program: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r2, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="8252", 0x2}], 0x1}}], 0x1, 0x4400c800) sendto$inet6(r2, &(0x7f0000000500)="22ebf1ce36603eabf3cbe3e002c2a07add805fda50ad9c6ead05", 0x1a, 0x3b00, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) (async) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) (async) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) (async) sendmmsg$inet6(r2, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="8252", 0x2}], 0x1}}], 0x1, 0x4400c800) (async) sendto$inet6(r2, &(0x7f0000000500)="22ebf1ce36603eabf3cbe3e002c2a07add805fda50ad9c6ead05", 0x1a, 0x3b00, 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) (async) [ 76.260455][ T4683] Bluetooth: hci0: command tx timeout [ 76.267381][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 76.270202][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.341228][ T5338] bridge_slave_0: left allmulticast mode [ 76.347180][ T5338] bridge_slave_0: left promiscuous mode [ 76.349963][ T5338] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.359074][ T5338] bridge_slave_1: left allmulticast mode [ 76.361587][ T5338] bridge_slave_1: left promiscuous mode [ 76.367752][ T5338] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.377211][ T5338] bond0: (slave bond_slave_0): Releasing backup interface [ 76.388300][ T5338] bond0: (slave bond_slave_1): Releasing backup interface [ 76.401064][ T5338] team0: Port device team_slave_0 removed [ 76.407466][ T5338] team0: Port device team_slave_1 removed [ 76.411080][ T5338] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.414978][ T5338] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 76.419372][ T5338] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.423726][ T5338] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 76.428139][ T5338] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 76.456924][ T5339] ip6gre0: entered promiscuous mode [ 76.466241][ T5339] team0: Port device ip6gre0 added [ 76.474770][ T5338] team0: Port device ip6gre0 removed [ 76.483791][ T5338] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 76.506438][ T5336] skbuff: skb_under_panic: text:ffffffff8a27e9c8 len:136 put:40 head:ffff8880417c0000 data:ffff8880417bffe8 tail:0x70 end:0x6c0 dev:team0 [ 76.527534][ T5336] ------------[ cut here ]------------ [ 76.530010][ T5336] kernel BUG at net/core/skbuff.c:213! [ 76.532397][ T5336] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 76.535327][ T5336] CPU: 0 UID: 0 PID: 5336 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full) [ 76.539442][ T5336] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.544168][ T5336] Workqueue: mld mld_ifc_work [ 76.546427][ T5336] RIP: 0010:skb_panic+0x157/0x160 [ 76.548691][ T5336] Code: c7 60 ac 6f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 ce 6a f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 76.556989][ T5336] RSP: 0018:ffffc9000c967400 EFLAGS: 00010286 [ 76.559703][ T5336] RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 0e1daa194e373a00 [ 76.563206][ T5336] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 76.566466][ T5336] RBP: 00000000000006c0 R08: ffffc9000c967167 R09: 1ffff9200192ce2c [ 76.569883][ T5336] R10: dffffc0000000000 R11: fffff5200192ce2d R12: ffff88803fd93290 [ 76.573318][ T5336] R13: ffff8880417c0000 R14: ffff8880417bffe8 R15: 0000000000000070 [ 76.576883][ T5336] FS: 0000000000000000(0000) GS:ffff88808d416000(0000) knlGS:0000000000000000 [ 76.580832][ T5336] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.583627][ T5336] CR2: 0000000000000000 CR3: 0000000043bc7000 CR4: 0000000000352ef0 [ 76.587044][ T5336] Call Trace: [ 76.588587][ T5336] [ 76.589854][ T5336] ? ip6gre_header+0xc8/0x790 [ 76.591922][ T5336] ? ip6gre_header+0xc8/0x790 [ 76.593983][ T5336] skb_push+0xc3/0xe0 [ 76.595739][ T5336] ip6gre_header+0xc8/0x790 [ 76.597627][ T5336] ? neigh_connected_output+0x1ea/0x460 [ 76.599942][ T5336] ? __pfx_ip6gre_header+0x10/0x10 [ 76.602142][ T5336] ? neigh_connected_output+0x1ea/0x460 [ 76.604575][ T5336] ? read_seqbegin+0xac/0x180 [ 76.606606][ T5336] ? neigh_connected_output+0x1ea/0x460 [ 76.608991][ T5336] ? lockdep_hardirqs_on+0x7b/0x110 [ 76.611326][ T5336] ? __pfx_ip6gre_header+0x10/0x10 [ 76.613442][ T5336] neigh_connected_output+0x286/0x460 [ 76.615711][ T5336] ip6_finish_output+0x234/0x7d0 [ 76.617886][ T5336] ? ip6_output+0x126/0x550 [ 76.619751][ T5336] ip6_output+0x340/0x550 [ 76.621640][ T5336] NF_HOOK+0x9e/0x380 [ 76.623514][ T5336] ? NF_HOOK+0x101/0x380 [ 76.625660][ T5336] ? __pfx_NF_HOOK+0x10/0x10 [ 76.627697][ T5336] ? __pfx_dst_output+0x10/0x10 [ 76.629860][ T5336] ? lockdep_hardirqs_on+0x7b/0x110 [ 76.631993][ T5336] ? __local_bh_enable_ip+0xd0/0x130 [ 76.633918][ T5336] ? icmp6_dst_alloc+0x3a5/0x420 [ 76.635929][ T5336] mld_sendpack+0x8d4/0xe60 [ 76.637948][ T5336] ? mld_sendpack+0x1e7/0xe60 [ 76.640036][ T5336] ? __pfx_mld_sendpack+0x10/0x10 [ 76.642263][ T5336] mld_ifc_work+0x83e/0xd60 [ 76.644252][ T5336] ? process_scheduled_works+0x9ef/0x1770 [ 76.646741][ T5336] process_scheduled_works+0xad1/0x1770 [ 76.649077][ T5336] ? __pfx_process_scheduled_works+0x10/0x10 [ 76.651710][ T5336] ? do_raw_spin_lock+0x121/0x290 [ 76.653938][ T5336] worker_thread+0x8a0/0xda0 [ 76.655944][ T5336] ? __kthread_parkme+0x7b/0x200 [ 76.658128][ T5336] kthread+0x711/0x8a0 [ 76.659885][ T5336] ? __pfx_worker_thread+0x10/0x10 [ 76.662011][ T5336] ? __pfx_kthread+0x10/0x10 [ 76.663859][ T5336] ? _raw_spin_unlock_irq+0x23/0x50 [ 76.666073][ T5336] ? __pfx_kthread+0x10/0x10 [ 76.668018][ T5336] ret_from_fork+0x510/0xa50 [ 76.670038][ T5336] ? __pfx_ret_from_fork+0x10/0x10 [ 76.672191][ T5336] ? __switch_to+0xc9e/0x1480 [ 76.674219][ T5336] ? __pfx_kthread+0x10/0x10 [ 76.676281][ T5336] ret_from_fork_asm+0x1a/0x30 [ 76.678377][ T5336] [ 76.679735][ T5336] Modules linked in: [ 76.681862][ T5336] ---[ end trace 0000000000000000 ]---