21999] R13: 00007f79d6016038 R14: 00007f79d6015fa0 R15: 00007ffc4c136368 [ 413.731028][T21999] [ 414.015638][T21995] bond3 (unregistering): Released all slaves [ 414.073552][T22006] netlink: 'syz.0.4456': attribute type 29 has an invalid length. [ 414.082779][T22008] netlink: 'syz.0.4456': attribute type 29 has an invalid length. [ 414.188832][T22005] syzkaller0: entered promiscuous mode [ 414.194906][T22005] syzkaller0: entered allmulticast mode [ 414.351127][T22030] netlink: 'syz.2.4463': attribute type 1 has an invalid length. [ 415.744767][T22036] ip6erspan0: entered promiscuous mode [ 415.959724][T22044] syzkaller0: entered promiscuous mode [ 415.985252][T22044] syzkaller0: entered allmulticast mode [ 415.994974][T22055] netlink: 'syz.2.4467': attribute type 2 has an invalid length. [ 416.021855][T22055] __nla_validate_parse: 3 callbacks suppressed [ 416.021872][T22055] netlink: 119 bytes leftover after parsing attributes in process `syz.2.4467'. [ 416.105832][T22057] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4468'. [ 417.694347][T22076] netlink: 'syz.1.4474': attribute type 12 has an invalid length. [ 417.720177][T22076] netlink: 'syz.1.4474': attribute type 29 has an invalid length. [ 417.754766][T22076] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4474'. [ 417.765341][T22076] netlink: 'syz.1.4474': attribute type 2 has an invalid length. [ 417.780441][T22089] netlink: 'syz.1.4474': attribute type 4 has an invalid length. [ 417.788974][T22076] netlink: 23 bytes leftover after parsing attributes in process `syz.1.4474'. [ 417.798607][T22089] netlink: 17 bytes leftover after parsing attributes in process `syz.1.4474'. [ 417.892193][T22098] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4477'. [ 417.937790][T22094] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ku crK:̥B| [ 418.036508][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 418.044588][ C1] lec:lec_tx_timeout: lec0 [ 418.049519][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 418.066047][T22106] netlink: 208 bytes leftover after parsing attributes in process `syz.0.4480'. [ 418.123186][T22110] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 418.377776][T22124] netlink: 96 bytes leftover after parsing attributes in process `syz.3.4483'. [ 418.555647][T22139] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4490'. [ 418.578148][T22139] veth0: Caught tx_queue_len zero misconfig [ 418.653758][T22150] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4492'. [ 418.743657][T22152] sctp: [Deprecated]: syz.0.4494 (pid 22152) Use of int in max_burst socket option. [ 418.743657][T22152] Use struct sctp_assoc_value instead [ 418.782808][T22155] netlink: 'syz.2.4495': attribute type 1 has an invalid length. [ 418.829081][T22158] netlink: zone id is out of range [ 418.834356][T22158] netlink: zone id is out of range [ 418.840088][T22158] netlink: zone id is out of range [ 418.845387][T22158] netlink: zone id is out of range [ 418.851127][T22155] 8021q: adding VLAN 0 to HW filter on device bond3 [ 418.859744][T22158] netlink: zone id is out of range [ 418.865225][T22158] netlink: zone id is out of range [ 418.878888][T22158] netlink: zone id is out of range [ 418.884055][T22158] netlink: zone id is out of range [ 418.924641][T22158] netlink: zone id is out of range [ 418.950605][T22158] netlink: zone id is out of range [ 419.015183][T22165] 8021q: adding VLAN 0 to HW filter on device bond3 [ 419.079211][T22172] macvlan2: entered promiscuous mode [ 419.084697][T22172] macvlan2: entered allmulticast mode [ 419.091020][T22172] bond3: entered allmulticast mode [ 419.097231][T22172] bond3: entered promiscuous mode [ 419.102956][T22172] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 419.112687][T22172] team0: Port device macvlan2 added [ 419.238514][T22187] netlink: 'syz.1.4505': attribute type 3 has an invalid length. [ 419.349676][T22193] ip6_vti0 speed is unknown, defaulting to 1000 [ 419.990001][T22216] netlink: 'syz.3.4513': attribute type 16 has an invalid length. [ 420.015805][T22216] netlink: 'syz.3.4513': attribute type 17 has an invalid length. [ 420.284452][T22216] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.310419][T22216] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.354458][T22193] lo speed is unknown, defaulting to 1000 [ 420.707892][T22254] gretap3: entered promiscuous mode [ 420.717630][T22254] gretap3: entered allmulticast mode [ 420.745620][T22257] netlink: 'syz.2.4526': attribute type 1 has an invalid length. [ 420.857556][T22262] netlink: 'syz.3.4528': attribute type 21 has an invalid length. [ 421.093144][T22274] syzkaller0: entered promiscuous mode [ 421.109973][T22274] syzkaller0: entered allmulticast mode [ 421.205444][T22288] __nla_validate_parse: 17 callbacks suppressed [ 421.205463][T22288] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4535'. [ 421.501974][T22295] 5gQ[: renamed from lo (while UP) [ 421.566321][T22302] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4540'. [ 421.642913][T22306] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4542'. [ 421.999713][T22327] netlink: 144 bytes leftover after parsing attributes in process `syz.1.4546'. [ 422.167602][T22336] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4549'. [ 422.172509][T22339] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4550'. [ 422.204517][T22336] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4549'. [ 422.274091][T22341] netlink: 168 bytes leftover after parsing attributes in process `syz.2.4552'. [ 422.617190][T22355] syzkaller0: entered promiscuous mode [ 422.622734][T22355] syzkaller0: entered allmulticast mode [ 422.631901][T22355] tipc: Enabled bearer , priority 0 [ 422.652697][T22354] tipc: Resetting bearer [ 422.701014][T22354] tipc: Disabling bearer [ 422.910745][T22375] validate_nla: 2 callbacks suppressed [ 422.910762][T22375] netlink: 'syz.2.4562': attribute type 10 has an invalid length. [ 422.959339][T22375] 8021q: adding VLAN 0 to HW filter on device team0 [ 423.001145][T22375] bond0: (slave team0): Enslaving as an active interface with an up link [ 423.017852][T22376] syzkaller0: entered promiscuous mode [ 423.023352][T22376] syzkaller0: entered allmulticast mode [ 423.038497][T22383] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4565'. [ 423.088334][T22383] netlink: 'syz.4.4565': attribute type 9 has an invalid length. [ 423.089403][T22375] tipc: Enabled bearer , priority 0 [ 423.101866][T22383] netlink: 'syz.4.4565': attribute type 6 has an invalid length. [ 423.114662][T22375] tipc: Resetting bearer [ 423.124599][T22374] tipc: Resetting bearer [ 423.167299][T22374] tipc: Disabling bearer [ 423.208448][T22385] 8021q: VLANs not supported on ip_vti0 [ 423.397425][T22402] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4571'. [ 423.598974][T22409] block nbd0: NBD_DISCONNECT [ 423.603875][T22409] block nbd0: Send disconnect failed -32 [ 423.873171][T22436] netlink: 'syz.3.4580': attribute type 26 has an invalid length. [ 423.991884][T22444] IPv6: NLM_F_CREATE should be specified when creating new route [ 424.006353][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5960 ms [ 424.014427][ C1] lec:lec_tx_timeout: lec0 [ 424.019834][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 424.060564][T22447] net_ratelimit: 47 callbacks suppressed [ 424.060580][T22447] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 424.173158][T22455] Cannot find set identified by id 65534 to match [ 424.533260][T22482] tap0: tun_chr_ioctl cmd 1074025676 [ 424.540424][T22482] tap0: owner set to 0 [ 424.899852][T22493] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 424.960547][T22511] ip6gre0: Master is either lo or non-ether device [ 425.174780][T22524] tap0: tun_chr_ioctl cmd 1074025678 [ 425.194210][T22524] tap0: group set to 0 [ 425.288127][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 425.296304][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 425.395949][T22533] syzkaller0: entered promiscuous mode [ 425.417516][T22533] syzkaller0: entered allmulticast mode [ 425.904042][T22563] block nbd0: Unsupported socket: should be TCP or UNIX. [ 426.109385][T22565] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 426.135065][T22577] ip6t_srh: unknown srh match flags 5F28 [ 426.302369][T22585] __nla_validate_parse: 17 callbacks suppressed [ 426.302387][T22585] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.4632'. [ 426.409322][T22603] netlink: 116 bytes leftover after parsing attributes in process `syz.2.4637'. [ 426.413979][T22600] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4635'. [ 426.534509][T22611] tipc: Started in network mode [ 426.545134][T22611] tipc: Node identity b6b1d3b5bc27, cluster identity 4711 [ 426.557847][T22611] tipc: Enabled bearer , priority 0 [ 426.691422][T22611] syzkaller0: entered promiscuous mode [ 426.697642][T22611] syzkaller0: entered allmulticast mode [ 426.704883][T22611] tipc: Resetting bearer [ 426.713029][T22623] netlink: 9 bytes leftover after parsing attributes in process `syz.1.4639'. [ 426.723757][T22623] gretap0: entered promiscuous mode [ 426.733886][T22619] xt_NFQUEUE: number of total queues is 0 [ 426.783543][T22609] tipc: Resetting bearer [ 426.909339][T22628] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4642'. [ 426.918826][T22628] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4642'. [ 428.345857][T22609] tipc: Disabling bearer [ 428.371260][T22627] bond0: Unable to set down delay as MII monitoring is disabled [ 428.449970][ T5944] tipc: Node number set to 177656757 [ 428.468750][T22665] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 428.522394][T22668] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4650'. [ 428.538659][T22668] netlink: 'syz.1.4650': attribute type 9 has an invalid length. [ 428.556612][T22668] netlink: 'syz.1.4650': attribute type 11 has an invalid length. [ 428.596034][T22679] IPVS: set_ctl: invalid protocol: 108 100.1.1.1:20003 [ 428.609085][T22668] netlink: 'syz.1.4650': attribute type 12 has an invalid length. [ 428.661911][T22668] netlink: 210020 bytes leftover after parsing attributes in process `syz.1.4650'. [ 428.707893][T22684] veth1_macvtap: left promiscuous mode [ 428.713402][T22684] macsec0: entered promiscuous mode [ 428.721520][T22668] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4650'. [ 428.733820][T22684] macsec0: entered allmulticast mode [ 428.761897][T22686] veth1_macvtap: entered promiscuous mode [ 428.780473][T22686] veth1_macvtap: entered allmulticast mode [ 428.799545][T22686] macsec0: left promiscuous mode [ 428.804735][T22686] macsec0: left allmulticast mode [ 428.830509][T22686] veth1_macvtap: left allmulticast mode [ 428.835897][ T29] audit: type=1800 audit(1771353551.191:4): pid=22693 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.4654" name="memory.events" dev="tmpfs" ino=1253 res=0 errno=0 [ 428.909162][ T29] audit: type=1804 audit(1771353551.231:5): pid=22689 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.4654" name="/newroot/243/memory.events" dev="tmpfs" ino=1253 res=1 errno=0 [ 429.026499][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 429.034561][ C1] lec:lec_tx_timeout: lec0 [ 429.039164][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 429.272420][T22719] syzkaller0: entered promiscuous mode [ 429.322968][T22719] syzkaller0: entered allmulticast mode [ 429.365764][T22716] netlink: 'syz.0.4662': attribute type 58 has an invalid length. [ 429.376887][T22716] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4662'. [ 429.613941][T22736] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 429.698783][T22740] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 429.735036][T22740] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 429.750398][T22744] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 430.613631][T22805] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 430.683380][T22806] netlink: 'syz.3.4692': attribute type 27 has an invalid length. [ 431.313700][T22856] __nla_validate_parse: 6 callbacks suppressed [ 431.313718][T22856] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4703'. [ 431.350584][T22856] hsr_slave_1: left promiscuous mode [ 431.463352][T22869] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4706'. [ 431.464041][T22866] netlink: 'syz.2.4707': attribute type 1 has an invalid length. [ 431.501145][T22866] netlink: 212 bytes leftover after parsing attributes in process `syz.2.4707'. [ 431.512954][T22860] netlink: 'syz.3.4705': attribute type 4 has an invalid length. [ 431.544414][T22870] netlink: 'syz.4.4704': attribute type 19 has an invalid length. [ 431.569398][T22866] netlink: 'syz.2.4707': attribute type 1 has an invalid length. [ 431.580147][T22870] netlink: 'syz.4.4704': attribute type 21 has an invalid length. [ 431.586873][T22866] netlink: 96 bytes leftover after parsing attributes in process `syz.2.4707'. [ 431.602247][T22870] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4704'. [ 431.628756][T22870] sctp: [Deprecated]: syz.4.4704 (pid 22870) Use of int in max_burst socket option deprecated. [ 431.628756][T22870] Use struct sctp_assoc_value instead [ 431.635962][T22866] netlink: 658 bytes leftover after parsing attributes in process `syz.2.4707'. [ 431.645690][T22877] IPv6: NLM_F_CREATE should be specified when creating new route [ 431.653905][T22866] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4707'. [ 431.906888][T22896] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 431.937556][T22898] netlink: 204 bytes leftover after parsing attributes in process `syz.1.4712'. [ 431.994473][T22900] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4715'. [ 432.021892][T22895] ip6_vti0 speed is unknown, defaulting to 1000 [ 432.055513][T22906] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4716'. [ 432.165359][T22916] IPVS: set_ctl: invalid protocol: 43 255.255.255.255:20003 [ 432.317349][T22924] : renamed from geneve0 (while UP) [ 432.454457][T22926] x_tables: duplicate underflow at hook 3 [ 432.605026][T22940] syzkaller0: entered promiscuous mode [ 432.619805][T22940] syzkaller0: entered allmulticast mode [ 432.767450][T22895] lo speed is unknown, defaulting to 1000 [ 432.928991][T22952] syzkaller0: entered promiscuous mode [ 432.934503][T22952] syzkaller0: entered allmulticast mode [ 433.092393][T22956] smc: net device team0 applied user defined pnetid SYZ2 [ 433.114112][T22956] smc: net device caif0 applied user defined pnetid SYZ2 [ 433.181815][T22956] sctp: [Deprecated]: syz.2.4732 (pid 22956) Use of int in maxseg socket option. [ 433.181815][T22956] Use struct sctp_assoc_value instead [ 433.631954][T22987] veth0: entered promiscuous mode [ 433.661339][T22986] veth0: left promiscuous mode [ 433.760627][T22989] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 433.895448][T22996] validate_nla: 2 callbacks suppressed [ 433.895466][T22996] netlink: 'syz.4.4741': attribute type 16 has an invalid length. [ 433.953771][T22996] netlink: 'syz.4.4741': attribute type 17 has an invalid length. [ 433.988647][T23003] netlink: 'syz.2.4746': attribute type 1 has an invalid length. [ 433.999241][T23007] netlink: 'syz.2.4746': attribute type 2 has an invalid length. [ 434.069911][T22996] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 434.500209][T23029] syzkaller0: entered promiscuous mode [ 434.515693][T23029] syzkaller0: entered allmulticast mode [ 434.889814][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5850 ms [ 434.897895][ C1] lec:lec_tx_timeout: lec0 [ 434.902625][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 434.982341][T23036] syzkaller0: entered promiscuous mode [ 434.997650][T23036] syzkaller0: entered allmulticast mode [ 435.014747][T23036] xt_TCPMSS: Only works on TCP SYN packets [ 435.075019][T23070] openvswitch: netlink: Actions may not be safe on all matching packets [ 435.177661][T23082] ip6_vti0 speed is unknown, defaulting to 1000 [ 435.258818][T23084] pimreg3: entered allmulticast mode [ 435.420688][T23095] netlink: 'syz.0.4773': attribute type 7 has an invalid length. [ 435.429046][T23095] netlink: 'syz.0.4773': attribute type 8 has an invalid length. [ 435.571617][T23104] netlink: 'syz.1.4776': attribute type 1 has an invalid length. [ 435.584992][T23104] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 435.763188][T23117] netlink: 'syz.1.4779': attribute type 1 has an invalid length. [ 436.057329][T23134] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 436.078061][T23082] lo speed is unknown, defaulting to 1000 [ 436.082177][T23136] syzkaller0: entered promiscuous mode [ 436.089945][T23136] syzkaller0: entered allmulticast mode [ 436.383073][T23142] __nla_validate_parse: 14 callbacks suppressed [ 436.383091][T23142] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4788'. [ 436.433999][T23143] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4788'. [ 436.481776][T23148] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4790'. [ 436.536813][T23154] netlink: 'syz.0.4791': attribute type 1 has an invalid length. [ 436.583242][T23154] 8021q: adding VLAN 0 to HW filter on device bond4 [ 436.703957][T23158] 8021q: adding VLAN 0 to HW filter on device bond4 [ 436.712694][T23158] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 436.724489][T23158] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 436.845609][T23154] bond4: (slave veth7): Enslaving as an active interface with a down link [ 437.061242][T23171] syzkaller0: entered promiscuous mode [ 437.086651][T23171] syzkaller0: entered allmulticast mode [ 439.079964][T23209] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4805'. [ 439.217802][T23218] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4809'. [ 439.296020][T23218] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4809'. [ 439.305978][ T29] audit: type=1800 audit(1771353561.651:6): pid=23218 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4809" name="memory.events" dev="tmpfs" ino=2237 res=0 errno=0 [ 439.427719][T23232] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 439.499993][T23241] syzkaller0: entered promiscuous mode [ 439.505545][T23241] syzkaller0: entered allmulticast mode [ 439.713156][T23254] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0x2 [ 439.736080][T23255] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4822'. [ 439.916487][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 439.924553][ C1] lec:lec_tx_timeout: lec0 [ 439.930137][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 440.182720][T23297] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4832'. [ 440.358221][T23308] syzkaller0: entered promiscuous mode [ 440.363872][T23308] syzkaller0: entered allmulticast mode [ 440.454038][T23310] syzkaller0: entered promiscuous mode [ 440.476770][T23310] syzkaller0: entered allmulticast mode [ 440.493901][T23314] netlink: 'syz.0.4839': attribute type 1 has an invalid length. [ 440.506067][T23314] netlink: 'syz.0.4839': attribute type 2 has an invalid length. [ 440.530250][T23319] netlink: 'syz.2.4838': attribute type 1 has an invalid length. [ 440.736936][T23330] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4842'. [ 440.756109][T23326] ip6_vti0 speed is unknown, defaulting to 1000 [ 440.758898][T23330] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4842'. [ 441.067702][T23333] ip6_vti0 speed is unknown, defaulting to 1000 [ 441.201941][T23346] openvswitch: netlink: Multiple metadata blocks provided [ 441.220994][T23346] syzkaller0: entered promiscuous mode [ 441.243228][T23346] syzkaller0: entered allmulticast mode [ 441.471154][T23359] __nla_validate_parse: 1 callbacks suppressed [ 441.471173][T23359] netlink: 144 bytes leftover after parsing attributes in process `syz.4.4854'. [ 441.571923][T23362] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4856'. [ 441.600334][T23361] SET target dimension over the limit! [ 441.684489][T23326] lo speed is unknown, defaulting to 1000 [ 442.315635][T23333] lo speed is unknown, defaulting to 1000 [ 442.362449][T23407] netlink: 'syz.1.4865': attribute type 2 has an invalid length. [ 442.449819][T23407] 9: entered promiscuous mode [ 442.704078][T23420] ip6gre1: entered promiscuous mode [ 442.717879][T23420] ip6gre1: entered allmulticast mode [ 443.041090][T23442] netlink: 'syz.4.4874': attribute type 25 has an invalid length. [ 443.071064][T23442] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4874'. [ 443.110219][T23447] netlink: 'syz.1.4876': attribute type 2 has an invalid length. [ 443.232807][T23446] bond9: (slave bond_slave_1): Device is not our slave [ 443.243907][T23446] bond9: option active_slave: invalid value (bond_slave_1) [ 443.281933][T23446] bond9 (unregistering): Released all slaves [ 443.537872][T23466] netlink: 'syz.1.4882': attribute type 11 has an invalid length. [ 443.586065][T23467] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4881'. [ 444.012623][T23483] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4887'. [ 444.320129][T23502] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 444.517476][T23511] ipt_REJECT: TCP_RESET invalid for non-tcp [ 444.543933][T23511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4894'. [ 444.734664][T23525] tipc: Failed to obtain node identity [ 444.746434][T23525] tipc: Enabling of bearer rejected, failed to enable media [ 444.946250][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 444.954349][ C1] lec:lec_tx_timeout: lec0 [ 444.959006][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 445.001518][T23543] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4904'. [ 445.026757][T23543] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4904'. [ 445.561317][T23573] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4913'. [ 445.807782][T23594] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4918'. [ 445.847983][T23598] netlink: 'syz.2.4921': attribute type 12 has an invalid length. [ 445.881706][ T5993] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.891424][ T5993] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 445.891785][T23600] netlink: 'syz.1.4920': attribute type 1 has an invalid length. [ 445.906971][T23598] netlink: 'syz.2.4921': attribute type 12 has an invalid length. [ 445.920967][ T5993] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 446.038144][T23609] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 446.045811][T23609] batadv_slave_1: entered allmulticast mode [ 446.116085][T23609] tipc: Enabled bearer , priority 0 [ 446.155746][T23617] netlink: 'syz.4.4928': attribute type 1 has an invalid length. [ 446.176510][T23617] netlink: 'syz.4.4928': attribute type 2 has an invalid length. [ 446.265360][T23625] tipc: Enabled bearer , priority 0 [ 446.288574][T23607] tipc: Disabling bearer [ 446.302057][T23625] syzkaller0: entered promiscuous mode [ 446.313016][T23625] syzkaller0: entered allmulticast mode [ 446.330063][T23633] netlink: 'syz.4.4934': attribute type 1 has an invalid length. [ 446.400469][T23633] 8021q: adding VLAN 0 to HW filter on device bond3 [ 446.449401][T23639] macvlan2: entered promiscuous mode [ 446.454727][T23639] macvlan2: entered allmulticast mode [ 446.462369][T23639] bond3: entered promiscuous mode [ 446.475984][T23639] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 446.489367][T23639] bond3: left promiscuous mode [ 446.520349][T23640] tipc: Resetting bearer [ 446.528542][T23645] netlink: 'syz.2.4936': attribute type 1 has an invalid length. [ 446.597107][T23650] bond4: (slave ip6gretap1): making interface the new active one [ 446.605630][T23650] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 446.624233][T23643] netlink: 'syz.2.4936': attribute type 9 has an invalid length. [ 446.634161][T23622] tipc: Resetting bearer [ 446.681934][T23622] tipc: Disabling bearer [ 446.724649][T23654] __nla_validate_parse: 3 callbacks suppressed [ 446.724667][T23654] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4939'. [ 446.748614][T23657] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4940'. [ 446.785232][T23654] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4939'. [ 446.969659][T23674] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 447.042562][T23681] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4947'. [ 447.162338][T23695] IPv6: NLM_F_CREATE should be specified when creating new route [ 447.173403][T23694] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4951'. [ 447.241218][T23700] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4953'. [ 447.380157][T23700] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4953'. [ 447.555006][T23724] netlink: 'syz.0.4958': attribute type 1 has an invalid length. [ 447.586568][T23724] netlink: 'syz.0.4958': attribute type 1 has an invalid length. [ 447.651863][T23724] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4958'. [ 447.741268][T23736] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 447.821479][T23739] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4962'. [ 447.948686][T23748] sctp: [Deprecated]: syz.1.4966 (pid 23748) Use of int in maxseg socket option. [ 447.948686][T23748] Use struct sctp_assoc_value instead [ 448.006998][T23750] vlan3: entered promiscuous mode [ 448.009753][T23757] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4967'. [ 448.012754][T23750] vlan3: entered allmulticast mode [ 448.056298][T23750] hsr_slave_1: entered allmulticast mode [ 448.099089][T23759] veth1_to_hsr: Caught tx_queue_len zero misconfig [ 448.121815][T23752] syzkaller0: entered promiscuous mode [ 448.132009][T23752] syzkaller0: entered allmulticast mode [ 448.253911][T23772] syzkaller1: entered promiscuous mode [ 448.273266][T23772] syzkaller1: entered allmulticast mode [ 448.314000][T23769] syz.3.4973 uses old SIOCAX25GETINFO [ 449.966288][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 449.974319][ C1] lec:lec_tx_timeout: lec0 [ 449.978878][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 451.330594][T23799] validate_nla: 3 callbacks suppressed [ 451.330613][T23799] netlink: 'syz.0.4981': attribute type 1 has an invalid length. [ 451.735859][T23826] x_tables: duplicate entry at hook 1 [ 451.749946][T23826] __nla_validate_parse: 6 callbacks suppressed [ 451.749964][T23826] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4986'. [ 451.851459][T23832] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.4989'. [ 451.961943][T23839] netlink: 'syz.3.4992': attribute type 6 has an invalid length. [ 451.970818][T23839] netlink: 'syz.3.4992': attribute type 6 has an invalid length. [ 452.073314][T23841] netlink: 'syz.2.4993': attribute type 1 has an invalid length. [ 452.387607][T23864] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5000'. [ 452.408363][T23864] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5000'. [ 452.480266][T23870] netlink: 'syz.0.5003': attribute type 29 has an invalid length. [ 452.534355][T23870] vlan2: entered allmulticast mode [ 452.544655][T23870] bridge_slave_0: entered allmulticast mode [ 452.557479][T23874] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5004'. [ 452.591209][T23874] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5004'. [ 452.601625][T23872] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.5005'. [ 452.814351][T23894] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5011'. [ 452.867727][T23903] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5014'. [ 452.877129][T23901] 8021q: VLANs not supported on syzkaller1 [ 453.168791][T23926] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.5020'. [ 453.293287][T23937] netlink: 'syz.2.5020': attribute type 83 has an invalid length. [ 453.652272][T23959] bond5 (unregistering): Released all slaves [ 453.954065][T23987] netlink: 'syz.4.5035': attribute type 2 has an invalid length. [ 453.986328][T23987] netlink: 'syz.4.5035': attribute type 1 has an invalid length. [ 453.995592][T23994] IPVS: set_ctl: invalid protocol: 22 255.255.255.255:20001 [ 454.343614][T24024] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 454.508737][T24033] syzkaller0: entered promiscuous mode [ 454.517614][T24033] syzkaller0: entered allmulticast mode [ 454.552430][T24036] ip6_vti0 speed is unknown, defaulting to 1000 [ 454.573975][T24037] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 454.650987][T24040] block nbd0: Unsupported socket: should be TCP or UNIX. [ 454.704214][T24042] netlink: 'syz.2.5053': attribute type 12 has an invalid length. [ 454.720005][T24042] netlink: 'syz.2.5053': attribute type 11 has an invalid length. [ 454.843723][T24050] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 454.986528][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 454.994565][ C1] lec:lec_tx_timeout: lec0 [ 454.999402][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 455.368206][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 455.375471][ C1] bridge0: topology change detected, propagating [ 455.382223][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 455.389458][ C1] bridge0: topology change detected, propagating [ 455.449923][T24036] lo speed is unknown, defaulting to 1000 [ 455.453580][T24080] syzkaller0: entered promiscuous mode [ 455.464067][T24080] syzkaller0: entered allmulticast mode [ 455.560699][T24090] Unknown options in mask b7f2 [ 455.597181][T24079] delete_channel: no stack [ 456.121436][T24117] openvswitch: netlink: Duplicate key (type 32). [ 456.137694][T24120] openvswitch: netlink: Duplicate key (type 32). [ 456.385205][T24134] mac80211_hwsim hwsim38 syzkaller0: left promiscuous mode [ 456.561156][T24137] bond3: ARP target 1.0.0.0 is already present [ 456.573491][T24137] bond3: option arp_ip_target: invalid value (1) [ 456.596658][T24137] bond3 (unregistering): Released all slaves [ 457.011674][T24154] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 457.030188][T24154] bond3 (unregistering): Released all slaves [ 457.275637][T24175] __nla_validate_parse: 22 callbacks suppressed [ 457.275655][T24175] netlink: 880 bytes leftover after parsing attributes in process `syz.3.5096'. [ 457.292168][T24175] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 457.557668][T24188] xt_l2tp: invalid flags combination: 0 [ 457.598164][T24199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5103'. [ 457.620544][T24199] validate_nla: 2 callbacks suppressed [ 457.620562][T24199] netlink: 'syz.4.5103': attribute type 3 has an invalid length. [ 457.735415][T24202] bridge7: entered promiscuous mode [ 457.741143][T24202] bridge7: entered allmulticast mode [ 457.769159][T24202] team0: Port device bridge7 added [ 457.832760][T24219] bridge0: port 3(team0) entered blocking state [ 457.860119][T24219] bridge0: port 3(team0) entered disabled state [ 457.878857][T24219] team0: entered allmulticast mode [ 457.888037][T24202] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5105'. [ 457.897253][T24219] team_slave_0: entered allmulticast mode [ 457.897315][T24219] team_slave_1: entered allmulticast mode [ 457.899372][T24219] team0: entered promiscuous mode [ 457.918035][T24219] team_slave_0: entered promiscuous mode [ 457.923832][T24219] team_slave_1: entered promiscuous mode [ 457.942566][T24225] bridge0: port 1(ipvlan2) entered blocking state [ 457.955412][T24225] bridge0: port 1(ipvlan2) entered disabled state [ 457.963794][T24225] ipvlan2: entered allmulticast mode [ 457.969990][T24225] bridge0: entered allmulticast mode [ 457.983273][T24225] ipvlan2: left allmulticast mode [ 457.991145][T24225] bridge0: left allmulticast mode [ 458.002299][T24202] hsr_slave_0: left promiscuous mode [ 458.083468][T24234] ip6_vti0 speed is unknown, defaulting to 1000 [ 458.223989][T24245] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5115'. [ 458.356019][T24256] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5119'. [ 458.373956][T24256] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5119'. [ 458.420582][T24259] syzkaller1: entered promiscuous mode [ 458.426091][T24259] syzkaller1: entered allmulticast mode [ 458.527227][T24259] netlink: 'syz.3.5118': attribute type 2 has an invalid length. [ 458.591044][T24240] ip6_vti0 speed is unknown, defaulting to 1000 [ 458.801992][T24234] lo speed is unknown, defaulting to 1000 [ 459.045575][T24240] lo speed is unknown, defaulting to 1000 [ 460.006255][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 460.014298][ C1] lec:lec_tx_timeout: lec0 [ 460.019348][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 465.026268][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 465.034279][ C1] lec:lec_tx_timeout: lec0 [ 479.842212][T14050] lec:lec_start_xmit: lec0:No lecd attached [ 480.829536][T24268] bond9: entered allmulticast mode [ 480.854595][T24281] bridge6: entered promiscuous mode [ 480.860115][T24281] bridge6: entered allmulticast mode [ 480.870009][T24281] bond9: (slave bridge6): Enslaving as an active interface with an up link [ 481.034993][T24298] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5125'. [ 481.149995][T24295] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 481.172203][T24309] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5131'. [ 481.237629][T24314] xt_ipcomp: unknown flags 1D [ 481.302833][T24318] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5135'. [ 481.555324][T24333] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5141'. [ 481.625016][T24333] xt_socket: unknown flags 0x50 [ 481.703958][T24340] netlink: 'syz.4.5142': attribute type 9 has an invalid length. [ 481.737766][T24345] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 481.820548][T24348] veth1_macvtap: left promiscuous mode [ 481.873360][T24354] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5145'. [ 481.933828][T24352] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5145'. [ 481.943544][T24352] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5145'. [ 481.960042][T24358] tipc: New replicast peer: 255.255.255.255 [ 481.975498][T24358] tipc: Enabled bearer , priority 10 [ 481.982138][T24353] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5145'. [ 482.000619][T24353] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5145'. [ 482.106916][T24362] ip6_vti0 speed is unknown, defaulting to 1000 [ 482.232747][T24373] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5155'. [ 483.179985][T24362] lo speed is unknown, defaulting to 1000 [ 483.235304][T24420] macvtap1: entered promiscuous mode [ 483.242090][T24420] vlan0: entered promiscuous mode [ 483.260580][T24420] macvtap1: entered allmulticast mode [ 483.271904][T24420] vlan0: entered allmulticast mode [ 483.284636][T24420] veth0_vlan: entered allmulticast mode [ 483.414600][T24425] syzkaller0: entered promiscuous mode [ 483.420576][T24425] syzkaller0: entered allmulticast mode [ 483.617490][T24441] sctp: [Deprecated]: syz.3.5178 (pid 24441) Use of int in maxseg socket option. [ 483.617490][T24441] Use struct sctp_assoc_value instead [ 483.645049][T24441] SET target dimension over the limit! [ 483.951266][T24460] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 483.989330][T24460] netlink: 'syz.2.5184': attribute type 8 has an invalid length. [ 484.176771][ T5874] IPVS: starting estimator thread 0... [ 484.270501][T24469] IPVS: using max 33 ests per chain, 79200 per kthread [ 484.859352][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 484.867412][ C1] lec:lec_tx_timeout: lec0 [ 485.840751][T24488] tipc: Started in network mode [ 485.845641][T24488] tipc: Node identity 080211000001, cluster identity 4711 [ 485.854771][T24488] tipc: Enabled bearer , priority 0 [ 485.861674][T24490] mac80211_hwsim hwsim38 syzkaller0: entered promiscuous mode [ 485.873237][T24493] bond0: entered promiscuous mode [ 485.879055][T24493] bond_slave_0: entered promiscuous mode [ 485.884888][T24493] bond_slave_1: entered promiscuous mode [ 485.892648][T24493] team0: entered promiscuous mode [ 485.898070][T24493] team_slave_0: entered promiscuous mode [ 485.903923][T24493] team_slave_1: entered promiscuous mode [ 485.913035][T24493] bond0: left promiscuous mode [ 485.917894][T24493] bond_slave_0: left promiscuous mode [ 485.925021][T24493] bond_slave_1: left promiscuous mode [ 485.931866][T24493] team0: left promiscuous mode [ 485.937135][T24493] team_slave_0: left promiscuous mode [ 485.944000][T24493] team_slave_1: left promiscuous mode [ 486.186663][T24517] __nla_validate_parse: 13 callbacks suppressed [ 486.186681][T24517] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5199'. [ 486.362502][T24531] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5203'. [ 486.462544][T24536] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5205'. [ 486.682622][T24551] syzkaller1: entered promiscuous mode [ 486.690225][T24551] syzkaller1: entered allmulticast mode [ 486.943604][T24566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5213'. [ 486.953401][T24566] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 486.995544][ T24] tipc: Node number set to 134418688 [ 487.233075][T24586] bond3: Unable to set peer notification delay as MII monitoring is disabled [ 487.245536][T24586] bond3 (unregistering): Released all slaves [ 487.274586][T24590] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.289521][T24590] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.355516][T24590] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.368950][T24590] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.444119][T24590] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.477125][T24590] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.571455][T24590] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.597027][T24590] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.655910][T24609] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 487.716692][ T36] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.724937][ T36] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.743253][ T36] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.751900][ T36] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.783306][ T5995] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.791965][ T5995] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.820991][ T5995] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 487.836309][ T5995] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.879257][T24618] netlink: 72 bytes leftover after parsing attributes in process `syz.0.5227'. [ 487.947436][T24622] syzkaller0: entered promiscuous mode [ 487.952939][T24622] syzkaller0: entered allmulticast mode [ 488.150620][T24640] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5234'. [ 488.177924][T24640] netlink: 'syz.2.5234': attribute type 1 has an invalid length. [ 488.211326][T24642] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5235'. [ 488.252657][T24640] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5234'. [ 488.298051][T24646] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5236'. [ 488.309434][T24646] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 488.357778][T24646] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 488.387757][T24649] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5237'. [ 488.399788][T24649] netlink: 'syz.2.5237': attribute type 33 has an invalid length. [ 488.428740][T24649] bond5: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 488.441523][T24649] bond5 (unregistering): Released all slaves [ 488.691477][T24661] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.699208][T24661] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.714707][ T7378] lo speed is unknown, defaulting to 1000 [ 488.722218][ T7378] syz0: Port: 1 Link DOWN [ 488.761529][ T2220] lo speed is unknown, defaulting to 1000 [ 489.055396][T24676] netlink: 'syz.4.5247': attribute type 13 has an invalid length. [ 489.299737][T24694] xt_hashlimit: size too large, truncated to 1048576 [ 489.517647][T24705] netlink: 'syz.1.5257': attribute type 1 has an invalid length. [ 489.571668][T24705] 8021q: adding VLAN 0 to HW filter on device bond10 [ 489.623236][T24709] bond10: up delay (35976) is not a multiple of miimon (100), value rounded to 35900 ms [ 489.645830][T24705] bond10: (slave ip6gretap1): Enslaving as an active interface with an up link [ 489.687041][ T36] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 489.742337][T24715] netlink: 'syz.4.5260': attribute type 10 has an invalid length. [ 489.761312][T24715] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.772953][T24715] bridge_slave_1: left allmulticast mode [ 489.779821][T24715] bridge_slave_1: left promiscuous mode [ 489.786751][T24715] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.796299][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 489.811010][T24715] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 489.821026][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 489.851087][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 489.865036][ T36] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 489.978368][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 490.010344][ T5995] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 490.177283][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 490.301836][T24758] ip6gre2: entered allmulticast mode [ 490.692099][T24782] tc_dump_action: action bad kind [ 490.790723][T24789] vlan3: entered allmulticast mode [ 490.796062][T24789] geneve1: entered allmulticast mode [ 490.900239][T24792] smc: adding net device wlan0 with user defined pnetid SYZ0 [ 491.959531][ T5995] net_ratelimit: 38 callbacks suppressed [ 491.959551][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 491.999466][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.027225][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.028700][T24871] __nla_validate_parse: 23 callbacks suppressed [ 492.028716][T24871] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5315'. [ 492.057068][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.076835][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.084676][ T5992] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 492.209167][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.237174][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.256732][T24885] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5320'. [ 492.256902][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.271803][T24887] netlink: 'syz.2.5321': attribute type 21 has an invalid length. [ 492.289382][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 492.296907][T24887] IPv6: NLM_F_CREATE should be specified when creating new route [ 494.026755][T24910] tap0: tun_chr_ioctl cmd 1074025678 [ 494.032263][T24910] tap0: group set to 0 [ 494.248875][T24940] erspan0: entered promiscuous mode [ 494.279568][T24940] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5341'. [ 494.487205][T24966] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5349'. [ 494.582183][T24973] xt_CT: You must specify a L4 protocol and not use inversions on it [ 495.084885][T25016] netlink: 'syz.1.5362': attribute type 15 has an invalid length. [ 495.121065][T25021] Unknown options in mask b7f2 [ 495.293880][T25029] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5365'. [ 495.327702][T25014] syzkaller0: entered promiscuous mode [ 495.333689][T25014] syzkaller0: entered allmulticast mode [ 495.494368][T25044] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5368'. [ 495.496834][T25045] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5365'. [ 496.955606][T25056] netlink: 'syz.0.5370': attribute type 10 has an invalid length. [ 496.965109][T25056] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5370'. [ 496.985711][T25059] netlink: 260 bytes leftover after parsing attributes in process `syz.2.5371'. [ 497.003720][T25059] netlink: 260 bytes leftover after parsing attributes in process `syz.2.5371'. [ 497.017439][ T13] net_ratelimit: 183 callbacks suppressed [ 497.017456][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 497.052163][ T13] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 497.137469][T25076] xt_bpf: check failed: parse error [ 497.176783][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 497.207177][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 497.228340][ T36] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 497.376302][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 497.418640][T25094] bond11 (unregistering): Released all slaves [ 497.442892][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 497.464778][T25111] netlink: 'syz.1.5377': attribute type 39 has an invalid length. [ 497.473229][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 497.473257][ T36] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 497.549279][T25104] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5382'. [ 497.576747][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 497.708497][T25125] ipt_rpfilter: unknown options [ 497.715938][T25125] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5386'. [ 497.727537][T25124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5385'. [ 497.768270][T25124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5385'. [ 497.787204][T25124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5385'. [ 497.909233][T25131] syzkaller1: entered promiscuous mode [ 497.914754][T25131] syzkaller1: entered allmulticast mode [ 498.236133][T25155] veth5: entered allmulticast mode [ 498.457895][T25183] netlink: 'syz.0.5403': attribute type 1 has an invalid length. [ 498.523019][T25183] 8021q: adding VLAN 0 to HW filter on device bond6 [ 498.532248][T25183] bond5: (slave bond6): making interface the new active one [ 498.541079][T25183] bond5: (slave bond6): Enslaving as an active interface with an up link [ 498.575254][T25190] netlink: 'syz.1.5405': attribute type 62 has an invalid length. [ 498.588204][T25183] bond5: (slave gretap1): Enslaving as a backup interface with an up link [ 498.601470][T25183] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5403'. [ 498.636695][T25183] 8021q: adding VLAN 0 to HW filter on device bond5 [ 499.160109][T25200] bond4: Removing last arp target with arp_interval on [ 499.205238][T25209] bond11: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 499.222742][T25209] bond11 (unregistering): Released all slaves [ 499.239985][T25217] netlink: 'syz.3.5414': attribute type 1 has an invalid length. [ 499.264632][T25212] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5413'. [ 499.274560][T25217] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5414'. [ 499.497036][T25230] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5418'. [ 499.521736][T25234] wg1: entered promiscuous mode [ 499.527704][T25234] wg1: entered allmulticast mode [ 499.566114][T25230] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5418'. [ 499.665749][T25240] batman_adv: batadv0: Adding interface: dummy0 [ 499.680572][T25240] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.711566][T25240] batman_adv: batadv0: Interface activated: dummy0 [ 499.902608][T25253] bridge3: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 500.043203][T25263] IPVS: Error connecting to the multicast addr [ 500.472671][T25292] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 500.581077][T25299] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 500.676846][T25302] gtp0: entered promiscuous mode [ 500.681951][T25302] gtp0: entered allmulticast mode [ 500.712855][T25309] netlink: 'syz.2.5447': attribute type 13 has an invalid length. [ 500.749638][T25309] gretap0: refused to change device tx_queue_len [ 500.840520][T25316] veth0_virt_wifi: entered promiscuous mode [ 500.992251][T25321] veth7: entered allmulticast mode [ 501.453411][ T1294] lec:lec_start_xmit: lec0:No lecd attached [ 501.588400][ T29] audit: type=1107 audit(1771353623.941:7): pid=25351 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=' [ 501.588400][ T29] spFx|E:s,e3|io%5[TZ1?Evy)}] 򏁱NAGҚ j^ڒOcsE' [ 501.618409][T25356] 0: renamed from hsr_slave_1 [ 501.638771][T25356] 0: entered allmulticast mode [ 501.644519][T25355] 1: renamed from c0 (while UP) [ 501.913616][T25384] : renamed from bond0 [ 502.015299][T25386] ip6_vti0 speed is unknown, defaulting to 1000 [ 502.130597][ T5995] net_ratelimit: 117 callbacks suppressed [ 502.130617][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 502.147342][ T5995] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 502.257446][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 502.267765][ T35] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 502.376815][T25411] netlink: 'syz.4.5481': attribute type 10 has an invalid length. [ 502.378109][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 502.393502][ T5995] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 502.428448][T25411] veth0_macvtap: left promiscuous mode [ 502.488459][T25411] 0: reclassify loop, rule prio 0, protocol 700 [ 502.495421][T25411] netlink: 'syz.4.5481': attribute type 1 has an invalid length. [ 502.536909][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 502.556882][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 502.565101][ T5992] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 502.675302][T25421] syzkaller0: entered promiscuous mode [ 502.695050][T25421] syzkaller0: entered allmulticast mode [ 502.715342][T25420] tipc: Started in network mode [ 502.724887][T25420] tipc: Node identity 7af69f6dcae2, cluster identity 4711 [ 502.752115][T25420] tipc: Enabled bearer , priority 0 [ 502.782841][T25421] tipc: Enabling of bearer rejected, already enabled [ 502.794678][T25427] delete_channel: no stack [ 502.827436][T25419] tipc: Resetting bearer [ 502.874531][T25419] tipc: Disabling bearer [ 502.878727][T25429] __nla_validate_parse: 18 callbacks suppressed [ 502.878743][T25429] netlink: 144 bytes leftover after parsing attributes in process `syz.1.5489'. [ 502.908004][T25386] lo speed is unknown, defaulting to 1000 [ 503.005769][T25435] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5491'. [ 503.022779][T25435] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5491'. [ 503.204391][T25444] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5496'. [ 503.411330][T25455] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5500'. [ 503.480715][T25457] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5501'. [ 503.558883][T25460] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5502'. [ 503.710476][T25474] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5506'. [ 503.740590][T25460] 8021q: adding VLAN 0 to HW filter on device bond5 [ 503.756285][T25469] batman_adv: batadv0: Interface deactivated: dummy0 [ 503.788031][T25469] batman_adv: batadv0: Removing interface: dummy0 [ 503.841889][T25469] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 503.920814][T25473] bond5 (unregistering): (slave dummy0): Releasing backup interface [ 503.942372][T25478] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5506'. [ 503.953322][T25473] bond5 (unregistering): Released all slaves [ 503.961139][T25479] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5506'. [ 504.243884][T25494] netlink: 'syz.1.5513': attribute type 28 has an invalid length. [ 504.252908][T25494] netlink: 'syz.1.5513': attribute type 3 has an invalid length. [ 504.324268][T25499] netlink: 'syz.0.5514': attribute type 1 has an invalid length. [ 504.332762][T25499] netlink: 'syz.0.5514': attribute type 1 has an invalid length. [ 504.899449][T25537] netlink: 'syz.1.5525': attribute type 1 has an invalid length. [ 504.937208][T25537] 8021q: adding VLAN 0 to HW filter on device bond0 [ 505.218844][T25556] xt_TCPMSS: Only works on TCP SYN packets [ 505.694294][T25590] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 505.732840][T25600] netlink: 'syz.0.5542': attribute type 5 has an invalid length. [ 505.733976][T25590] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 505.790442][T25590] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 505.807541][T25590] batman_adv: batadv0: Interface deactivated: netdevsim0 [ 505.814600][T25590] batman_adv: batadv0: Removing interface: netdevsim0 [ 505.861590][T25608] netlink: 'syz.1.5546': attribute type 1 has an invalid length. [ 505.881481][T25600] netlink: 'syz.0.5542': attribute type 11 has an invalid length. [ 505.890863][T25608] netlink: 'syz.1.5546': attribute type 10 has an invalid length. [ 505.903991][T25600] netlink: 'syz.0.5542': attribute type 11 has an invalid length. [ 506.078669][T25616] netlink: 'syz.3.5549': attribute type 29 has an invalid length. [ 506.531619][T25639] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 506.535590][T25648] netlink: 'syz.4.5557': attribute type 4 has an invalid length. [ 506.560336][T25648] netlink: 'syz.4.5557': attribute type 1 has an invalid length. [ 506.600205][T25639] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 506.794176][T25639] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 506.806463][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5350 ms [ 506.814471][ C1] lec:lec_tx_timeout: lec0 [ 506.833501][T25639] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 506.880518][T25672] netlink: 'syz.0.5562': attribute type 1 has an invalid length. [ 506.942147][T25639] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 506.980135][T25639] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.236780][ T5995] net_ratelimit: 122 callbacks suppressed [ 507.236799][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.276066][ T5995] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.292742][ T5995] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 507.309451][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.348920][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.375334][ T5995] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.377340][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.393326][ T5995] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 507.407339][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.425528][ T5995] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.434981][ T5995] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 507.437488][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.470501][ T5995] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.481199][ T5995] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 507.497463][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.523752][ T35] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 507.668004][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 507.679140][ T13] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 507.914655][T25720] netlink: 'syz.4.5574': attribute type 1 has an invalid length. [ 507.934855][T25720] __nla_validate_parse: 20 callbacks suppressed [ 507.934871][T25720] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5574'. [ 508.021106][T25728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5577'. [ 508.057704][T25731] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5578'. [ 508.070798][T25728] vlan1: entered allmulticast mode [ 508.077083][T25728] mac80211_hwsim hwsim37 wlan0: entered allmulticast mode [ 508.179971][T25737] netlink: 'syz.2.5580': attribute type 8 has an invalid length. [ 508.313020][T25743] bond5: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 508.357169][T25743] bond5 (unregistering): Released all slaves [ 508.596072][T25755] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.5586'. [ 508.635664][T25753] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.5586'. [ 508.801097][T25774] x_tables: duplicate underflow at hook 3 [ 508.888722][T25780] netlink: 84 bytes leftover after parsing attributes in process `syz.2.5596'. [ 508.966099][T25788] bpq0: left promiscuous mode [ 509.068563][T25788] syzkaller0: entered promiscuous mode [ 509.079079][T25788] syzkaller0: entered allmulticast mode [ 509.344991][T25809] netlink: 212328 bytes leftover after parsing attributes in process `syz.0.5605'. [ 509.355345][T25808] netlink: 'syz.4.5604': attribute type 10 has an invalid length. [ 509.363124][T25809] netlink: 212328 bytes leftover after parsing attributes in process `syz.0.5605'. [ 509.379171][T25808] dummy0: entered promiscuous mode [ 509.384532][T25808] dummy0: entered allmulticast mode [ 509.392867][T25808] team0: Port device dummy0 added [ 509.451709][T25816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5607'. [ 509.478899][T25816] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5607'. [ 510.066828][ T5827] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 510.079175][ T5827] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 510.094680][T25837] FAULT_INJECTION: forcing a failure. [ 510.094680][T25837] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 510.111281][ T5827] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 510.121915][ T5827] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 510.134529][ T5827] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 510.143939][T25837] CPU: 0 UID: 0 PID: 25837 Comm: syz.4.5614 Not tainted syzkaller #0 PREEMPT(full) [ 510.143963][T25837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 510.143975][T25837] Call Trace: [ 510.143982][T25837] [ 510.143989][T25837] dump_stack_lvl+0xe8/0x150 [ 510.144016][T25837] should_fail_ex+0x412/0x560 [ 510.144043][T25837] _copy_to_user+0x31/0xb0 [ 510.144065][T25837] simple_read_from_buffer+0xe1/0x170 [ 510.144093][T25837] proc_fail_nth_read+0x1bb/0x230 [ 510.144118][T25837] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 510.144142][T25837] ? rw_verify_area+0x2a6/0x4d0 [ 510.144161][T25837] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 510.144182][T25837] vfs_read+0x20c/0xa70 [ 510.144199][T25837] ? fdget_pos+0x246/0x320 [ 510.144221][T25837] ? __pfx___mutex_lock+0x10/0x10 [ 510.144244][T25837] ? __pfx_vfs_read+0x10/0x10 [ 510.144264][T25837] ? __fget_files+0x2a/0x420 [ 510.144285][T25837] ? __fget_files+0x3a0/0x420 [ 510.144300][T25837] ? __fget_files+0x2a/0x420 [ 510.144326][T25837] ksys_read+0x150/0x270 [ 510.144347][T25837] ? __pfx_ksys_read+0x10/0x10 [ 510.144377][T25837] do_syscall_64+0x14d/0xf80 [ 510.144397][T25837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.144413][T25837] ? trace_irq_disable+0x37/0x100 [ 510.144431][T25837] ? clear_bhb_loop+0x40/0x90 [ 510.144451][T25837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.144468][T25837] RIP: 0033:0x7febe875cece [ 510.144483][T25837] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 510.144496][T25837] RSP: 002b:00007febe69f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 510.144513][T25837] RAX: ffffffffffffffda RBX: 00007febe69f66c0 RCX: 00007febe875cece [ 510.144526][T25837] RDX: 000000000000000f RSI: 00007febe69f60a0 RDI: 0000000000000004 [ 510.144536][T25837] RBP: 00007febe69f6090 R08: 0000000000000000 R09: 0000000000000000 [ 510.144546][T25837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.144555][T25837] R13: 00007febe8a16038 R14: 00007febe8a15fa0 R15: 00007ffc5ff230e8 [ 510.144586][T25837] [ 510.480859][ T5830] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 510.522427][ T5830] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 510.532177][ T5830] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 510.580572][ T5830] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 510.590623][ T5830] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 510.703246][T25864] bond3: entered promiscuous mode [ 510.743090][T25864] bridge8: entered promiscuous mode [ 510.751232][T25864] bond3: (slave bridge8): Enslaving as a backup interface with an up link [ 510.849818][T25838] ip6_vti0 speed is unknown, defaulting to 1000 [ 511.020844][T25886] validate_nla: 3 callbacks suppressed [ 511.020863][T25886] netlink: 'syz.2.5627': attribute type 2 has an invalid length. [ 511.120963][T25893] netlink: 'syz.4.5629': attribute type 3 has an invalid length. [ 511.345942][T25904] syzkaller0: entered allmulticast mode [ 511.476745][T25910] sctp: [Deprecated]: syz.2.5635 (pid 25910) Use of struct sctp_assoc_value in delayed_ack socket option. [ 511.476745][T25910] Use struct sctp_sack_info instead [ 511.619181][T25838] lo speed is unknown, defaulting to 1000 [ 511.985301][T25926] syzkaller0: entered promiscuous mode [ 512.006272][T25926] syzkaller0: entered allmulticast mode [ 512.108930][T25925] gre0: entered promiscuous mode [ 512.113915][T25925] gre0: entered allmulticast mode [ 512.258262][ T5993] net_ratelimit: 106 callbacks suppressed [ 512.258281][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.287005][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.318997][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.359477][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.386813][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.400607][ T5992] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 512.552326][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.600796][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.646918][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 512.654836][ T5830] Bluetooth: hci3: command tx timeout [ 512.685483][T25838] chnl_net:caif_netlink_parms(): no params data found [ 512.700033][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 513.053744][T25838] bridge0: port 1(bridge_slave_0) entered blocking state [ 513.087198][T25838] bridge0: port 1(bridge_slave_0) entered disabled state [ 513.094479][T25838] bridge_slave_0: entered allmulticast mode [ 513.131773][T25980] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 513.145387][T25838] bridge_slave_0: entered promiscuous mode [ 513.156045][T25985] __nla_validate_parse: 23 callbacks suppressed [ 513.156062][T25985] netlink: 596 bytes leftover after parsing attributes in process `syz.3.5655'. [ 513.159868][T25838] bridge0: port 2(bridge_slave_1) entered blocking state [ 513.181137][T25838] bridge0: port 2(bridge_slave_1) entered disabled state [ 513.191657][T25838] bridge_slave_1: entered allmulticast mode [ 513.200056][T25838] bridge_slave_1: entered promiscuous mode [ 513.237964][T25838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 513.250947][T25838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 513.330395][T25838] team0: Port device team_slave_0 added [ 513.369602][T25838] team0: Port device team_slave_1 added [ 513.480961][T25838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 513.517167][T25838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 513.586691][T25838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 513.653166][T25838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 513.676937][T25838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 513.743349][T25838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 513.882793][T26034] vcan0: tx address claim with dlc 0 [ 513.951958][T25838] hsr_slave_0: entered promiscuous mode [ 513.965463][T25838] hsr_slave_1: entered promiscuous mode [ 513.973557][T25838] debugfs: 'hsr0' already exists in 'hsr' [ 514.003814][T25838] Cannot create hsr debugfs directory [ 514.035532][T26040] netlink: 'syz.4.5667': attribute type 20 has an invalid length. [ 514.047093][T26040] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5667'. [ 514.104673][T26040] netlink: 'syz.4.5667': attribute type 20 has an invalid length. [ 514.144157][T26040] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5667'. [ 514.154102][ T5995] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.178101][ T5995] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.213182][ T5995] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.231615][ T5995] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.715144][T25838] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.729372][ T5830] Bluetooth: hci3: command tx timeout [ 514.808521][T26088] bridge0: port 4(batadv1) entered blocking state [ 514.829819][T26082] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 514.836473][T26088] bridge0: port 4(batadv1) entered disabled state [ 514.856074][T26082] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 514.856417][T26088] batadv1: entered allmulticast mode [ 514.883470][T26088] batadv1: entered promiscuous mode [ 514.899266][T25838] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.975520][T25838] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.082081][T25838] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.284688][T26109] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 515.299719][ T36] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 515.310172][ T36] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 515.313201][T26109] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.370892][T25838] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 515.394127][T26109] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 515.405725][T26109] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.424708][T25838] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 515.441445][T25838] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 515.467363][T25838] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 515.481742][T26109] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 515.493200][T26109] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.552484][T26109] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 515.568584][T26109] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.741209][ T13] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.780540][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.790676][T26138] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5687'. [ 515.853625][ T13] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.870593][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.890033][ T13] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.929542][ T13] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.961373][ T13] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 515.971990][ T13] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.018653][T26150] tipc: Enabled bearer , priority 0 [ 516.027523][T26149] tipc: Enabling of bearer rejected, already enabled [ 516.038775][T26154] netlink: 'syz.2.5691': attribute type 11 has an invalid length. [ 516.050434][T25838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 516.059371][T26154] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5691'. [ 516.142461][T26148] syzkaller0: entered promiscuous mode [ 516.148985][T26148] syzkaller0: entered allmulticast mode [ 516.155677][T26148] tipc: Resetting bearer [ 516.235439][ T13] tipc: Resetting bearer [ 516.316023][T26158] syzkaller0: entered promiscuous mode [ 516.322788][T26158] syzkaller0: entered allmulticast mode [ 516.341658][T26148] tipc: Resetting bearer [ 516.463293][T26176] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5693'. [ 516.741685][T26184] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5696'. [ 516.818854][ T5827] Bluetooth: hci3: command tx timeout [ 517.268156][ T35] net_ratelimit: 176 callbacks suppressed [ 517.268175][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.298240][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.316873][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.339816][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.366797][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.388062][ T35] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.427920][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.466859][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.496750][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.519607][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 517.867569][T26148] tipc: Disabling bearer [ 518.887179][ T5827] Bluetooth: hci3: command 0x0419 tx timeout [ 519.318934][T26184] bridge_slave_1: left allmulticast mode [ 519.324633][T26184] bridge_slave_1: left promiscuous mode [ 519.330824][T26184] bridge0: port 2(bridge_slave_1) entered disabled state [ 519.340124][T26184] bridge_slave_0: left allmulticast mode [ 519.345757][T26184] bridge_slave_0: left promiscuous mode [ 519.351888][T26184] bridge0: port 1(bridge_slave_0) entered disabled state [ 519.451555][T25838] 8021q: adding VLAN 0 to HW filter on device team0 [ 519.501528][ T5980] bridge0: port 1(bridge_slave_0) entered blocking state [ 519.508705][ T5980] bridge0: port 1(bridge_slave_0) entered forwarding state [ 519.534245][ T5980] bridge0: port 2(bridge_slave_1) entered blocking state [ 519.541417][ T5980] bridge0: port 2(bridge_slave_1) entered forwarding state [ 519.601505][T26213] netlink: 'syz.2.5702': attribute type 11 has an invalid length. [ 519.611856][T26213] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5702'. [ 519.671632][T26216] tipc: Enabled bearer , priority 0 [ 519.688518][T26216] +: renamed from syzkaller0 [ 519.701822][T26216] tipc: Disabling bearer [ 519.713890][T26219] netlink: 240 bytes leftover after parsing attributes in process `syz.3.5703'. [ 519.931441][T26235] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5706'. [ 520.000808][T26239] netlink: 16215 bytes leftover after parsing attributes in process `syz.2.5708'. [ 520.015043][T26239] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5708'. [ 520.038959][T26239] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5708'. [ 520.150876][T26243] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5709'. [ 520.186961][T26243] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5709'. [ 520.198406][T25838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 520.320156][T25838] veth0_vlan: entered promiscuous mode [ 520.367592][T25838] veth1_vlan: entered promiscuous mode [ 520.431897][T25838] veth0_macvtap: entered promiscuous mode [ 520.451860][T25838] veth1_macvtap: entered promiscuous mode [ 520.470811][T26265] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5716'. [ 520.472841][T25838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 520.499488][T25838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 520.531515][ T5993] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.541246][ T5993] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.579374][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.602827][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.678541][T26284] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5721'. [ 520.967098][ T5830] Bluetooth: hci3: command 0x0419 tx timeout [ 520.980397][ T5995] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 520.992496][ T5995] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.084475][ T5995] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.095644][ T5995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.189982][T26311] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 521.227490][T26311] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 521.318439][T26320] netlink: 'syz.2.5729': attribute type 83 has an invalid length. [ 521.377536][T26323] netlink: 'syz.1.5730': attribute type 13 has an invalid length. [ 521.434496][T26322] netlink: 'syz.1.5730': attribute type 16 has an invalid length. [ 521.451345][T26322] netlink: 'syz.1.5730': attribute type 17 has an invalid length. [ 521.845036][T26344] netlink: 'syz.4.5736': attribute type 6 has an invalid length. [ 521.885224][T26344] netlink: 'syz.4.5736': attribute type 5 has an invalid length. [ 522.022525][T26351] netlink: 'syz.3.5737': attribute type 1 has an invalid length. [ 522.318515][ T5993] net_ratelimit: 156 callbacks suppressed [ 522.318534][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 522.345132][ T5993] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 522.466916][T26296] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 522.493180][T26296] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 522.626970][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 522.634976][ T5993] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 522.770745][T26394] xt_socket: unknown flags 0x50 [ 522.787028][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 522.817061][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 522.847380][ T5992] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 522.977384][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 523.227821][T26429] bond1: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 523.241437][T26429] bond1 (unregistering): Released all slaves [ 523.835823][T26469] netlink: 'syz.4.5765': attribute type 10 has an invalid length. [ 523.851621][ T5992] wlan1: Trigger new scan to find an IBSS to join [ 523.900323][T26469] dummy0: left allmulticast mode [ 523.925472][T26469] team0: Port device dummy0 removed [ 523.948233][T26469] bridge0: port 2(dummy0) entered blocking state [ 523.964990][T26469] bridge0: port 2(dummy0) entered disabled state [ 523.985925][T26469] dummy0: entered allmulticast mode [ 524.212025][T26487] netlink: 'syz.4.5774': attribute type 29 has an invalid length. [ 524.640868][T26515] __nla_validate_parse: 21 callbacks suppressed [ 524.640880][T26515] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5785'. [ 524.699973][T26525] dummy0: left allmulticast mode [ 524.710621][T26520] netlink: 124 bytes leftover after parsing attributes in process `syz.3.5786'. [ 524.724183][T26525] dummy0: left promiscuous mode [ 524.736217][T26525] bridge0: port 2(dummy0) entered disabled state [ 524.774042][T26528] syzkaller1: entered promiscuous mode [ 524.780279][T26528] syzkaller1: entered allmulticast mode [ 524.799900][T26528] validate_nla: 1 callbacks suppressed [ 524.799916][T26528] netlink: 'syz.1.5787': attribute type 1 has an invalid length. [ 525.163902][T26545] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5794'. [ 525.272966][T26547] netlink: 'syz.4.5795': attribute type 29 has an invalid length. [ 525.281836][T26547] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5795'. [ 525.505328][T26562] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5799'. [ 525.661492][T26567] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5802'. [ 525.922597][T26585] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5810'. [ 525.926573][T26580] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5806'. [ 525.982975][T26592] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5806'. [ 526.021391][T26591] bond1: (slave bond_slave_1): Device is not our slave [ 526.033438][T26591] bond1: option active_slave: invalid value (bond_slave_1) [ 526.051739][T26591] bond1 (unregistering): Released all slaves [ 526.077762][T26599] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5812'. [ 526.442040][T26626] netlink: 'syz.2.5819': attribute type 5 has an invalid length. [ 526.598793][T26637] netlink: 'syz.0.5823': attribute type 11 has an invalid length. [ 526.612727][T26637] netlink: 'syz.0.5823': attribute type 4 has an invalid length. [ 526.621379][T26637] netlink: 'syz.0.5823': attribute type 5 has an invalid length. [ 526.624224][T26639] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 526.631702][T26637] netlink: 'syz.0.5823': attribute type 6 has an invalid length. [ 526.678185][T26644] Cannot find set identified by id 0 to match [ 526.712112][T26639] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 526.817217][ T13] wlan1: Trigger new scan to find an IBSS to join [ 526.861167][T26652] bond7: option xmit_hash_policy: invalid value (64) [ 526.882599][T26652] bond7 (unregistering): Released all slaves [ 526.935696][T26658] vlan2: entered allmulticast mode [ 526.954149][T26658] mac80211_hwsim hwsim66 wlan0: entered allmulticast mode [ 527.169244][T26681] netlink: 'syz.3.5837': attribute type 1 has an invalid length. [ 527.317872][T26674] syzkaller0: entered promiscuous mode [ 527.323382][T26674] syzkaller0: entered allmulticast mode [ 527.343685][T26687] bond4: (slave vxcan1): The slave device specified does not support setting the MAC address [ 527.355109][ T3514] net_ratelimit: 100 callbacks suppressed [ 527.355127][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.370394][T26687] bond4: (slave vxcan1): Setting fail_over_mac to active for active-backup mode [ 527.388196][T26687] bond4: (slave vxcan1): making interface the new active one [ 527.407991][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.420292][T26687] bond4: (slave vxcan1): Enslaving as an active interface with an up link [ 527.429463][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.447991][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.457533][ T3514] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 527.598859][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.642698][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.696961][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.747081][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 527.767352][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 528.135988][T26725] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20002 [ 529.657208][T26761] 8021q: adding VLAN 0 to HW filter on device bond5 [ 529.687942][T26762] __nla_validate_parse: 13 callbacks suppressed [ 529.687962][T26762] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5853'. [ 529.693532][T26769] syzkaller1: entered promiscuous mode [ 529.710555][T26769] syzkaller1: entered allmulticast mode [ 529.848424][ T3514] wlan1: Trigger new scan to find an IBSS to join [ 530.670570][T26802] xt_CONNSECMARK: invalid mode: 0 [ 530.850006][ T3514] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 531.205754][T26844] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5877'. [ 531.502510][T26854] tipc: Enabling of bearer rejected, failed to enable media [ 531.684920][T26867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5886'. [ 531.913371][T26877] netlink: 'syz.3.5891': attribute type 2 has an invalid length. [ 531.953524][T26877] 9: entered promiscuous mode [ 532.024805][ T5827] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 532.035547][ T5827] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 532.050233][ T5827] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 532.079328][ T5827] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 532.101544][ T5827] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 532.179302][T26882] ip6_vti0 speed is unknown, defaulting to 1000 [ 532.249136][ T13] batman_adv: batadv1: IGMP Querier appeared [ 532.255223][ T13] batman_adv: batadv1: MLD Querier appeared [ 532.367623][ T36] net_ratelimit: 159 callbacks suppressed [ 532.367645][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.398354][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.429406][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.456842][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.476614][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.507531][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.535151][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.578085][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.618012][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.647070][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 532.770138][ T3514] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.796751][ T3514] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.971075][ T3514] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.987144][ T3514] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.019952][T26882] lo speed is unknown, defaulting to 1000 [ 533.120056][ T3514] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.132071][ T3514] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.233768][ T3514] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.257006][ T3514] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.288805][T26915] sctp: [Deprecated]: syz.1.5903 (pid 26915) Use of int in max_burst socket option deprecated. [ 533.288805][T26915] Use struct sctp_assoc_value instead [ 533.908037][T26942] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5909'. [ 534.012084][T26954] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5909'. [ 534.173655][ T5830] Bluetooth: hci2: command tx timeout [ 534.490514][ T3514] bond5 (unregistering): (slave gretap1): Releasing backup interface [ 534.801253][ T3514] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 534.812432][ T3514] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 534.823140][ T3514] bond0 (unregistering): Released all slaves [ 534.833487][ T3514] bond1 (unregistering): Released all slaves [ 534.846360][ T3514] bond2 (unregistering): Released all slaves [ 534.859399][ T3514] bond3 (unregistering): left allmulticast mode [ 534.865652][ T3514] bond3 (unregistering): left promiscuous mode [ 534.880218][ T3514] team0: Port device macvlan2 removed [ 534.893190][ T3514] bond3 (unregistering): Released all slaves [ 534.906433][ T3514] bond4 (unregistering): (slave veth7): Releasing active interface [ 534.915980][ T3514] bond4 (unregistering): Released all slaves [ 534.931117][ T3514] bond5 (unregistering): (slave bond6): Releasing backup interface [ 534.939915][ T3514] bond5 (unregistering): Released all slaves [ 534.955819][ T3514] bond6 (unregistering): Released all slaves [ 535.080488][T26882] chnl_net:caif_netlink_parms(): no params data found [ 535.266715][ T3514] tipc: Left network mode [ 535.300732][T26882] bridge0: port 1(bridge_slave_0) entered blocking state [ 535.317970][T26882] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.325453][T26882] bridge_slave_0: entered allmulticast mode [ 535.333896][T26882] bridge_slave_0: entered promiscuous mode [ 535.400084][T26882] bridge0: port 2(bridge_slave_1) entered blocking state [ 535.428391][T26882] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.448324][T26882] bridge_slave_1: entered allmulticast mode [ 535.461380][T26882] bridge_slave_1: entered promiscuous mode [ 535.581047][T26882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 535.859767][T26882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 535.960784][T26882] team0: Port device team_slave_0 added [ 536.033209][T27034] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5920'. [ 536.044975][T26882] team0: Port device team_slave_1 added [ 536.092662][T27034] 8021q: VLANs not supported on gre0 [ 536.118073][T27029] netlink: 'syz.3.5922': attribute type 1 has an invalid length. [ 536.137432][T27029] netlink: 96 bytes leftover after parsing attributes in process `syz.3.5922'. [ 536.162231][T27029] netlink: 1 bytes leftover after parsing attributes in process `syz.3.5922'. [ 536.208636][T27029] netlink: 'syz.3.5922': attribute type 1 has an invalid length. [ 536.213705][T26882] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 536.217474][T27029] netlink: 'syz.3.5922': attribute type 8 has an invalid length. [ 536.243949][T26882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 536.262778][T27029] netlink: 606 bytes leftover after parsing attributes in process `syz.3.5922'. [ 536.281179][ T5830] Bluetooth: hci2: command tx timeout [ 536.384801][T26882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 536.420098][T26882] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 536.435541][T26882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 536.526722][T26882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 536.665301][T27058] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5927'. [ 536.708577][T27062] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5928'. [ 536.729475][T27061] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5928'. [ 536.813543][T26882] hsr_slave_0: entered promiscuous mode [ 536.850531][T26882] hsr_slave_1: entered promiscuous mode [ 536.867797][T26882] debugfs: 'hsr0' already exists in 'hsr' [ 536.873550][T26882] Cannot create hsr debugfs directory [ 537.402265][ T5992] net_ratelimit: 181 callbacks suppressed [ 537.402285][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.450473][ T5992] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.487188][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.520169][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.538015][ T3514] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 537.546000][ T3514] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 537.567420][ T36] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.587882][ T3514] veth1_macvtap: left promiscuous mode [ 537.594301][ T3514] veth0_macvtap: left promiscuous mode [ 537.600387][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.617090][ T3514] veth1_vlan: left promiscuous mode [ 537.622515][ T3514] veth0_vlan: left promiscuous mode [ 537.628292][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.666857][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.687347][T26296] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 537.716854][T26296] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 538.190758][T27123] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 538.223881][T27123] bond1: (slave lo): Enslaving as an active interface with an up link [ 538.327878][ T5830] Bluetooth: hci2: command tx timeout [ 538.441319][T27135] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 538.603661][T27151] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.5946'. [ 538.853486][ T3514] IPVS: stop unused estimator thread 0... [ 538.952496][T27172] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5951'. [ 538.984404][T27172] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5951'. [ 539.454546][T27199] ip6_vti0 speed is unknown, defaulting to 1000 [ 539.462146][T26882] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 539.502634][T26882] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 539.570438][T26882] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 539.711131][T27210] netlink: 'syz.3.5960': attribute type 2 has an invalid length. [ 539.751287][T26882] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 540.051188][T27199] lo speed is unknown, defaulting to 1000 [ 540.352414][T26882] 8021q: adding VLAN 0 to HW filter on device bond0 [ 540.406824][ T5830] Bluetooth: hci2: command tx timeout [ 540.480531][T26882] 8021q: adding VLAN 0 to HW filter on device team0 [ 540.509912][ T5993] bridge0: port 1(bridge_slave_0) entered blocking state [ 540.517086][ T5993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 540.572328][ T5993] bridge0: port 2(bridge_slave_1) entered blocking state [ 540.579519][ T5993] bridge0: port 2(bridge_slave_1) entered forwarding state [ 540.889590][T27269] bridge_slave_0 (unregistering): left promiscuous mode [ 540.917825][T27269] bridge0: port 1(bridge_slave_0) entered disabled state [ 541.048060][T27278] netlink: 'syz.1.5974': attribute type 1 has an invalid length. [ 541.347774][T27280] vlan0 (unregistering): left allmulticast mode [ 541.354254][T27280] veth0_vlan (unregistering): left allmulticast mode [ 541.363132][T27280] vlan0 (unregistering): left promiscuous mode [ 541.895990][T26882] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 542.010133][T26882] veth0_vlan: entered promiscuous mode [ 542.043902][T27309] __nla_validate_parse: 2 callbacks suppressed [ 542.043920][T27309] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5979'. [ 542.063061][T26882] veth1_vlan: entered promiscuous mode [ 542.147216][T27312] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5980'. [ 542.205133][T27312] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5980'. [ 542.217040][T26882] veth0_macvtap: entered promiscuous mode [ 542.240388][T26882] veth1_macvtap: entered promiscuous mode [ 542.315798][T26882] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 542.373397][T26882] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 542.443440][ T5993] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.457088][T26295] net_ratelimit: 169 callbacks suppressed [ 542.457106][T26295] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.488650][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 542.540792][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.568809][ T5992] bridge_slave_0: left allmulticast mode [ 542.575086][ T5992] bridge_slave_0: left promiscuous mode [ 542.583612][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.604110][ T5992] bridge0: port 1(bridge_slave_0) entered disabled state [ 542.638009][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.686776][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.728008][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.767382][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.789720][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.819490][T26296] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.823240][T27341] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5987'. [ 542.857643][T26296] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 542.928953][T27343] netlink: 'syz.4.5988': attribute type 64 has an invalid length. [ 542.954769][T27343] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5988'. [ 543.014039][T27350] netlink: 'syz.1.5989': attribute type 1 has an invalid length. [ 543.026416][ T5995] smc: removing ib device syz2 [ 543.043442][T27350] netlink: 184 bytes leftover after parsing attributes in process `syz.1.5989'. [ 543.055768][T27350] netlink: 'syz.1.5989': attribute type 1 has an invalid length. [ 543.066613][T27350] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5989'. [ 543.282878][ T5992] dvmrp8 (unregistering): left allmulticast mode [ 543.475293][ T5992] team0: Port device bridge1 removed [ 543.712778][ T5992] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 543.750599][ T5992] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 543.765462][ T5992] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 543.803358][ T5992] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 543.821985][ T5992] bond0 (unregistering): Released all slaves [ 543.860797][ T5992] bond1 (unregistering): Released all slaves [ 543.925145][ T5992] bond2 (unregistering): Released all slaves [ 543.955056][ T5992] bond3 (unregistering): Released all slaves [ 544.012970][ T5992] bond4 (unregistering): Released all slaves [ 544.082164][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.217537][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.440035][T27380] syzkaller0: entered promiscuous mode [ 544.457366][T27380] syzkaller0: entered allmulticast mode [ 544.983684][ T5993] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 544.997189][T27404] FAULT_INJECTION: forcing a failure. [ 544.997189][T27404] name failslab, interval 1, probability 0, space 0, times 0 [ 545.016822][ T5993] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 545.055122][T27404] CPU: 0 UID: 0 PID: 27404 Comm: syz.1.5997 Not tainted syzkaller #0 PREEMPT(full) [ 545.055149][T27404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 545.055160][T27404] Call Trace: [ 545.055168][T27404] [ 545.055177][T27404] dump_stack_lvl+0xe8/0x150 [ 545.055203][T27404] should_fail_ex+0x412/0x560 [ 545.055231][T27404] should_failslab+0xa8/0x100 [ 545.055254][T27404] ? skb_clone+0x212/0x3a0 [ 545.055281][T27404] kmem_cache_alloc_noprof+0x87/0x650 [ 545.055310][T27404] skb_clone+0x212/0x3a0 [ 545.055336][T27404] __netlink_deliver_tap+0x404/0x850 [ 545.055367][T27404] ? netlink_deliver_tap+0x2e/0x1b0 [ 545.055386][T27404] netlink_deliver_tap+0x19c/0x1b0 [ 545.055406][T27404] netlink_sendskb+0x68/0x140 [ 545.055431][T27404] netlink_unicast+0x3a3/0x9b0 [ 545.055463][T27404] ? __pfx_netlink_unicast+0x10/0x10 [ 545.055496][T27404] nfnetlink_rcv+0x2517/0x27b0 [ 545.055555][T27404] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 545.055595][T27404] ? ref_tracker_free+0x693/0x840 [ 545.055646][T27404] ? __netlink_deliver_tap+0x807/0x850 [ 545.055663][T27404] ? netlink_deliver_tap+0x2e/0x1b0 [ 545.055699][T27404] netlink_unicast+0x80f/0x9b0 [ 545.055731][T27404] ? __pfx_netlink_unicast+0x10/0x10 [ 545.055756][T27404] ? netlink_sendmsg+0x650/0xb40 [ 545.055772][T27404] ? skb_put+0x11b/0x210 [ 545.055794][T27404] netlink_sendmsg+0x813/0xb40 [ 545.055822][T27404] ? __pfx_netlink_sendmsg+0x10/0x10 [ 545.055843][T27404] ? aa_sock_msg_perm+0xf1/0x1b0 [ 545.055867][T27404] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 545.055892][T27404] ? __pfx_netlink_sendmsg+0x10/0x10 [ 545.055909][T27404] ____sys_sendmsg+0xa68/0xad0 [ 545.055930][T27404] ? __might_fault+0xaf/0x130 [ 545.055957][T27404] ? __pfx_____sys_sendmsg+0x10/0x10 [ 545.055988][T27404] ? import_iovec+0x73/0xa0 [ 545.056011][T27404] ___sys_sendmsg+0x2a5/0x360 [ 545.056031][T27404] ? __lock_acquire+0x6b5/0x2cf0 [ 545.056054][T27404] ? __pfx____sys_sendmsg+0x10/0x10 [ 545.056111][T27404] ? __fget_files+0x2a/0x420 [ 545.056128][T27404] ? __fget_files+0x3a0/0x420 [ 545.056158][T27404] __x64_sys_sendmsg+0x1bd/0x2a0 [ 545.056179][T27404] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 545.056207][T27404] ? __pfx_ksys_write+0x10/0x10 [ 545.056235][T27404] do_syscall_64+0x14d/0xf80 [ 545.056255][T27404] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 545.056277][T27404] ? trace_irq_disable+0x37/0x100 [ 545.056293][T27404] ? clear_bhb_loop+0x40/0x90 [ 545.056312][T27404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 545.056328][T27404] RIP: 0033:0x7f12a119c629 [ 545.056344][T27404] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 545.056358][T27404] RSP: 002b:00007f12a204d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 545.056376][T27404] RAX: ffffffffffffffda RBX: 00007f12a1415fa0 RCX: 00007f12a119c629 [ 545.056389][T27404] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 545.056400][T27404] RBP: 00007f12a204d090 R08: 0000000000000000 R09: 0000000000000000 [ 545.056411][T27404] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 545.056421][T27404] R13: 00007f12a1416038 R14: 00007f12a1415fa0 R15: 00007ffe8c1e4ef8 [ 545.056449][T27404] [ 545.426945][T14050] lec:lec_start_xmit: lec0:No lecd attached [ 545.524246][T27409] netlink: 'syz.3.5999': attribute type 1 has an invalid length. [ 545.562391][T27409] netlink: 'syz.3.5999': attribute type 7 has an invalid length. [ 545.578155][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 545.578264][T27409] netlink: 'syz.3.5999': attribute type 8 has an invalid length. [ 545.595755][T27409] netlink: 208 bytes leftover after parsing attributes in process `syz.3.5999'. [ 545.605509][T27409] NCSI netlink: No device for ifindex 65584 [ 545.615816][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 545.665477][T27426] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6002'. [ 545.861482][T27431] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6003'. [ 546.210169][T27445] netlink: 'syz.2.6008': attribute type 1 has an invalid length. [ 546.458134][T27445] 8021q: adding VLAN 0 to HW filter on device bond6 [ 546.540231][ T5827] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 546.575581][ T5827] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 546.585534][T27452] bond6: (slave geneve2): making interface the new active one [ 546.594369][ T5827] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 546.614414][ T5827] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 546.631260][ T5827] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 546.654424][T27452] bond6: (slave geneve2): Enslaving as an active interface with an up link [ 546.862686][T27465] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 546.882630][T27465] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 546.941446][T27465] bond0 (unregistering): Released all slaves [ 547.214609][T27482] netlink: 'syz.1.6018': attribute type 1 has an invalid length. [ 547.232090][T27481] __nla_validate_parse: 2 callbacks suppressed [ 547.232110][T27481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6017'. [ 547.277481][T27485] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6019'. [ 547.288972][T27481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6017'. [ 547.300486][ T13] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.327789][ T13] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.337634][T27485] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6019'. [ 547.347566][ T13] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.378722][ T5992] tipc: Disabling bearer [ 547.384306][ T5992] tipc: Left network mode [ 547.398525][ T13] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 547.465787][T27489] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6021'. [ 547.507616][ T5995] net_ratelimit: 166 callbacks suppressed [ 547.507636][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 547.561193][T27494] syzkaller1: entered promiscuous mode [ 547.583249][T27494] syzkaller1: entered allmulticast mode [ 547.595292][T27489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6021'. [ 547.614482][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 547.615639][T27455] lo speed is unknown, defaulting to 1000 [ 547.626843][T27489] netlink: 'syz.1.6021': attribute type 5 has an invalid length. [ 547.668296][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 547.697017][T27489] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6021'. [ 547.717563][ T5993] bond10: (slave ip6gretap1): failed to get link speed/duplex [ 547.809715][T27489] geneve2: entered promiscuous mode [ 547.827269][T26295] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 547.838522][T27489] geneve2: entered allmulticast mode [ 547.865129][T26295] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 547.883446][ T5995] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 547.897037][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 547.938396][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 547.960873][ T5995] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 547.974127][ T5995] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 547.984294][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 548.017002][ T5995] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 548.037499][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 548.632584][T27541] netlink: 'syz.1.6037': attribute type 6 has an invalid length. [ 548.737502][ T5827] Bluetooth: hci5: command tx timeout [ 548.759321][T27544] xt_cluster: node mask cannot exceed total number of nodes [ 548.874971][ T5992] veth0_macvtap: left allmulticast mode [ 548.895868][ T5992] veth0_vlan: left promiscuous mode [ 549.034076][T27557] netlink: 'syz.1.6043': attribute type 10 has an invalid length. [ 549.065075][T27563] netlink: 9 bytes leftover after parsing attributes in process `syz.2.6044'. [ 549.125979][ T29] audit: type=1804 audit(1771353671.481:8): pid=27564 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.6044" name="/newroot/524/cgroup.controllers" dev="tmpfs" ino=2680 res=1 errno=0 [ 549.149178][ T29] audit: type=1800 audit(1771353671.481:9): pid=27564 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.6044" name="cgroup.controllers" dev="tmpfs" ino=2680 res=0 errno=0 [ 549.508498][ T5992] team0 (unregistering): Port device team_slave_1 removed [ 549.522719][ T5992] team0 (unregistering): Port device team_slave_0 removed [ 549.610894][ T5992] team0 (unregistering): Port device 0! removed [ 549.650406][T27557] bridge0: port 3(team0) entered blocking state [ 549.660418][T27557] bridge0: port 3(team0) entered disabled state [ 549.667812][T27557] team0: entered allmulticast mode [ 549.672927][T27557] team_slave_0: entered allmulticast mode [ 549.682611][T27557] team_slave_1: entered allmulticast mode [ 549.692101][T27557] team0: entered promiscuous mode [ 549.698414][T27557] team_slave_0: entered promiscuous mode [ 549.704249][T27557] team_slave_1: entered promiscuous mode [ 549.712565][T27563] gretap0: entered promiscuous mode [ 549.733790][T27564] gre0: left promiscuous mode [ 549.740338][T27564] gre0: left allmulticast mode [ 549.745801][T27564] gretap0: left promiscuous mode [ 549.792228][ T87] lo speed is unknown, defaulting to 1000 [ 549.827795][ T87] syz0: Port: 1 Link ACTIVE [ 549.835812][ T87] lo speed is unknown, defaulting to 1000 [ 550.018260][T27455] chnl_net:caif_netlink_parms(): no params data found [ 550.205689][ T5992] IPVS: stop unused estimator thread 0... [ 550.534339][T27601] mac80211_hwsim hwsim66 wlan0: entered promiscuous mode [ 550.565168][T27455] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.584340][T27455] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.601498][T27455] bridge_slave_0: entered allmulticast mode [ 550.610465][T27455] bridge_slave_0: entered promiscuous mode [ 550.639942][ T5992] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 550.672704][ T5992] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 44030 - 0 [ 550.687410][T27609] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6057'. [ 550.693980][ T5992] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 550.742424][T27610] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6058'. [ 550.752466][T27455] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.772029][T27455] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.806248][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5380 ms [ 550.807139][ T5827] Bluetooth: hci5: command tx timeout [ 550.814267][ C1] lec:lec_tx_timeout: lec0 [ 550.830353][T27455] bridge_slave_1: entered allmulticast mode [ 550.843589][T27455] bridge_slave_1: entered promiscuous mode [ 550.880215][T27609] team0: left allmulticast mode [ 550.885687][T27609] team_slave_0: left allmulticast mode [ 550.898509][T27609] team_slave_1: left allmulticast mode [ 550.904014][T27609] team0: left promiscuous mode [ 550.917033][T27609] team_slave_0: left promiscuous mode [ 550.927392][T27609] team_slave_1: left promiscuous mode [ 550.937811][T27609] bridge0: port 3(team0) entered disabled state [ 550.950463][T27609] bridge_slave_1: left allmulticast mode [ 550.957210][T27609] bridge_slave_1: left promiscuous mode [ 550.963269][T27609] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.992397][T27609] bridge_slave_0: left allmulticast mode [ 551.006224][T27609] bridge_slave_0: left promiscuous mode [ 551.012037][T27609] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.137675][ T5992] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 551.149840][ T5992] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 44030 - 0 [ 551.162843][ T5992] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 551.219657][T27618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 551.230098][T27618] team0: Failed to send port change of device batadv0 via netlink (err -105) [ 551.243397][T27618] team0: Failed to send options change via netlink (err -105) [ 551.274917][T27618] team0: Port device batadv0 added [ 551.300519][T27455] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 551.415799][T27614] syzkaller0: entered promiscuous mode [ 551.425171][T27614] syzkaller0: entered allmulticast mode [ 551.503196][T27634] Bluetooth: MGMT ver 1.23 [ 551.509440][T27634] netlink: 'syz.0.6063': attribute type 26 has an invalid length. [ 552.526880][ T5993] net_ratelimit: 191 callbacks suppressed [ 552.526901][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.560595][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.588430][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.617458][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.637596][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.660408][T26295] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.691659][ T5993] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.720731][T26295] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.751340][ T5994] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.781226][ T5994] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 552.887952][ T5827] Bluetooth: hci5: command tx timeout [ 552.983292][T27455] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 552.995500][ T5992] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 553.005864][ T5992] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 44030 - 0 [ 553.018025][ T5992] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 553.139377][ T5992] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 553.160977][T27642] xt_socket: unknown flags 0x50 [ 553.162274][ T5992] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 44030 - 0 [ 553.165966][T27642] xt_socket: unknown flags 0x50 [ 553.203434][ T5992] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 553.244502][T27648] __nla_validate_parse: 3 callbacks suppressed [ 553.244522][T27648] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6069'. [ 553.348401][T27455] team0: Port device team_slave_0 added [ 553.370425][T27455] team0: Port device team_slave_1 added [ 553.431339][T27455] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 553.439372][T27455] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 553.478205][T27455] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 553.491987][T27455] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 553.500518][T27455] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 553.528590][T27455] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 553.549783][T27665] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6073'. [ 553.838989][T27455] hsr_slave_0: entered promiscuous mode [ 553.850397][T27455] hsr_slave_1: entered promiscuous mode [ 553.859442][T27455] debugfs: 'hsr0' already exists in 'hsr' [ 553.865188][T27455] Cannot create hsr debugfs directory [ 553.961716][T27687] netlink: 'syz.0.6081': attribute type 1 has an invalid length. [ 553.976048][ T5992] team0: left allmulticast mode [ 553.985771][ T5992] team_slave_1: left allmulticast mode [ 553.999242][ T5992] team0: left promiscuous mode [ 554.004032][ T5992] team_slave_1: left promiscuous mode [ 554.019724][ T5992] bridge0: port 3(team0) entered disabled state [ 554.169225][T27697] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6083'. [ 554.388150][ T5992] team0: Port device bridge1 removed [ 554.592157][ T5992] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 554.602805][ T5992] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 554.613470][ T5992] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 554.623875][ T5992] bond0 (unregistering): Released all slaves [ 554.636112][ T5992] bond1 (unregistering): Released all slaves [ 554.651220][ T5992] bond2 (unregistering): (slave 5gQ[): Releasing backup interface [ 554.662161][ T5992] bond2 (unregistering): (slave 5gQ[): last VLAN challenged slave left bond - VLAN blocking is removed [ 554.677303][ T5992] bond2 (unregistering): Released all slaves [ 554.690825][ T5992] bond3 (unregistering): Released all slaves [ 554.703807][ T5992] bond4 (unregistering): Released all slaves [ 554.721557][T27685] netlink: 'syz.3.6080': attribute type 3 has an invalid length. [ 554.902402][T27707] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6085'. [ 554.968615][ T5827] Bluetooth: hci5: command tx timeout [ 554.975557][T27707] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6085'. [ 554.978004][T27711] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6087'. [ 555.029707][T27717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6087'. [ 555.058228][T27717] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6087'. [ 555.087703][T27707] bond7 (unregistering): Released all slaves [ 555.148727][ T5992] tipc: Left network mode [ 555.193913][T27717] geneve2: entered promiscuous mode [ 555.202207][T27717] geneve2: entered allmulticast mode [ 555.352242][T27734] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6093'. [ 555.430980][T27732] netlink: 'syz.1.6092': attribute type 4 has an invalid length. [ 556.947151][T27732] netlink: 'syz.1.6092': attribute type 4 has an invalid length. [ 557.010027][T27747] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6095'. [ 557.450741][ T36] smc: removing ib device  [ 557.533968][T27769] sit0: entered promiscuous mode [ 557.539339][ T3514] net_ratelimit: 206 callbacks suppressed [ 557.539355][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 557.557048][T26295] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 557.563035][T27769] netlink: 'syz.3.6102': attribute type 1 has an invalid length. [ 557.586883][ T3514] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 557.604822][ T5888] ================================================================== [ 557.612899][ T5888] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x5e/0x170 [ 557.621655][ T5888] Read of size 8 at addr ffff8880312f22f0 by task kworker/0:4/5888 [ 557.629526][ T5888] [ 557.631833][ T5888] CPU: 0 UID: 0 PID: 5888 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 557.631849][ T5888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 557.631859][ T5888] Workqueue: events smc_ib_port_event_work [ 557.631876][ T5888] Call Trace: [ 557.631882][ T5888] [ 557.631888][ T5888] dump_stack_lvl+0xe8/0x150 [ 557.631906][ T5888] print_report+0xba/0x230 [ 557.631920][ T5888] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 557.631935][ T5888] kasan_report+0x117/0x150 [ 557.631954][ T5888] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 557.631972][ T5888] __ethtool_get_link_ksettings+0x5e/0x170 [ 557.631988][ T5888] ib_get_eth_speed+0x180/0x7f0 [ 557.632003][ T5888] ? rxe_query_port+0x7e/0x3d0 [ 557.632026][ T5888] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 557.632043][ T5888] ? do_raw_spin_unlock+0xf5/0x210 [ 557.632064][ T5888] rxe_query_port+0x93/0x3d0 [ 557.632083][ T5888] ib_query_port+0x170/0x830 [ 557.632099][ T5888] smc_ib_port_event_work+0x15a/0x940 [ 557.632117][ T5888] ? process_scheduled_works+0xa0f/0x17a0 [ 557.632130][ T5888] ? process_scheduled_works+0xa0f/0x17a0 [ 557.632144][ T5888] process_scheduled_works+0xaec/0x17a0 [ 557.632168][ T5888] ? __pfx_process_scheduled_works+0x10/0x10 [ 557.632183][ T5888] ? assign_work+0x3d5/0x5e0 [ 557.632198][ T5888] worker_thread+0xa50/0xfc0 [ 557.632221][ T5888] kthread+0x388/0x470 [ 557.632237][ T5888] ? __pfx_worker_thread+0x10/0x10 [ 557.632250][ T5888] ? __pfx_kthread+0x10/0x10 [ 557.632265][ T5888] ret_from_fork+0x51e/0xb90 [ 557.632283][ T5888] ? __pfx_ret_from_fork+0x10/0x10 [ 557.632295][ T5888] ? __switch_to+0xc7d/0x1400 [ 557.632309][ T5888] ? __pfx_kthread+0x10/0x10 [ 557.632324][ T5888] ret_from_fork_asm+0x1a/0x30 [ 557.632347][ T5888] [ 557.632352][ T5888] [ 557.803559][ T5888] Allocated by task 17721: [ 557.807960][ T5888] kasan_save_track+0x3e/0x80 [ 557.812646][ T5888] __kasan_kmalloc+0x93/0xb0 [ 557.817230][ T5888] __kvmalloc_node_noprof+0x528/0x8a0 [ 557.822590][ T5888] alloc_netdev_mqs+0xa6/0x11b0 [ 557.827422][ T5888] rtnl_create_link+0x31f/0xd70 [ 557.832256][ T5888] rtnl_newlink_create+0x277/0xb70 [ 557.837346][ T5888] rtnl_newlink+0x1666/0x1be0 [ 557.842010][ T5888] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 557.846928][ T5888] netlink_rcv_skb+0x232/0x4b0 [ 557.851672][ T5888] netlink_unicast+0x80f/0x9b0 [ 557.856423][ T5888] netlink_sendmsg+0x813/0xb40 [ 557.861180][ T5888] __sys_sendto+0x709/0x7a0 [ 557.865668][ T5888] __x64_sys_sendto+0xde/0x100 [ 557.870413][ T5888] do_syscall_64+0x14d/0xf80 [ 557.874988][ T5888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.880863][ T5888] [ 557.883169][ T5888] Freed by task 27767: [ 557.887220][ T5888] kasan_save_track+0x3e/0x80 [ 557.891894][ T5888] kasan_save_free_info+0x46/0x50 [ 557.896906][ T5888] __kasan_slab_free+0x5c/0x80 [ 557.901668][ T5888] kfree+0x1c1/0x610 [ 557.905547][ T5888] device_release+0x9e/0x1d0 [ 557.910123][ T5888] kobject_put+0x228/0x560 [ 557.914524][ T5888] netdev_run_todo+0xc75/0xde0 [ 557.919270][ T5888] rtnl_dellink+0x6a7/0x820 [ 557.923753][ T5888] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 557.928673][ T5888] netlink_rcv_skb+0x232/0x4b0 [ 557.933438][ T5888] netlink_unicast+0x80f/0x9b0 [ 557.938185][ T5888] netlink_sendmsg+0x813/0xb40 [ 557.942925][ T5888] ____sys_sendmsg+0xa68/0xad0 [ 557.947682][ T5888] ___sys_sendmsg+0x2a5/0x360 [ 557.952340][ T5888] __x64_sys_sendmsg+0x1bd/0x2a0 [ 557.957259][ T5888] do_syscall_64+0x14d/0xf80 [ 557.961835][ T5888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.967706][ T5888] [ 557.970010][ T5888] The buggy address belongs to the object at ffff8880312f2000 [ 557.970010][ T5888] which belongs to the cache kmalloc-cg-4k of size 4096 [ 557.984301][ T5888] The buggy address is located 752 bytes inside of [ 557.984301][ T5888] freed 4096-byte region [ffff8880312f2000, ffff8880312f3000) [ 557.998169][ T5888] [ 558.000485][ T5888] The buggy address belongs to the physical page: [ 558.006896][ T5888] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x312f0 [ 558.015651][ T5888] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 558.024129][ T5888] memcg:ffff8880119b0bc1 [ 558.028348][ T5888] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 558.035869][ T5888] page_type: f5(slab) [ 558.039833][ T5888] raw: 00fff00000000040 ffff88813feb6500 dead000000000100 dead000000000122 [ 558.048397][ T5888] raw: 0000000000000000 0000000800040004 00000000f5000000 ffff8880119b0bc1 [ 558.056962][ T5888] head: 00fff00000000040 ffff88813feb6500 dead000000000100 dead000000000122 [ 558.065615][ T5888] head: 0000000000000000 0000000800040004 00000000f5000000 ffff8880119b0bc1 [ 558.074264][ T5888] head: 00fff00000000003 ffffea0000c4bc01 00000000ffffffff 00000000ffffffff [ 558.082914][ T5888] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 558.091560][ T5888] page dumped because: kasan: bad access detected [ 558.097961][ T5888] page_owner tracks the page as allocated [ 558.103667][ T5888] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5828, tgid 5828 (syz-executor), ts 68340027811, free_ts 46110198569 [ 558.125006][ T5888] post_alloc_hook+0x228/0x280 [ 558.129765][ T5888] get_page_from_freelist+0x24dc/0x2580 [ 558.135295][ T5888] __alloc_frozen_pages_noprof+0x18d/0x380 [ 558.141084][ T5888] allocate_slab+0x77/0x660 [ 558.145565][ T5888] refill_objects+0x331/0x3c0 [ 558.150217][ T5888] __pcs_replace_empty_main+0x2b9/0x620 [ 558.155746][ T5888] __kmalloc_cache_noprof+0x392/0x660 [ 558.161100][ T5888] ipv6_add_dev+0x6aa/0x13a0 [ 558.165676][ T5888] addrconf_notify+0x771/0x1050 [ 558.170506][ T5888] notifier_call_chain+0x19d/0x3a0 [ 558.175600][ T5888] register_netdevice+0x173a/0x1cf0 [ 558.180780][ T5888] xfrmi_newlink+0x49d/0x7c0 [ 558.185351][ T5888] rtnl_newlink_create+0x329/0xb70 [ 558.190442][ T5888] rtnl_newlink+0x1666/0x1be0 [ 558.195101][ T5888] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 558.200016][ T5888] netlink_rcv_skb+0x232/0x4b0 [ 558.204759][ T5888] page last free pid 5485 tgid 5485 stack trace: [ 558.211065][ T5888] __free_frozen_pages+0xbf8/0xd70 [ 558.216168][ T5888] __slab_free+0x263/0x2b0 [ 558.220569][ T5888] qlist_free_all+0x97/0x100 [ 558.225142][ T5888] kasan_quarantine_reduce+0x148/0x160 [ 558.230583][ T5888] __kasan_slab_alloc+0x22/0x80 [ 558.235415][ T5888] kmem_cache_alloc_lru_noprof+0x2b8/0x640 [ 558.241203][ T5888] __d_alloc+0x37/0x6f0 [ 558.245344][ T5888] d_alloc_parallel+0xe6/0x1610 [ 558.250173][ T5888] __lookup_slow+0x137/0x410 [ 558.254745][ T5888] lookup_slow+0x53/0x70 [ 558.258967][ T5888] link_path_walk+0xd1e/0x18d0 [ 558.263714][ T5888] path_openat+0x2c3/0x3860 [ 558.268196][ T5888] do_file_open+0x23e/0x4a0 [ 558.272683][ T5888] do_sys_openat2+0x113/0x200 [ 558.277339][ T5888] __x64_sys_openat+0x138/0x170 [ 558.282168][ T5888] do_syscall_64+0x14d/0xf80 [ 558.286742][ T5888] [ 558.289046][ T5888] Memory state around the buggy address: [ 558.294654][ T5888] ffff8880312f2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 558.302691][ T5888] ffff8880312f2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 558.310731][ T5888] >ffff8880312f2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 558.318768][ T5888] ^ [ 558.326459][ T5888] ffff8880312f2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 558.334500][ T5888] ffff8880312f2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 558.342534][ T5888] ================================================================== [ 558.369799][ T13] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 558.413035][ T5995] bond10: (slave ip6gretap1): link status up, enabling it in 0 ms [ 558.435513][ T5888] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 558.442719][ T5888] CPU: 0 UID: 0 PID: 5888 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 558.452073][ T5888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 558.462111][ T5888] Workqueue: events smc_ib_port_event_work [ 558.467907][ T5888] Call Trace: [ 558.471173][ T5888] [ 558.474091][ T5888] vpanic+0x1e0/0x670 [ 558.478065][ T5888] panic+0xc5/0xd0 [ 558.481776][ T5888] ? __pfx_panic+0x10/0x10 [ 558.486182][ T5888] ? preempt_schedule_thunk+0x16/0x30 [ 558.491543][ T5888] ? preempt_schedule_thunk+0x16/0x30 [ 558.496902][ T5888] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 558.502872][ T5888] check_panic_on_warn+0x89/0xb0 [ 558.507799][ T5888] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 558.513762][ T5888] end_report+0x6f/0x140 [ 558.517993][ T5888] kasan_report+0x128/0x150 [ 558.522486][ T5888] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 558.528464][ T5888] __ethtool_get_link_ksettings+0x5e/0x170 [ 558.534273][ T5888] ib_get_eth_speed+0x180/0x7f0 [ 558.539111][ T5888] ? rxe_query_port+0x7e/0x3d0 [ 558.543867][ T5888] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 558.549233][ T5888] ? do_raw_spin_unlock+0xf5/0x210 [ 558.554344][ T5888] rxe_query_port+0x93/0x3d0 [ 558.558937][ T5888] ib_query_port+0x170/0x830 [ 558.563520][ T5888] smc_ib_port_event_work+0x15a/0x940 [ 558.568886][ T5888] ? process_scheduled_works+0xa0f/0x17a0 [ 558.574594][ T5888] ? process_scheduled_works+0xa0f/0x17a0 [ 558.580300][ T5888] process_scheduled_works+0xaec/0x17a0 [ 558.585844][ T5888] ? __pfx_process_scheduled_works+0x10/0x10 [ 558.591810][ T5888] ? assign_work+0x3d5/0x5e0 [ 558.596387][ T5888] worker_thread+0xa50/0xfc0 [ 558.600973][ T5888] kthread+0x388/0x470 [ 558.605031][ T5888] ? __pfx_worker_thread+0x10/0x10 [ 558.610123][ T5888] ? __pfx_kthread+0x10/0x10 [ 558.614699][ T5888] ret_from_fork+0x51e/0xb90 [ 558.619278][ T5888] ? __pfx_ret_from_fork+0x10/0x10 [ 558.624373][ T5888] ? __switch_to+0xc7d/0x1400 [ 558.629040][ T5888] ? __pfx_kthread+0x10/0x10 [ 558.633622][ T5888] ret_from_fork_asm+0x1a/0x30 [ 558.638380][ T5888] [ 558.641731][ T5888] Kernel Offset: disabled [ 558.646058][ T5888] Rebooting in 86400 seconds..