last executing test programs: 4.366896411s ago: executing program 1 (id=3405): r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0xc, [@fwd={0x2}, @struct={0x4, 0x6, 0x0, 0x4, 0x1, 0xffffffff, [{0x1, 0x1, 0x4}, {0xe, 0x5, 0x8}, {0x3, 0x2, 0x5}, {0x8, 0x1, 0x1}, {0xb, 0x1, 0x6}, {0x9, 0x1, 0x1}]}]}, {0x0, [0x5f, 0x5f, 0x0, 0x2e, 0x2e, 0x6f, 0x3e, 0x2e, 0x61, 0x0]}}, &(0x7f0000000180)=""/102, 0x84, 0x66, 0x0, 0x5}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@bloom_filter={0x1e, 0x5, 0x0, 0x7, 0x280, 0x1, 0x4, '\x00', 0x0, r2, 0x3, 0x0, 0x23, 0xe}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r3}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) recvmsg$unix(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)=""/76, 0x4c}], 0x1}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r3, &(0x7f00000007c0)}, 0x20) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) sendto$packet(r5, &(0x7f00000000c0)="37fe0187610488b3d05d92015ee9ad38d34e1b37234adcd7a271dcd87da03ea3c1b0eb949065c29156446f75a0f3128825ba4f61f4b702bf489c5737aa6121dd0090d0729c829124ccc2197c0af536a4bf1add8929dddebfe0edee", 0xfffffffffffffec6, 0x0, 0x0, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000013c0)=0xc) sendmmsg$unix(r7, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c, 0x1, 0x2, {r8, r9, r10}}}, @rights={{0x14, 0x1, 0x1, [r7]}}], 0x38, 0x40044}}], 0x1, 0x4) getsockname$netrom(r6, 0x0, &(0x7f0000000140)=0xe0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14) socket$key(0xf, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'ip6_vti0\x00', r11, 0x2f, 0x9, 0x81, 0xcfaa, 0x1a, @mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7, 0x8, 0x80, 0xe}}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'veth0_vlan\x00', 0x0}) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@setlink={0x2c, 0x13, 0x1, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r12, 0x800, 0x80}, [@IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1404c0d5}, 0x10) 3.367240839s ago: executing program 1 (id=3415): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)={0x14, 0x25, 0x1, 0x70bd2c, 0x25dfdbfb, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4040085}, 0x10) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xf, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000008000000850000008600000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) r2 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r2, &(0x7f0000001280)={&(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x1, 0x3}}, 0x10, &(0x7f00000011c0)=[{&(0x7f0000000080)="76b6939e031833d84849623a32403fb4bee581d5177b28ad5fe175be156097d8d51c42910f7b666c3ca659af7418559555b83a134d5a7d694de73d76673b9c9570cb5d86f4e683565b99eca59bcc00d2e0dd69a369bfbe2e36362dee2c8954c0d279e2124bb59fb1254d2c493aeee9025a116e84f6dd235e32b4e23fe637a74bfce81656852005c1dd68618aabb077e8fa3d024dd1871b894c895b316fa780c26be7de8fdfa9a17e4ef7c491ed9127d41c5067e35a0ea8e704028581c093c7c64de95055928bd58831b4f140adf4024ff47c13b939b08f8419a83278265b7746b5544d55f9da44bf4c88516d6739f5f1ae805f5c54d1831b3c5d3c93d569cf7881b7d066e0d57b3d77d97bc24964556d875f80c5bee4fc81b8fc3731468a3df2ee385149ae7e40c9762218f34d8cc4c5f1df58efc17f05ef6da8d8d1e961e10197c59e8b06bca9df2c7cacf0de9760d1520871b15fef8462a93e51795ebeb2e7b2835686fc37310299b3582f4988e80538b15edf45cf9397f4bcc39bcbd8cad3d0f1e7bfd86f4882c176b22a07ad78c7efaf22dd34502c71f36a13eedce6c92a93e01b6082b842cb2481aff9239dcd72f22c84d5240b1543487386ba908ee50203e706877f73a0df9dae6ae1b54627638e351e8780b1612ca111fc978e52b0d2887ee99927d8db35dc4581e18e70bd2e724b02b9b54ac9564f7bf2556f8dc72b716dff5b3ccb259d0dd83439caac7afd94a67dd97ca29d2fc9aa7d85d92134195b5edbb3c86633558a95f01d8e223e917fa352d1a7f76f7ebbe099d72f4353b608d25f2aaedb48c50cd5dd22dbb26bda8435b52896352e754b6d903da9b579d688e6a774ca93c7cdab0b7983ba9d7270cc34586d0224e491e30e726d90e060be227b426d5aac3bcf3e4d6c37b4216e208b0a05341a56d89669ffed1a66a342e8924d3617c4b8a7880bdf10afbaddb8aa07fd84851f41e779025270db83785ea0ebd43ecf8ac3bd3a9075bdc1a97a914014726bfc64a2d2d2947fee50195d91234ba48ca3a785733e95039ca847053bab108bcbba20436127be3777f1880e32281651dbe26356c9184d130ce0e69661e47bd9505969e5b2299f9359f5cd9272c7e6e4fb1064512bcfe4baea2a7adc7128966f18146357eb4dfdbd0d16790568f3e6ccf94bacebb7bb060c4e011024350237672fb3fb32f684234869b38bab2aed92549c96fd1272a54ec730daa2fe22013609ab6559c71480cae33dbf0ef89060a91e7e07ec43ee5bb4fc02bffa55a6529d7a6b04ed609ba978161f5599962306e529960bf1c335051216efcbb1c77594f103ff9606491a50c65d596e6e6cc46b2d5e8480bd5144802d5b81b9646b7d965249b3839f1e5ab1f65411889a744d6231fc31446cad25944947aaf5fd912481d36d81c1f4d4f766a8a9f1788e1030cf8b2ceb4e72630f86a96d319a8e568024559a26ffed789a118bd4ce9d6fcc9965cc8260d0cc09c54fd809740f3cf4f501fd056c7cc2c57ecce1e051787d2aaff9a77f083fed3e8dc8937f9e9c873633db3fe886ae9575420636f961bd8ed850a66f36c26c7f21cf045d5781345f05a9bf930f2d19399b413b4fcc4c0afbd7187e5f11bc74cc8c1c9f15ba00cbe14c890f04fbef25fe5bc2a93b4dd331034e0bae25fda41ae03526a77f5538fb080470a73b9b512d4020398173a25398802a9dfd7a9878c929ce16c65b40e0130ce0dd919f86cc86a5a1e2278e9fc8119ac52a9f1195b70e2fdaed99ff628bc5aa0894d96c37304b9b44438e9336611198407ab7ce0a8545799b5c0346b858ab5647ba38cc10b20a8f5add11d81949b412ecf76cf9936ab1c2abb22b8649957717000cadd7387fc5729edc5acfc65a8d6dcd1840a589a81302350313cf7d88987eb8d6c084733929824e664bff0a7027aaba5e4a2c1acbe9045e8e901943d94754efbdcc7fc08f2c52314a6f97b64d4ec6d2cd90a38f20916b646a25f63af7c6e66c00aeed782620ccb7da1a5c23d179d04a406fdcfd479c10b617c9b5894ee4553850421554b0a04cd6ba49f0e809c4a732f203fcd8314f3fb3c68848a37df697a32bd40626fdd1903d4ee0a998ffee0b9c4186af1d8eb8ca93fc9724905fc3664017c81a7c9aa46fcb8466af1fb8245bcd0e7a030342220fd04955a5820212d80dd46bbbcea08b8e94eb23609f27c7181ab2e89650906f5bd3da0a6d59d3ae20908349b5ac1709cf1d5ca97f97d12feb65633ea9097ceb73983225a17abb581f924febae264a9ce8fa9cacbcc1f617a9af8761ec6fc1ac8d92d510b831a4ff7e2bdfb4e55219b8619e701964e7e14914ed55894ee0905c36178122790bc68943bbd3cb95100ce257e9314c0647b374f19665a72ef6b8135f597f6d99fbbf58af04267f5862abdc1253bc4ec21747dcbda6dfbf78d8c12fc11cda17a1721c69ca50f2861229f16aea81ef155595ad78cdb0218be5c39aca5eaddc649aa963e13b95ac46829f438c138c3c38e5f7c2631171ef3cc5bf967ada957203bce81ac029cc744a15553083424952bcf8f91b823d760b4f043497c95aa55b476341b333a7f6ac526e63d736103efb68aa356b6e734a3094de6cbb46e4bdb65b0c0a5d7b38803ecf75da55182fb626c65b038c54989a491ef5336cc43744fee365156c4c5e63e854719e7a51076aa3ad2a02e5b7eb7697d8474f04db6314c9f763fa5ff849209b2dc1cda603fa127151e9d39933575bfb79543d230f185bfd00ca8fe0322dc756ea1b681f3b62c6a47f780a226a120e4e5299234bb03ba0e3d6919c5e9ccc7a725f80080513610c8c71ceefc1e23b98e1961633bb5dce54a7e5504c5b94e4cd5e0f040be3678139c739876b23342b7b058843c93b54432a55f2c233db179c61b405917660e35094df63ecc5acc2f31ccf712346a4703608d19a6075efb326684a127502062707a98504df6230bfd0e97d5b70fc1ba2c90dd61ff909f9d1af8b134a1178112a116823657ac52eb94947fa41d3b8fd65e9790ccb495d1565626d0604ec96bffb5923675f838cdc8567114c7fa5020ed624e1741107feb005476fbf4d855e59d3f8c0be488f34294a5dac5f45363eb8199b2d3813cba42bb9c5a647a99f9fda0c09b507bac2c0a689e2b529425add15adcd37d65db01d09a196f2c233a5b3dcad4facba47be72e5738a2203c03f10643b2be22f057d9478049d0f6376a622151246ffa1ae2d04c14d2a4a758c05bc1f43c100a7613446c4d23851fa5eebefa64da7ff781809091099be7b212cdd52a621002bac81d5082e7713e6a2e29a15b18ef1261e262f0eeebc6348f430d510cc64d4e40d20ae43436b557c2ffffab3892f2e0645bb17bb6d0a439ec7d909a8f3ecc0846cdf4d95855886bd911096033b40ae3b3605c464e053dc6dbc0a38835f1aa0b46acaa036bf847b1364bbe27d381e14204a1e47736c245078049eba40a53e90af1cca53ecb062cb9c7cd4208c56e8cfc2f4931658f9c4540fc53ddd0c63125007986cd02e0d05edca099be1d42e1c1771e5016095d4f5172dca0a83a98e40c218a31d411d6b2f93254fc58ee6145f4e9c3418d817c8d0609988b7b4ca322e6e44006b3d0e37ef14803590f525f7810966801f6c56b1d7e187a4948237a0e2ed8ad60ab468a6dd1330daa135e366072e8c9c7a7096eb6a0ff47cb91656727fe3990c6f738ba3d38ac257f83cb9784d9e9c1d958cd1776fe75a0573c93507cc5a84f808eff3d3096cf7a3594f6a8b43819fe758a5fa587974562fb5563a7372487fd5977bb41806bc277f320c3eab67c325b9492dd1f6906ef96ed5b8fd1f022ceb3f432840451caf63c21517cc6bb7a7b414968f81a6f9a9c5dd4f8d1df13f61dc8e3df12cbd5b315a13b1d39c08bd35b8671bf9adb474173a49ae9defaa53fd8c82edff109a1c65d77b4f68dd7d8701806133516b68c9dcf36b860347ffaf8c86af00bd04d18e76a84328578ed63be375ffc22be39819a43ec38f6d0ad2c4b9e0c3303c75f847c9a3bb4a475fe4ef8ea7d2947d9adb30ff17f11ab2991e91ea5d921a0fe99b897a736a22dc2b69b97f8447397334d8cd1dff4f5cb55bfc394e45fd51dc50a4b0c1e1b9f0637083afccd39c0112ff8c91848e2481acf58c8c6e2d21bd61d4716b5f1738c9ca07c9659867a604a569717b4eb0575543d8a3804bd146688d713d4b0d9df86988412c4d0872a657ff954b88ba773cccbd0ab82b3b1394622c15da2cb73bd57353c85da07a98e153a2d27f99c8ed644c3533b6a8719f830852b93230887bf52b2bd60ebf7347aac9606b34eb94697635900e1c0e361d4bb41f02ce336559c78b12592fcf71811ac658b6c8259d3be52035bba026437be2cff139e986e3add9a5649b26e9369fe123c6116b0f7593ad3ff3d6a0a70732c414b2e9ca6f554edc7f00c6f86d2e1e756b32d7b9fb22022b1eed0e59d7fe80f08448aa23ed4e53904481acdd069fcf6469a88d28853766763c2803527139a2dd5169b8dda0c25e2f596412fdba180ba892534c3e815fdcd04e1f3c87acffa4d7198f483cfb3da6a9930ebb26421d6866d23904e024a61211c29f900e86d1007a954ad29eb7805ed08c36494e39cb236c395c848f4e82e6f02caec73aa6204f2f5c07bad93bc04820718be19a7ace2be9b0d94949a029f750ad284bd83babb38bd309a588e44e577e8e01fbc5c3c24bb4db36c6fc78f943a854a9049991ab00be0cf21511f97fb1edb9bc3d78d6deaa97dc7da6ad00c02c5c77950fef2376b88ce034612ed1e6f0e3161c715ea127696516801ab2a662c0d5dfc7ff7585f3de1e326f036530a4652b82adc3493d4cfd431c68e0c4c82b12e3fd4e547197e663ffa1dfa0d5f228f2b0bd9b0cf2e1180c375bec44e8dcb7", 0xd9d}], 0x1}, 0x40004) 3.223095165s ago: executing program 1 (id=3418): bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="85000000b20000006a0a00ff000000000c08000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000004000000dd0000000a00000000000000", @ANYRES32, @ANYBLOB='\x00\x004'], 0x50) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a"], 0x64}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="24000000420007012abd700000000000017c0000100004000a"], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$igmp(0x2, 0x3, 0x2) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x11, 0x3240, 0x3a}, {@loopback, 0x4e23, 0x4, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100"], 0x57) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000000780)=[{&(0x7f0000000180)="200000001300034700bb65e1c3e4ffff01000000010000005600000025000000", 0x20}], 0x1) close(0x3) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x2400080c) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x203b}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048054}, 0x8000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'gretap0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="85000000b20000006a0a00ff000000000c08000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000004000000dd0000000a00000000000000", @ANYRES32, @ANYBLOB='\x00\x004'], 0x50) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a"], 0x64}, 0x1, 0x0, 0x0, 0x8040}, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="24000000420007012abd700000000000017c0000100004000a"], 0x24}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) socket$igmp(0x2, 0x3, 0x2) (async) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @broadcast, 0x4e21, 0x3, 'fo\x00', 0x11, 0x3240, 0x3a}, {@loopback, 0x4e23, 0x4, 0xc3, 0x12d5c, 0x12d5c}}, 0x44) (async) socket$inet(0x2, 0x2, 0x0) (async) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) (async) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100"], 0x57) (async) socket$netlink(0x10, 0x3, 0x0) (async) writev(r2, &(0x7f0000000780)=[{&(0x7f0000000180)="200000001300034700bb65e1c3e4ffff01000000010000005600000025000000", 0x20}], 0x1) (async) close(0x3) (async) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x2400080c) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x203b}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048054}, 0x8000) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'gretap0\x00'}) (async) 2.94700874s ago: executing program 3 (id=3422): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) getsockopt$rose(0xffffffffffffffff, 0x104, 0x7, 0x0, 0x0) bind$rds(r0, &(0x7f0000000280)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="170900100000fedbdf25010000000500070000000000080009000000000008000a0000000000060002000100000014001f00ff0100000000000000000000000000011400200000000000ffff0000000000000000000111890b3ddbb27ad75caa769b41ffb9e1b58480a6b4647d2635ca57d65ca75b805e"], 0x5c}, 0x1, 0x0, 0x0, 0x44}, 0x0) sendmsg$rds(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$kcm(0xa, 0x5, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffffd}, 0x18) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x8936, &(0x7f0000000000)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) ppoll(&(0x7f0000000500)=[{r4}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r7 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) close(r7) write$cgroup_int(r0, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) mmap(&(0x7f00007a6000/0x3000)=nil, 0x3000, 0x100000c, 0x22051, r0, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0xd, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r8, 0x0, 0xe, 0x0, &(0x7f0000000040)="c1188e19b95d02ff4284860186dd", 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x4, &(0x7f0000000000)=ANY=[@ANYRES16=r8], &(0x7f00000000c0)='GPL\x00', 0x4, 0x9c, &(0x7f0000001300)=""/156, 0x0, 0xa}, 0x94) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xba0c29e690d41d4b, 0x20000000ec071, 0xffffffffffffffff, 0x0) 2.946702946s ago: executing program 1 (id=3423): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b000000000000000000035f008080000000050041532ea4d7d016ebfd6c699f0c272f40f47cbdd56a042f6cc7505571140f6d4ea4a95f4495ee35e070331b89cb3de717bb3c8d37929954711cc298eea2aba8c40b3ba6bfc8c301bdfb5ff188ccdb7afbd389acb6921911f92fa93eaf50491d34f7330826458f6ea1ba711fe1f41cd4a4fa9eba1a359f6104fdc2", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) getsockopt(r2, 0x111, 0x6, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x14, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000200000000000000fcffffff18110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000010000008500000086000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r3, 0x0, 0x8, &(0x7f00000000c0)=ANY=[@ANYRESDEC], 0x1) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @local}, &(0x7f0000000040)=0xc) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x33, r4}) ioctl(0xffffffffffffffff, 0x8916, &(0x7f0000000000)) getsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000100)={@private0}, &(0x7f0000000200)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000e000000c500000001f0ffff95"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r6 = socket(0x28, 0x5, 0x0) r7 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r7, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r7, 0x4) sendmsg$IPSET_CMD_GET_BYINDEX(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) connect$vsock_stream(r6, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r6, &(0x7f0000000100)=[{{0x0, 0xffffffc2, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0) r8 = accept4$unix(r7, 0x0, 0x0, 0x800) recvfrom$unix(r8, &(0x7f0000000140)=""/248, 0x1ffd4, 0x0, 0x0, 0x0) r9 = socket$inet6(0xa, 0x80002, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x3b}, @in6=@local, 0x0, 0x0, 0x0, 0xc9c, 0xa, 0x10, 0x30, 0x0, 0x0, 0xee01}, {0x0, 0x7f, 0x7, 0x3, 0x0, 0xfffffffffffffffd, 0x5, 0xffffffffffffffff}, {0xffffffff, 0x0, 0x0, 0x5}, 0x0, 0x0, 0x1, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x84811}, 0x0) sendto$inet6(r9, 0x0, 0x0, 0x800, &(0x7f0000000080)={0xa, 0x4e20, 0x104, @local}, 0x1c) r11 = socket$inet_sctp(0x2, 0x1, 0x84) poll(&(0x7f0000000100)=[{r11, 0x84}], 0x1, 0x3ff) sendto$inet(r11, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) 2.15827372s ago: executing program 4 (id=3428): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0x18, &(0x7f0000000840)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000001c00000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r1, 0xfffff000, 0xe, 0x0, &(0x7f00000000c0)="61df712bc884fed5722780b605a7", 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x61, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x2f, 0x9, @dev={0xac, 0x14, 0x14, 0x10}, @remote}}}}}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000d40)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x28801}, 0x8000002) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r6, 0x18000000000002a0, 0x36, 0x0, &(0x7f0000000040)="d2ff03cb4608008cb89e08d986dd8af46937a3f6552f286b9a0a3f7e6ac17a835a83245ac19eb53fa94abbf023538509a259c8051dfc", 0x0, 0xb22a, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r9, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000a80)={0x2c, r10, 0x615, 0x70bd2c, 0x25dfdbfb, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x30000000}, 0x24000042) r11 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'veth0_to_bridge\x00', 0x0}) setsockopt$packet_add_memb(r11, 0x107, 0x1, &(0x7f0000000000)={r12, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_add_memb(r11, 0x107, 0x1, &(0x7f00000001c0)={r12, 0x1, 0x6, @multicast}, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r8, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)={0xd0, r10, 0x800, 0x70bd29, 0x25dfdbfc, {}, [@HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x8082}, 0x80) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="700000001000010025bd7004fbdbdf2500000000", @ANYRES32=r7, @ANYBLOB="30080600034a04000a000100aaaaaaaaaa1f000044001680400001800c0007"], 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) 1.907254148s ago: executing program 1 (id=3429): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0xa}, {0x0, 0xfff1}, {0x1, 0x9}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x81000, 0x8d5, 0x0, 0x4, 0x80000001, 0x4, 0x1, 0x0, 0x800, 0xf, 0x1e, 0xe, 0x11, 0x1, 0x4, 0x8}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40099}, 0x4000000) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)={'wlan0\x00', @random="f688b2409cfc"}) 1.906688303s ago: executing program 3 (id=3430): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000340)="703aed9e3191c530f94c9366dd8d", 0x0, 0x5043, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x4c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) 1.890810598s ago: executing program 2 (id=3431): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x10, 0x3, 0x0) socket$kcm(0xa, 0x1, 0x0) r1 = socket(0x2, 0x3, 0x9) getsockname$packet(r1, 0x0, &(0x7f0000000040)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000180)='kmem_cache_free\x00', 0xffffffffffffffff, 0x0, 0x4000000000001}, 0x18) r2 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[], 0x54}, 0x1, 0x0, 0x0, 0x40814}, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec85"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="20000000690003050000000000000000000000000000000008c9f26fd04d9cb5"], 0x20}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback, 0xfffffffd}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r3, 0x5452, &(0x7f0000000140)=0xf9c) writev(r3, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(0x4) 1.781858693s ago: executing program 0 (id=3432): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000}, 0x94) r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}], 0x1, 0x0) 1.638953706s ago: executing program 3 (id=3433): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0xf, &(0x7f00000007c0)=ANY=[@ANYBLOB="18fcffffffffffffff0000000200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900001700000056090100000a000027000000000000009c23000000000000b5030000010000008500000076000000b7000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$netlink(0x10, 0x3, 0xa) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'vxcan1\x00'}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r1, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x1a, &(0x7f0000000200)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000240), &(0x7f0000000280), 0x8, 0x9f, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmmsg$alg(r3, &(0x7f0000005100), 0x0, 0x20000010) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000480)={0x58, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0xfff2}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x24004080}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r1, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000440)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xcf, &(0x7f0000000500)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x16, 0x8, 0x8, &(0x7f00000005c0)}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000740)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'lo\x00'}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r7, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r9, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0xff, r9}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000880)=0x14) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r12, {0x5}, {}, {0xa, 0xfff1}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_RSHIFT={0x8, 0x4, 0xebc4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0xc010) 1.623682425s ago: executing program 0 (id=3434): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000002500000000000800da41190018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000fcff00008500000086000000bf0900000000000055090100800400009500000000000000bf91000000000000b7020000030000008500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0xb, 0xffe, &(0x7f0000000cc0)=""/4094, 0x41100, 0x6, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) 1.565099229s ago: executing program 1 (id=3435): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000008c0)=@newsa={0x178, 0x10, 0x1, 0x0, 0x25dfdbfc, {{@in=@empty, @in6=@dev={0xfe, 0x80, '\x00', 0x16}, 0x0, 0x0, 0x81e, 0x4, 0x0, 0x20, 0x80, 0x21}, {@in=@multicast1, 0x0, 0x33}, @in=@loopback, {0x401, 0x0, 0x8, 0x0, 0xffffffff, 0x3, 0x0, 0x8000000}, {0xfffffffffffffffd, 0x0, 0xfffffffffffffffd, 0x80000001}, {0x0, 0x1, 0xfffffffc}, 0x0, 0x0, 0xa, 0x4, 0x1, 0x40}, [@algo_auth={0x88, 0x1, {{'rmd160\x00'}, 0x200, "d5deb33e8d02d5b4c6cdd277a6d0adde7a89a2677f61d0a96eb8706a52b9fbdc312b5aeab8894c493c358ef76ec179b21865e1b6f29b2da7d564f2bcd96ec67f"}}]}, 0x178}, 0x1, 0x0, 0x0, 0x24040021}, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r1, 0x1) recvmmsg(r1, &(0x7f0000001d00)=[{{0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000001d40)=""/4078, 0xfee}, {&(0x7f0000000340)=""/141, 0x8d}, {&(0x7f0000002d40)=""/4116, 0x1005}, {&(0x7f0000000400)=""/6, 0x6}, {&(0x7f0000000440)=""/231, 0xe7}], 0x5}}], 0x3ffffbd, 0x0, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000000)={0x2042, 0x4, 0x1}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x10000000}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = socket$netlink(0x10, 0x3, 0xc) r5 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000000040)="ff02040000b5ffffffffffffffff2e2be82db1af00000000", 0x18) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e20, 0x1000040, @private1={0xfc, 0x1, '\x00', 0xa}, 0xae3c}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r5, 0x29, 0x3b, &(0x7f0000000200)=ANY=[@ANYBLOB="322bf2d90a000000"], 0x8) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r5, 0x29, 0x37, &(0x7f00000000c0)={0x32}, 0x8) sendmmsg$inet6(r5, &(0x7f0000002940)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}], 0x62, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="070000000400000008020000210000"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000001850000001b000000b70000000000070095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r7}, 0x18) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="020300000e000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000400000020001000000000000000a18ff00000005000500000000000a"], 0x70}}, 0x0) bind$netlink(r4, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfb, 0x20}, 0xc) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00', 0x0}, 0x30) r11 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_subtree(r11, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r10], 0x8) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="a800000000010904000500000000000002000000240001801400018008000100e000000108000200ac1e01010c00028005000100000009002400028014000180080001000000010908000200ac1e00010c000280050001000000000044000f800800014000000006080003400000002b080003400000000808000240000000400800014000000000fb0001400000000708000140000044f10800034000000003080007"], 0xa8}}, 0x0) unshare(0x22020600) openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) 1.443090306s ago: executing program 4 (id=3436): r0 = socket$xdp(0x2c, 0x3, 0x0) unshare(0x2c020400) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000040)=0x20000, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=@base={0x12, 0x5, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r2}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r1}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r2, &(0x7f0000000040)}, 0x20) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000080)='cpuacct.usage\x00', 0x2, 0x0) ioctl$BTRFS_IOC_SEND(r3, 0x40489426, &(0x7f00000000c0)={{r4}, 0x6, &(0x7f0000000040)=[0xe, 0x4, 0x2, 0x4, 0x8000000000000000, 0x6], 0x3, 0x0, 0x1}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=@framed={{0x4e, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0x7b}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) sendfile(r5, r4, 0x0, 0x4) r6 = socket(0x10, 0x803, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000001800090000080000000000001c140000fe00000100000000080013"], 0x24}}, 0x0) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r7, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x54, 0x1, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xdada}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x745}, @CTA_TIMEOUT_GRE_UNREPLIED={0x8}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x40) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000180)={0x0, 0xc35}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000280)={r9, 0x4}, &(0x7f00000002c0)=0x8) sendmsg$FOU_CMD_ADD(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000) getsockname$packet(r6, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) connect$inet(r6, &(0x7f0000000140)={0x2, 0x4e23, @multicast1}, 0x10) 1.441993177s ago: executing program 0 (id=3437): r0 = socket(0x10, 0x803, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a05000000000000000000070000000900010073797a300000000060000000090a010400000000000000000700000008000840000000010900010073797a30000000001c000980100002800c0001800800014000000002080201405fffffff080005400000000408000a4000000000090002"], 0xa8}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="61000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000080)=@ethtool_rxfh={0x1}}) 1.269670419s ago: executing program 4 (id=3438): syz_emit_ethernet(0x16a, &(0x7f0000000180)=ANY=[@ANYBLOB="ffffffffffffce4013d30da28100420086dd60d37fe401303aff0000000000bbffd3f100000000000000000000000001860090780000040a0000000032e90000030aa78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e2503774d06223e0ae6d8e01e874c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac17090dbaf736b41e5af050201010000000000000000000000001918fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129e08c8b83806a610ad8477a2499a9a0527f75b655a6653d0363a9793b9d64ebeea07d68423e90280409de160bf38557275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f373452f8854ca016e2d10a98bb17b60a9aa9f843dd8b84b3ff9fa363eb1cbdbe1ca6f7b31f2000000000000"], 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) write$tun(r0, &(0x7f0000000340)={@void, @val={0x2, 0x0, 0x8, 0x9, 0x3, 0x7}, @ipv4=@icmp={{0x14, 0x4, 0x1, 0x12, 0xd9, 0x66, 0x0, 0x8, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0x2b}, @broadcast, {[@generic={0x83, 0x7, "4233059b19"}, @generic={0x94, 0x8, "f35efff2b788"}, @ra={0x94, 0x4}, @rr={0x7, 0x27, 0x2e, [@broadcast, @private=0xa010101, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x2b}, @empty, @multicast2, @broadcast, @remote, @multicast2]}]}}, @parameter_prob={0xc, 0x0, 0x0, 0xdc, 0xf6, 0x0, {0x1f, 0x4, 0x1, 0x22, 0x4, 0x68, 0x31, 0x4, 0xe, 0x0, @multicast1, @loopback, {[@cipso={0x86, 0x26, 0xffffffffffffffff, [{0x1, 0x7, "e9e84ab6e4"}, {0x1, 0x10, "f184cd8f78f738ab4d8a397b7c3f"}, {0x6, 0x9, "1fc3669fcac935"}]}, @lsrr={0x83, 0x13, 0x15, [@loopback, @loopback, @dev={0xac, 0x14, 0x14, 0x14}, @multicast2]}, @timestamp={0x44, 0x14, 0x6b, 0x0, 0xd, [0x343, 0x9, 0x6e3, 0x5]}, @lsrr={0x83, 0x1b, 0xab, [@remote, @remote, @rand_addr=0x64010102, @remote, @remote, @empty]}]}}, "c433b858e0"}}}, 0xe3) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x15, 0x8, 0x2, 0x3, 0x0, 0x70bd29, 0x9e32, [@sadb_x_nat_t_type={0x1, 0x14, 0x3}]}, 0x18}}, 0x4800) 1.229517358s ago: executing program 3 (id=3439): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x6, 0x23, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xb12f}, [@map_idx_val={0x18, 0x8, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf7b}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe52}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_query, @snprintf, @map_val={0x18, 0x2, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0x3}]}, &(0x7f0000000140)='syzkaller\x00', 0xa4b0, 0x24, &(0x7f0000000180)=""/36, 0x41100, 0x6b, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x3, 0x10, 0x5, 0x7}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000280)=[{0x4, 0x4, 0xb, 0x5}], 0x10, 0x1ff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r0, 0x0, 0x1, 0x42, &(0x7f0000000380)='\n', &(0x7f00000003c0)=""/66, 0x6d, 0x0, 0xad, 0x74, &(0x7f0000000440)="e2a7b690b0ff23ae5f55a9cf16af511e6d9e01e21e45bb794c0db3aba58722fccad6885a047a2d5e27ccc80e201e1051294f28c45066458776d421a058fca609c4b0d3f2a0f6a6f3bfd84565519a03ae186d7b3a8210aa1f5d25b381da4beaff218da88235c368132554a6e59f8e8d50bda0d024be9711a65acc118be260254a5a75b3b6cfbb307db0093ea258597d9161c7e4ee7d6c85b2370d913a3cc9b544900bcf8a69c1bba832ac91e3c6", &(0x7f0000000500)="afe417fec37348d1d9cadc5d8462d32ff38ed6e229a8bcc8456cf4e00fb31dc70af0f33d605aebeeda25494651a021ef51a42194744feeee6448263db7cb974c42ced155b1f1358a42fe778ca444a841fc94e94bb221e7ca66bb0baaabe2837f5c97fc6c9a551dc31c93aa37aef496b2019c1ad6", 0x3, 0x0, 0xfffff001}, 0x50) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000600)={0xffffffffffffffff}) sendto$inet(r1, &(0x7f0000000640)="c3cd0e331ca578661c446d330d5b73b3eb6b3e21bf787c4a56d98fc3c1eb6311859906e2a4090e6274e7fb40188f0cf530807450baf1a890a1bdada468c58b9475506b206b123497ba0b47395573dff4cf3adb9abca5df386463ca7c4e1bcbaddb83a6de34f83a87f18a6696f42f5a932033342432c4cf06461d69d2d549b5a3d2d1f6884a6409c6bf5bb3af83d653a71182611389b7b1c0c9b81ce9e2eaf9", 0x9f, 0x80, &(0x7f0000000700)={0x2, 0x4e22, @loopback}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r0, 0x0, 0xb6, 0x54, &(0x7f0000000740)="39ff7af81eaf8222b41e48e09a7b9e2399692186309237e1e2371d1b6264ba1c1b9e439791284dbf53dd8b10f583e82b5e84805c49a6fdd02d1551d448d329a6fa238c0f64cf7bad67e943ee3512ac39625772ef14160d61cff0526161f2b32af818d9947d6f7dc2f4982639a5db7123a19de4e0fcb53ad4c1ca320a4f96d949089b99143516b9e15467f1b1979b50790212f602c939ade2cba5a27bbd54f5dfbec913a05ddf165ce25ed0800df25eb909af1bdca81b", &(0x7f0000000800)=""/84, 0x4, 0x0, 0xbd, 0x0, &(0x7f0000000880)="9cf1795455a5ee95e6ebf3eef54cb64f5b0c2a2ec7460599b5e506b6e9bcfdcdedeeeb4c8b98371c51ec7c4b7259f3764affb091cd6e18c9e8e51cd4c0d2d39198981c6d7deefa5fce29c6836cd66e52aa190f2e16e6ba7216f27ea2cc8856c36de0bac2a81fe4dc0277ab6c0951c9024358550f2ede6b1b90a88e7c4680c6e7a3eb29c4048ba292ba78c773bc133ae4b1a4cf6f93e42c12aad483980bf82f40e39a056785c717a97ca64028a8b5f4f3d9e2786224e917cea2a483bbf5", &(0x7f0000000940), 0x0, 0x0, 0x8}, 0x50) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, &(0x7f0000000a00)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) connect(r1, &(0x7f0000000a40)=@l2tp={0x2, 0x0, @multicast2, 0x3}, 0x80) bind$netlink(r1, &(0x7f0000000ac0)={0x10, 0x0, 0x25dfdbfc, 0x100}, 0xc) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000b40), r1) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x1c, r2, 0x200, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x44) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000c80)=@o_path={&(0x7f0000000c40)='./file0\x00', 0xffffffffffffffff, 0x4000, r1}, 0x18) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000e00)={&(0x7f0000000cc0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x98, 0x9, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_ADT={0x1c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x3}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}}]}, @IPSET_ATTR_DATA={0x68, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}, @IPSET_ATTR_IFACE={0x14, 0x17, 'vlan0\x00'}, @IPSET_ATTR_IFACE={0x14, 0x17, 'vcan0\x00'}, @IPSET_ATTR_IFACE={0x14, 0x17, 'team_slave_1\x00'}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty}}, @IPSET_ATTR_IFACE={0x14}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000000) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000e40)=0xa, 0x4) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000001f00)={@private2, 0x0}, &(0x7f0000001f40)=0x14) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000002300)={r0, 0xe0, &(0x7f0000002200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000002000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x2, &(0x7f0000002040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000020c0)=[0x0, 0x0], 0x0, 0x49, &(0x7f0000002100)=[{}, {}], 0x10, 0x10, &(0x7f0000002140), &(0x7f0000002180), 0x8, 0x9a, 0x8, 0x8, &(0x7f00000021c0)}}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000002380)={0x14, 0x5, &(0x7f0000000e80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3}, [@map_idx_val={0x18, 0x0, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x310}]}, &(0x7f0000000ec0)='syzkaller\x00', 0xf1, 0x1000, &(0x7f0000000f00)=""/4096, 0x40f00, 0x4, '\x00', r3, @fallback=0x10, 0xffffffffffffffff, 0x8, &(0x7f0000001f80)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000001fc0)={0x4, 0x8, 0x3, 0x809}, 0x10, r4, r0, 0x4, 0x0, &(0x7f0000002340)=[{0x5, 0x3, 0xb, 0x4}, {0x2, 0x5, 0x9, 0xe}, {0x1, 0x2, 0xa, 0x9}, {0x4, 0x2, 0x8, 0x6}], 0x10, 0x4}, 0x94) r6 = epoll_create(0x7) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002640)=@bpf_lsm={0x1d, 0x11, &(0x7f0000002440)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd079}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x39}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @jmp={0x5, 0x1, 0x0, 0x0, 0x2, 0x6, 0xfffffffffffffff0}, @exit], &(0x7f0000002500)='syzkaller\x00', 0x1, 0x3c, &(0x7f0000002540)=""/60, 0x40f00, 0xc5, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000002580)={0x3, 0x2}, 0x8, 0x10, &(0x7f00000025c0)={0x2, 0x1, 0x1e1, 0xb}, 0x10, r4, 0x0, 0x0, &(0x7f0000002600)=[0x1, r5, r5, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0x80000000}, 0x94) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000002700)={0x40000000}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000002780)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(r8, &(0x7f0000002840)={&(0x7f0000002740), 0xc, &(0x7f0000002800)={&(0x7f00000027c0)={0x28, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x40010) r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000028c0), r1) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r1, &(0x7f0000002980)={&(0x7f0000002880)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000002940)={&(0x7f0000002900)={0x28, r10, 0x1, 0x70bd28, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x44044000}, 0x40) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nbd(&(0x7f0000002a00), r8) sendmsg$NBD_CMD_STATUS(r11, &(0x7f0000002ac0)={&(0x7f00000029c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002a80)={&(0x7f0000002a40)={0x38, r12, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xfffffffffffffffc}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x80c0}, 0x1) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000002b00)={0xc0, 0x8, 0x8000, 0x80, 0x8000, 0x7, 0x1, 0x3fd7, 0x0}, &(0x7f0000002b40)=0x20) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000002b80)={r13, 0x7a, "6f665a9371207160fcab0643b2615a8841037f6f1481664c5b86adc3f94b8b0ec36dc66b383c9487e8ec1abf6bb8103224412405e674a6861ee5987a14a8e7ec716dfff258540ce943d49635da8c4770275e4f8814f8f477495098551945ca4335c9686b97c0bbae9a3b26ac3ea883b20c82263ac9527e1d849b"}, &(0x7f0000002c40)=0x82) socket$netlink(0x10, 0x3, 0xa) 1.085117138s ago: executing program 3 (id=3440): socket(0x10, 0x803, 0x0) (async) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)={0x18, r3, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x818}, 0x20000004) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020100000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a32000000001400000011001f"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xf}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x80}}, 0x40) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x3, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffe}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r4}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r4}, 0x10) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000200)) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_GET(r6, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000e40)={0x34, r7, 0x1, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x34}}, 0x800) (async) sendmsg$ETHTOOL_MSG_FEATURES_GET(r6, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000e40)={0x34, r7, 0x1, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x34}}, 0x800) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000980)=""/241, 0xe3}, {&(0x7f0000000b80)=""/240, 0xe8}, {&(0x7f0000003500)=""/4090, 0x1000}, {&(0x7f0000000ac0)=""/169, 0xa9}, {&(0x7f0000000880)=""/150, 0x86}, {&(0x7f00000005c0)=""/146, 0x92}, {&(0x7f0000000400)=""/139, 0x8b}, {&(0x7f0000000c80)=""/271, 0x10f}, {&(0x7f0000000540)=""/88, 0x58}], 0x9}, 0x11}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe79}, 0xfffffff8}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0xffffffffffffff1d, 0x0}}], 0x15, 0x2102, 0x0) (async) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000980)=""/241, 0xe3}, {&(0x7f0000000b80)=""/240, 0xe8}, {&(0x7f0000003500)=""/4090, 0x1000}, {&(0x7f0000000ac0)=""/169, 0xa9}, {&(0x7f0000000880)=""/150, 0x86}, {&(0x7f00000005c0)=""/146, 0x92}, {&(0x7f0000000400)=""/139, 0x8b}, {&(0x7f0000000c80)=""/271, 0x10f}, {&(0x7f0000000540)=""/88, 0x58}], 0x9}, 0x11}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe79}, 0xfffffff8}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0xffffffffffffff1d, 0x0}}], 0x15, 0x2102, 0x0) ioctl$PPPIOCGFLAGS1(r5, 0x8004745a, &(0x7f0000000080)) 1.002984747s ago: executing program 4 (id=3441): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000002880), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x1c, r3, 0x711, 0x70bd2a, 0x25dfdbfc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x28008000}, 0x40000) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r3, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x2514000}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x9}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xe878}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x1) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="400000006800010003001000fdffff7f00000000000000000c000200010000001500000014000c8006000110d43f000008000300050000000600030001"], 0x40}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newtaction={0x6c, 0x30, 0x10b, 0x0, 0x0, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x3, 0x800000}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x5, 0x5, @val=0x3}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}}, 0x0) 990.032459ms ago: executing program 0 (id=3442): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x3) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaa320180c2000000080045000028000000000006907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c02000900000001"], 0x0) syz_emit_ethernet(0x38, &(0x7f0000000580)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x4}, {"c516"}}}}}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xffe0}, {0xf}, {0xe}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x4, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4040c00) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x5, 0x2, 0x7, 0x2, 0x1}, 0x50) socket$inet6(0xa, 0x5, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x10, 0x3, 0x0) socket$kcm(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x11, 0x80a, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r4, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x54}, 0x1, 0x0, 0x0, 0x40814}, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000ac1814bb0100000001000000ffffffff"], 0x14) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000140)={'ipvlan1\x00', &(0x7f0000000240)=@ethtool_link_settings={0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x1, 0x0, 0xffffff75, 0x400000, 0x0, 0x4]}}) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000940)={0x3, 0xc, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r6, 0x0, 0xe, 0x0, &(0x7f00000000c0)="e0b9545dd30a3731677b2d0bfa91", 0x0, 0x27cb, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) getsockname(r0, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, &(0x7f0000000140)=0x80) 947.023158ms ago: executing program 2 (id=3443): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0xc, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa1000000000000070100144f0000ffb702000008000000b7030000008000202aa31804d0850000007100000085000000a000000095"], &(0x7f0000000200)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x40f00, 0x5f, '\x00', r1, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xc3) setsockopt$ax25_int(r3, 0x101, 0x5, &(0x7f00000008c0)=0x7, 0x4) ioctl$BTRFS_IOC_SET_FEATURES(r2, 0x40309439, &(0x7f0000000000)={0x3, 0x4, 0x1}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0x10, 0x38, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 859.157613ms ago: executing program 4 (id=3444): unshare(0x2c020400) (async) r0 = socket$inet6(0x10, 0x2, 0x6) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x14, 0xfc, 0x0, 0xfffffffc}, {0x6, 0x6, 0x7, 0x6}]}, 0x10) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r1}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x13, &(0x7f0000000580)=ANY=[@ANYBLOB="18080000000010000000000000000000851000000600000018000000", @ANYRESOCT=r2, @ANYBLOB="00000000000000116608ffff0000100018000000000000000000000000000a009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa11c000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x8}, 0x94) pwrite64(r3, 0x0, 0x0, 0x200) (async) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) (async) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async) socket$packet(0x11, 0x2, 0x300) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x24dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0xb, 0x9}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket(0x400000000010, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd21, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0xc}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8848}, 0x20044814) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000500)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000000000000100000409000000010000000000000000000000002e2e009190988eb49b63dc3f9e0626818740f6c4071857083b9852e747b9e3652a843c4d0797bef98afa3c8a4fe9eaa22f3b006e40b172e6b7d8b04e"], 0x0, 0x34, 0x0, 0x1, 0x3ff}, 0x28) r13 = socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000000010c30000000003000000851000000600000018000000e23e64c1961c2452d30d3d8d3b0e5ca90784a5b497e6e934d474bccb8e77852bcf6bfdd53820004f429084200639e239cc40bce0c2f15de173b266ae0d6714471d91f25d0a220083cb05786346ebae501011a84e52fba53eb7f998b722249c31894a909dc9be2babbcc77ae2107bf7af118045b243b3d78ea48a73bd25c39c275db66f9cb871b7ad8f082a9c5127c85fda49194e75590b7bc84ebd7db9b34382df2ca248c0434a0e58fda0f928884dd77eed6bc959ab33a88e0e2126f1f7729d7166ee54f14065", @ANYRESDEC=r13, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x1e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000000}, 0x94) 845.941016ms ago: executing program 2 (id=3445): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="200000005e00010000000000000000000c000000010000000600008004000180"], 0x20}], 0x1}, 0x0) (async) socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) bind$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x4, 0x6, @remote}, 0x14) (async) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket(0x1e, 0x4, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f00000000c0)) (async) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, 0x0, &(0x7f0000000100)) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) (async) recvmmsg$unix(r3, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/uts\x00') (async) unshare(0x6a040000) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$devlink(&(0x7f00000016c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r5, 0x0, 0x0) (async) sendmmsg(r3, &(0x7f00000030c0), 0x0, 0x9200000000000000) (async) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bind$packet(r2, &(0x7f0000000000)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @link_local}, 0x14) (async) syz_emit_ethernet(0x19, &(0x7f0000000140)=ANY=[], 0x0) (async) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd4, 0x0, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000000206050000000000000000000000000305000100070000000500040003000000050019000700000034000780050014003e0000000500070073000000050003000600000008001740000000010500030005000000050015000c0000000940020073797a3000000000"], 0x6c}, 0x1, 0x0, 0x0, 0x4004891}, 0xc0) (async) r7 = accept4$rose(0xffffffffffffffff, &(0x7f0000000240)=@full={0xb, @dev, @rose, 0x0, [@default, @default, @null, @netrom, @netrom, @rose]}, &(0x7f0000000280)=0x40, 0x800) ioctl$SIOCRSGL2CALL(r7, 0x89e5, &(0x7f00000002c0)=@null) (async) socket$nl_xfrm(0x10, 0x3, 0x6) 823.086082ms ago: executing program 3 (id=3446): pipe(&(0x7f0000000080)={0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3a, 0x0) tee(r0, r2, 0x8f5, 0x100000000000000) write$cgroup_type(r2, &(0x7f0000000180), 0x9) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYRES8=r2], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffe81}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r3}, 0x10) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3000008, 0x32, 0xffffffffffffffff, 0xa84a2000) pipe(0x0) 347.190561ms ago: executing program 4 (id=3447): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xfffffffd, 0x6}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x7}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x19, &(0x7f0000000000)={&(0x7f00000004c0)=@newqdisc={0xac, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x80000, {0x0, 0x0, 0x0, r7, {0x0, 0x11}, {0xffe6, 0xb}, {0x2, 0xc}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x5}}, @qdisc_kind_options=@q_drr={0x8}, @qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x7fffffff}}}, @qdisc_kind_options=@q_htb={{0x8}, {0x3c, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x3}, @TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x49}, @TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x5}, @TCA_HTB_DIRECT_QLEN={0x8}, @TCA_HTB_INIT={0x18, 0x2, {0x3, 0x51}}]}}, @TCA_RATE={0x6, 0x5, {0x1, 0x93}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x9}]}, 0xac}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4000000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 340.882827ms ago: executing program 2 (id=3448): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r1, &(0x7f00000000c0), 0x9) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0xb, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r2}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r3) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) ioctl$BTRFS_IOC_LOGICAL_INO(r1, 0xc0389424, &(0x7f0000000200)={0xf, 0x28, '\x00', 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0]}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xd, 0x4, 0x4, 0x7, 0x0, r4, 0x10000}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x2008031, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0xa, 0x1, 0x106) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x80f, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r8, &(0x7f0000001380), &(0x7f0000000000)=""/10, 0x2}, 0x20) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000000), 0x4) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r7) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) sendmsg$kcm(r6, &(0x7f00000019c0)={&(0x7f0000000300)=@l2tp6={0xa, 0x0, 0x0, @dev, 0x5}, 0x80, 0x0}, 0x24004059) close(r6) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000002100210126bd7000000000000a000000000000000000000008000a00040000"], 0x24}}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000880), 0xde9, r5}, 0x38) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x74, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0x9, 0xff0c, 'pptp\x00'}}]}, 0x74}}, 0x0) 338.429421ms ago: executing program 0 (id=3449): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000}, 0x94) r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000000880)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}], 0x1, 0x0) (fail_nth: 4) 266.390019ms ago: executing program 2 (id=3450): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff000000000300000000000000000000000200000000000000000000000000000a0300000000000000000000ff"], 0x0, 0x56}, 0x20) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000002e00)={0xc, 0xf, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000fcffffff000000000000000218110000", @ANYRES32=r1, @ANYBLOB="0000000500000000b702000014000000b7030000000000708500000083000000bf0900000000000055090100000000009500000000000000bf9100000000008500000085000000b700005033bf03009500"/92], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01060000000000000000090000003c0004801300010062726f6164636173742d6c696e6b000024000780080005000000000008000300ff00"], 0x50}}, 0x0) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) 126.92908ms ago: executing program 0 (id=3451): sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) socket$nl_route(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x48, r3, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c1937}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x48}}, 0x20000000) 0s ago: executing program 2 (id=3452): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r0}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) unshare(0x20400) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) getpid() syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e24, @loopback}}, 0xde19, 0x5}, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_ifreq(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'bond0\x00', @ifru_names='wlan1\x00'}) getpeername$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r3, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r5}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) r6 = openat$cgroup_devices(r2, &(0x7f0000000240)='devices.allow\x00', 0x2, 0x0) sendfile(r6, r6, &(0x7f00000001c0)=0x1000000000e17, 0x400000000004) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)=ANY=[@ANYBLOB="180000007d0001060000000000000000070007000000000069e6838624357c5661391557c188a5675599fbc0abb3aa3afebda799820277"], 0x18}], 0x1}, 0x0) r7 = socket(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x14c, 0x24, 0x3fe3aa0262d8c783, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xfff3}, {0x0, 0x2}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfc}}, @TCA_CHOKE_STAB={0x104, 0x2, "1c1f15f3c5e23d27d29a00dd397b5c11d4cf201c1a0619fc314514ab71788e4079fdbe4f2a0d60b83a7d04c1d709981110401e5e10685abbad9b6f18e303e902c77244658a099a36fa486760c4941ea7df64250af29a4935de5d244f0549d93679b3d4fb358c2076bc6b1c9735ff8243f088e67455ba14975d12e5903ceeb7a23d62ecb5253ad444ef726b58a00f13f22ccc84cc06c9912b621c3ddc5f3229dc84c0880b5c6faefe33413b34a146e592fc15ae234dac030f05bb99eab08dfd2cb5659c6fc21fb7da6c380165ddde4659e75538dc864a53f691e1d785d6e6f73a03abf2120bce67e2d50075fd811b3e03a1cc2d66335bdee19738a0c1fb79b77d"}]}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) kernel console output (not intermixed with test programs): device bond7 [ 418.523855][T14216] bond11: entered promiscuous mode [ 418.529549][T14216] bond11: entered allmulticast mode [ 418.547293][T14216] 8021q: adding VLAN 0 to HW filter on device bond11 [ 418.782849][T14233] lo speed is unknown, defaulting to 1000 [ 418.797298][T14233] lo speed is unknown, defaulting to 1000 [ 418.822702][T14238] wg1: left allmulticast mode [ 418.836537][T14238] bridge_slave_0: left allmulticast mode [ 418.837475][T14237] netlink: 'syz.1.2173': attribute type 39 has an invalid length. [ 418.844280][T14238] batadv_slave_1: left promiscuous mode [ 418.868915][T14238] bond2: left promiscuous mode [ 418.874506][T14238] bond3: left promiscuous mode [ 418.893467][T14240] netlink: 'syz.1.2173': attribute type 5 has an invalid length. [ 418.913710][T14238] gretap2: left promiscuous mode [ 419.453769][T14269] sch_fq: defrate 128 ignored. [ 419.503251][T14269] netlink: 'syz.1.2180': attribute type 3 has an invalid length. [ 419.712109][T14277] netlink: 'syz.3.2182': attribute type 21 has an invalid length. [ 419.729428][T14274] lo speed is unknown, defaulting to 1000 [ 419.729669][T14277] netlink: 'syz.3.2182': attribute type 1 has an invalid length. [ 419.748954][T14274] lo speed is unknown, defaulting to 1000 [ 419.973991][T14287] geneve2: left promiscuous mode [ 419.979676][T14287] geneve2: left allmulticast mode [ 419.989122][T14287] bond1: left promiscuous mode [ 420.002663][T14287] bond2: left promiscuous mode [ 420.012958][T14287] bond5: left promiscuous mode [ 420.026855][T14287] wireguard0: left promiscuous mode [ 420.040705][T14287] veth5: left promiscuous mode [ 420.068546][T14287] veth7: left promiscuous mode [ 420.083964][T14287] vlan3: left allmulticast mode [ 420.090754][T14287] bridge0: left allmulticast mode [ 420.097465][T14287] bridge0: left promiscuous mode [ 420.102963][T14287] macvtap1: left promiscuous mode [ 420.108275][T14287] macvtap1: left allmulticast mode [ 420.134228][T14287] bridge5: left allmulticast mode [ 420.140945][T14287] bond11: left promiscuous mode [ 420.146649][T14287] bond11: left allmulticast mode [ 420.153453][ T7954] lo speed is unknown, defaulting to 1000 [ 420.178990][ T8029] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.195396][ T7954] syz0: Port: 1 Link DOWN [ 420.205586][ T8029] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.214398][ T8029] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.243507][ T8029] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 420.249682][T14292] __nla_validate_parse: 8 callbacks suppressed [ 420.249698][T14292] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2186'. [ 420.523284][T14307] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2191'. [ 420.539128][T14307] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2191'. [ 420.549096][T14307] netlink: 5 bytes leftover after parsing attributes in process `syz.0.2191'. [ 420.596178][T14311] lo speed is unknown, defaulting to 1000 [ 420.613566][T14311] lo speed is unknown, defaulting to 1000 [ 421.695312][ T7414] page_pool_release_retry() stalled pool shutdown: id 63, 1 inflight 60 sec [ 422.023618][T14366] lo speed is unknown, defaulting to 1000 [ 422.042925][T14366] lo speed is unknown, defaulting to 1000 [ 422.258604][T14378] lo speed is unknown, defaulting to 1000 [ 422.369609][T14382] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2211'. [ 422.429892][T14382] xfrm1: entered promiscuous mode [ 422.462370][T14382] xfrm1: entered allmulticast mode [ 422.476839][T14382] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2211'. [ 422.993457][T14412] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 423.036153][T14413] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 423.047065][T14409] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 423.080625][T14378] lo speed is unknown, defaulting to 1000 [ 423.623245][T14438] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 423.653246][T14439] team0: Device ipip0 is of different type [ 423.702294][T14448] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2225'. [ 423.749349][T14448] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2225'. [ 424.522407][T14481] netlink: 144 bytes leftover after parsing attributes in process `syz.2.2237'. [ 424.567243][T14481] syz_tun: entered allmulticast mode [ 424.586567][T14481] siw: device registration error -23 [ 424.741931][T14481] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 424.771758][T14491] gre0: entered allmulticast mode [ 424.800962][T14490] bridge5: entered allmulticast mode [ 424.826461][T14480] syz_tun: left allmulticast mode [ 424.898788][T14497] IPVS: set_ctl: invalid protocol: 51 10.1.1.2:20003 [ 425.260466][T14523] netlink: 'syz.0.2249': attribute type 1 has an invalid length. [ 425.270207][T14523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2249'. [ 425.289847][T14523] macvtap2: entered allmulticast mode [ 425.358264][T14479] gre0: left allmulticast mode [ 425.438720][T14528] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2251'. [ 425.521071][T14533] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 425.623507][T14551] syzkaller1: entered promiscuous mode [ 425.642478][T14551] syzkaller1: entered allmulticast mode [ 425.764306][T14556] syzkaller1: entered allmulticast mode [ 425.874502][T14568] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2260'. [ 425.891172][T14567] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2261'. [ 425.949866][T14567] 8021q: adding VLAN 0 to HW filter on device bond3 [ 426.034029][T14567] bond3: (slave macsec0): Error -34 calling dev_set_mtu [ 426.104566][T14577] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2262'. [ 426.601367][T14606] netlink: 'syz.4.2269': attribute type 3 has an invalid length. [ 426.717628][T14613] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2272'. [ 426.756676][T14613] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2272'. [ 426.767675][T14613] tipc: Invalid UDP bearer configuration [ 426.767740][T14613] tipc: Enabling of bearer rejected, failed to enable media [ 426.813312][T14618] sit2: entered promiscuous mode [ 426.907615][T14619] sctp: [Deprecated]: syz.1.2272 (pid 14619) Use of int in max_burst socket option. [ 426.907615][T14619] Use struct sctp_assoc_value instead [ 427.232199][T14640] ip6gre1: entered allmulticast mode [ 427.242140][T14643] netlink: 'syz.3.2279': attribute type 9 has an invalid length. [ 427.278297][T14643] netlink: 448 bytes leftover after parsing attributes in process `syz.3.2279'. [ 427.348770][T14645] lo speed is unknown, defaulting to 1000 [ 427.617386][T14658] syzkaller1: entered promiscuous mode [ 427.633117][T14658] syzkaller1: entered allmulticast mode [ 427.678159][T14659] bridge6: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 427.990193][T14669] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2289'. [ 428.019916][T14669] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2289'. [ 428.034632][T14669] netlink: 'syz.1.2289': attribute type 5 has an invalid length. [ 428.091694][T14669] geneve3: entered promiscuous mode [ 428.101845][T14669] geneve3: entered allmulticast mode [ 428.119493][ T8027] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 428.132543][ T8027] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 428.160650][ T8027] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 428.190837][T14674] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 428.199124][T14674] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 428.247505][ T8027] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 428.427681][T14673] lo speed is unknown, defaulting to 1000 [ 428.886686][T14705] gretap0: left promiscuous mode [ 429.014662][T14705] 8021q: adding VLAN 0 to HW filter on device team0 [ 429.085171][T14705] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 429.103317][ T7413] lo speed is unknown, defaulting to 1000 [ 429.109836][ T7413] syz0: Port: 1 Link ACTIVE [ 429.589385][T14733] bond8: option lp_interval: invalid value (0) [ 429.614565][T14733] bond8: option lp_interval: allowed values 1 - 2147483647 [ 429.633801][T14733] bond8 (unregistering): Released all slaves [ 430.292325][T14767] __nla_validate_parse: 4 callbacks suppressed [ 430.292343][T14767] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2311'. [ 430.373908][T14769] lo speed is unknown, defaulting to 1000 [ 431.672612][T14790] lo speed is unknown, defaulting to 1000 [ 431.796676][T14821] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 431.943499][T14828] netlink: 'syz.4.2326': attribute type 7 has an invalid length. [ 432.040996][T14831] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2328'. [ 432.050993][T14831] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2328'. [ 432.061720][T14824] lo speed is unknown, defaulting to 1000 [ 432.085801][T14833] netlink: 'syz.3.2329': attribute type 1 has an invalid length. [ 432.105846][T14833] netlink: 'syz.3.2329': attribute type 1 has an invalid length. [ 432.759933][T14866] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2339'. [ 432.795415][T14866] netlink: 'syz.3.2339': attribute type 7 has an invalid length. [ 432.810319][T14866] netlink: 'syz.3.2339': attribute type 8 has an invalid length. [ 432.819415][T14866] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2339'. [ 433.020596][T14868] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2339'. [ 433.417621][T14895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2348'. [ 433.649293][T14910] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2351'. [ 433.828963][T14921] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2352'. [ 434.053294][T14929] lo speed is unknown, defaulting to 1000 [ 434.182207][T14941] ¬»: renamed from ip6_vti0 (while UP) [ 434.693125][T14953] netlink: 'syz.4.2360': attribute type 10 has an invalid length. [ 434.761138][T14953] tipc: Resetting bearer [ 434.773601][T14953] tipc: Resetting bearer [ 434.797188][T14953] 8021q: adding VLAN 0 to HW filter on device team0 [ 434.822264][T14953] bond0: (slave team0): Enslaving as an active interface with an up link [ 434.848936][T14960] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2362'. [ 435.222480][T14968] lo speed is unknown, defaulting to 1000 [ 435.676325][T14991] netlink: 'syz.2.2371': attribute type 9 has an invalid length. [ 435.919139][T14996] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2373'. [ 435.950828][T14996] veth0_to_bond: entered allmulticast mode [ 435.997095][T14996] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2373'. [ 436.000351][T14971] lo speed is unknown, defaulting to 1000 [ 436.479089][T15012] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2378'. [ 436.701901][T15018] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2379'. [ 436.952773][ T7412] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 436.970513][T15024] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 437.083126][ T7412] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 437.201018][T15028] lo speed is unknown, defaulting to 1000 [ 438.097352][ T7413] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 450.255139][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 559.243720][T15050] lo speed is unknown, defaulting to 1000 [ 559.426353][T15058] bond0: option packets_per_slave: invalid value (16779898) [ 559.453175][T15058] bond0: option packets_per_slave: allowed values 0 - 65535 [ 559.483039][T15065] sctp: [Deprecated]: syz.2.2394 (pid 15065) Use of struct sctp_assoc_value in delayed_ack socket option. [ 559.483039][T15065] Use struct sctp_sack_info instead [ 559.537372][T15071] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2393'. [ 560.024036][T15084] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2397'. [ 560.429132][T15091] netlink: 84 bytes leftover after parsing attributes in process `syz.4.2399'. [ 560.573379][T15095] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2401'. [ 560.576559][T15100] macsec1: entered promiscuous mode [ 560.605969][T15100] macsec1: entered allmulticast mode [ 560.868852][T15108] netlink: 'syz.4.2403': attribute type 16 has an invalid length. [ 560.877680][T15108] netlink: 'syz.4.2403': attribute type 17 has an invalid length. [ 561.046932][ T7952] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 561.050122][T15108] 8021q: adding VLAN 0 to HW filter on device bond0 [ 561.128841][T15108] tipc: Resetting bearer [ 561.150600][T15108] tipc: Resetting bearer [ 561.199769][T15108] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 561.267288][ T7952] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 561.286570][T15104] lo speed is unknown, defaulting to 1000 [ 561.451730][T15114] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 561.486550][T15114] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.595592][ T7952] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 561.654154][T15114] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 561.683756][T15114] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.832464][T15114] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 561.851011][T15114] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.877436][T15126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2406'. [ 561.892857][T15126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2406'. [ 562.031744][T15114] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 562.046829][T15114] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 562.104720][ T8031] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 562.262445][ T36] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 562.280205][ T36] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.373030][ T70] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 562.383299][ T70] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.421946][T15134] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2408'. [ 562.486684][ T8029] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 562.504405][ T8029] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.572040][ T70] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 562.587311][ T70] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 562.944594][T15146] lo speed is unknown, defaulting to 1000 [ 563.087887][T15144] netlink: 'syz.0.2410': attribute type 17 has an invalid length. [ 563.097191][T15144] netlink: 148 bytes leftover after parsing attributes in process `syz.0.2410'. [ 563.150105][ T70] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 563.169652][ T70] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 563.436994][T15152] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2413'. [ 563.866167][ T7413] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 564.217534][T15167] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2417'. [ 564.237493][T15161] lo speed is unknown, defaulting to 1000 [ 565.172280][T15175] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2420'. [ 565.784418][T15194] netlink: 'syz.3.2424': attribute type 10 has an invalid length. [ 565.813961][T15194] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2424'. [ 565.848482][T15194] debugfs: 'netdev:nicvf0' already exists in 'phy7' [ 566.235886][T15213] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2429'. [ 566.369791][T15219] tap0: tun_chr_ioctl cmd 1074025677 [ 566.375668][T15219] tap0: linktype set to 776 [ 566.454373][T15224] netlink: 'syz.3.2434': attribute type 1 has an invalid length. [ 566.610405][T15226] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2435'. [ 566.617728][T15228] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 566.870695][T15237] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2439'. [ 567.232655][T15252] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2444'. [ 567.273425][T15257] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2447'. [ 567.375106][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 567.749823][T15093] Set syz1 is full, maxelem 65536 reached [ 568.017330][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 568.227138][T15293] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 568.296785][T15294] lo speed is unknown, defaulting to 1000 [ 568.859965][T15305] lo speed is unknown, defaulting to 1000 [ 569.202897][T15325] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2462'. [ 569.251409][T15303] netlink: 'syz.0.2457': attribute type 2 has an invalid length. [ 569.268567][T15325] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2462'. [ 569.342440][T15325] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 569.412444][T15325] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 569.451362][T15334] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2464'. [ 569.554146][T15325] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 569.702141][T15325] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 569.858223][ T8031] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 569.910206][ T8031] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 570.018494][ T13] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 570.045669][ T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 570.201270][T15354] netlink: 'syz.3.2472': attribute type 1 has an invalid length. [ 570.210799][T15354] netlink: 'syz.3.2472': attribute type 3 has an invalid length. [ 570.241982][T15354] __nla_validate_parse: 1 callbacks suppressed [ 570.242002][T15354] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2472'. [ 570.273820][T15354] NCSI netlink: No device for ifindex 246 [ 570.605311][T15381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2476'. [ 570.618225][T15382] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2473'. [ 570.815694][T15381] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2476'. [ 570.931723][T15395] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2479'. [ 570.962565][T15395] netlink: 'syz.4.2479': attribute type 1 has an invalid length. [ 570.973656][T15395] netlink: 15190 bytes leftover after parsing attributes in process `syz.4.2479'. [ 571.004272][T15398] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2480'. [ 571.117120][T15407] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2482'. [ 571.140682][T15411] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2481'. [ 571.151058][T15411] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2481'. [ 571.296719][T15419] netlink: 'syz.0.2484': attribute type 15 has an invalid length. [ 571.952449][T15432] tipc: Enabled bearer , priority 0 [ 571.962603][T15432] syzkaller0: entered promiscuous mode [ 571.978131][T15432] syzkaller0: entered allmulticast mode [ 572.004030][T15433] tipc: Resetting bearer [ 572.032299][T15431] tipc: Resetting bearer [ 572.097927][T15431] tipc: Disabling bearer [ 572.162599][T15439] bond0: option resend_igmp: invalid value (18446744072921022467) [ 572.174428][T15439] bond0: option resend_igmp: allowed values 0 - 255 [ 572.891003][T15470] siw: device registration error -23 [ 573.029654][T15477] batadv0: entered promiscuous mode [ 574.231558][T15497] lo speed is unknown, defaulting to 1000 [ 576.335170][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 576.873546][T15524] __nla_validate_parse: 7 callbacks suppressed [ 576.873568][T15524] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2510'. [ 577.340297][T15518] tipc: Resetting bearer [ 577.409524][T15518] syzkaller0: left promiscuous mode [ 577.423473][T15518] syzkaller0: left allmulticast mode [ 577.434356][T15518] xfrm1: left promiscuous mode [ 577.440204][T15518] xfrm1: left allmulticast mode [ 577.449370][T15518] ip6gre1: left allmulticast mode [ 577.522117][T15531] tipc: Enabled bearer , priority 0 [ 577.547829][T15534] syzkaller0: entered promiscuous mode [ 577.553344][T15534] syzkaller0: entered allmulticast mode [ 577.726057][T15542] tipc: Resetting bearer [ 577.916951][T15542] tipc: Disabling bearer [ 578.046569][T15555] netlink: 'syz.4.2514': attribute type 17 has an invalid length. [ 578.054530][T15555] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2514'. [ 578.226150][T15559] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2516'. [ 578.244235][T15559] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2516'. [ 578.288024][T15563] vlan4: entered allmulticast mode [ 578.528435][T15575] netlink: 'syz.4.2521': attribute type 5 has an invalid length. [ 578.569264][T15577] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2522'. [ 578.686087][T15584] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2519'. [ 578.695220][T15582] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2523'. [ 578.729508][T15583] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2522'. [ 578.764550][T15584] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2519'. [ 578.776493][T15577] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2522'. [ 579.409713][T15613] netlink: 'syz.4.2527': attribute type 17 has an invalid length. [ 579.681800][T15619] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 579.706761][T15619] syzkaller0: entered promiscuous mode [ 579.712494][T15619] syzkaller0: entered allmulticast mode [ 579.768743][T15624] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.786713][T15624] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.858208][T15624] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.869216][T15624] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.903016][T15627] tipc: Enabled bearer , priority 0 [ 579.928945][T15624] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.945640][T15624] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.964336][T15629] syzkaller0: entered promiscuous mode [ 579.972508][T15629] syzkaller0: entered allmulticast mode [ 579.992175][T15624] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.002679][T15624] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.043726][T15629] tipc: Resetting bearer [ 580.074409][T15629] tipc: Disabling bearer [ 580.197877][ T8027] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.207368][ T8027] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.242966][ T8027] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.252243][ T8027] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.279850][ T13] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.290003][ T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.324569][ T13] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.344525][ T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.512038][T15645] pimreg: entered allmulticast mode [ 580.637821][T15652] netlink: 'syz.0.2539': attribute type 17 has an invalid length. [ 580.784381][T15657] lo speed is unknown, defaulting to 1000 [ 580.913492][T15661] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 581.272620][T15665] lo speed is unknown, defaulting to 1000 [ 581.287400][T15674] netlink: 'syz.2.2545': attribute type 4 has an invalid length. [ 581.890821][T15671] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 582.811131][T15728] xt_l2tp: missing protocol rule (udp|l2tpip) [ 583.087230][T15741] netlink: 'syz.4.2564': attribute type 13 has an invalid length. [ 583.127049][T15741] netlink: 'syz.4.2564': attribute type 17 has an invalid length. [ 583.159678][T15745] __nla_validate_parse: 7 callbacks suppressed [ 583.159697][T15745] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2567'. [ 583.273444][T15741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 583.286854][ T7959] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 583.307509][T15741] 8021q: adding VLAN 0 to HW filter on device team0 [ 583.314653][T15741] tipc: Resetting bearer [ 583.321157][T15741] tipc: Resetting bearer [ 583.330598][T15741] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 583.398368][T15754] netlink: 'syz.3.2567': attribute type 2 has an invalid length. [ 583.439997][T15763] netlink: 'syz.1.2571': attribute type 1 has an invalid length. [ 583.504171][T15765] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2571'. [ 583.734568][T15735] lo speed is unknown, defaulting to 1000 [ 583.807513][T15763] bond12: entered promiscuous mode [ 583.813179][T15763] 8021q: adding VLAN 0 to HW filter on device bond12 [ 583.821930][T15765] bond12: entered allmulticast mode [ 583.895408][T15768] bond12: (slave bridge7): making interface the new active one [ 583.903083][T15768] bridge7: entered promiscuous mode [ 583.909270][T15768] bridge7: entered allmulticast mode [ 583.917038][T15768] bond12: (slave bridge7): Enslaving as an active interface with an up link [ 583.928214][ T1108] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 583.995998][ T1108] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.048747][ T70] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 584.067125][ T70] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 584.092172][ T1108] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 584.096439][ T7413] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 584.108921][ T1108] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.145537][ T1108] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 584.174331][ T1108] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.195716][ T7954] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 584.209706][T15778] netlink: 'syz.3.2574': attribute type 29 has an invalid length. [ 584.236705][ T1108] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 584.245887][ T1108] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.254286][T15778] netlink: 'syz.3.2574': attribute type 29 has an invalid length. [ 584.355773][ T1108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.364323][ T1108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 584.378712][T15778] netlink: 596 bytes leftover after parsing attributes in process `syz.3.2574'. [ 584.774483][T15802] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2579'. [ 585.018709][T15806] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2582'. [ 585.471710][T15824] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2588'. [ 585.550156][T15826] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2586'. [ 585.582354][T15822] lo speed is unknown, defaulting to 1000 [ 585.585214][T15826] sctp: [Deprecated]: syz.0.2586 (pid 15826) Use of int in max_burst socket option deprecated. [ 585.585214][T15826] Use struct sctp_assoc_value instead [ 585.941501][ T7954] lo speed is unknown, defaulting to 1000 [ 585.948019][ T7954] syz0: Port: 1 Link DOWN [ 586.025896][ T8031] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 256 - 0 [ 586.071528][ T8031] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 256 - 0 [ 586.123329][ T8031] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 256 - 0 [ 586.198768][T15846] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 586.238390][T15846] netlink: 'syz.3.2592': attribute type 83 has an invalid length. [ 586.346910][T15852] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2592'. [ 586.383239][T15854] netlink: 'syz.4.2593': attribute type 1 has an invalid length. [ 586.400904][T15854] netlink: 'syz.4.2593': attribute type 4 has an invalid length. [ 586.546169][ T8031] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 256 - 0 [ 587.222393][T15876] netlink: 'syz.3.2597': attribute type 17 has an invalid length. [ 587.250034][T15876] netlink: 148 bytes leftover after parsing attributes in process `syz.3.2597'. [ 587.281009][T15877] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2596'. [ 588.249198][T15907] __nla_validate_parse: 2 callbacks suppressed [ 588.249216][T15907] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2605'. [ 588.331818][T15907] bridge7: entered allmulticast mode [ 588.431347][T15914] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2607'. [ 588.495931][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 588.834406][T15928] pim6reg1: entered promiscuous mode [ 588.919030][T15928] pim6reg1: entered allmulticast mode [ 588.962241][T15934] validate_nla: 1 callbacks suppressed [ 588.962262][T15934] netlink: 'syz.3.2613': attribute type 9 has an invalid length. [ 589.007795][T15932] netlink: zone id is out of range [ 589.014193][T15932] netlink: zone id is out of range [ 589.020438][T15932] netlink: zone id is out of range [ 589.035907][T15932] netlink: zone id is out of range [ 589.046334][T15932] netlink: zone id is out of range [ 589.056876][T15932] netlink: zone id is out of range [ 589.075931][T15932] netlink: zone id is out of range [ 589.105850][T15932] netlink: zone id is out of range [ 589.111021][T15932] netlink: zone id is out of range [ 589.125812][T15932] netlink: zone id is out of range [ 589.159343][T15941] netlink: 'syz.2.2616': attribute type 25 has an invalid length. [ 589.420503][T15955] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2617'. [ 589.462785][T15955] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2617'. [ 589.518365][T15954] lo speed is unknown, defaulting to 1000 [ 589.524083][T15955] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2617'. [ 589.921869][T15972] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2622'. [ 590.311735][T15977] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2624'. [ 590.403769][T15979] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2625'. [ 590.585475][T15983] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2626'. [ 590.604744][T15983] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2626'. [ 590.840792][T15984] netlink: 'syz.4.2626': attribute type 2 has an invalid length. [ 590.870720][T15987] bridge8: entered allmulticast mode [ 590.877834][T15983] lo speed is unknown, defaulting to 1000 [ 591.155570][T15993] nbd: socks must be embedded in a SOCK_ITEM attr [ 591.251445][T16002] vlan2: entered allmulticast mode [ 591.387204][T16004] veth15: entered promiscuous mode [ 591.671520][T16009] lo speed is unknown, defaulting to 1000 [ 591.686430][T16031] tipc: Enabled bearer , priority 0 [ 591.711345][T16031] tipc: Resetting bearer [ 591.753538][T16030] tipc: Disabling bearer [ 592.403082][T16065] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144 [ 592.683414][T16070] tipc: Enabled bearer , priority 0 [ 592.744643][T16072] syzkaller0: entered promiscuous mode [ 592.751650][T16072] syzkaller0: entered allmulticast mode [ 592.814393][T16072] tipc: Resetting bearer [ 592.876589][T16069] tipc: Resetting bearer [ 592.908954][T16074] netlink: 'syz.4.2650': attribute type 1 has an invalid length. [ 592.953125][T16069] tipc: Disabling bearer [ 592.982823][T16080] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 593.102707][T16075] lo speed is unknown, defaulting to 1000 [ 593.251440][ T36] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.374448][ T8027] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.384202][ T8027] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.401777][ T8027] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 593.429802][T16102] __nla_validate_parse: 11 callbacks suppressed [ 593.429822][T16102] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2657'. [ 593.452241][T16102] netlink: 'syz.1.2657': attribute type 7 has an invalid length. [ 593.462959][T16102] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2657'. [ 593.601693][T16092] lo speed is unknown, defaulting to 1000 [ 593.757910][T16119] syz_tun: entered allmulticast mode [ 593.764345][T16115] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2659'. [ 593.832297][T16119] dvmrp1: entered allmulticast mode [ 593.964412][T16131] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2662'. [ 594.451871][T16119] syz_tun: left allmulticast mode [ 594.548701][T16135] lo speed is unknown, defaulting to 1000 [ 594.572606][T16146] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2664'. [ 594.628386][T16146] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2664'. [ 594.936673][T16158] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2666'. [ 595.447205][T16172] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2668'. [ 595.461217][T16172] hsr_slave_0: left promiscuous mode [ 595.499139][T16172] hsr_slave_1: left promiscuous mode [ 596.054361][T16180] lo speed is unknown, defaulting to 1000 [ 596.301865][T16190] syzkaller1: entered promiscuous mode [ 596.311234][T16190] syzkaller1: entered allmulticast mode [ 596.335969][T16190] netlink: 'syz.4.2675': attribute type 21 has an invalid length. [ 596.357115][T16190] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2675'. [ 596.375912][T16190] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2675'. [ 596.968142][T16214] 8021q: adding VLAN 0 to HW filter on device bond4 [ 597.038167][T16214] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 597.068116][T16214] macvlan0: entered promiscuous mode [ 597.092875][T16214] macvlan0: entered allmulticast mode [ 597.112453][T16214] bond4: entered promiscuous mode [ 597.120204][T16214] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 597.138811][T16214] bond4: left promiscuous mode [ 597.195740][T16226] tipc: Enabling of bearer rejected, failed to enable media [ 597.884597][T16252] tipc: Enabled bearer , priority 0 [ 597.913871][T16251] syzkaller0: entered promiscuous mode [ 597.920255][T16251] syzkaller0: entered allmulticast mode [ 597.927596][T16251] tipc: Resetting bearer [ 597.939730][T16247] net_ratelimit: 2 callbacks suppressed [ 597.939748][T16247] syzkaller0: mtu less than device minimum [ 598.020235][T16260] macvlan3: entered promiscuous mode [ 598.050369][T16260] vlan0: entered promiscuous mode [ 598.064792][T16264] !: renamed from dummy0 (while UP) [ 598.074271][T16243] tipc: Resetting bearer [ 598.095046][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 598.165920][T16243] tipc: Disabling bearer [ 598.328495][T16264] lo speed is unknown, defaulting to 1000 [ 598.596423][T16280] tipc: Enabled bearer , priority 0 [ 598.624721][T16280] syzkaller0: entered promiscuous mode [ 598.638274][T16280] syzkaller0: entered allmulticast mode [ 598.669317][T16280] netlink: 'syz.3.2696': attribute type 11 has an invalid length. [ 598.700624][T16279] tipc: Resetting bearer [ 598.761779][T16279] tipc: Disabling bearer [ 598.920679][T16287] __nla_validate_parse: 1 callbacks suppressed [ 598.920697][T16287] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2698'. [ 599.039301][T16295] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2700'. [ 599.158685][T16295] netlink: 'syz.1.2700': attribute type 1 has an invalid length. [ 599.170880][T16301] netem: incorrect ge model size [ 599.178889][T16301] netem: change failed [ 599.339792][T16313] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2703'. [ 599.388241][T16313] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2703'. [ 599.418726][T16313] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2703'. [ 599.747766][T16334] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 599.857292][T16343] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2710'. [ 599.886912][T16334] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 599.909329][T16334] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 600.396827][T16367] syzkaller1: entered promiscuous mode [ 600.422212][T16367] syzkaller1: entered allmulticast mode [ 600.731164][T16375] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2718'. [ 601.269695][T16391] netlink: 'syz.2.2721': attribute type 12 has an invalid length. [ 601.408283][T16401] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2726'. [ 601.469425][T16402] lo speed is unknown, defaulting to 1000 [ 601.927742][T16393] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 601.978572][T16412] netlink: 'syz.4.2729': attribute type 1 has an invalid length. [ 602.122485][T16412] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2729'. [ 602.382782][T16423] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2732'. [ 602.447118][T16425] IPVS: Error connecting to the multicast addr [ 602.628554][T16432] netlink: 'syz.3.2736': attribute type 1 has an invalid length. [ 603.012743][T16442] bond13: entered promiscuous mode [ 603.019124][T16442] bond13: entered allmulticast mode [ 603.025859][T16442] 8021q: adding VLAN 0 to HW filter on device bond13 [ 603.272142][T16459] nft_compat: unsupported protocol 0 [ 603.448904][T16470] netlink: 'syz.1.2748': attribute type 1 has an invalid length. [ 603.532264][T16470] 8021q: adding VLAN 0 to HW filter on device bond14 [ 603.778421][T16492] bond0: (slave batadv_slave_0): Releasing backup interface [ 603.791373][T16492] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 603.837587][T16492] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 604.247793][T16497] tipc: Resetting bearer [ 604.293234][T16497] syzkaller0: left promiscuous mode [ 604.594777][ T36] nci: nci_rx_work: unknown MT 0x1 [ 604.710964][T16520] __nla_validate_parse: 8 callbacks suppressed [ 604.710983][T16520] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2761'. [ 604.734462][T16538] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2761'. [ 604.886070][T16541] syzkaller0: left allmulticast mode [ 605.834663][T16555] netlink: 248 bytes leftover after parsing attributes in process `syz.1.2771'. [ 605.870506][T16561] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2769'. [ 606.281593][T16582] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2773'. [ 606.447547][T16587] netlink: 'syz.3.2775': attribute type 11 has an invalid length. [ 606.476620][T16587] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2775'. [ 606.491435][T16589] lo speed is unknown, defaulting to 1000 [ 607.664455][T16630] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2787'. [ 608.759275][T16653] lo speed is unknown, defaulting to 1000 [ 608.932303][T16663] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2792'. [ 609.258515][T16679] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2800'. [ 609.419414][T16680] bond9: option arp_all_targets: invalid value (3) [ 609.450688][T16680] bond9 (unregistering): Released all slaves [ 609.483947][T16690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2803'. [ 609.651781][T16655] lo speed is unknown, defaulting to 1000 [ 609.754436][T16693] mac80211_hwsim hwsim9 wlan0: entered promiscuous mode [ 609.796550][T16693] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 610.062020][T16705] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2806'. [ 610.078333][T16704] syzkaller0: entered promiscuous mode [ 610.083842][T16704] syzkaller0: entered allmulticast mode [ 610.280023][T16716] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2809'. [ 610.379342][T16718] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2809'. [ 611.011949][T16740] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2815'. [ 611.068121][T16734] pim6reg: entered allmulticast mode [ 611.830932][T16769] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2822'. [ 612.094238][T16779] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2827'. [ 612.193113][T16784] netlink: 'syz.1.2829': attribute type 1 has an invalid length. [ 612.294382][T16788] lo speed is unknown, defaulting to 1000 [ 612.628930][T16805] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2836'. [ 612.669462][T16805] bridge8: entered allmulticast mode [ 612.708018][T16805] netlink: 'syz.0.2836': attribute type 1 has an invalid length. [ 612.850639][T16812] veth17: entered promiscuous mode [ 613.031629][T16822] bridge0: failed insert local address into bridge forwarding table [ 613.046945][T16822] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2841'. [ 613.193139][ T70] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.202793][ T70] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.259924][ T70] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.268887][ T70] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 613.444435][T16839] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2846'. [ 613.469167][T16841] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2845'. [ 613.664802][T16846] netlink: 'syz.2.2847': attribute type 10 has an invalid length. [ 613.676642][T16846] !: entered promiscuous mode [ 613.687926][T16846] A link change request failed with some changes committed already. Interface 0! may have been left with an inconsistent configuration, please check. [ 613.862586][T16854] xt_l2tp: v2 sid > 0xffff: 1114112 [ 614.199367][T16868] netlink: 'syz.2.2855': attribute type 1 has an invalid length. [ 614.297511][T16868] 8021q: adding VLAN 0 to HW filter on device bond6 [ 614.364574][T16871] bond6: (slave gretap2): making interface the new active one [ 614.397424][T16871] bond6: (slave gretap2): Enslaving as an active interface with an up link [ 614.740107][T16888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 614.757085][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 614.766830][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 614.775572][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 614.783705][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 614.791898][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 614.843032][T16889] lo speed is unknown, defaulting to 1000 [ 615.170402][T16896] lo speed is unknown, defaulting to 1000 [ 615.658207][ T70] bond2 (unregistering): (slave gretap1): Releasing active interface [ 615.781174][ T70] team0: Port device geneve0 removed [ 616.054414][T16911] netlink: 'syz.3.2866': attribute type 10 has an invalid length. [ 616.339011][ T70] bond0 (unregistering): (slave team0): Releasing backup interface [ 616.348214][ T70] tipc: Resetting bearer [ 616.354785][ T70] bond0 (unregistering): Released all slaves [ 616.463694][ T70] bond1 (unregistering): Released all slaves [ 616.477347][ T70] bond2 (unregistering): Released all slaves [ 616.580419][ T70] bond3 (unregistering): Released all slaves [ 616.683706][ T70] bond4 (unregistering): Released all slaves [ 616.727250][T16911] bond0: (slave 0!): Enslaving as an active interface with an up link [ 616.896215][ T51] Bluetooth: hci5: command tx timeout [ 617.016602][T16929] __nla_validate_parse: 9 callbacks suppressed [ 617.016624][T16929] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2871'. [ 617.054709][T16927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2870'. [ 617.181578][T16943] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2874'. [ 617.188022][T16940] tipc: Enabled bearer , priority 0 [ 617.191337][T16943] netlink: 'syz.3.2874': attribute type 5 has an invalid length. [ 617.205849][T16943] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2874'. [ 617.222731][T16943] geneve3: entered promiscuous mode [ 617.228385][T16943] geneve3: entered allmulticast mode [ 617.235340][ T8029] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 617.245817][ T8029] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 617.273859][T16946] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2871'. [ 617.284888][ T8029] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 617.293128][ T8029] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 617.333049][T16940] tipc: Disabling bearer [ 617.358259][T16889] chnl_net:caif_netlink_parms(): no params data found [ 617.571068][T16951] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2876'. [ 617.593971][T16950] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 617.658805][T16889] bridge0: port 1(bridge_slave_0) entered blocking state [ 617.666566][T16889] bridge0: port 1(bridge_slave_0) entered disabled state [ 617.673887][T16889] bridge_slave_0: entered allmulticast mode [ 617.682326][T16889] bridge_slave_0: entered promiscuous mode [ 617.699118][T16950] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 617.738556][T16889] bridge0: port 2(bridge_slave_1) entered blocking state [ 617.757633][T16889] bridge0: port 2(bridge_slave_1) entered disabled state [ 617.765610][T16889] bridge_slave_1: entered allmulticast mode [ 617.774297][T16889] bridge_slave_1: entered promiscuous mode [ 617.789015][T16950] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 617.859432][T16950] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 617.929840][T16889] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 617.955674][T16962] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 617.966135][T16962] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.994728][T16889] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 618.069589][T16962] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 618.096972][T16962] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.151374][T16966] syzkaller0: entered promiscuous mode [ 618.158105][T16966] syzkaller0: entered allmulticast mode [ 618.211226][T16972] tipc: Enabled bearer , priority 0 [ 618.270012][T16962] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 618.280377][T16962] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.299605][T16889] team0: Port device team_slave_0 added [ 618.306327][ T1108] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 618.332179][ T1108] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 618.347029][T16889] team0: Port device team_slave_1 added [ 618.362179][T16962] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 618.374660][T16962] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.538257][ T8027] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 618.547032][ T8027] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 618.593699][T16889] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 618.609792][T16889] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 618.637220][T16889] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 618.684174][T16889] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 618.709449][T16889] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 618.737863][T16994] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2889'. [ 618.773253][T16889] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 618.787926][ T70] tipc: Disabling bearer [ 618.796908][ T70] tipc: Disabling bearer [ 618.811422][ T70] tipc: Disabling bearer [ 618.842580][T16961] tipc: Resetting bearer [ 618.844897][ T70] tipc: Left network mode [ 618.888754][T16961] tipc: Disabling bearer [ 618.927223][ T70] IPVS: stopping backup sync thread 6326 ... [ 618.973042][ T8027] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 618.983525][ T51] Bluetooth: hci5: command tx timeout [ 618.990925][ T8027] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.057434][ T8027] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 619.071439][ T8027] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.142227][T16889] hsr_slave_0: entered promiscuous mode [ 619.149524][T16889] hsr_slave_1: entered promiscuous mode [ 619.257590][ T36] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 619.266467][ T36] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.340662][ T36] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 619.352355][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.412364][T17014] vxcan2: entered allmulticast mode [ 619.679573][T17020] lo speed is unknown, defaulting to 1000 [ 619.827980][T17029] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2898'. [ 620.506961][T17056] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2901'. [ 620.552317][ T70] hsr_slave_0: left promiscuous mode [ 620.586481][ T70] hsr_slave_1: left promiscuous mode [ 620.628927][ T70] pim6reg99999999 (unregistering): left allmulticast mode [ 621.067728][ T51] Bluetooth: hci5: command tx timeout [ 621.329203][T17059] lo speed is unknown, defaulting to 1000 [ 621.409663][T17071] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2907'. [ 621.560170][T16889] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 621.624917][T16889] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 621.663265][T16889] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 621.715630][T16889] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 621.864024][ T70] IPVS: stop unused estimator thread 0... [ 622.502124][T17100] lo speed is unknown, defaulting to 1000 [ 622.641846][T17108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 622.718515][T16889] 8021q: adding VLAN 0 to HW filter on device bond0 [ 622.780847][T16889] 8021q: adding VLAN 0 to HW filter on device team0 [ 622.927524][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 622.935886][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 623.089633][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 623.096845][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 623.136085][ T51] Bluetooth: hci5: command tx timeout [ 623.158896][T16889] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 623.170611][T16889] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 623.732962][T16889] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 623.928707][T17137] netlink: 'syz.0.2919': attribute type 21 has an invalid length. [ 623.960213][T17137] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2919'. [ 624.095741][T17149] netlink: 5444 bytes leftover after parsing attributes in process `syz.0.2922'. [ 624.126061][T17149] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 624.147570][T17148] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2923'. [ 624.165442][T17146] lo speed is unknown, defaulting to 1000 [ 624.185230][T17152] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2921'. [ 624.280648][T17160] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2925'. [ 624.452330][T17163] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2924'. [ 624.653994][T17182] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2929'. [ 624.689012][ T8027] nci: nci_rx_work: unknown MT 0x1 [ 624.741160][T16889] veth0_vlan: entered promiscuous mode [ 624.748786][T17177] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 624.810365][T17182] netlink: 'syz.0.2929': attribute type 1 has an invalid length. [ 624.846757][T16889] veth1_vlan: entered promiscuous mode [ 624.898788][T17192] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2931'. [ 624.909565][T17184] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2929'. [ 624.947347][T17194] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2930'. [ 624.966049][T17192] 8021q: adding VLAN 0 to HW filter on device bond15 [ 624.984159][T17196] bond15: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 625.111203][T16889] veth0_macvtap: entered promiscuous mode [ 625.203688][T16889] veth1_macvtap: entered promiscuous mode [ 625.262283][T16889] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 625.296441][T16889] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 625.313821][ T70] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.332401][ T70] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.388125][ T70] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.435323][ T70] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.610532][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.629770][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.694001][T17220] netlink: 'syz.2.2939': attribute type 3 has an invalid length. [ 625.725586][ T1108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.734184][ T1108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.897357][T17227] IPVS: set_ctl: invalid protocol: 103 10.1.1.2:20000 [ 625.984501][T17239] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 626.229791][T17247] RDS: rds_bind could not find a transport for ::ffff:172.30.1.2, load rds_tcp or rds_rdma? [ 626.479786][ T5848] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 626.492319][ T5848] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 626.501126][ T5848] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 626.512421][ T5848] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 626.522426][ T5848] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 626.589636][T17255] lo speed is unknown, defaulting to 1000 [ 627.271296][T17276] lo speed is unknown, defaulting to 1000 [ 627.534070][T17255] chnl_net:caif_netlink_parms(): no params data found [ 627.746519][T17289] bridge_slave_1: left allmulticast mode [ 627.752206][T17289] bridge_slave_1: left promiscuous mode [ 627.758431][T17289] bridge0: port 2(bridge_slave_1) entered disabled state [ 627.769373][T17289] bridge_slave_0: left allmulticast mode [ 627.776087][T17289] bridge_slave_0: left promiscuous mode [ 627.783425][T17289] bridge0: port 1(bridge_slave_0) entered disabled state [ 627.949167][T17287] lo speed is unknown, defaulting to 1000 [ 628.440817][T17255] bridge0: port 1(bridge_slave_0) entered blocking state [ 628.453865][T17255] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.465935][T17255] bridge_slave_0: entered allmulticast mode [ 628.509004][T17255] bridge_slave_0: entered promiscuous mode [ 628.552722][T17315] mac80211_hwsim hwsim37 wlan1: entered promiscuous mode [ 628.572668][T17315] macvtap1: entered promiscuous mode [ 628.578468][ T5848] Bluetooth: hci1: command tx timeout [ 628.682754][T17255] bridge0: port 2(bridge_slave_1) entered blocking state [ 628.702811][T17255] bridge0: port 2(bridge_slave_1) entered disabled state [ 628.712328][T17255] bridge_slave_1: entered allmulticast mode [ 628.720436][T17255] bridge_slave_1: entered promiscuous mode [ 628.780251][T17322] netlink: 'syz.2.2963': attribute type 7 has an invalid length. [ 628.793978][T17322] netlink: 'syz.2.2963': attribute type 8 has an invalid length. [ 628.831497][T17255] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 628.848784][T17255] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 628.969410][T17255] team0: Port device team_slave_0 added [ 628.994226][T17255] team0: Port device team_slave_1 added [ 629.103071][T17333] __nla_validate_parse: 20 callbacks suppressed [ 629.103091][T17333] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2967'. [ 629.208671][T17255] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 629.226801][T17255] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 629.260595][T17255] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 629.276771][ T70] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.292041][ T70] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.360229][T17255] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 629.377716][T17255] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 629.402876][T17333] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2967'. [ 629.454459][T17255] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 629.466965][ T70] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.478041][ T70] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.489325][ T70] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.497941][ T70] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.522477][ T70] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 629.531013][ T70] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.545741][T17347] tipc: Started in network mode [ 629.550648][T17347] tipc: Node identity 1e2bd6432cb6, cluster identity 4711 [ 629.558243][T17347] tipc: Enabled bearer , priority 0 [ 629.605499][T17347] syzkaller0: entered promiscuous mode [ 629.611217][T17347] syzkaller0: entered allmulticast mode [ 629.677380][T17351] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2969'. [ 629.682971][T17255] hsr_slave_0: entered promiscuous mode [ 629.693514][T17255] hsr_slave_1: entered promiscuous mode [ 629.700633][T17255] debugfs: 'hsr0' already exists in 'hsr' [ 629.719552][T17255] Cannot create hsr debugfs directory [ 629.741635][T17347] tipc: Resetting bearer [ 629.755615][T17350] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2971'. [ 629.809965][T17346] tipc: Resetting bearer [ 629.860591][T17346] tipc: Disabling bearer [ 629.881468][T17359] netlink: 'syz.2.2973': attribute type 3 has an invalid length. [ 630.084630][T17371] netlink: 'syz.4.2975': attribute type 10 has an invalid length. [ 630.131783][T17375] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2978'. [ 630.453310][T17255] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 630.547320][T17255] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 630.627100][T17255] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 630.662351][ T5848] Bluetooth: hci1: command tx timeout [ 630.727479][T17255] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 630.864781][T17392] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2981'. [ 631.099793][T17400] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2983'. [ 631.142535][T17402] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2982'. [ 631.150363][T17398] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2983'. [ 631.172431][T17255] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 631.216550][T17255] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 631.263867][T17255] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 631.306715][T17255] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 631.590271][T17255] 8021q: adding VLAN 0 to HW filter on device bond0 [ 631.706576][T17255] 8021q: adding VLAN 0 to HW filter on device team0 [ 631.743104][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 631.750321][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 631.790048][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 631.797251][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 631.810351][T17427] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2990'. [ 631.887941][T17429] netlink: 'syz.0.2991': attribute type 41 has an invalid length. [ 631.903617][T17429] netlink: 'syz.0.2991': attribute type 3 has an invalid length. [ 631.941951][T17429] pimreg: left allmulticast mode [ 631.994702][T17434] siw: device registration error -23 [ 632.400190][T17255] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 632.444586][T17446] bond8: option tlb_dynamic_lb: mode dependency failed, not supported in mode active-backup(1) [ 632.473311][T17446] bond8 (unregistering): Released all slaves [ 632.632764][T17255] veth0_vlan: entered promiscuous mode [ 632.653724][T17255] veth1_vlan: entered promiscuous mode [ 632.707116][T17255] veth0_macvtap: entered promiscuous mode [ 632.714024][T17454] sctp: [Deprecated]: syz.1.2997 (pid 17454) Use of int in max_burst socket option deprecated. [ 632.714024][T17454] Use struct sctp_assoc_value instead [ 632.718270][T17255] veth1_macvtap: entered promiscuous mode [ 632.736328][ T5848] Bluetooth: hci1: command tx timeout [ 632.771916][T17255] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 632.860116][T17255] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 632.909177][ T8031] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.967941][ T8031] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.000970][ T8031] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.053428][ T8031] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.187052][T17467] veth0: entered promiscuous mode [ 633.194807][T17467] netlink: zone id is out of range [ 633.202995][T17467] netlink: get zone limit has 8 unknown bytes [ 633.446582][T17473] netlink: 'syz.0.3002': attribute type 16 has an invalid length. [ 633.459089][T17473] netlink: 'syz.0.3002': attribute type 17 has an invalid length. [ 634.817470][ T5848] Bluetooth: hci1: command tx timeout [ 635.059958][T17473] 8021q: adding VLAN 0 to HW filter on device team0 [ 635.075390][ T7414] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 635.083940][T17473] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 635.101580][T17471] __nla_validate_parse: 8 callbacks suppressed [ 635.101599][T17471] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3003'. [ 635.151731][T17467] veth0: left promiscuous mode [ 635.264737][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 635.287586][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 635.360176][T17494] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 635.401236][T17494] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3007'. [ 635.425421][ T7952] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 635.441572][T17494] 8021q: VLANs not supported on ip6tnl0 [ 635.456002][ T8031] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 635.466178][ T8031] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 635.466306][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 635.493472][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 635.543594][T17504] netlink: 'syz.1.3008': attribute type 1 has an invalid length. [ 635.640263][ T7952] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 636.330306][T17533] FAULT_INJECTION: forcing a failure. [ 636.330306][T17533] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 636.405334][T17533] CPU: 1 UID: 0 PID: 17533 Comm: syz.4.3016 Not tainted syzkaller #0 PREEMPT(full) [ 636.405362][T17533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 636.405375][T17533] Call Trace: [ 636.405382][T17533] [ 636.405390][T17533] dump_stack_lvl+0x189/0x250 [ 636.405417][T17533] ? __pfx____ratelimit+0x10/0x10 [ 636.405446][T17533] ? __pfx_dump_stack_lvl+0x10/0x10 [ 636.405468][T17533] ? __pfx__printk+0x10/0x10 [ 636.405494][T17533] ? __might_fault+0xb0/0x130 [ 636.405528][T17533] should_fail_ex+0x414/0x560 [ 636.405557][T17533] _copy_from_user+0x2d/0xb0 [ 636.405579][T17533] ___sys_sendmsg+0x158/0x2a0 [ 636.405605][T17533] ? __pfx____sys_sendmsg+0x10/0x10 [ 636.405663][T17533] ? __fget_files+0x2a/0x420 [ 636.405685][T17533] ? __fget_files+0x3a0/0x420 [ 636.405718][T17533] __x64_sys_sendmsg+0x19b/0x260 [ 636.405744][T17533] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 636.405776][T17533] ? __pfx_ksys_write+0x10/0x10 [ 636.405795][T17533] ? rcu_is_watching+0x15/0xb0 [ 636.405821][T17533] ? do_syscall_64+0xbe/0x3b0 [ 636.405845][T17533] do_syscall_64+0xfa/0x3b0 [ 636.405863][T17533] ? lockdep_hardirqs_on+0x9c/0x150 [ 636.405892][T17533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.405911][T17533] ? clear_bhb_loop+0x60/0xb0 [ 636.405943][T17533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.405962][T17533] RIP: 0033:0x7fb33b18eec9 [ 636.405980][T17533] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 636.405997][T17533] RSP: 002b:00007fb33c074038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 636.406018][T17533] RAX: ffffffffffffffda RBX: 00007fb33b3e6090 RCX: 00007fb33b18eec9 [ 636.406033][T17533] RDX: 0000000000000040 RSI: 00002000000001c0 RDI: 0000000000000003 [ 636.406046][T17533] RBP: 00007fb33c074090 R08: 0000000000000000 R09: 0000000000000000 [ 636.406058][T17533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 636.406070][T17533] R13: 00007fb33b3e6128 R14: 00007fb33b3e6090 R15: 00007fff316621e8 [ 636.406103][T17533] [ 636.748815][T17539] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3020'. [ 636.796491][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 636.821760][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 636.835910][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 636.846049][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 636.856548][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 636.875513][T17539] block nbd3: Unsupported socket: should be TCP or UNIX. [ 636.947401][T17538] lo speed is unknown, defaulting to 1000 [ 637.207281][T17558] vlan2: entered allmulticast mode [ 637.212434][T17558] bridge0: entered allmulticast mode [ 637.263385][T17566] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 637.316767][T17565] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 637.520478][T17579] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3027'. [ 637.706467][T17587] netlink: 'syz.2.3029': attribute type 1 has an invalid length. [ 637.768785][T17587] bond7: (slave bridge5): making interface the new active one [ 637.779445][T17587] bond7: (slave bridge5): Enslaving as an active interface with an up link [ 637.819134][T17538] chnl_net:caif_netlink_parms(): no params data found [ 638.021272][T17600] FAULT_INJECTION: forcing a failure. [ 638.021272][T17600] name failslab, interval 1, probability 0, space 0, times 0 [ 638.054379][T17600] CPU: 0 UID: 0 PID: 17600 Comm: syz.2.3030 Not tainted syzkaller #0 PREEMPT(full) [ 638.054413][T17600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 638.054425][T17600] Call Trace: [ 638.054432][T17600] [ 638.054441][T17600] dump_stack_lvl+0x189/0x250 [ 638.054470][T17600] ? __pfx____ratelimit+0x10/0x10 [ 638.054500][T17600] ? __pfx_dump_stack_lvl+0x10/0x10 [ 638.054525][T17600] ? __pfx__printk+0x10/0x10 [ 638.054559][T17600] ? __pfx___might_resched+0x10/0x10 [ 638.054586][T17600] should_fail_ex+0x414/0x560 [ 638.054619][T17600] should_failslab+0xa8/0x100 [ 638.054646][T17600] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 638.054671][T17600] ? __alloc_skb+0x112/0x2d0 [ 638.054696][T17600] __alloc_skb+0x112/0x2d0 [ 638.054721][T17600] netlink_sendmsg+0x5c6/0xb30 [ 638.054770][T17600] ? __pfx_netlink_sendmsg+0x10/0x10 [ 638.054795][T17600] ? aa_sock_msg_perm+0xf1/0x1d0 [ 638.054831][T17600] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 638.054855][T17600] ? __pfx_netlink_sendmsg+0x10/0x10 [ 638.054873][T17600] __sock_sendmsg+0x21c/0x270 [ 638.054903][T17600] ____sys_sendmsg+0x505/0x830 [ 638.054928][T17600] ? __pfx_____sys_sendmsg+0x10/0x10 [ 638.054957][T17600] ? import_iovec+0x74/0xa0 [ 638.054981][T17600] ___sys_sendmsg+0x21f/0x2a0 [ 638.055006][T17600] ? __pfx____sys_sendmsg+0x10/0x10 [ 638.055063][T17600] ? __fget_files+0x2a/0x420 [ 638.055086][T17600] ? __fget_files+0x3a0/0x420 [ 638.055121][T17600] __x64_sys_sendmsg+0x19b/0x260 [ 638.055144][T17600] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 638.055177][T17600] ? __pfx_ksys_write+0x10/0x10 [ 638.055206][T17600] ? do_syscall_64+0xbe/0x3b0 [ 638.055228][T17600] do_syscall_64+0xfa/0x3b0 [ 638.055246][T17600] ? lockdep_hardirqs_on+0x9c/0x150 [ 638.055274][T17600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.055292][T17600] ? clear_bhb_loop+0x60/0xb0 [ 638.055316][T17600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.055335][T17600] RIP: 0033:0x7f19ecd8eec9 [ 638.055351][T17600] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 638.055365][T17600] RSP: 002b:00007f19eaff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 638.055383][T17600] RAX: ffffffffffffffda RBX: 00007f19ecfe6090 RCX: 00007f19ecd8eec9 [ 638.055396][T17600] RDX: 0000000000000040 RSI: 00002000000001c0 RDI: 0000000000000003 [ 638.055409][T17600] RBP: 00007f19eaff6090 R08: 0000000000000000 R09: 0000000000000000 [ 638.055421][T17600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 638.055433][T17600] R13: 00007f19ecfe6128 R14: 00007f19ecfe6090 R15: 00007fff80cc07b8 [ 638.055466][T17600] [ 638.648339][T17538] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.675039][T17538] bridge0: port 1(bridge_slave_0) entered disabled state [ 638.683149][T17538] bridge_slave_0: entered allmulticast mode [ 638.695162][T17538] bridge_slave_0: entered promiscuous mode [ 638.784030][T17538] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.794795][T17538] bridge0: port 2(bridge_slave_1) entered disabled state [ 638.802307][T17538] bridge_slave_1: entered allmulticast mode [ 638.810954][T17538] bridge_slave_1: entered promiscuous mode [ 638.943163][T17620] netlink: 'syz.2.3036': attribute type 3 has an invalid length. [ 638.971218][T17620] netlink: 'syz.2.3036': attribute type 3 has an invalid length. [ 638.976144][ T51] Bluetooth: hci0: command tx timeout [ 638.987162][T17538] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 639.001789][T17538] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 639.077941][T17538] team0: Port device team_slave_0 added [ 639.088842][T17538] team0: Port device team_slave_1 added [ 639.174807][T17538] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 639.185387][T17538] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 639.235797][T17538] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 639.258989][T17538] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 639.271803][T17538] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 639.302787][T17538] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 639.306918][T17631] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3040'. [ 639.321293][T17630] lo speed is unknown, defaulting to 1000 [ 639.570474][T17538] hsr_slave_0: entered promiscuous mode [ 639.585392][T17538] hsr_slave_1: entered promiscuous mode [ 639.599930][T17538] debugfs: 'hsr0' already exists in 'hsr' [ 639.612394][T17538] Cannot create hsr debugfs directory [ 639.696137][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 639.915611][ T7954] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 639.974777][ T7954] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 640.030853][ T7954] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 640.199208][T17656] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3046'. [ 640.240785][T17650] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3044'. [ 640.260556][T17649] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3044'. [ 640.269224][T17660] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3045'. [ 640.518033][T17538] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 640.529434][T17538] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.648067][T17538] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 640.679182][T17538] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.957789][T17538] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 640.996297][T17538] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.029350][T17664] lo speed is unknown, defaulting to 1000 [ 641.055822][ T51] Bluetooth: hci0: command tx timeout [ 641.103347][T17538] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 641.115828][T17538] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.389475][T17683] netlink: 'syz.1.3052': attribute type 1 has an invalid length. [ 641.439125][T17684] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3052'. [ 641.520126][T17538] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 641.619120][T17538] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 641.688433][T17538] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 641.730521][T17538] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 641.998795][T17700] lo speed is unknown, defaulting to 1000 [ 642.259957][T17538] 8021q: adding VLAN 0 to HW filter on device bond0 [ 642.319705][T17538] 8021q: adding VLAN 0 to HW filter on device team0 [ 642.533872][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.541138][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 642.596630][T17711] syzkaller0: entered promiscuous mode [ 642.615339][T17711] syzkaller0: entered allmulticast mode [ 642.651566][ T8029] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.658793][ T8029] bridge0: port 2(bridge_slave_1) entered forwarding state [ 643.135836][ T51] Bluetooth: hci0: command tx timeout [ 643.314544][T17726] netlink: 29 bytes leftover after parsing attributes in process `syz.1.3057'. [ 643.796207][T17538] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 643.897716][T17538] veth0_vlan: entered promiscuous mode [ 643.912824][T17538] veth1_vlan: entered promiscuous mode [ 644.062677][T17743] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3060'. [ 644.089919][T17538] veth0_macvtap: entered promiscuous mode [ 644.117943][T17538] veth1_macvtap: entered promiscuous mode [ 644.152445][T17747] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3061'. [ 644.177817][T17538] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 644.238575][T17538] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 644.279196][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.315918][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.344622][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.378422][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.467254][T17758] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3066'. [ 644.520174][T17758] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3066'. [ 644.538243][T17758] netlink: 'syz.1.3066': attribute type 14 has an invalid length. [ 644.565082][T17758] netlink: 'syz.1.3066': attribute type 11 has an invalid length. [ 644.623561][ T8031] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.645906][ T8031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.732672][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 644.758504][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.215483][ T51] Bluetooth: hci0: command tx timeout [ 645.728028][T17800] lo speed is unknown, defaulting to 1000 [ 646.101453][T17803] __nla_validate_parse: 6 callbacks suppressed [ 646.101470][T17803] netlink: 176 bytes leftover after parsing attributes in process `syz.3.3074'. [ 646.169566][T17803] ip6gretap0: entered promiscuous mode [ 646.178069][T17803] netlink: 176 bytes leftover after parsing attributes in process `syz.3.3074'. [ 646.547126][ T5848] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 646.558976][ T5848] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 646.568251][ T5848] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 646.578573][ T5848] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 646.589446][ T5848] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 646.821517][T17814] lo speed is unknown, defaulting to 1000 [ 647.392175][T17833] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3078'. [ 647.951815][T17814] chnl_net:caif_netlink_parms(): no params data found [ 648.218870][T17814] bridge0: port 1(bridge_slave_0) entered blocking state [ 648.226699][T17814] bridge0: port 1(bridge_slave_0) entered disabled state [ 648.236176][T17814] bridge_slave_0: entered allmulticast mode [ 648.244221][T17814] bridge_slave_0: entered promiscuous mode [ 648.266581][T17814] bridge0: port 2(bridge_slave_1) entered blocking state [ 648.273832][T17814] bridge0: port 2(bridge_slave_1) entered disabled state [ 648.281966][T17814] bridge_slave_1: entered allmulticast mode [ 648.290647][T17814] bridge_slave_1: entered promiscuous mode [ 648.387357][T17814] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 648.409605][T17814] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 648.450768][T17851] netlink: 'syz.3.3082': attribute type 11 has an invalid length. [ 648.486851][T17814] team0: Port device team_slave_0 added [ 648.506306][T17814] team0: Port device team_slave_1 added [ 648.551860][T17850] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3081'. [ 648.602039][T17652] Set syz1 is full, maxelem 65536 reached [ 648.627055][T17814] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 648.641810][T17814] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 648.669770][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 648.679953][ T51] Bluetooth: hci2: command tx timeout [ 648.691560][T17814] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 648.720063][T17852] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3081'. [ 648.738607][T17814] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 648.751054][T17814] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 648.777590][T17814] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 648.904532][T17814] hsr_slave_0: entered promiscuous mode [ 648.916225][T17814] hsr_slave_1: entered promiscuous mode [ 648.922791][T17814] debugfs: 'hsr0' already exists in 'hsr' [ 648.929125][T17814] Cannot create hsr debugfs directory [ 649.041374][T17866] bond17 (unregistering): Released all slaves [ 649.091750][T17871] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3088'. [ 649.200451][T17864] lo speed is unknown, defaulting to 1000 [ 649.233146][T17873] tipc: Started in network mode [ 649.240867][T17873] tipc: Node identity 16ab1037b2ab, cluster identity 4711 [ 649.255481][T17873] tipc: Enabled bearer , priority 0 [ 649.264915][T17873] syzkaller0: entered promiscuous mode [ 649.270409][T17873] syzkaller0: entered allmulticast mode [ 649.383622][T17873] tipc: Resetting bearer [ 649.401160][T17877] netlink: 92 bytes leftover after parsing attributes in process `syz.1.3090'. [ 649.428423][T17877] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3090'. [ 649.475908][T17872] tipc: Resetting bearer [ 649.492938][T17872] tipc: Disabling bearer [ 649.716294][T17881] tipc: Enabled bearer , priority 0 [ 649.743833][T17881] syzkaller0: entered promiscuous mode [ 649.776989][T17881] syzkaller0: entered allmulticast mode [ 649.988194][T17880] tipc: Resetting bearer [ 650.046358][T17880] tipc: Disabling bearer [ 650.549087][T17921] syz_tun: entered allmulticast mode [ 650.560464][T17917] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3102'. [ 650.612786][T17921] dvmrp8: entered allmulticast mode [ 650.699575][T17923] netlink: 'syz.3.3103': attribute type 23 has an invalid length. [ 650.736446][ T51] Bluetooth: hci2: command tx timeout [ 650.793241][T17921] lo speed is unknown, defaulting to 1000 [ 650.822100][T17814] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 650.890692][T17814] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 650.921145][T17814] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 650.972162][T17814] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 651.196935][T17931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3104'. [ 651.249595][T17931] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3104'. [ 651.322890][T17931] netlink: 220 bytes leftover after parsing attributes in process `syz.0.3104'. [ 651.378769][T17920] syz_tun: left allmulticast mode [ 651.378770][T17931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3104'. [ 651.426233][T17920] dvmrp8: left allmulticast mode [ 651.687459][T17814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.899431][T17814] 8021q: adding VLAN 0 to HW filter on device team0 [ 651.913190][ T1108] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.920413][ T1108] bridge0: port 1(bridge_slave_0) entered forwarding state [ 651.961130][ T8031] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.961842][T17938] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3106'. [ 651.968318][ T8031] bridge0: port 2(bridge_slave_1) entered forwarding state [ 652.023437][T17939] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3106'. [ 652.077987][T17814] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 652.104971][T17814] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 652.380336][T17945] netlink: 'syz.1.3109': attribute type 2 has an invalid length. [ 652.400588][T17945] netlink: 'syz.1.3109': attribute type 1 has an invalid length. [ 652.430724][T17945] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3109'. [ 652.691983][T17814] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 652.710402][T17957] tipc: Enabled bearer , priority 0 [ 652.729072][T17957] syzkaller0: entered promiscuous mode [ 652.734691][T17957] syzkaller0: entered allmulticast mode [ 652.777579][T17957] tipc: Resetting bearer [ 652.792953][T17954] tipc: Resetting bearer [ 652.814689][T17954] tipc: Disabling bearer [ 652.823295][ T51] Bluetooth: hci2: command tx timeout [ 652.892033][T17968] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3115'. [ 652.909313][T17814] veth0_vlan: entered promiscuous mode [ 652.929021][T17970] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3115'. [ 652.949560][T17963] lo speed is unknown, defaulting to 1000 [ 652.952520][T17814] veth1_vlan: entered promiscuous mode [ 653.047043][T17814] veth0_macvtap: entered promiscuous mode [ 653.096921][T17814] veth1_macvtap: entered promiscuous mode [ 653.142876][T17979] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3118'. [ 653.167978][T17814] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 653.206983][T17814] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 653.250699][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.263319][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.287680][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.346306][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.500738][ T8031] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 653.521174][ T8031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 653.769428][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 653.782204][T17992] lo speed is unknown, defaulting to 1000 [ 653.788869][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.229888][T18004] tc_dump_action: action bad kind [ 654.260892][T18005] 8021q: VLANs not supported on nlmon0 [ 654.868890][T18017] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 654.895784][ T51] Bluetooth: hci2: command tx timeout [ 655.381348][T18030] netlink: 'syz.3.3134': attribute type 4 has an invalid length. [ 655.498171][T18030] wg1: entered allmulticast mode [ 655.609470][T18042] lo speed is unknown, defaulting to 1000 [ 655.956646][T18044] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 656.422845][T18053] __nla_validate_parse: 85 callbacks suppressed [ 656.422864][T18053] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3141'. [ 656.633835][ T5848] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 656.644134][ T5848] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 656.653130][ T5848] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 656.662874][ T5848] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 656.671528][ T5848] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 656.754780][T18055] lo speed is unknown, defaulting to 1000 [ 657.094824][T18062] lo speed is unknown, defaulting to 1000 [ 657.607881][ T8031] batadv1: left allmulticast mode [ 657.622019][ T8031] batadv1: left promiscuous mode [ 657.629078][ T8031] bridge0: port 3(batadv1) entered disabled state [ 657.940953][ T8031] bond7 (unregistering): (slave ip6gretap1): Releasing active interface [ 658.354584][ T8031] dvmrp1 (unregistering): left allmulticast mode [ 658.490477][ T8031] bond9 (unregistering): (slave vlan3): Releasing active interface [ 658.578531][ T8031] team0: Port device bridge2 removed [ 658.804067][ T8031] bond12 (unregistering): (slave bridge7): Releasing backup interface [ 658.813281][ T8031] bridge7 (unregistering): left promiscuous mode [ 658.819981][ T51] Bluetooth: hci3: command tx timeout [ 658.830437][ T8031] bridge7 (unregistering): left allmulticast mode [ 658.975360][T18104] netlink: 'syz.4.3151': attribute type 10 has an invalid length. [ 659.045826][ T8031] bond0 (unregistering): Released all slaves [ 659.157205][ T8031] bond1 (unregistering): Released all slaves [ 659.268955][ T8031] bond2 (unregistering): Released all slaves [ 659.283202][ T8031] bond3 (unregistering): (slave veth3): Releasing active interface [ 659.292063][ T8031] bond3 (unregistering): Released all slaves [ 659.401325][ T8031] bond4 (unregistering): Released all slaves [ 659.503452][ T8031] bond5 (unregistering): (slave wireguard0): Releasing backup interface [ 659.513284][ T8031] bond5 (unregistering): (slave wireguard1): Releasing backup interface [ 659.522462][ T8031] bond5 (unregistering): Released all slaves [ 659.628917][ T8031] bond6 (unregistering): Released all slaves [ 659.724646][ T8031] bond7 (unregistering): Released all slaves [ 659.829137][ T8031] bond8 (unregistering): Released all slaves [ 659.842526][ T8031] bond9 (unregistering): Released all slaves [ 659.858299][ T8031] bond10 (unregistering): Released all slaves [ 659.963118][ T8031] bond11 (unregistering): Released all slaves [ 660.061530][ T8031] bond12 (unregistering): Released all slaves [ 660.156162][ T8031] bond13 (unregistering): Released all slaves [ 660.264148][ T8031] bond14 (unregistering): Released all slaves [ 660.360626][ T8031] bond15 (unregistering): Released all slaves [ 660.374485][ T8031] bond16 (unregistering): Released all slaves [ 660.501572][T18086] lo speed is unknown, defaulting to 1000 [ 660.590942][ T8031] tipc: Left network mode [ 660.895317][ T51] Bluetooth: hci3: command tx timeout [ 661.067143][T18124] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3156'. [ 661.251448][T18062] chnl_net:caif_netlink_parms(): no params data found [ 661.683359][T18062] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.691262][T18062] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.701003][T18062] bridge_slave_0: entered allmulticast mode [ 661.711627][T18062] bridge_slave_0: entered promiscuous mode [ 661.724786][T18062] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.733592][T18062] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.746996][T18062] bridge_slave_1: entered allmulticast mode [ 661.774531][T18062] bridge_slave_1: entered promiscuous mode [ 661.842850][T18153] tun0: tun_chr_ioctl cmd 1074025672 [ 661.849994][T18153] tun0: ignored: set checksum disabled [ 661.950377][T18062] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 661.964406][T18154] tun0: tun_chr_ioctl cmd 1074025672 [ 661.977054][T18154] tun0: ignored: set checksum disabled [ 661.987881][T18062] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 662.019690][ T8031] hsr_slave_0: left promiscuous mode [ 662.027539][ T8031] hsr_slave_1: left promiscuous mode [ 662.069940][ T8031] pim6reg99999999 (unregistering): left allmulticast mode [ 662.947358][T18062] team0: Port device team_slave_0 added [ 662.975055][ T51] Bluetooth: hci3: command tx timeout [ 663.045564][T18062] team0: Port device team_slave_1 added [ 663.190834][T18167] syzkaller1: entered promiscuous mode [ 663.203839][T18167] syzkaller1: entered allmulticast mode [ 663.248068][T18062] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 663.256042][T18062] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 663.294498][T18062] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 663.383026][T18062] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 663.390439][T18062] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 663.432198][T18062] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 663.451072][T18170] netlink: 'syz.0.3168': attribute type 4 has an invalid length. [ 663.943717][T18062] hsr_slave_0: entered promiscuous mode [ 663.974325][T18062] hsr_slave_1: entered promiscuous mode [ 663.986952][T18062] debugfs: 'hsr0' already exists in 'hsr' [ 663.994373][T18062] Cannot create hsr debugfs directory [ 664.005726][T18182] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3170'. [ 664.017645][T18182] netlink: 245 bytes leftover after parsing attributes in process `syz.4.3170'. [ 664.302123][T18188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3173'. [ 664.331025][T18188] netlink: 'syz.0.3173': attribute type 5 has an invalid length. [ 664.341254][T18188] netlink: 'syz.0.3173': attribute type 8 has an invalid length. [ 664.376547][T18188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3173'. [ 664.429037][T18197] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3175'. [ 664.472515][T18199] bridge_slave_0: left allmulticast mode [ 664.496510][T18199] bridge_slave_0: left promiscuous mode [ 664.568677][T18199] bridge0: port 1(bridge_slave_0) entered disabled state [ 664.589732][T18199] bridge_slave_1: left allmulticast mode [ 664.595647][T18199] bridge_slave_1: left promiscuous mode [ 664.601658][T18199] bridge0: port 2(bridge_slave_1) entered disabled state [ 664.650543][T18199] bond0: (slave bond_slave_0): Releasing backup interface [ 664.676549][T18199] bond0: (slave bond_slave_1): Releasing backup interface [ 664.695725][T18199] team0: Port device team_slave_0 removed [ 664.709363][T18199] team0: Port device team_slave_1 removed [ 664.716985][T18199] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 664.724479][T18199] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 664.734685][T18199] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 664.748184][T18199] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 664.760954][T18199] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 664.808273][T18188] geneve2: entered promiscuous mode [ 664.813705][T18188] geneve2: entered allmulticast mode [ 664.940644][ T3441] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 664.953497][T18210] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3178'. [ 664.963344][ T3441] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 664.978548][ T3441] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 664.988633][ T3441] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 665.056582][ T51] Bluetooth: hci3: command tx timeout [ 665.221573][T18225] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3179'. [ 665.291057][T18213] syzkaller1: entered promiscuous mode [ 665.306918][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 665.325057][T18213] syzkaller1: entered allmulticast mode [ 666.113735][ T8031] IPVS: stop unused estimator thread 0... [ 666.331150][T18241] !: renamed from dummy0 (while UP) [ 667.057523][T18062] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 667.137722][T18062] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 667.234237][T18062] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 667.318186][T18062] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 667.378950][T18260] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3188'. [ 667.433640][T18257] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3187'. [ 668.568500][ T3577] nci: nci_rsp_packet: unknown rsp opcode 0x73a [ 668.601761][ T30] audit: type=1804 audit(1759491282.671:3): pid=18292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3193" name="/newroot/58/cgroup.controllers" dev="tmpfs" ino=316 res=1 errno=0 [ 668.610335][T18062] 8021q: adding VLAN 0 to HW filter on device bond0 [ 668.648699][ T30] audit: type=1800 audit(1759491282.701:4): pid=18292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3193" name="cgroup.controllers" dev="tmpfs" ino=316 res=0 errno=0 [ 668.729199][T18062] 8021q: adding VLAN 0 to HW filter on device team0 [ 668.744481][ T3577] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.751709][ T3577] bridge0: port 1(bridge_slave_0) entered forwarding state [ 668.779215][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.786464][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 669.191905][T18062] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 669.327160][T18062] veth0_vlan: entered promiscuous mode [ 669.360198][T18062] veth1_vlan: entered promiscuous mode [ 669.443603][T18062] veth0_macvtap: entered promiscuous mode [ 669.484057][T18062] veth1_macvtap: entered promiscuous mode [ 669.539887][T18062] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 669.589842][T18062] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 669.608728][ T3577] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.633227][ T3577] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.660466][ T3577] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.673847][ T3577] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.700761][T18327] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3202'. [ 669.721705][T18327] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3202'. [ 669.872998][ T8031] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.881907][ T8031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.921430][ T3441] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.939644][ T3441] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 670.496803][ T5848] Bluetooth: hci3: command 0x0405 tx timeout [ 670.704612][T18355] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3211'. [ 671.240133][T18370] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3213'. [ 671.250338][T18370] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3213'. [ 671.288113][T18372] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 671.356444][T18372] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 671.409357][T18372] bridge1: entered promiscuous mode [ 671.414601][T18372] bridge1: entered allmulticast mode [ 671.463293][T18372] team0: Port device bridge1 added [ 672.039751][T18398] netlink: 'syz.4.3221': attribute type 4 has an invalid length. [ 672.095883][T18398] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3221'. [ 673.143055][T18435] netlink: 'syz.1.3231': attribute type 13 has an invalid length. [ 673.167975][T18435] netlink: 'syz.1.3231': attribute type 17 has an invalid length. [ 673.352456][T18441] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3231'. [ 673.399576][T18444] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3234'. [ 673.603441][T18435] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 673.868905][T18450] bridge1: entered promiscuous mode [ 673.884512][T18450] bridge1: entered allmulticast mode [ 673.907705][T18450] team0: Port device bridge1 added [ 674.267670][T18467] netlink: 'syz.0.3240': attribute type 2 has an invalid length. [ 674.987385][T18481] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3247'. [ 675.046228][T18490] netlink: 'syz.3.3249': attribute type 1 has an invalid length. [ 675.087600][T18490] netlink: 'syz.3.3249': attribute type 1 has an invalid length. [ 675.097347][T18487] netlink: 'syz.0.3250': attribute type 4 has an invalid length. [ 675.135965][T18490] netlink: 160 bytes leftover after parsing attributes in process `syz.3.3249'. [ 675.166629][T18489] syzkaller0: entered promiscuous mode [ 675.172334][T18489] syzkaller0: entered allmulticast mode [ 675.178321][T18490] netlink: 'syz.3.3249': attribute type 1 has an invalid length. [ 675.178343][T18490] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3249'. [ 675.206677][T18488] netlink: 212388 bytes leftover after parsing attributes in process `syz.4.3247'. [ 675.223520][T18488] netlink: get zone limit has 8 unknown bytes [ 675.349918][T18501] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3251'. [ 675.614305][T18501] netlink: 'syz.2.3251': attribute type 10 has an invalid length. [ 675.664314][T18501] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3251'. [ 675.834225][T18501] batman_adv: batadv0: Adding interface: virt_wifi0 [ 675.859052][T18501] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 675.932426][T18501] batman_adv: batadv0: Interface activated: virt_wifi0 [ 675.967272][T18512] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3254'. [ 676.129487][T18500] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3252'. [ 676.487408][T18531] netlink: 'syz.2.3258': attribute type 10 has an invalid length. [ 676.578025][T18531] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 676.593349][T18531] team0: Port device netdevsim0 added [ 676.730015][T18545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3264'. [ 676.774008][T18545] netlink: 248 bytes leftover after parsing attributes in process `syz.0.3264'. [ 676.931976][T18558] syz_tun: entered allmulticast mode [ 676.950141][T18556] syz_tun: left allmulticast mode [ 677.239965][T18574] nbd: nbd2 already in use [ 677.254133][T18574] block nbd2: NBD_DISCONNECT [ 677.262846][T18574] block nbd2: Send disconnect failed -32 [ 677.285448][T18574] block nbd2: shutting down sockets [ 677.590067][T18592] veth1_macvtap: left promiscuous mode [ 677.595913][T18592] macsec0: entered allmulticast mode [ 677.613917][T18592] veth1_macvtap: entered promiscuous mode [ 677.662375][T18592] veth1_macvtap: entered allmulticast mode [ 677.689592][T18597] netlink: 'syz.0.3280': attribute type 21 has an invalid length. [ 677.700422][T18592] macsec0: left allmulticast mode [ 677.707128][T18592] veth1_macvtap: left allmulticast mode [ 677.722983][T18597] tipc: Enabling of bearer rejected, failed to enable media [ 677.801837][T18601] geneve2: entered promiscuous mode [ 677.825122][T18601] geneve2: entered allmulticast mode [ 678.659891][T18641] nbd: nbd1 already in use [ 678.669891][T18642] nbd: nbd1 already in use [ 678.676315][T18641] block nbd1: NBD_DISCONNECT [ 678.680936][T18641] block nbd1: Send disconnect failed -32 [ 678.731551][T18641] block nbd1: shutting down sockets [ 679.022794][T18649] IPVS: set_ctl: invalid protocol: 47 224.0.0.2:20000 [ 679.566938][ T8029] bond6 (unregistering): (slave ip6gretap1): Releasing active interface [ 679.576998][ T8029] bond6 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 4e:fe:26:09:97:31 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 679.803901][T18696] netlink: 'syz.2.3304': attribute type 4 has an invalid length. [ 680.688500][ T8029] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 680.697163][ T8029] bond0 (unregistering): Released all slaves [ 680.792703][ T8029] bond1 (unregistering): Released all slaves [ 680.805629][ T8029] bond2 (unregistering): Released all slaves [ 680.821629][ T8029] bond3 (unregistering): Released all slaves [ 680.834597][ T8029] bond4 (unregistering): Released all slaves [ 680.938939][ T8029] bond5 (unregistering): (slave veth5): Releasing active interface [ 680.950683][ T8029] bond5 (unregistering): Released all slaves [ 681.050472][ T8029] bond6 (unregistering): (slave veth7): Releasing active interface [ 681.060372][ T8029] bond6 (unregistering): Released all slaves [ 681.159187][ T8029] bond7 (unregistering): Released all slaves [ 681.197907][T18672] tipc: Enabling of bearer rejected, failed to enable media [ 681.229533][T18694] netlink: 'syz.2.3304': attribute type 4 has an invalid length. [ 681.357932][T18701] vxcan1: entered allmulticast mode [ 681.378581][T18701] vxcan1: left allmulticast mode [ 681.399958][ T8029] : left promiscuous mode [ 681.606820][ T8029] tipc: Disabling bearer [ 681.615811][ T8029] tipc: Left network mode [ 681.730062][T18718] __nla_validate_parse: 4 callbacks suppressed [ 681.730082][T18718] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3312'. [ 681.730895][ T8029] IPVS: stopping master sync thread 13684 ... [ 681.763423][T18718] netlink: 576 bytes leftover after parsing attributes in process `syz.2.3312'. [ 681.816424][T18722] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3313'. [ 682.007629][T18725] tipc: Enabling of bearer rejected, failed to enable media [ 682.022690][T18730] netlink: 'syz.1.3316': attribute type 25 has an invalid length. [ 682.042844][T18735] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 682.180510][T18741] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3320'. [ 682.192377][T18741] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3320'. [ 682.203255][T18735] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 682.509168][T18763] vlan0: entered promiscuous mode [ 682.549641][T18763] macvtap0: entered promiscuous mode [ 682.627579][T18775] netlink: 'syz.0.3327': attribute type 1 has an invalid length. [ 682.637624][ T8029] mac80211_hwsim hwsim8 wlan0 (unregistering): left allmulticast mode [ 682.648208][ T8029] mac80211_hwsim hwsim8 wlan0 (unregistering): left promiscuous mode [ 682.702013][T18762] vlan0: entered promiscuous mode [ 682.859422][T18775] bond1: entered promiscuous mode [ 682.893051][T18775] 8021q: adding VLAN 0 to HW filter on device bond1 [ 683.007656][T18796] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3332'. [ 683.086373][ T8029] hsr_slave_0: left promiscuous mode [ 683.102455][ T8029] hsr_slave_1: left promiscuous mode [ 683.136733][ T8029] vlan0: left promiscuous mode [ 683.142232][ T8029] veth0_macvtap: left allmulticast mode [ 683.149942][ T8029] veth1_macvtap: left promiscuous mode [ 683.157096][ T8029] veth0_macvtap: left promiscuous mode [ 683.164075][ T8029] veth1_vlan: left promiscuous mode [ 683.391005][ T8029] pim6reg99999999 (unregistering): left allmulticast mode [ 684.122893][T18796] ip6gretap0: entered promiscuous mode [ 684.129375][T18796] macvtap2: entered promiscuous mode [ 684.136278][T18796] macvtap2: entered allmulticast mode [ 684.141761][T18796] ip6gretap0: entered allmulticast mode [ 684.159343][T18803] ip6gretap0: left allmulticast mode [ 684.165451][T18803] ip6gretap0: left promiscuous mode [ 684.208330][T18812] netlink: 'syz.2.3336': attribute type 4 has an invalid length. [ 684.449059][T18822] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.461695][T18833] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3340'. [ 684.483830][T18833] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 684.552341][T18833] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 684.609405][T18839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3342'. [ 684.674192][T18822] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.721753][T18839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3342'. [ 684.824071][T18851] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3344'. [ 684.828799][T18822] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.060206][T18822] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.123510][ T8029] IPVS: stop unused estimator thread 0... [ 685.304191][ T8029] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.321844][ T8029] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 685.341732][ T8029] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 685.363522][ T7375] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 685.398911][ T7375] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 685.422302][ T8029] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.472469][ T8029] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.550215][ T8029] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.640416][T18885] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 685.779841][ T1297] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 685.945603][ T7952] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 686.169202][T18915] IPv6: addrconf: prefix option has invalid lifetime [ 686.746862][T18935] netlink: 'syz.3.3366': attribute type 1 has an invalid length. [ 686.869853][T18935] 8021q: adding VLAN 0 to HW filter on device bond1 [ 686.898604][T18939] bond1: (slave geneve2): making interface the new active one [ 686.907987][T18939] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 687.144610][T18950] __nla_validate_parse: 2 callbacks suppressed [ 687.144630][T18950] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3371'. [ 687.202105][T18950] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3371'. [ 687.233069][T18953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3373'. [ 689.777306][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 690.443914][T18970] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3378'. [ 690.971645][T18982] netlink: 'syz.0.3380': attribute type 2 has an invalid length. [ 692.102701][T18982] dvmrp1: entered allmulticast mode [ 693.351389][T19004] netlink: 'syz.1.3387': attribute type 1 has an invalid length. [ 693.441339][T19004] 8021q: adding VLAN 0 to HW filter on device bond2 [ 693.552414][T19010] bond2: (slave ip6erspan0): making interface the new active one [ 693.591054][T19010] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 693.640407][T19022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3389'. [ 694.022101][T19042] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3394'. [ 694.167950][T19054] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3397'. [ 694.429749][T19042] bridge_slave_1: left allmulticast mode [ 694.447956][T19042] bridge_slave_1: left promiscuous mode [ 694.514672][T19042] bridge0: port 2(bridge_slave_1) entered disabled state [ 694.528249][T19042] bridge_slave_0: left allmulticast mode [ 694.534195][T19042] bridge_slave_0: left promiscuous mode [ 694.544181][T19042] bridge0: port 1(bridge_slave_0) entered disabled state [ 695.279782][T19096] tipc: Started in network mode [ 695.308902][T19096] tipc: Node identity d2e0d0839ef1, cluster identity 4711 [ 695.345599][T19096] tipc: Enabled bearer , priority 0 [ 695.386170][T19104] syzkaller0: entered promiscuous mode [ 695.406922][T19104] syzkaller0: entered allmulticast mode [ 695.451307][T19096] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 695.466750][T19096] tipc: Resetting bearer [ 695.474287][T19111] Bluetooth: MGMT ver 1.23 [ 695.480435][T19112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3410'. [ 695.491679][T19093] tipc: Resetting bearer [ 695.508074][T19093] tipc: Disabling bearer [ 695.532083][T19113] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 695.928035][T19089] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 696.032195][T19133] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 696.145183][T19135] netlink: 'syz.2.3417': attribute type 3 has an invalid length. [ 696.176587][T19136] netlink: 'syz.2.3417': attribute type 3 has an invalid length. [ 696.251762][T19139] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 696.501288][T19147] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3416'. [ 696.548455][T19160] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3424'. [ 696.598388][T19147] hsr_slave_0: left promiscuous mode [ 696.617982][T19147] hsr_slave_1: left promiscuous mode [ 696.627811][T19164] netlink: 14 bytes leftover after parsing attributes in process `syz.4.3425'. [ 696.653435][T19160] 0ªX¹¦À: renamed from caif0 [ 696.662061][T19160] 0ªX¹¦À: entered allmulticast mode [ 696.675491][T19160] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 696.779579][T19169] IPv6: addrconf: prefix option has invalid lifetime [ 697.073033][T19164] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 697.096582][T19164] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 697.118053][T19164] bond0 (unregistering): Released all slaves [ 697.163881][T19169] 8021q: adding VLAN 0 to HW filter on device bond2 [ 697.272899][T19174] macvlan2: entered promiscuous mode [ 697.308654][T19174] macvlan2: entered allmulticast mode [ 697.316845][T19174] bond2: entered promiscuous mode [ 697.323896][T19174] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 697.416726][T19174] bond2: left promiscuous mode [ 697.538478][T19181] ipvlan0: entered promiscuous mode [ 697.670040][T19183] veth0_to_bridge: entered promiscuous mode [ 697.677262][T19198] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3431'. [ 697.743660][T19194] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3428'. [ 697.761698][T19201] netlink: 'syz.3.3433': attribute type 1 has an invalid length. [ 697.764123][T19194] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 697.856725][T19201] 8021q: adding VLAN 0 to HW filter on device bond2 [ 697.864216][T19180] veth0_to_bridge: left promiscuous mode [ 697.877584][T19201] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3433'. [ 698.150146][T19217] 8021q: adding VLAN 0 to HW filter on device bond3 [ 698.183822][T19217] bridge0: port 1(bond3) entered blocking state [ 698.211512][T19217] bridge0: port 1(bond3) entered disabled state [ 698.228338][T19217] bond3: entered allmulticast mode [ 698.257845][T19217] bond3: entered promiscuous mode [ 698.275669][T19217] bridge0: port 1(bond3) entered blocking state [ 698.282379][T19217] bridge0: port 1(bond3) entered forwarding state [ 698.330801][ T13] bridge0: port 1(bond3) entered disabled state [ 698.575074][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 698.944691][ T36] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.963903][ T36] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 698.974501][ T36] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.984029][ T36] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 699.036655][ T36] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.058295][ T36] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 699.080996][ T36] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.100293][ T36] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 699.126740][T19260] FAULT_INJECTION: forcing a failure. [ 699.126740][T19260] name failslab, interval 1, probability 0, space 0, times 0 [ 699.145849][T19257] tipc: Enabled bearer , priority 0 [ 699.159988][T19257] syzkaller0: entered promiscuous mode [ 699.161219][T19260] CPU: 0 UID: 0 PID: 19260 Comm: syz.0.3449 Not tainted syzkaller #0 PREEMPT(full) [ 699.161243][T19260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 699.161255][T19260] Call Trace: [ 699.161263][T19260] [ 699.161271][T19260] dump_stack_lvl+0x189/0x250 [ 699.161300][T19260] ? __pfx____ratelimit+0x10/0x10 [ 699.161330][T19260] ? __pfx_dump_stack_lvl+0x10/0x10 [ 699.161353][T19260] ? __pfx__printk+0x10/0x10 [ 699.161378][T19260] ? __local_bh_enable_ip+0x12d/0x1c0 [ 699.161408][T19260] ? sctp_get_port_local+0xe5d/0x1680 [ 699.161438][T19260] should_fail_ex+0x414/0x560 [ 699.161470][T19260] should_failslab+0xa8/0x100 [ 699.161495][T19260] __kmalloc_cache_noprof+0x70/0x3d0 [ 699.161526][T19260] ? sctp_add_bind_addr+0x8c/0x370 [ 699.161551][T19260] sctp_add_bind_addr+0x8c/0x370 [ 699.161569][T19260] ? sctp_auto_asconf_init+0x15c/0x1e0 [ 699.161600][T19260] sctp_do_bind+0x5ab/0x940 [ 699.161639][T19260] sctp_connect_new_asoc+0x25c/0x690 [ 699.161667][T19260] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 699.161691][T19260] ? __local_bh_enable_ip+0x12d/0x1c0 [ 699.161718][T19260] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 699.161737][T19260] ? security_sctp_bind_connect+0x7e/0x2e0 [ 699.161761][T19260] sctp_sendmsg+0x155c/0x2810 [ 699.161799][T19260] ? __pfx_sctp_sendmsg+0x10/0x10 [ 699.161827][T19260] ? aa_sk_perm+0x81e/0x950 [ 699.161857][T19260] ? __pfx_aa_sk_perm+0x10/0x10 [ 699.161885][T19260] ? sock_rps_record_flow+0x19/0x410 [ 699.161917][T19260] ? inet_sendmsg+0x2f4/0x370 [ 699.161949][T19260] __sock_sendmsg+0x19c/0x270 [ 699.161980][T19260] ____sys_sendmsg+0x52d/0x830 [ 699.162009][T19260] ? __pfx_____sys_sendmsg+0x10/0x10 [ 699.162041][T19260] ? import_iovec+0x74/0xa0 [ 699.162068][T19260] ___sys_sendmsg+0x21f/0x2a0 [ 699.162094][T19260] ? __pfx____sys_sendmsg+0x10/0x10 [ 699.162157][T19260] ? __fget_files+0x2a/0x420 [ 699.162181][T19260] ? __fget_files+0x3a0/0x420 [ 699.162219][T19260] __sys_sendmmsg+0x227/0x430 [ 699.162249][T19260] ? __pfx___sys_sendmmsg+0x10/0x10 [ 699.162269][T19260] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 699.162318][T19260] ? ksys_write+0x22a/0x250 [ 699.162344][T19260] ? __pfx_ksys_write+0x10/0x10 [ 699.162363][T19260] ? rcu_is_watching+0x15/0xb0 [ 699.162393][T19260] __x64_sys_sendmmsg+0xa0/0xc0 [ 699.162418][T19260] do_syscall_64+0xfa/0x3b0 [ 699.162437][T19260] ? lockdep_hardirqs_on+0x9c/0x150 [ 699.162465][T19260] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.162485][T19260] ? clear_bhb_loop+0x60/0xb0 [ 699.162514][T19260] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.162533][T19260] RIP: 0033:0x7fb97c18eec9 [ 699.162550][T19260] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 699.162567][T19260] RSP: 002b:00007fb97a3ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 699.162588][T19260] RAX: ffffffffffffffda RBX: 00007fb97c3e5fa0 RCX: 00007fb97c18eec9 [ 699.162602][T19260] RDX: 0000000000000001 RSI: 0000200000000880 RDI: 0000000000000003 [ 699.162615][T19260] RBP: 00007fb97a3ee090 R08: 0000000000000000 R09: 0000000000000000 [ 699.162628][T19260] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 699.162640][T19260] R13: 00007fb97c3e6038 R14: 00007fb97c3e5fa0 R15: 00007ffd0beb3f78 [ 699.162673][T19260] [ 699.315941][T19265] __nla_validate_parse: 2 callbacks suppressed [ 699.315959][T19265] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3450'. [ 699.323629][T19257] syzkaller0: entered allmulticast mode [ 699.597953][T19270] tipc: Resetting bearer [ 699.606741][T19255] tipc: Resetting bearer [ 699.649873][T19255] tipc: Disabling bearer [ 699.657528][T19271] [ 699.659870][T19271] ====================================================== [ 699.666883][T19271] WARNING: possible circular locking dependency detected [ 699.673910][T19271] syzkaller #0 Not tainted [ 699.678324][T19271] ------------------------------------------------------ [ 699.685342][T19271] syz.0.3451/19271 is trying to acquire lock: [ 699.691409][T19271] ffffffff8de20648 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x286/0x1720 [ 699.701014][T19271] [ 699.701014][T19271] but task is already holding lock: [ 699.708388][T19271] ffff888024ceec98 (&q->q_usage_counter(io)#50){++++}-{0:0}, at: nbd_start_device+0x17f/0xb10 [ 699.718700][T19271] [ 699.718700][T19271] which lock already depends on the new lock. [ 699.718700][T19271] [ 699.729112][T19271] [ 699.729112][T19271] the existing dependency chain (in reverse order) is: [ 699.738133][T19271] [ 699.738133][T19271] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 699.746765][T19271] lock_acquire+0x120/0x360 [ 699.751802][T19271] blk_alloc_queue+0x538/0x620 [ 699.757107][T19271] __blk_mq_alloc_disk+0x15c/0x340 [ 699.762762][T19271] nbd_dev_add+0x46c/0xae0 [ 699.767712][T19271] nbd_init+0x168/0x1f0 [ 699.772398][T19271] do_one_initcall+0x233/0x820 [ 699.777696][T19271] do_initcall_level+0x104/0x190 [ 699.783174][T19271] do_initcalls+0x59/0xa0 [ 699.788051][T19271] kernel_init_freeable+0x334/0x4b0 [ 699.793796][T19271] kernel_init+0x1d/0x1d0 [ 699.798664][T19271] ret_from_fork+0x436/0x7d0 [ 699.803784][T19271] ret_from_fork_asm+0x1a/0x30 [ 699.809085][T19271] [ 699.809085][T19271] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 699.816310][T19271] lock_acquire+0x120/0x360 [ 699.821342][T19271] fs_reclaim_acquire+0x72/0x100 [ 699.826825][T19271] prepare_alloc_pages+0x153/0x610 [ 699.832476][T19271] __alloc_frozen_pages_noprof+0x123/0x370 [ 699.838828][T19271] __alloc_pages_noprof+0xa/0x30 [ 699.844309][T19271] pcpu_populate_chunk+0x182/0xb30 [ 699.849962][T19271] pcpu_alloc_noprof+0xcbf/0x1720 [ 699.855527][T19271] bpf_map_alloc_percpu+0xbc/0x1b0 [ 699.861172][T19271] prealloc_init+0x225/0x630 [ 699.866288][T19271] htab_map_alloc+0x6ce/0xc70 [ 699.871477][T19271] map_create+0xaa6/0x1640 [ 699.876416][T19271] __sys_bpf+0x5f0/0x860 [ 699.881174][T19271] __x64_sys_bpf+0x7c/0x90 [ 699.886105][T19271] do_syscall_64+0xfa/0x3b0 [ 699.891118][T19271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.897525][T19271] [ 699.897525][T19271] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 699.905253][T19271] validate_chain+0xb9b/0x2140 [ 699.910541][T19271] __lock_acquire+0xab9/0xd20 [ 699.915740][T19271] lock_acquire+0x120/0x360 [ 699.920773][T19271] __mutex_lock+0x187/0x1350 [ 699.925880][T19271] pcpu_alloc_noprof+0x286/0x1720 [ 699.931424][T19271] sbitmap_init_node+0x1e1/0x630 [ 699.936878][T19271] sbitmap_queue_init_node+0x3e/0x4d0 [ 699.942768][T19271] blk_mq_init_tags+0x15c/0x2d0 [ 699.948135][T19271] blk_mq_alloc_map_and_rqs+0xbb/0x9c0 [ 699.954115][T19271] blk_mq_update_nr_hw_queues+0xa26/0x1ab0 [ 699.960434][T19271] nbd_start_device+0x17f/0xb10 [ 699.965808][T19271] nbd_genl_connect+0x135b/0x18f0 [ 699.971350][T19271] genl_family_rcv_msg_doit+0x212/0x300 [ 699.977411][T19271] genl_rcv_msg+0x60e/0x790 [ 699.982430][T19271] netlink_rcv_skb+0x208/0x470 [ 699.987706][T19271] genl_rcv+0x28/0x40 [ 699.992202][T19271] netlink_unicast+0x82c/0x9e0 [ 699.997482][T19271] netlink_sendmsg+0x805/0xb30 [ 700.002760][T19271] __sock_sendmsg+0x21c/0x270 [ 700.007951][T19271] ____sys_sendmsg+0x505/0x830 [ 700.013221][T19271] ___sys_sendmsg+0x21f/0x2a0 [ 700.018405][T19271] __x64_sys_sendmsg+0x19b/0x260 [ 700.023851][T19271] do_syscall_64+0xfa/0x3b0 [ 700.028862][T19271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.035263][T19271] [ 700.035263][T19271] other info that might help us debug this: [ 700.035263][T19271] [ 700.045483][T19271] Chain exists of: [ 700.045483][T19271] pcpu_alloc_mutex --> fs_reclaim --> &q->q_usage_counter(io)#50 [ 700.045483][T19271] [ 700.059151][T19271] Possible unsafe locking scenario: [ 700.059151][T19271] [ 700.066615][T19271] CPU0 CPU1 [ 700.071969][T19271] ---- ---- [ 700.077322][T19271] lock(&q->q_usage_counter(io)#50); [ 700.082691][T19271] lock(fs_reclaim); [ 700.089177][T19271] lock(&q->q_usage_counter(io)#50); [ 700.097064][T19271] lock(pcpu_alloc_mutex); [ 700.101558][T19271] [ 700.101558][T19271] *** DEADLOCK *** [ 700.101558][T19271] [ 700.109684][T19271] 6 locks held by syz.0.3451/19271: [ 700.114866][T19271] #0: ffffffff8f12a5d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 700.123066][T19271] #1: ffffffff8f12a3e8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 700.132030][T19271] #2: ffff888024e219c8 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xa7/0x1ab0 [ 700.143425][T19271] #3: ffff888024e218d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xba/0x1ab0 [ 700.154391][T19271] #4: ffff888024ceec98 (&q->q_usage_counter(io)#50){++++}-{0:0}, at: nbd_start_device+0x17f/0xb10 [ 700.165105][T19271] #5: ffff888024ceecd0 (&q->q_usage_counter(queue)#34){+.+.}-{0:0}, at: nbd_start_device+0x17f/0xb10 [ 700.176097][T19271] [ 700.176097][T19271] stack backtrace: [ 700.181971][T19271] CPU: 1 UID: 0 PID: 19271 Comm: syz.0.3451 Not tainted syzkaller #0 PREEMPT(full) [ 700.181991][T19271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 700.182001][T19271] Call Trace: [ 700.182009][T19271] [ 700.182015][T19271] dump_stack_lvl+0x189/0x250 [ 700.182040][T19271] ? __pfx_dump_stack_lvl+0x10/0x10 [ 700.182059][T19271] ? __pfx__printk+0x10/0x10 [ 700.182084][T19271] ? print_lock_name+0xde/0x100 [ 700.182107][T19271] print_circular_bug+0x2ee/0x310 [ 700.182129][T19271] check_noncircular+0x134/0x160 [ 700.182150][T19271] validate_chain+0xb9b/0x2140 [ 700.182177][T19271] __lock_acquire+0xab9/0xd20 [ 700.182195][T19271] ? pcpu_alloc_noprof+0x286/0x1720 [ 700.182214][T19271] lock_acquire+0x120/0x360 [ 700.182228][T19271] ? pcpu_alloc_noprof+0x286/0x1720 [ 700.182254][T19271] __mutex_lock+0x187/0x1350 [ 700.182269][T19271] ? pcpu_alloc_noprof+0x286/0x1720 [ 700.182288][T19271] ? stack_depot_save_flags+0x41b/0x860 [ 700.182314][T19271] ? kasan_save_track+0x4f/0x80 [ 700.182331][T19271] ? __kasan_kmalloc+0x93/0xb0 [ 700.182348][T19271] ? __kmalloc_cache_node_noprof+0x234/0x3d0 [ 700.182367][T19271] ? blk_mq_init_tags+0x83/0x2d0 [ 700.182385][T19271] ? pcpu_alloc_noprof+0x286/0x1720 [ 700.182404][T19271] ? blk_mq_update_nr_hw_queues+0xa26/0x1ab0 [ 700.182419][T19271] ? nbd_start_device+0x17f/0xb10 [ 700.182437][T19271] ? nbd_genl_connect+0x135b/0x18f0 [ 700.182456][T19271] ? __pfx___mutex_lock+0x10/0x10 [ 700.182470][T19271] ? netlink_sendmsg+0x805/0xb30 [ 700.182491][T19271] ? ___sys_sendmsg+0x21f/0x2a0 [ 700.182509][T19271] ? __x64_sys_sendmsg+0x19b/0x260 [ 700.182533][T19271] pcpu_alloc_noprof+0x286/0x1720 [ 700.182559][T19271] sbitmap_init_node+0x1e1/0x630 [ 700.182576][T19271] ? __kasan_kmalloc+0x93/0xb0 [ 700.182595][T19271] sbitmap_queue_init_node+0x3e/0x4d0 [ 700.182613][T19271] blk_mq_init_tags+0x15c/0x2d0 [ 700.182634][T19271] blk_mq_alloc_map_and_rqs+0xbb/0x9c0 [ 700.182659][T19271] ? blk_mq_update_nr_hw_queues+0x928/0x1ab0 [ 700.182674][T19271] ? kfree+0x18e/0x440 [ 700.182692][T19271] blk_mq_update_nr_hw_queues+0xa26/0x1ab0 [ 700.182715][T19271] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 700.182739][T19271] ? sysfs_add_file_mode_ns+0x259/0x300 [ 700.182765][T19271] nbd_start_device+0x17f/0xb10 [ 700.182787][T19271] ? device_create_file+0xf4/0x1c0 [ 700.182808][T19271] nbd_genl_connect+0x135b/0x18f0 [ 700.182830][T19271] ? __pfx_nbd_genl_connect+0x10/0x10 [ 700.182853][T19271] ? __nla_parse+0x40/0x60 [ 700.182868][T19271] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 700.182894][T19271] genl_family_rcv_msg_doit+0x212/0x300 [ 700.182919][T19271] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 700.182946][T19271] ? stack_trace_save+0x9c/0xe0 [ 700.182968][T19271] genl_rcv_msg+0x60e/0x790 [ 700.182990][T19271] ? __pfx_genl_rcv_msg+0x10/0x10 [ 700.183010][T19271] ? __pfx_nbd_genl_connect+0x10/0x10 [ 700.183033][T19271] netlink_rcv_skb+0x208/0x470 [ 700.183048][T19271] ? __lock_acquire+0xab9/0xd20 [ 700.183062][T19271] ? __pfx_genl_rcv_msg+0x10/0x10 [ 700.183082][T19271] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 700.183105][T19271] ? down_read+0x1ad/0x2e0 [ 700.183122][T19271] genl_rcv+0x28/0x40 [ 700.183141][T19271] netlink_unicast+0x82c/0x9e0 [ 700.183168][T19271] ? __pfx_netlink_unicast+0x10/0x10 [ 700.183193][T19271] ? netlink_sendmsg+0x642/0xb30 [ 700.183208][T19271] ? skb_put+0x11b/0x210 [ 700.183225][T19271] netlink_sendmsg+0x805/0xb30 [ 700.183245][T19271] ? __pfx_netlink_sendmsg+0x10/0x10 [ 700.183262][T19271] ? aa_sock_msg_perm+0xf1/0x1d0 [ 700.183285][T19271] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 700.183310][T19271] ? __pfx_netlink_sendmsg+0x10/0x10 [ 700.183326][T19271] __sock_sendmsg+0x21c/0x270 [ 700.183350][T19271] ____sys_sendmsg+0x505/0x830 [ 700.183370][T19271] ? __pfx_____sys_sendmsg+0x10/0x10 [ 700.183392][T19271] ? import_iovec+0x74/0xa0 [ 700.183410][T19271] ___sys_sendmsg+0x21f/0x2a0 [ 700.183429][T19271] ? __pfx____sys_sendmsg+0x10/0x10 [ 700.183461][T19271] ? __fget_files+0x2a/0x420 [ 700.183485][T19271] ? __fget_files+0x3a0/0x420 [ 700.183509][T19271] __x64_sys_sendmsg+0x19b/0x260 [ 700.183528][T19271] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 700.183551][T19271] ? rcu_is_watching+0x15/0xb0 [ 700.183570][T19271] ? do_syscall_64+0xbe/0x3b0 [ 700.183588][T19271] do_syscall_64+0xfa/0x3b0 [ 700.183603][T19271] ? lockdep_hardirqs_on+0x9c/0x150 [ 700.183626][T19271] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.183642][T19271] ? clear_bhb_loop+0x60/0xb0 [ 700.183660][T19271] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.183675][T19271] RIP: 0033:0x7fb97c18eec9 [ 700.183690][T19271] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 700.183704][T19271] RSP: 002b:00007fb97a3cd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 700.183722][T19271] RAX: ffffffffffffffda RBX: 00007fb97c3e6090 RCX: 00007fb97c18eec9 [ 700.183734][T19271] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000007 [ 700.183745][T19271] RBP: 00007fb97c211f91 R08: 0000000000000000 R09: 0000000000000000 [ 700.183755][T19271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 700.183765][T19271] R13: 00007fb97c3e6128 R14: 00007fb97c3e6090 R15: 00007ffd0beb3f78 [ 700.183784][T19271] [ 700.696889][ T7952] tipc: Node number set to 849204803 [ 700.769575][ T51] block nbd1: Receive control failed (result -32) [ 700.769621][ T5848] block nbd1: Receive control failed (result -32) [ 700.797429][T19271] nbd1: detected capacity change from 0 to 127