last executing test programs: 2.149117287s ago: executing program 2 (id=3696): r0 = socket$kcm(0x10, 0x2, 0x0) recvmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000a40)=""/4072, 0xfe8}], 0x1}, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0xe}, &(0x7f0000000200)=0x8) write$cgroup_subtree(r0, &(0x7f0000001ec0)=ANY=[@ANYBLOB="004000003a00913a74067388481f9c0e0a"], 0xfe33) 2.107991286s ago: executing program 1 (id=3697): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SPLIT(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="70fac4b0642ef506c17dbe10bd29ac5b01000000448b03fd", @ANYRES16=r2, @ANYBLOB="01002cbd7000fedbdf25090000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300030000000800090002000000"], 0x44}, 0x1, 0x0, 0x0, 0x20040094}, 0x20004010) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x9, 0xa, 0x5) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="1800000000000000170100000300000001"], 0x18, 0x40045}], 0x1, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="440000001000090600000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="a7ffa888000000001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r10], 0x44}}, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r12, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYBLOB="491e3666111310311f4b3e7d88370560eecfe314f33807c7a56781cb6bbd48b9930b77952d15e4f78aea28f7804764fe570cc1c72770309b728beb0cf93c7165dda3df8e921797ae5bdfb176293771aa7e", @ANYRES16, @ANYBLOB='\x00'/12, @ANYRES16=r11, @ANYBLOB="1c0012800b00010062726964676500000c0002800500070006000000"], 0x44}, 0x1, 0x0, 0x0, 0x3004c0c1}, 0x40001) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYRESOCT=r0, @ANYRES8=r1, @ANYRESHEX=0x0], 0x44}, 0x1, 0x0, 0x0, 0x840}, 0x40040) r13 = socket$inet6_udplite(0xa, 0x2, 0x88) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000700)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000000380)=[0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x5e, &(0x7f00000008c0)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000440), &(0x7f0000000480), 0x8, 0xbf, 0x8, 0x8, &(0x7f00000004c0)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r13, 0x89f3, &(0x7f00000006c0)={'ip6_vti0\x00', &(0x7f0000000640)={'syztnl1\x00', r14, 0x29, 0x3, 0x7, 0x1743, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8, 0x7, 0x3, 0x6}}) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_GET(r15, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="80000000", @ANYRES16=r2, @ANYBLOB="000229bd7000ffdbdf250b000000080001000a686077ddb9a51ffb4dfaccf937c17063690011000200303030303a30303a31302e300000000008000b0001000000080001007063690011000200303030303a30303a31302e300000000008000b00ff7f0000080001007063690011000200303a30302d31302e300000000008000b0000000000000000"], 0x80}, 0x1, 0x0, 0x0, 0x48080}, 0x84) 1.918274391s ago: executing program 4 (id=3699): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@migrate={0xa0, 0x21, 0xd39, 0x0, 0x0, {{@in=@dev, @in6=@mcast2}}, [@migrate={0x50, 0x11, [{@in6=@local, @in=@dev, @in=@empty, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}]}]}, 0xa0}}, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000080)=0x80000000, 0x4) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) setsockopt$inet_int(r1, 0x0, 0x33, &(0x7f0000000000)=0x80000000, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @local}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r3, 0x0, 0x33, &(0x7f0000000000)=0x80000000, 0x4) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x38}}, 0x10) 1.905596984s ago: executing program 1 (id=3701): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000073017f000000000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r1, 0x0, 0x3, &(0x7f0000000040)=0x1, 0x4) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c0000002000010300000000fbdbdf25022000000000000000000000080001000000000008001b"], 0x2c}}, 0x0) 1.812772668s ago: executing program 2 (id=3702): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) (async) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e23, 0xfffffffe, @mcast1, 0x87}}, 0x0, 0x0, 0x3a, 0x0, "276148cd1259e41d8f0ffd4be8b6d180a19ecb3e60c92e9fe908c95534a69b91fe9e2770ba387440609895d7fbb1c08bdfd96493f4fc1810d150cc3f2bbd548044dcec63bc8b2168c59e27175814071e"}, 0xd8) (async) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) (async) r9 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x30, r9, 0x1, 0x0, 0x0, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_ALGID={0x5}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x30}}, 0x0) 1.749655982s ago: executing program 0 (id=3704): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0xad}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000080)={0xe0, 0x10, 0x509, 0x0, 0x0, "", [@generic="6f6d8864d22a3f2ffaa46c88bc", @typed={0xa9, 0x0, 0x0, 0x0, @binary="2b0e13e735a3184f123d6da2f1acfac0ee2dd2b184b27db1f302de337c0004060000000000bf852c8986626691b01b2d44e4ce28712828bdda0a9423debbb86f9dba4a2dba4dbe076c28282900c446a567de243ab0d67683f7bb11c9cab3b3eed8a8bef4ff1631aa78acefca03c1a66db4424a8ba100022db228bb7b5eb5100e434db5dd5e995aa0912086d9f4606d2e4cc898739222c5d3a83cb6b707f3336336ebb7d681"}, @nested={0x14, 0x0, 0x0, 0x1, [@typed={0xd, 0x0, 0x0, 0x0, @binary="cfe7336f91087ba18b"}]}]}, 0xe0}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000040)=[@sack_perm, @mss={0x2, 0x6499}, @window={0x3, 0x7, 0x5}, @timestamp, @mss={0x2, 0x8}, @sack_perm], 0x6) 1.660391655s ago: executing program 1 (id=3705): r0 = socket$nl_generic(0x10, 0x3, 0x10) bind$tipc(0xffffffffffffffff, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x1, 0x2}}, 0x10) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001200000008000800000000000800090003000000180001801400020076657468305f746f5f626f6e640000000800070000000000080006"], 0x4c}}, 0x0) (async) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x1c, 0x3, 0x1, 0x201, 0x0, 0x0, {}, [@CTA_STATUS={0x8}]}, 0x1c}}, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="2000000018000109000000000000000002180000fd00000800000000040008800345d5617eadd586e784ebc3b0d0cfcf150b023e3417d1d1b4b82306bd27cc3c01bc00b529c19981dd236436f69ed825e50bd469ce3ad55801bbc24a171c951fc04b7c62bb2f8be064cdc273772c80e574c0a4e17862e6d56bdc9f8eac718fcdb955ed0dfc2bf8972f271cdd82740931cd11407385b327ae15b6b3c7129c7fcd333776355bafd3162e645c20be33f0224276508ae1c29bebd59faf45d5bb06"], 0x20}}, 0x0) (async) r5 = accept4$llc(r2, 0x0, 0x0, 0x80000) getsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f00000006c0), &(0x7f0000000700)=0x4) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x24, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x13c8}, [@exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x8}, @map_val={0x18, 0x5, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffff}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @tail_call, @jmp={0x5, 0x0, 0x5, 0xb, 0xa, 0x80, 0xfffffffffffffffc}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}, @alu={0x7, 0x0, 0xa, 0x1, 0xa, 0x1, 0x10}]}, &(0x7f0000000000)='syzkaller\x00', 0xe68, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x8e05, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000200)=[0xffffffffffffffff, 0x1], &(0x7f0000000240)=[{0x0, 0x5, 0xe, 0xb}], 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000640)={r6, 0x0, 0x60, 0x0, &(0x7f0000000500)="93b41951c8afc97cbae50b39bba9e7e85b9f646504d476fffe8c81f1a016616e8cdeb123b0c5527d3d27ba7ca041998951a9caf620c95f560e88a087502c476e0bfa9d048ead307b4be97be1886898662e2e15edb9f5e3514a7651776afb5599", 0x0, 0xe, 0x0, 0xbb, 0x0, &(0x7f0000000580)="708d96a4eb6b95286bc80b526828fde096ef9329b5c2040e73d9bfa727ccdaf683f57b453ab52db232bcb04a51723944958f1b83d84e03c0b651b4b2a8c00ee045557b30e6a7bb64baaa92d537c22b9bb3b477aa9d8efbaeae0d621a42bc57ea4abf42c9eba8f0cc0adebd6fe27ddd9e166e0c055b70522b9c5ba0df84bb68d3ec52fa88d87d6ede21ec86578c7e0714a7d2b6812e620ce48964c0883d648f923fbecf420f7dc1f86e7d8566c00d06cf62ec44f5ee61bf4df2c867", 0x0, 0x2, 0x0, 0x9}, 0x50) 1.656165761s ago: executing program 2 (id=3706): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r1, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r2 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)={@ifindex, r2, 0x11}, 0xa) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="580000000102010100000000000000000a0000004400018006000340000000002c00018014000300ff02000000000000000000000000000114000400000000000000000000000000000200010c000280050001"], 0x58}}, 0x0) 1.626340184s ago: executing program 0 (id=3707): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000240)={'hsr0\x00', {0x2, 0x4e23, @loopback}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'geneve0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x88a8ffff, &(0x7f0000000140)={0x11, 0x88a8, r6}, 0x14) syz_genetlink_get_family_id$fou(&(0x7f00000002c0), r2) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000580)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)={0x1c0, r4, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x9}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_KEYS={0xcc, 0x51, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPES={0x1c, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}, {0x18, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPES={0x14, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_SEQ={0x14, 0x4, "a274e4d59b278b541aa5ee01708ec725"}]}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_MODE={0x5}, @NL80211_KEY_DEFAULT_TYPES={0x20, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_CIPHER={0x8}]}, {0x30, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "7dd168f5dc"}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_IE={0xd1, 0x2a, [@prep={0x83, 0x25, {{0x0, 0x1}, 0x8, 0x0, @device_a, 0x7, @value=@broadcast, 0xff, 0xfffffffd, @broadcast, 0x7fffffff}}, @chsw_timing={0x68, 0x4, {0x1, 0xb}}, @random_vendor={0xdd, 0x87, "a5c1b5a4d6e551012bf837178eeefcb97e491cdd73d426f9ddf386814eb4fceae8e100e4f5366a113c6313ecae9bcaf7e780d703feddf0cf0e261cc88c91a6e95b1b09ffbfff67a16fd29f4a3370bb9622b368b305241bd91f5b6f4f11372287cbc6afe0c4241f2bd0e4d08bd27616cd8c61aa7a87f30236c43f3c1d22720cb7a0e31cbade412b"}, @erp={0x2a, 0x1, {0x1, 0x0, 0x1}}, @link_id={0x65, 0x12, {@from_mac, @device_a, @broadcast}}]}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x80}, 0x20000040) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x2c, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_CQM={0x10, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x4}, @NL80211_ATTR_CQM_RSSI_HYST={0x8}]}]}, 0x2c}}, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r1], 0x24}}, 0x0) 1.526566456s ago: executing program 2 (id=3709): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f00000003c0)={0xfffffffd}, 0x8) r1 = socket(0x2d, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x2d, 0x0, 0x0, 0x2}, 0x3, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f00000000c0)={0x1d, r3}, 0x18) connect$can_j1939(r2, &(0x7f0000000140)={0x1d, r3, 0x0, {}, 0x1}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711205000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) sendmmsg(r2, &(0x7f0000002a00)=[{{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000000500)="b875a1431a05b9319c", 0x9}, {&(0x7f0000000300)="c4be5aa278c6e9cf5a3388fec514b113ec649c1aeccf82a26664c6a0943b8f210eb492e4cad744501e19c5247ce03ffbabfe55f3faba16fa3a102de57e67f3484ecc2146f97ca1b9c219b962f35ceba085982866a21c760ed8a761ec6d59a23973ff0effb7644a895cf37ae95bb7fb38279ee7ba38e209b2f0b30866", 0x7c}, {&(0x7f0000000380)="81890cee1324d96a99635658f58c13205a735211de441a66d30f8e407545e4da7831e6ede15377d5f3182f202b0c9febc0cb7db0caf9e1d8bde36e46fd89f6f2e1b9bd86d297a6d6ad6a862f251d5819e18fc40acd06d18bc614b67dfab03e0199876196300e1d4e5b27764717efe3d9eb89c89b582e30a64c5137fe7ca2011998bdd3f483e0b93d790e40cbec6320f334b6ca9eb41f86", 0x97}, {&(0x7f0000000440)="4f786c91aa3b0408d6877f1a2a07d86d4f4c0201f0aea8c94c4344180b675fb0fb743afd16d61339b95973884aa973909c573b034a857cf2267deaaf304b4fd32740d750318327049d3323ba29f3d3c4e2657f6e010dd7ac132075ddf8a6e684862a70bf4202283782112b56605b990a2a20c6a74d07e2cfd4a19d768874c40d925d0eb7927d172e9082b45e011d1f", 0x8f}, {&(0x7f0000000200)="7986411241f0c69c577ef5b86a2d2d7c1f72a9fabf7ae48ed534437a191c9d344efacd03e6ac09dc913aa5f0e24f3f8f53bb2b2ed113bc21ac859d660a3924e5cc59c9b7d71803c7e6f674e06aacbb59efbd857ae80649a9272d363e643b1f1d8301d8879bc1fcfa25ac3c786d007766121c4516a7145a4f46745990778aeecbb21310d08232966ded4bfdb4da472669fafdd19f645c74c3b70d402be22aa27277a050f64eea915d450fe1198f2554e25b1757c7493a4cc9f6b19800a5835b2606eb01456f8ca1b71ff23ccc5a388a82fabafe231b8c3ff7ea4c2148c5ff49aba750fe3ead268d760ce66c", 0xeb}, {&(0x7f0000000600)="37109f2d9b9555aff11a9a19184236ddc7f5506ba23202af57f725d0d410f6c6feda59d3297b8541ffc653bbc87e155da817d8d66ee1225e619fc7b83ef66bcd25040553914e8cf39b1d006ba53f5339a7351b66db86a224249b65c7ec71769979992ab03441e9bd05e51a5dcc67f89acce6668fa8454565b714a30806f422d2811ca779f4b9405847ce92cb82e9e2f32f9c846b3626a66b1e285518ff20a42d08e97cf115a958e3c8c67c0b9959dc518f3e58ded7bd292cf7cdf2e8b48d7d19291f1578b9e9b321df153dff4d5a27d0f041457c0b8c7e13d800e97c964290f5fcc7b7b027054d461320d24afa153aa9858d84ea69a6ec68cf8410f5b480f9c07384a9bd271277667f00ff578fe0eb32027213e9b217877c2cdccaca6568155e1e9e4582eeca379fe37bb24ec4a8d4d92c7e485be00027996174a34b62ae039b8718d61bd89619a56f8df62713d80095edebab535a741e6094389389df6a4ce697b6ecade4f2b533a7d9f967e50b0e6484f3206cc37632b05a5c63101536952517eb580f8a68bf2af48c48e7832011c007cf16747dda664a34d90937bc653922828257b09a0839638dcaaef27e0a59c812d44245a9edc25babafbdf0ec040597aa7ffcdd59bfc472d61efa292618c89c37ac20eeff55aaaf1c04c17a78ba5a9f36035d8a93b2a0d9621f74420c0dcc7ec0aedbc881aa37e3b4016ccfffd45c6112808b568acd02612b8791512196ab9c33eb24fab475fc09c4c510e0701e053f145e8a6ab1fc51d346228d63cb0beb7084258947c75e56d857036eef1a1ee15f5b2639477efc8c66914bc1c49427ae4d472e69d45a86bda61b7c746282aa8337a68c1947e8b024107b2f52accb164714dbe8218fe0e6a20c2bcca9ce78dbd10d3edec649e749b73176ad172c8e2a933d3df0c2c7f0acc721c9bc4487ddeeed36c40c23a8c20ace01673544ae77109ee1579ee933363c2c5efef3929a63f5a3d3613c85778792abc740c60c8958e49ed17d100ea4239e247b867926011d49eb4ab9de2614a740adf27daed044645aae893bbb6f94b1391ebe01b7387463b03ad5673ca0f172d98e00a9300d0628db25ec9f6b5f6214b3f9f92e1d6f46de9eb0d4bb4964dee36797db1f02c55d3b98eff6805adb95f72f0f2ad32f9f23a55b00e7383bd5b14c14a56af92a4e680454c766ece011a2ed6a645beaa24175458de822d1f0ec90e7d1ed3da61bd303436ddc85aab976cb5e702c50ec46fab814e17466b2216a105917868587dd1a6e774db5fe8c8739a6490fe219a619f979db92c61b55130c9a5e095137afc0e4585fdd84da21705f7e1de16a633afbbf2419c4f63598444ccd25ec6fd337f85b77a6725928c781a948edb9420524a4d622bfed0ab6bcd620990de3c91907cf61aa212e0af21ad052a3ef0e8ae2cb86e68caa9e7c310c936b099ceb9cac89afaab77fbc794caaaa8249de343439b06620f90a2d72d06b9b49b821d826d0182946955fa73be781dc3764338e17b3dfe17c3d18953726fadee46e489708724a4872ab3072d9c1961304575b84f8596b66f94d3c61b5dae777379b", 0x464}], 0x6}}], 0x1, 0x0) 1.492675421s ago: executing program 1 (id=3710): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xa, 0xf}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x14, 0x2, [@TCA_PIE_TARGET={0x8, 0x1, 0xffffffff}, @TCA_PIE_ECN={0x8}]}}]}, 0x40}}, 0x40) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20004000) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f0000000a00)={'tunl0\x00', &(0x7f0000000a40)=@ethtool_cmd={0x3d, 0x0, 0xfffffffd, 0x1, 0x2, 0x3, 0x8, 0xfe, 0x0, 0x9, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3, [0x0, 0x2]}}) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='bic', 0xff3d) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.43816012s ago: executing program 0 (id=3711): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="340000001000010400"/20, @ANYRES32=r2, @ANYBLOB="171c203d3182da00140012800b0001006970366772650000040002806d306bc555d029e357bdff35285caf17843468702d7e13ccdebc18ea8286e197fe1f2a2a"], 0x34}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000164000/0x3000)=nil, 0x3000, 0x0, 0x12, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r4, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_FIOSETOWN(r5, 0x8901, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) (async) unshare(0x600) r6 = socket$netlink(0x10, 0x3, 0x0) pwrite64(r6, 0x0, 0x0, 0x0) r7 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) (async) r9 = socket$kcm(0x2, 0x3, 0x106) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="1400000010000100000000000000000000000092a6734b00060a0b160000000000000000020000084400048018000180080001006f7366000c0002800800014000000004280001001c0002800800014000000000080003400000001408000240000000020900010073797a30000000000900020073797a3200000000140000001100010000000000000000f1ffffff0a0000000000000000"], 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) sendmsg$inet(r9, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)="fbd2b9ed", 0x4}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x18, 0x4, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r8], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', r2, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r11, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) 997.363513ms ago: executing program 3 (id=3715): gettid() r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x3d2}}, 0x0) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x501, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2}, [@IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0xb}]}, 0x28}, 0x1, 0x0, 0x0, 0x240000c1}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000280)) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, 0x20878, 0x1a201}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80d0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001600000127bd7000ffdbdf25021844fe", @ANYRES32=r2, @ANYBLOB="140003007767320000000000000000000000000008000200ac14143d08000a0002000000080009000c00007d01085ed619b5cd9fea0008000a000000"], 0x54}}, 0x0) 979.548223ms ago: executing program 4 (id=3716): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000240)={r1, &(0x7f0000000040)='batadv_slave_0\x00', 0x200802, &(0x7f00000000c0)={@_ha_fsid={[0x8, 0x7]}, {0x9f1c, 0x4, 0x1}}, 0xbf, &(0x7f0000000100), &(0x7f0000000180)=0x1}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000440)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r3, &(0x7f0000000500)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="24000000f11273579a87405e8259c6d73cb3f61c6abf69243533f910299573b4f8bf6d2349ac54931aa973e5f9822974da27251541a2cc616b7926c605295f361feedb7904213533f545f09bffe00237aac2bc3d8e79edd803956000d8eb6b9712fc91f70db1b2a54283b39ccb77f78570", @ANYRES16=r4, @ANYBLOB="00002abd7000fcdbdf250c000000f5fe0300", @ANYRES32=r5, @ANYBLOB="0800090005ac0f00"], 0x24}, 0x1, 0x0, 0x0, 0x2004c805}, 0x10006) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r2}, 0x90) r7 = socket$isdn_base(0x22, 0x3, 0x0) accept(r7, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010025bd7000ffdbdf2500000000", @ANYRES32=r9], 0x20}}, 0x8080) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001000010027bd70000000000000000000", @ANYRES32=r1, @ANYBLOB="004100000000000014002b8008000100", @ANYRES32=r6], 0x34}}, 0x4008000) 889.879837ms ago: executing program 3 (id=3717): r0 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000002c0)={@cgroup, 0xffffffffffffffff, 0x12, 0x2000000, 0x0, @void, @value=0x0}, 0x20) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x842}, @TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x4}, 0x4) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_int(r4, 0x29, 0x7, &(0x7f00000003c0)=0x80000001, 0x4) sendto$inet6(r0, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) 855.390548ms ago: executing program 0 (id=3718): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) socket$key(0xf, 0x3, 0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000001c0)={&(0x7f0000000000)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r5}}, 0x24}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) 651.263657ms ago: executing program 4 (id=3719): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r3 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r4 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r5, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000440)={r2, r5, 0x25, 0x0, @val=@netkit}, 0x1c) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e000000000077eef46608000a00", @ANYRES32=r1], 0x3c}}, 0x8000) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000b80)={r9, r8, 0x25, 0x0, @val=@netkit}, 0x1c) 598.264639ms ago: executing program 3 (id=3720): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d083911000000000000a1180015000600142603600e120900210000000401a80016000400144006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480e1211000000e3bd012a128748b429021627e305dd2b7a146efb4400", 0x2e}], 0x1}, 0x4048004) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="14001800100001000940eb7d578fb84c4a2330e200000000000015fc000a7bba79893009f3b300000000000000000700000009a6b660d61bca"], 0xec}}, 0x0) 546.483287ms ago: executing program 0 (id=3721): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b40)={0x48, r2, 0x1, 0x3, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}, {0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)={0x1c, 0x2, 0x6, 0x401, 0x0, 0x0, {0x3}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r1) (async) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b40)={0x48, r2, 0x1, 0x3, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}, {0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)={0x1c, 0x2, 0x6, 0x401, 0x0, 0x0, {0x3}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) 456.245072ms ago: executing program 4 (id=3722): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b000100627269646765000018000280050019008400"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@newqdisc={0x24, 0x24, 0x800, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf, 0x9}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 331.934274ms ago: executing program 1 (id=3723): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r0}, &(0x7f0000000580), &(0x7f00000005c0)=r1}, 0x20) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000780)={0x2, 0x400000000000003, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, [@sadb_lifetime={0x4, 0x3}, @sadb_address={0x5, 0x6, 0x6c, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1}}, @sadb_lifetime={0x4, 0x4, 0x0, 0x7}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3}, @sadb_address={0x5, 0x5, 0x0, 0x80, 0x0, @in6={0xa, 0x0, 0x0, @mcast1}}, @sadb_address={0x3, 0x7, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0xc8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x20, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@newtaction={0x84, 0x30, 0xffff, 0x0, 0x0, {}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x2}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x84}}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000009e00000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x421, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x7}, @IFLA_BR_MCAST_STARTUP_QUERY_CNT={0x8}]}}}]}, 0x44}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x24, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x809b}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x6}]}]}], {0x14}}, 0x90}}, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x50) socketpair(0x6, 0x80000, 0x5, &(0x7f0000000080)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r7, &(0x7f0000000c00)="a4ec7c45291d4c1df57b06cf7ea2545bc659e3786438363f0cad6585d70ccf3ffaeede632a972d90fe724517747736e7c5bc63ed4b82b8ef2bb448d0a6b86fc4a5dd423f2755d4844ad660c768dc5fa46b44c1bd3f21fb12c5ff9d7a412a8a66369e745015a8318f20c5042eefaff79eb7dbee2ca521fc171d953d341157d2e962453d7f5688885abdf34abc922801bd5c985a8192a4726e8ca9144b06413de8574b312c0f62e286e2b23d46996582e1cf984100a2ebf01e8cf4edc32ee631f553ae10ddfb85b28e15aea6170b100d915d71dc7fdbd8493eda5a611f47909f691040a504fc9afab456d301a7b2159dc30be22a56e8d17f2510625c02d80e850a56bb4175c080ce540783408af358521f3e1a2f8ef2811a4eb99ba90b6f3bb9591696d41dfb185b292b687938f9614c597107d2197a6f738c7e4c5a6b161b1ad404be827d52a5c034d070cde19995ebe36551d320b3302399eb05294bdfb71b53c2a508a3845774346ef802d27bd21540393f0109f493dc6f6d36b8b25ae1c729d4452ada759ebac4675de47b4f781291bc6db51af9e44df639b7ad6e02d620d3067feedb249237233eb5b51c57f25b1b743ead8f1012ba64757b9dac99095c0e0c2a42bc31031a9604e438ab37c4d4dacf10a5ab5c60219a8a8fe30741bd554948eed8e001ffb42d1e2a359ca54ea7947d44aff644e1381bf169a0badcf0be8f593fee86495c1bbc775723dab869f75907026afdae70aa43ebaf433824c13b04602041fe398fd770a1448bd4b1751e68a6eb298c25f25abc3fbbad6e4cc7fce5d2acfd59d75fde74ea6f0a64ab403342c84b1df7ace6bfe9ffdebbe585b99290d0e196fc3dff4e1815f1d4a7ee3412e2aca61d6cdbba9780e2d47ddadf4b12102f17a22ba02223dbe2b24d2c2a91c88de63733765d2d8ee678b02d8b33be3db86efeacdc70cd6998cd9a7e164b617b8c18c83d2efc1fa5fc22dc2ff747e15892bae88ec33842a2db2a7aaa8c5b91a713e9fa56e8dd2d1b372b42194a0309ae36200c90fc34e5badf8ed44b7630427ab1e1a26f6a85736e40d633753cdee336fee0ae71be5926681bcd2eaf3a205ed28e279a3f91723a7ba7b1641b52c0e95e4a0817e0658360fec0f291c74f48325299763ca01dd682cdb2cb0264d26450de2fa94cef252620a7b19040625f83e98a07c7fd02e62a5684eed64671e372304a89fd0ac1de787b3ac76c3f69ae3ed7d8d0aa0070887e584e08b4befd44e2a78d297881c3188437e4c2e85b0d773b2ba5831802311c9a14aea2273c1e64474565cd4c69b5851b1e625e564691c7201fa2a209421f5f0d9366559df6e55ece66b43e31206bc285715414f425aeaac95d2192d1bbf1835614b20f11e32d056e23bb7c5914d5cb8698f183950fbd68c2169b6aa3d52789e081dbf4963c434d4c50168131cf7e93fdbc96acf58c4fcc2e3affaa3c8d3e81d1138bde976bda49437c6cdfb86a5670948cd07f8ce910531695c42d5badc33dc6a4fb894fd599090d9e7b9a884f1da11d8aafecdc009e0a210ce55b73584333075f3b981b30fb3e504279e346b5834c434513fc45fa212a4c6a89528b6707704e22bf2677b0778d6f79dc39f1ebfea91856c8ef4c3f93aeb901103414a10de90bdff3237d96ca593e37117730155b087c7988981131a0c9a47b872d196961626cdb07613d122b1780b3af72849f3f5d5f5cac7b47719dd392e04860e44f8c477c1cf136e872ff8df6dc6d50aa74e692a57aef94c25f0f579637b1a2b48c8a32f9147e6a33c29af026ffcf0a6950b297564a1aa88f15528eafc8dd2e4a6ffe7ab3a2b8b988258397ae87ccb993cb5176c373eeb55841f836dbeb9056d90f53339db0c4fbc2a533145dc4cbe539ebaaf7228183895e9b4bc94c884f5d3df7baa2158bcb851f513d7ced580ac50ae4169c5a707a09c7ca6b1b9d23d0a17d8647f686beedc461614ce213aab591696ccd8ad04de2b1b73e00c0c0c21352769109d42be60994f1b112f8ff9730ba8004c73409b2908363e0f64e43c83fd87433fc855f01675fdf831413faef048538da47d9dea7a274a1a6c06aee59845a72f428beb5ae64613a44b5807b200ac1e2a768117e60dfda92f6e93bb99b608553db9081a7531d17d0e0c3579cfb04fd0b6a12a5505c73d5b0c58abb10c8a2d84c89b0c02bbd9fb79e747320f563060e4fb53183ec08b6addf36d04df4d0199e75854ea88b768300988646665a9667e96aafdbd9cb8f33590b7f0df62bf82f6fbb60748b79fd761ac6a1e9981a620a812cbb8bb75fac37c1126f1d6bb6ec0347534966e7b0e54e1174a214af980a02890cd4f6db82573e79ae71b46377d8d8103f2da9932fcbd6328751480d5e3b5c9ba29333265fdbd2e59590bb3304e5f3a412c438cf93444bacb45e1f4690bdac858ef87f3fcb72fdad5900ad617e834190ed3f4a96fb9dcd1924193430e4ca927545719e40147e9db0a1cdf26f818b541f63f09073f172845c715d502772ca12909baee30dfb2fec2f4971aa68d224291d676ccc7e8058bdb0e7dcdc0a6fc03b26788ce60f1cd739e6283b4806013ec4ea5edcfdaea0de3e9f1fdfc4c6296221c3125c18f4227b0a455fa8dddc9d0b381c76f4e2d5ee4afa671ca67034f6fa0398bf6ef8cad593a6052f18309861f79154f02a363f5a1765c0e69506ccf383a59612a5bf2a5b9f9ba7536cd8ef9a2861dc995f08948c4753001fe286112843bd11fbe925cb15b25534cdd31a9495ae989a935c3648b22b61f136d20da88c0eabfd882960923f0e4e1276207abc6a615e2a0cd5ee06feb8375e0fa5e2c10b3315abfcbaca1be4dd4f855824d9f4f2f71d08074f46c9261e128f62b3c5f207b245d5232b249a2682f6e73d67ab93f0b1a387c39733430e638ecbb25e85a457d7aa61f8af45ab2522cc5f56a847ca63f31aae1aa04a9cbe8039732adebcc3260bffa691c6ed7c0f7fb8d195091a7e6189e8749fa3debf474092db2623ff7ad8a108448688993331611fab2ca66280fd98d35021702e2388754b4479a23926fb6706e00922ae234710c545f7b6e2fb9c0c221a1c614d4ba0de9f332d9ad333860212cb8c7438d324c0a05e7f2cd8b10a57b2797270759fc98bcd1bd6b76c34f7a02fc5561f1395f5e9ec7360543dc4948f56ff46ef1110788d20c2b48bcf12c76dea6afe03b1715e3c32e5d0c3095a99e34455d9a64efae6bb10d7d6a03238304f93bf9c3b76a5a5f803a7201de7c9d7fa5658995cfab7df712eab465cae3b509c37317f43d6feb50c11e8cc5fbf0328996797a143454148f33cf1788ad82b95f669601fb9e15f1a5c31da401d4e3d4f7b2a6396223adfee93dc292ee5308c49741a832283b0d9ef346fdc4dd08bd29f01bf6fb152061a8bef11068709b1d14138be4bdc087f4afac15b7480c1a93a64c05164bc07d04e0186b0e424bb7d0c5ebdd03476345570c6aa23ffdc0b76703ebf1e88c06e4a261d1e27bd04f060ceac0df072e76a3b4a336f90fc34074fcd2c89f420f08c5e6dad5baad308672131483a2669a406196cb01335732f8c7b6a3b284983c906973db8b13d51c757d5319d57f53f3ffe7263ad3cf0ddaaf134c8e6c8e9261cd38428d006ea3a7a2ec673d882f8df81faef3ac62d83a5cbc118189cafc643076e4ad4b7ed6b208daf21cb373d4464526c5e2a1f98789416527ecb22b3fe71af6583087d2dec938d061055f095504e8ebbbc6061e57b1991d979203eecfcde1b56c6bf3c7e00213ad274e2a94963b71ef7fd2c3d584e68aeced415c55be6d9ec27a43ecb333486523c85cf466466e32baa83dfceba5746ed3e3ade95463270d854f49db059864922dc854f124703a4115aa17b883cc9546466705e667f5d11e2158ec3bf7eb40a9f6e2d4b343369fe429fafa67e72a0a189eb63bd3e6a5542caf251b94b4f47620d02bf016d4ef4d5f802dabcfe590fbd7ea009e08850d168b0b49d3bef7a58c79417262b68168e3f4630697912bd794b8eb8f35b032e813ece930b67c7e6ef38309bd3e0858719c446b8dfa811e9d23ce49609bbaf7b931e0aa06645e62f6f4f34488bae1ab6739bad250a280180d50cb175cfe74f47ede9ab89729bd28f90c2753f15cabd751e7b22f2547ccc4e66cc81f9d69c7c10e004fa643846207949c7f287fa690b2fbb0692ce86bf9afc0e75a4a07ad44a71c7fd0565897172aae4852c1ecb8353afca54f3892ee3d11f35d31aadae2550d1b7b5f717742c6b9943515d1538b29625cb3a1a626089841bf234cc48a8910b8697260512eeb12d2f57c45c06f7c17b0f9fcc771f6218636f4e236d8473fec18bd6b4434229f8db251714addf6eb5ed78c2b8d3ebffd0aa80768ccee4e452b45c377fcca59e16d4bc9082b3afe93c9529972645e700bb7afd591fc5ac060f08cf0be3cbdef698594e3b9a93bac8a613a4bbd21c7c041381d60d19416910727704dd8f6e314edb2eebba4f3b77e9a76a47266fe39ac339c856345c838e58b17984b925ea6cc60b69386ef47ca2c50ddac1753371588f57de980d5f1a71521c1c0aa16b6b15d603ed86909b7bb4f66a699ac056b8c2c6eb57edc3755fa53f09704f8ee5aab9486b61d14170a68e90576fb389d6acf544b184b901f120312afd0d7dfeb861bfa02bbcb9a245715118eff57269c3d188f2bc6b8475450396e58d07ad7f77216bbd1371eab970fff3d38545c530e70ee5beb135a47a7b7b1e3dd5354b8aa5ce61aebf4e5f8a15fafb3019851e5a7a1e7c4b1d89755d1a6d166d27a6eb6b611897a14b0ac260672185ae735dfca503e5a59bf4f2690bb93a9c9a50f7e40d6b87b9b8f38dd99da13067957889064423bfd7aa6098a73749072fd3ecd6ec86f503ee018b1fb88e65f7576edd399248ffddca15d8f53c74538b855d74886ddf7fd3d79e75864de842a7a6206dd38fa54e91763dd784c29341114b9c45b257846bdf2b5e987ae7af38b4746ffc7e8ecbb0d7ff3515b9c89ec26a7c2b0c6850b8843ae43b642bce81f4791a9b362cc9839186e87e3a28cb2f46e5ec256261bd6f6f295bfa64664f0aa163ce1a393dd20272014f4f8e33a7bdd31ead192457fd7a27ff8311294a78f6d791b3d0d4fb0186a4082eea33da4093565ea38d3b9f1d455f8c0c2d784ce13aba2165d7e93646b7e3817baf04bb59e5cdeb94836fff34b0e8460e9d7619097eb998a95288c9b99ce056868a637304666c8615ba4ad5c08511c85eee7f1d292aeaf9f06b69156d13cbdd03a97b8879d75312fd6677ad447614ded4636f2731d6080d532c71194340fbfcd8eb1f4c936729acb8189872b01f137fdf516cc33f12ceb9faf2078dd9c76705a26427eeaf4332c60d26e98038b3b51d9e0b9f4d28bc1a652f8a06cddd832addca3c1afd392d9c66cc37b740ce34efa75dec6bc1b866abfbdc568ffd21132831ef46515229c46a47a3d78a88cbb8ad2c49bab16074176362ae0588d7e1d3261d443496e34c6a1709bbb1dd51fab9e763a95aa7ed7c8505a7769383ae08e117e77fc898fdc1273d5106f3df96b5bed84e3e8f21ee74c9e5c1bf1ac9342f1cbfce05bfd21b9385f9d7d67e88d4535f6b410545d9c2fe1a6167b62e40692f3aa38d147b78f57a4398016718125481cf2c627e4fb33ee8e0f9d8c071c47352485bba79c855d832ea11a5a7a4235526afc7b5b5cb79f9ea3598914131a19eb6d3deeb2a3fea14fa8919fe8de7c9f413ceca56062d84df7d153b8935ea5f7bc93891", &(0x7f0000000240)=@udp6=r8, 0x4}, 0x20) 331.655553ms ago: executing program 3 (id=3724): socket(0xa, 0x2400000001, 0x0) write(0xffffffffffffffff, &(0x7f0000000080), 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newlink={0x7a, 0x10, 0x403, 0x70bd2e, 0x0, {0x0, 0x0, 0x4, 0x0, 0x302}, [@IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x80000000}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x80c5) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r2, 0x89a2, &(0x7f0000000200)='bridge0\x00') 303.683405ms ago: executing program 4 (id=3725): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000061194c000000000095000000000000004a17884bdc083b96d6095a5306da188e2f2e586a7e71cdc30852f9eb8f9be3262daeb66001b23c062f21a0b5ea432d44e8144c8ababee3dbd2a2b1e16e5f9c7b7c07f8cc3608d7f48bff97"], &(0x7f0000000480)='syzkaller\x00', 0x4}, 0x94) sendmsg$inet_sctp(r1, &(0x7f0000000440)={&(0x7f0000000540)=@in={0x2, 0x4e20, @loopback=0x7f0000fd}, 0x10, &(0x7f0000000100)=[{&(0x7f00000001c0)="db34", 0x2}], 0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000000000008400000006"], 0x18, 0x240488d1}, 0x8c4) r2 = accept(r1, &(0x7f0000000280)=@phonet, &(0x7f0000000300)=0x80) sendmsg$nl_route(r2, &(0x7f0000000400)={&(0x7f0000000340), 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=@ipv6_getmulticast={0x14, 0x3a, 0x200, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x48005}, 0x20000045) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000004600070128b570000000008f017c0000080004804e2d", @ANYRESOCT=r0], 0x1c}, 0x1, 0x0, 0x0, 0x4040094}, 0xc000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x34, r6, 0x1, 0x70bd25, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_CQM={0x18, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0xb, 0x1, [0xffffffff, 0xfffffffd]}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x8000}]}]}, 0x34}, 0x1, 0x0, 0x0, 0xc01}, 0x0) sendmsg$NL80211_CMD_SET_PMK(r2, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x3c, r6, 0x20, 0x70bd27, 0x5, {{}, {@void, @void}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "e1abb0d2eedcc91704876974b26901a0"}, @NL80211_ATTR_PMK={0x14, 0xfe, "aecdd125f37e05072aeb08ec6d175147"}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040094}, 0x800) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'erspan0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x10, 0x8, 0x100, 0x7, {{0x17, 0x4, 0x1, 0x8, 0x5c, 0x66, 0x0, 0x6, 0x29, 0x0, @broadcast, @remote, {[@generic={0x86, 0x4, "81b6"}, @lsrr={0x83, 0x7, 0x3a, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x24, 0xcc, 0x0, 0xa, [0x5, 0x7f, 0x10, 0x6, 0x5111, 0x7, 0x2, 0x8]}, @ssrr={0x89, 0x17, 0xde, [@loopback, @remote, @dev={0xac, 0x14, 0x14, 0x5}, @multicast1, @multicast1]}]}}}}}) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000001240)=ANY=[@ANYBLOB="340000006800010000000000fddbdf25020000000000000006000700010000000c000880050004000100000008000500", @ANYRES32=r8], 0x34}, 0x1, 0x0, 0x0, 0x440a}, 0x4040414) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@getqdisc={0x30, 0x26, 0x400, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x2, 0x9}, {0xffe0, 0x7}, {0xb, 0xb}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0xc0) 299.456769ms ago: executing program 0 (id=3726): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000040), &(0x7f00000000c0)=0x4) getsockopt$inet_tcp_int(r3, 0x6, 0x2d, 0x0, &(0x7f00000017c0)) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x90646, 0x8}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_UPDELAY={0x8, 0x4, 0x8c88}, @IFLA_BOND_USE_CARRIER={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x3c, r8, 0x1, 0x10000, 0x0, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x7}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}]}, 0x3c}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xa, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000061104d00000000009500000000000000c5b6328b5697dd4a8aca88709111eff797230a449160af06353728dae6e091a0d1171a04dce01c3889b1423174bf65f12e0a92edbadd4b640d5f5617d99336da0475a4a056321b9a581eb4cdf9841ac008163f5cc5f052290752ac407ac37d8b55390915c6bcc09d803509d1bfdfbdc86f5c2d519e817c4eb9e3ea3a7bebc682eb432a2afe3d19595fc3a1fe1451016c0a89cc9fc3ec46"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r9], 0x54}}, 0x0) 185.451636ms ago: executing program 3 (id=3727): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYRES64], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001540)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x2}}}}]}, 0x40}}, 0xc0) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 64) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async, rerun: 64) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async, rerun: 32) unshare(0x6a040000) (async, rerun: 32) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="1800000000105d"], 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) (async, rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="400000001000370400"/20, @ANYRES32=r2, @ANYBLOB="830405000000000020001280080001006774700014000280080004000100000008000200db4c34ce"], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async, rerun: 32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000280)={r0, &(0x7f0000000180)='\'Z\x00', 0x14000, &(0x7f00000001c0)={@_ha_fsid={[0x6, 0x7]}, {0x6, 0x75, 0x203c, 0x100000000}}, 0xffff, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000240)=0x7}) write$cgroup_subtree(r6, &(0x7f0000000640)=ANY=[@ANYBLOB='+Cpu '], 0x5) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000440)={r0, &(0x7f0000000340)=':\x00', 0x1000, &(0x7f0000000380)={@_ha_fsid={[0x80, 0x6]}, {0x6, 0xe7e, 0x82, 0x6}}, 0x40000, &(0x7f00000003c0), &(0x7f0000000400)=0x100}) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x4}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_ext={0x1c, 0xc, &(0x7f0000000100)=@raw=[@exit, @generic={0x5, 0x6, 0xb, 0x0, 0xfffffe00}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x5}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x26, '\x00', r2, 0x0, r6, 0x8, &(0x7f00000002c0)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000300)={0x0, 0x0, 0x3, 0x2}, 0x10, 0x13319, r0, 0x3, &(0x7f0000000500)=[r7, 0xffffffffffffffff, r8], &(0x7f0000000540)=[{0x0, 0x2, 0xb, 0x8}, {0x0, 0x3, 0x1}, {0x0, 0x4, 0xc, 0x3}], 0x10, 0xc}, 0x94) 125.093756ms ago: executing program 2 (id=3728): syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x18, 0xfffe, 0x0, 0xa0, 0x2f, 0x0, @loopback, @multicast1}, {0x2001, 0x880b, 0x8}}}}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) splice(r0, 0x0, r2, 0x0, 0xfffffffffffffff1, 0x8) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f00000003c0)={{r1, &(0x7f0000000140)='[\x00', 0x0, &(0x7f0000000180)={@_ha_fsid={[0x4, 0xa]}, {0x6, 0xfff8, 0x2, 0x5}}, 0x7, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000300)=0x9}, {[0x3, 0x8, 0x5, 0x10000]}, 0xd2, 0x7b, &(0x7f0000000340)=""/123}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0xd, 0x29, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@btf_id={0x18, 0x5, 0x3, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf939}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @btf_id={0x18, 0x2, 0x3, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x9}, 0x94) (async) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$can_raw(r4, 0x0, 0x0) (async) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r4, &(0x7f0000000000)="1b56f00e9a7b04c5e10bad91366bf032cb81a443705707e0e25bf7c86e3b8f86177d2d7b791f6d30f61cb5dfd1165a033df5b0cf675f93807a57bddd"}, 0x20) 709.591µs ago: executing program 1 (id=3729): r0 = socket$inet6(0xa, 0x80002, 0x7ffe) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4, 0x5, @remote, 0x7}, 0x1c) 485.717µs ago: executing program 2 (id=3730): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xc, 0x10, &(0x7f0000000080)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x22}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc0, &(0x7f000000cf3d)=""/192, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x38}, 0x94) 309.659µs ago: executing program 3 (id=3731): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x4, 0x2, 0x5}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r1, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) sendmsg$inet(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f00000002c0)="feb8defb9d1fdc5e6d50b18da9f2e1939f40fce0c6e312b5101d44d38f4f8be7a294a85f1fb1d0dbca84e97e7b65bde2b94d11b429f6eeb68a0a0797fa77868310d85a1e50fcb3f339b1cdfdb1b4a2568465ba23724cc0c3ea01b458a95ca005d72d69811bdab6ec333abecdc68772fc97efa65ce95c6846ef2b0966863e20a1ec582b8aebf1924bd8edf86337a0fb6b0c100349117acc219ff91a5a7c568f62774167ac087ba9abbcb2dce06df67aaf34cb8204a86cc4b8219001203d49ea306b59cf3eaaa35b2ae5add30eea3f7a543670419c8143875f337c47e84b5c2eb3de3fd75aabaf5168fbd402b8980fd2f48486fe8a0ab33a8808355ff32f114b2966d115f8c2fe587618af47de0a9a2b10d7cc3169db127fdaf6a1cf9a731180680720c437cb09b1a4c289781b2af70fc2513bb89a51062df574374afef335ee5227c68db0bcfe0e51b9fba0e8c0658198a9de6fe19a0e29c3239818d5cd922d12725f9a2cf5f830655afd3cd90866e7b9e3c9867a3afa16d60242fb2569a67d8e2a077a1f8058179a5040e69d1854807ee5264dc62d688c78f1c3e5c8d0e200b9b8e54b569a3db22752e7c7c98302880cbc5047c8c575fa02cfb380b3aef9fe30bb5f59ce5861263f049be8a1fcdff70137dc658a712a755b556d5e7b0b759a1f87a8a19d8e2c3850c37a519b5b57351cb1b56dd57165964be22a1807d37340e9ef7949800990af954382b3b1e8f45dc56a84b065da15b377335146b4ce8b556a1ca40106a37696be4b5ba83c6fbe7f2a16ca83b2b7badf2b8a174951fc2c33b382ab14fdc62c3e87ca088324cd0c9a106ea7ca117e66418657478675277da07f5187da0d00766c9714d425c1c8af26cc526f40600f08ad40829ed0cb29934e8a4d8c29a62b0ad5e15aecc1768b268837db3bbba4156e0ea2a458d7e0159fd8905640449dc2e05cc52abfc0967d7239851e7308bea25a019d290740702523075f3a26d263a27c612e3d8d80473a21f6952062bc432bc0a8156a0e016edf1c80e35a6267517c04754d494ed0961c06e1a7308bf2b3175a4dd74aded5cdf2eabaac5d186175501b1052fdbf0b85fe4e2375b4717ef2eccd48d12545a2f1fad324c81f3ac35a09353f9824076031f449e08cdb5e4183492bd5c93a9244f4989e725e69ed242f610822daff8dd0e160cf21b73a80361eb000b447bd29fcb236193601e284a08c10d6dd5a359f269010528e774c82f0b62080516239e36e98d248182ded17a70b6ac1ac70cafbb9fbc339569fc606267aac59004918a5ebb4ab7978b0fd68ec77a223c0c79e454097469638816fc621deaceca47f5e42958e29ab84ace4b89ffeb6d3c05b9b65e048d70ddceb29c0a00c5db952637138b3e9edb8af209d9b813c9b425bf95651ab1ac35f9b650aa82994b9087c67102e16a1791cbf9a8c7be18cf1ca82a0bf11a758d07af677fda4e127ea4a1ddf067e72ba7efc7edfd40e40d754120d4d6c0de69ed0f1d45ca584c435847e91950583836ba68e6867347dfccfaf817c99448b2e9f4ccdba2313d6c39694f75305051795a355a1b9103183013faf6096f8c971dae4a693dfa18593ea7aa1c34e10ab7c53f51c66bcaa1c4e88942cb63e9cbee21fdd5752732ff870c95ec549ed3788134cb628f6ecd94bda04eca6ebe1ca529bc9b9c1468ae758c87a6adee4aa180f24bb6714e61689084ad321551883b85483035d3d5078d71b2419af06631343fa6c3109dc25972a785266cc17339aac5032af3e1076f08b5c593f96aaa9e5ff512d31c1b99bf0f2a64e45eb7515cea626d1c59413b2a2de0d953984e6f268aba70082cd7cd7da309dcf0783a34c795b6d87c5addc74929e4191516b97fc28785c6d7cc6bb51d42fbf0cd54139facbdae3d61a9f71883699f32630132afd59c67719592089067a173c754c13b1a54a50c4119c93f279166d82b075ed0df831bc3d6b62d4b8cb5cfedb48edf4b0e15b73170bad473efcf298095dd1d2c0017f782e", 0x599}, {0x0}], 0x2, &(0x7f0000001900)}, 0x4000000) 0s ago: executing program 4 (id=3732): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r3 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r4 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r5, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000440)={r2, r5, 0x25, 0x0, @val=@netkit}, 0x1c) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e000000000077eef46608000a00", @ANYRES32=r1], 0x3c}}, 0x8000) r7 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000b80)={r9, r8, 0x25, 0x0, @val=@netkit}, 0x1c) kernel console output (not intermixed with test programs): .261452][T14036] [ 293.348801][T14031] ip6gre1: entered promiscuous mode [ 293.504681][T14031] ip6gre1: entered allmulticast mode [ 293.704519][T14057] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2601'. [ 293.715593][T14050] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2599'. [ 293.790182][T14057] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2601'. [ 293.799735][ T3503] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 293.830237][T14057] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2601'. [ 293.982341][T14067] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2606'. [ 294.003816][T14067] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2606'. [ 294.179701][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.273729][ T3475] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.329682][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.338718][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.464079][T14104] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2615'. [ 294.656609][T14109] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2616'. [ 294.883065][T14122] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2622'. [ 294.922759][ T3475] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.041138][T14124] syzkaller0: entered promiscuous mode [ 295.053800][T14124] syzkaller0: entered allmulticast mode [ 295.109635][T14136] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.255847][T14145] bond13: option all_slaves_active: invalid value (222) [ 295.264954][T14145] bond13 (unregistering): Released all slaves [ 295.305707][T14142] 8021q: VLANs not supported on syzkaller0 [ 295.390436][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 295.805317][T14181] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 296.040707][ T1153] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.499837][ T3503] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 297.162269][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 297.212075][T14165] syzkaller0: entered promiscuous mode [ 297.217754][T14165] syzkaller0: entered allmulticast mode [ 297.435531][T14216] netlink: 'syz.4.2639': attribute type 1 has an invalid length. [ 297.540509][T14225] bond0: (slave rose0): Enslaving as an active interface with an up link [ 297.617121][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 297.659483][T14234] syzkaller0: create flow: hash 285596532 index 1 [ 297.805559][T14234] syzkaller0: delete flow: hash 285596532 index 1 [ 297.841602][T14243] netlink: 'syz.1.2648': attribute type 21 has an invalid length. [ 297.852114][T14244] netlink: 'syz.1.2648': attribute type 21 has an invalid length. [ 297.878084][T14246] netlink: 'syz.3.2647': attribute type 1 has an invalid length. [ 298.279632][ T3475] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 298.742506][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.092989][T14241] geneve4: entered promiscuous mode [ 299.100340][T14243] __nla_validate_parse: 3 callbacks suppressed [ 299.100356][T14243] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2648'. [ 299.116134][T14244] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2648'. [ 299.199257][ T3540] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 53424 - 0 [ 299.206265][T14267] netlink: 'syz.3.2655': attribute type 4 has an invalid length. [ 299.208118][ T3540] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 53424 - 0 [ 299.280479][ T3540] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 53424 - 0 [ 299.289859][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 299.319420][ T13] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 53424 - 0 [ 299.364175][T14274] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2658'. [ 299.389979][T14274] bridge0: port 2(bridge_slave_1) entered disabled state [ 299.397453][T14274] bridge0: port 1(bridge_slave_0) entered disabled state [ 299.422218][T14278] netlink: 164 bytes leftover after parsing attributes in process `syz.3.2657'. [ 299.431652][T14278] netlink: 'syz.3.2657': attribute type 10 has an invalid length. [ 299.453299][T14280] netlink: 'syz.3.2657': attribute type 10 has an invalid length. [ 299.479312][T14278] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 299.508811][T14280] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 299.576560][T14290] netlink: 'syz.2.2659': attribute type 1 has an invalid length. [ 299.594913][T14290] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 299.891560][T14313] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2666'. [ 300.441203][T14347] netlink: 'syz.3.2677': attribute type 1 has an invalid length. [ 300.459592][T14347] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2677'. [ 300.499937][ T3475] net_ratelimit: 3 callbacks suppressed [ 300.499954][ T3475] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.527332][T14351] IPVS: set_ctl: invalid protocol: 1 172.30.1.3:20000 [ 300.888184][T14377] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2686'. [ 300.917709][T14377] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2686'. [ 300.932006][T14377] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2686'. [ 300.945476][T14382] openvswitch: netlink: Key 6 has unexpected len 0 expected 2 [ 300.953433][ T3475] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 301.406082][T14410] IPVS: set_ctl: invalid protocol: 135 127.0.0.1:20267 [ 301.426746][T14410] IPVS: sh: FWM 3 0x00000003 - no destination available [ 301.629542][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 301.637915][T14422] delete_channel: no stack [ 301.649808][T14422] netlink: 'syz.3.2698': attribute type 1 has an invalid length. [ 301.661498][T14425] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2699'. [ 301.854855][ T1703] block nbd0: Possible stuck request ffff8880264b8000: control (read@0,1024B). Runtime 30 seconds [ 301.866608][ T1703] block nbd0: Possible stuck request ffff8880264b8200: control (read@1024,1024B). Runtime 30 seconds [ 301.878118][ T1703] block nbd0: Possible stuck request ffff8880264b8400: control (read@2048,1024B). Runtime 30 seconds [ 301.889564][ T1703] block nbd0: Possible stuck request ffff8880264b8600: control (read@3072,1024B). Runtime 30 seconds [ 301.901020][T14439] xt_CT: You must specify a L4 protocol and not use inversions on it [ 302.061546][T14449] bond8: entered promiscuous mode [ 302.075382][T14449] bond8: entered allmulticast mode [ 302.081057][T14449] 8021q: adding VLAN 0 to HW filter on device bond8 [ 302.089880][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 302.115036][T14455] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 302.143914][T14457] x_tables: unsorted underflow at hook 3 [ 302.170972][T14457] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 302.202289][T14457] gretap1: entered promiscuous mode [ 302.213443][T14457] gretap1: entered allmulticast mode [ 302.295848][T14465] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 302.308962][T14465] SET target dimension over the limit! [ 302.493831][T14470] bond8: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 302.528565][T14470] bond8 (unregistering): Released all slaves [ 302.639764][T14478] nbd1: detected capacity change from 0 to 127 [ 302.676583][ T5143] block nbd1: Receive control failed (result -32) [ 302.686655][T13795] block nbd1: Send control failed (result -32) [ 302.719453][T13795] block nbd1: Request send failed, requeueing [ 302.749590][ T1703] block nbd1: Dead connection, failed to find a fallback [ 302.757373][ T1703] block nbd1: shutting down sockets [ 302.760737][ T3475] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 302.763619][ T1703] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.786781][ T1703] Buffer I/O error on dev nbd1, logical block 0, async page read [ 302.797234][T13795] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.813498][T13795] Buffer I/O error on dev nbd1, logical block 1, async page read [ 302.823848][T13795] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.833480][T13795] Buffer I/O error on dev nbd1, logical block 2, async page read [ 302.841699][T13795] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.852437][T13795] Buffer I/O error on dev nbd1, logical block 3, async page read [ 302.860613][T13795] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.871689][T13795] Buffer I/O error on dev nbd1, logical block 0, async page read [ 302.880158][T13795] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.889907][T13795] Buffer I/O error on dev nbd1, logical block 1, async page read [ 302.897872][T13795] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.907601][T13795] Buffer I/O error on dev nbd1, logical block 2, async page read [ 302.915488][T13795] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.925796][T13795] Buffer I/O error on dev nbd1, logical block 3, async page read [ 302.949623][T13795] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 302.959226][T13795] Buffer I/O error on dev nbd1, logical block 0, async page read [ 302.988629][T13795] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 303.009242][T13795] Buffer I/O error on dev nbd1, logical block 1, async page read [ 303.071123][T13795] ldm_validate_partition_table(): Disk read failed. [ 303.085514][T13795] Dev nbd1: unable to read RDB block 0 [ 303.099988][T13795] nbd1: unable to read partition table [ 303.162372][T13795] ldm_validate_partition_table(): Disk read failed. [ 303.173356][T13795] Dev nbd1: unable to read RDB block 0 [ 303.191459][T13795] nbd1: unable to read partition table [ 303.219762][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 303.353028][T14504] bridge9: entered promiscuous mode [ 303.358307][T14504] bridge9: entered allmulticast mode [ 303.396910][T14518] validate_nla: 1 callbacks suppressed [ 303.396930][T14518] netlink: 'syz.3.2727': attribute type 3 has an invalid length. [ 303.636241][T14531] openvswitch: netlink: IP tunnel dst address not specified [ 303.784992][T14541] FAULT_INJECTION: forcing a failure. [ 303.784992][T14541] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 303.824120][T14541] CPU: 0 UID: 0 PID: 14541 Comm: syz.1.2732 Not tainted syzkaller #0 PREEMPT(full) [ 303.824149][T14541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 303.824170][T14541] Call Trace: [ 303.824178][T14541] [ 303.824187][T14541] dump_stack_lvl+0xe8/0x150 [ 303.824222][T14541] should_fail_ex+0x412/0x560 [ 303.824255][T14541] _copy_from_iter+0x1d3/0x1670 [ 303.824288][T14541] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 303.824324][T14541] ? __pfx_policy_nodemask+0x10/0x10 [ 303.824357][T14541] ? __pfx__copy_from_iter+0x10/0x10 [ 303.824396][T14541] ? set_page_refcounted+0xa0/0x1e0 [ 303.824427][T14541] ? page_copy_sane+0x4e/0x270 [ 303.824460][T14541] copy_page_from_iter+0xdd/0x170 [ 303.824497][T14541] tun_get_user+0x1d4b/0x3dd0 [ 303.824535][T14541] ? tun_get_user+0x6ff/0x3dd0 [ 303.824586][T14541] ? aa_file_perm+0x440/0x1630 [ 303.824617][T14541] ? __pfx_tun_get_user+0x10/0x10 [ 303.824649][T14541] ? __lock_acquire+0x6b5/0x2cf0 [ 303.824685][T14541] ? ref_tracker_alloc+0x363/0x4d0 [ 303.824719][T14541] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 303.824751][T14541] ? tun_get+0x1c/0x2f0 [ 303.824779][T14541] ? tun_get+0x1c/0x2f0 [ 303.824815][T14541] ? tun_get+0x1c/0x2f0 [ 303.824842][T14541] ? tun_get+0x1c/0x2f0 [ 303.824876][T14541] tun_chr_write_iter+0x113/0x200 [ 303.824909][T14541] vfs_write+0x61d/0xb90 [ 303.824943][T14541] ? __pfx_vfs_write+0x10/0x10 [ 303.824979][T14541] ? __fget_files+0x2a/0x420 [ 303.825008][T14541] ksys_write+0x150/0x270 [ 303.825036][T14541] ? __pfx_ksys_write+0x10/0x10 [ 303.825073][T14541] do_syscall_64+0x14d/0xf80 [ 303.825101][T14541] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.825121][T14541] ? trace_irq_disable+0x37/0x100 [ 303.825144][T14541] ? clear_bhb_loop+0x40/0x90 [ 303.825170][T14541] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.825189][T14541] RIP: 0033:0x7f526115cece [ 303.825208][T14541] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 303.825225][T14541] RSP: 002b:00007f5262067fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 303.825247][T14541] RAX: ffffffffffffffda RBX: 00007f52620686c0 RCX: 00007f526115cece [ 303.825263][T14541] RDX: 0000000000000066 RSI: 0000200000000000 RDI: 00000000000000c8 [ 303.825276][T14541] RBP: 00007f5262068090 R08: 0000000000000000 R09: 0000000000000000 [ 303.825288][T14541] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 303.825300][T14541] R13: 00007f5261416038 R14: 00007f5261415fa0 R15: 00007ffc8ec27b08 [ 303.825332][T14541] [ 303.828539][T14540] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.062570][T14546] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 304.118456][T14545] __nla_validate_parse: 11 callbacks suppressed [ 304.118478][T14545] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2733'. [ 304.184429][T14551] netlink: 'syz.4.2738': attribute type 11 has an invalid length. [ 304.213831][T14551] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2738'. [ 304.248014][T14551] bond8: entered promiscuous mode [ 304.280361][T14551] netlink: 'syz.4.2738': attribute type 21 has an invalid length. [ 304.288372][T14551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2738'. [ 304.308522][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806e394000: rx timeout, send abort [ 304.317154][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88806e394000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 304.322769][T14551] netlink: 'syz.4.2738': attribute type 21 has an invalid length. [ 304.339564][T14551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2738'. [ 304.369679][T14559] xt_hashlimit: size too large, truncated to 1048576 [ 304.406296][T14551] macvlan2: entered promiscuous mode [ 304.439292][T14551] macvlan2: entered allmulticast mode [ 304.445784][T14551] bond8: (slave macvlan2): Opening slave failed [ 304.512773][T14566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2742'. [ 304.683887][T14578] !: renamed from dummy0 (while UP) [ 304.745046][ T30] audit: type=1800 audit(1771431127.866:4): pid=14580 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2746" name="memory.events" dev="tmpfs" ino=2727 res=0 errno=0 [ 304.791550][ T30] audit: type=1804 audit(1771431127.866:5): pid=14580 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2746" name="/newroot/535/memory.events" dev="tmpfs" ino=2727 res=1 errno=0 [ 304.913835][T14590] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2749'. [ 304.949401][T14590] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2749'. [ 304.968587][T14590] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2749'. [ 305.050247][T14599] xt_bpf: check failed: parse error [ 305.094425][T14603] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2753'. [ 305.140087][T14603] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2753'. [ 305.591507][ T1339] net_ratelimit: 4 callbacks suppressed [ 305.591526][ T1339] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.883248][T14645] netlink: 'syz.0.2767': attribute type 2 has an invalid length. [ 305.900519][T14645] xt_hashlimit: overflow, try lower: 3/0 [ 306.062667][ T5840] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 306.072010][ T5840] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 306.081931][ T5840] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 306.101180][ T5840] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 306.110935][ T5840] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 306.133399][ T5143] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 306.140976][ T5143] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 306.148466][ T5143] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 306.169381][ T5143] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 306.179417][ T5143] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 306.260076][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 306.719442][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 306.828689][T14697] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 306.924351][T14702] netdevsim netdevsim1: Firmware load for './file0/file0/..' refused, path contains '..' component [ 306.970840][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.230475][T14711] Cannot find add_set index 65532 as target [ 307.268400][T14712] tc_dump_action: action bad kind [ 307.361945][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.581974][T14729] lec:lec_atm_send: lec0: Unknown message type 1367348599 [ 307.594718][T14657] chnl_net:caif_netlink_parms(): no params data found [ 307.841458][ T3475] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.941400][T14690] lec:lec_atm_close: lec0: Shut down! [ 307.948568][T14657] bridge0: port 1(bridge_slave_0) entered blocking state [ 308.040420][T14657] bridge0: port 1(bridge_slave_0) entered disabled state [ 308.047771][T14657] bridge_slave_0: entered allmulticast mode [ 308.075033][T14657] bridge_slave_0: entered promiscuous mode [ 308.192512][ T3475] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.220433][ T3475] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.249974][ T5143] Bluetooth: hci5: command tx timeout [ 308.283851][T14657] bridge0: port 2(bridge_slave_1) entered blocking state [ 308.301745][T14657] bridge0: port 2(bridge_slave_1) entered disabled state [ 308.309072][T14657] bridge_slave_1: entered allmulticast mode [ 308.328387][T14657] bridge_slave_1: entered promiscuous mode [ 308.345901][T14760] tipc: Enabled bearer , priority 0 [ 308.414849][ T3475] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.440079][ T3475] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.519699][ T3540] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 308.611961][T14753] syzkaller0: entered promiscuous mode [ 308.617676][T14753] syzkaller0: entered allmulticast mode [ 308.624168][T14753] tipc: Resetting bearer [ 308.643464][T14657] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 308.656298][T14751] tipc: Resetting bearer [ 309.019505][ T1339] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.642027][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.816493][T14751] tipc: Disabling bearer [ 309.845576][ T3475] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.856605][ T3475] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.886311][T14657] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 310.010406][T14785] __nla_validate_parse: 17 callbacks suppressed [ 310.010425][T14785] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2790'. [ 310.084137][T14784] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2790'. [ 310.099000][ T3475] batman_adv: batadv0: Removing interface: netdevsim0 [ 310.160195][T14657] team0: Port device team_slave_0 added [ 310.197383][T14657] team0: Port device team_slave_1 added [ 310.302807][T14657] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 310.324891][T14657] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 310.343024][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2795'. [ 310.369439][ T5143] Bluetooth: hci5: command tx timeout [ 310.384420][T14657] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 310.419492][T14657] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 310.437727][T14657] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 310.484699][T14657] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 310.658823][T14657] hsr_slave_0: entered promiscuous mode [ 310.670533][T14657] hsr_slave_1: entered promiscuous mode [ 310.686847][T14657] debugfs: 'hsr0' already exists in 'hsr' [ 310.717607][T14657] Cannot create hsr debugfs directory [ 310.734562][T14817] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2797'. [ 310.750943][ T1339] net_ratelimit: 1 callbacks suppressed [ 310.750958][ T1339] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.768719][T14816] netlink: 'syz.0.2798': attribute type 3 has an invalid length. [ 310.839743][ T5915] lec:lec_start_xmit: lec0:No lecd attached [ 310.869782][T14817] bond7: (slave syz_tun): Releasing backup interface [ 311.554134][ T3475] bond0 (unregistering): Released all slaves [ 311.565503][ T3475] bond1 (unregistering): Released all slaves [ 311.581125][ T3475] bond2 (unregistering): Released all slaves [ 311.596481][ T3475] bond3 (unregistering): Released all slaves [ 311.612687][ T3475] bond4 (unregistering): Released all slaves [ 311.628419][ T3475] bond5 (unregistering): Released all slaves [ 311.648506][ T3475] bond6 (unregistering): Released all slaves [ 311.670877][ T3475] bond7 (unregistering): Released all slaves [ 311.686263][ T3475] bond8 (unregistering): Released all slaves [ 311.701414][ T3475] bond9 (unregistering): Released all slaves [ 311.718699][ T3475] bond10 (unregistering): Released all slaves [ 311.738433][ T3475] bond11 (unregistering): Released all slaves [ 311.970411][ T3475] tipc: Left network mode [ 312.088044][T14857] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 312.137937][T14859] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2810'. [ 312.414729][ T5143] Bluetooth: hci5: command tx timeout [ 312.462978][T14875] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2814'. [ 312.526387][T14875] bond5: (slave syz_tun): Releasing backup interface [ 313.175934][ T13] tipc: Subscription rejected, illegal request [ 313.199464][T14908] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2823'. [ 313.303491][T14914] netlink: 404 bytes leftover after parsing attributes in process `syz.4.2825'. [ 313.407315][T14922] netlink: 84 bytes leftover after parsing attributes in process `syz.3.2824'. [ 313.430293][ T3475] hsr_slave_0: left promiscuous mode [ 313.460769][ T3475] hsr_slave_1: left promiscuous mode [ 313.475625][ T3475] veth1_macvtap: left promiscuous mode [ 313.487679][ T3475] veth0_macvtap: left promiscuous mode [ 313.494673][ T3475] veth1_vlan: left promiscuous mode [ 313.501108][ T3475] veth0_vlan: left promiscuous mode [ 313.565827][ T3475] team0 (unregistering): Port device wireguard1 removed [ 313.978750][T14657] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 314.057332][T14657] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 314.122435][T14657] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 314.170148][T14657] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 314.201415][T14952] openvswitch: netlink: IP tunnel dst address not specified [ 314.491716][ T5143] Bluetooth: hci5: command tx timeout [ 314.574759][T14968] netlink: 'syz.4.2836': attribute type 4 has an invalid length. [ 314.602701][T14968] netlink: 17 bytes leftover after parsing attributes in process `syz.4.2836'. [ 314.644111][T14657] 8021q: adding VLAN 0 to HW filter on device bond0 [ 314.683442][T14657] 8021q: adding VLAN 0 to HW filter on device team0 [ 314.717765][T14974] netlink: 'syz.0.2838': attribute type 15 has an invalid length. [ 314.773155][T14813] bridge0: port 1(bridge_slave_0) entered blocking state [ 314.780399][T14813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 314.811847][T14813] bridge0: port 2(bridge_slave_1) entered blocking state [ 314.819216][T14813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 315.266708][T15004] __nla_validate_parse: 5 callbacks suppressed [ 315.266728][T15004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2844'. [ 315.285257][T15004] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2844'. [ 315.345793][T14995] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 315.357754][T14995] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 315.513386][T15007] can: request_module (can-proto-5) failed. [ 315.573846][T15004] geneve3: entered promiscuous mode [ 315.579587][T15004] geneve3: entered allmulticast mode [ 315.625004][ T13] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.647245][ T13] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.672779][T15015] netlink: 'syz.4.2847': attribute type 1 has an invalid length. [ 315.683472][ T13] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.709806][ T13] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 315.778417][T15019] nbd: must specify at least one socket [ 315.796205][T15017] xt_hashlimit: size too large, truncated to 1048576 [ 315.826710][T14657] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 315.929479][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5090 ms [ 315.937990][ C1] lec:lec_tx_timeout: lec0 [ 315.943275][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 315.994491][T14657] veth0_vlan: entered promiscuous mode [ 316.035597][T14657] veth1_vlan: entered promiscuous mode [ 316.130942][T15038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2854'. [ 316.145106][T15032] syzkaller0: entered promiscuous mode [ 316.150881][T15032] syzkaller0: entered allmulticast mode [ 316.325457][T15048] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2856'. [ 317.473066][T14657] veth0_macvtap: entered promiscuous mode [ 317.502102][T14657] veth1_macvtap: entered promiscuous mode [ 317.575769][T14657] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 317.594158][T15055] netlink: 'syz.1.2859': attribute type 1 has an invalid length. [ 317.657310][T14657] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 317.710307][T12463] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.748602][T12463] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.773323][T12463] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.794679][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.013767][ T3475] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 318.049362][ T3475] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 318.208056][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 318.253114][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 318.395856][T15097] netdevsim netdevsim1: Direct firmware load for /tun failed with error -2 [ 318.419326][T15097] netdevsim netdevsim1: Falling back to sysfs fallback for: /tun [ 318.576084][T15103] team0: Device gtp0 is up. Set it down before adding it as a team port [ 318.627806][T15109] netlink: 'syz.0.2872': attribute type 1 has an invalid length. [ 318.830576][T15116] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2875'. [ 318.850306][T15116] gretap0: entered promiscuous mode [ 318.872554][T15119] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2876'. [ 318.962339][ T5840] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 318.975565][ T5840] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 318.984293][ T5840] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 318.992795][ T5840] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 319.000863][ T5840] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 319.230360][T15127] x_tables: ip6_tables: ipcomp match: only valid for protocol 108 [ 319.258499][T15125] syz_tun: left allmulticast mode [ 319.340038][T15130] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2879'. [ 319.468041][T15133] netlink: 'syz.2.2880': attribute type 1 has an invalid length. [ 319.493509][T15133] netlink: 'syz.2.2880': attribute type 1 has an invalid length. [ 319.583932][T15139] netlink: 'syz.4.2883': attribute type 1 has an invalid length. [ 319.676783][T15141] xt_hashlimit: size too large, truncated to 1048576 [ 319.781175][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 319.814927][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.826449][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 53424 - 0 [ 320.041208][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 320.079651][T15166] netlink: 'syz.0.2890': attribute type 4 has an invalid length. [ 320.086007][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.087451][T15166] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2890'. [ 320.146625][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 53424 - 0 [ 320.181956][T15170] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2891'. [ 320.208433][T15170] netlink: 'syz.2.2891': attribute type 7 has an invalid length. [ 320.229213][T15170] netlink: 'syz.2.2891': attribute type 8 has an invalid length. [ 320.242360][T15170] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2891'. [ 320.344497][T15163] syzkaller0: entered promiscuous mode [ 320.350507][T15163] syzkaller0: entered allmulticast mode [ 320.401330][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 320.419558][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.431413][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 53424 - 0 [ 320.476574][T15181] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2892'. [ 320.487182][T15181] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 320.599326][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 320.620078][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.631754][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 53424 - 0 [ 320.959227][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 320.967472][ C1] lec:lec_tx_timeout: lec0 [ 320.972289][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 321.051982][ T5143] Bluetooth: hci2: command tx timeout [ 321.901952][T15194] netlink: 'syz.0.2896': attribute type 1 has an invalid length. [ 322.063866][T15210] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2898'. [ 322.083579][T15121] chnl_net:caif_netlink_parms(): no params data found [ 322.116341][T15212] netlink: 'syz.0.2899': attribute type 1 has an invalid length. [ 322.338846][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 322.410526][T15224] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2902'. [ 322.526822][T15221] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2901'. [ 322.605282][ T13] bridge_slave_1: left allmulticast mode [ 322.639528][ T13] bridge_slave_1: left promiscuous mode [ 322.651783][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.712354][ T13] bridge_slave_0: left allmulticast mode [ 322.718069][ T13] bridge_slave_0: left promiscuous mode [ 322.744417][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.818568][T15251] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2906'. [ 322.830409][T15251] validate_nla: 1 callbacks suppressed [ 322.830428][T15251] netlink: 'syz.4.2906': attribute type 7 has an invalid length. [ 322.851321][T15251] netlink: 'syz.4.2906': attribute type 8 has an invalid length. [ 322.860927][T15251] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2906'. [ 323.129386][ T5143] Bluetooth: hci2: command 0x041b tx timeout [ 323.188391][ T13] bond10 (unregistering): (slave erspan1): Releasing active interface [ 323.196839][ T13] erspan1 (unregistering): left promiscuous mode [ 323.228181][ T13] bond3 (unregistering): (slave gretap1): Releasing active interface [ 323.346814][ T13] team0: Port device bridge1 removed [ 323.628866][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 323.641315][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 323.652144][ T13] bond0 (unregistering): (slave team0): Releasing backup interface [ 323.662669][ T13] bond0 (unregistering): Released all slaves [ 323.677764][ T13] bond1 (unregistering): Released all slaves [ 323.693259][ T13] bond2 (unregistering): Released all slaves [ 323.707687][ T13] bond3 (unregistering): Released all slaves [ 323.722650][ T13] bond4 (unregistering): Released all slaves [ 323.747615][ T13] bond5 (unregistering): Released all slaves [ 323.762386][ T13] bond6 (unregistering): Released all slaves [ 323.777712][ T13] bond7 (unregistering): Released all slaves [ 323.792163][ T13] bond8 (unregistering): Released all slaves [ 323.806407][ T13] bond9 (unregistering): Released all slaves [ 323.823559][ T13] bond10 (unregistering): Released all slaves [ 323.840204][ T13] bond11 (unregistering): Released all slaves [ 323.860203][ T13] bond12 (unregistering): Released all slaves [ 323.885009][ T13] bond13 (unregistering): Released all slaves [ 323.901546][ T13] bond14 (unregistering): Released all slaves [ 323.927964][T15228] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2902'. [ 323.950664][T15242] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2902'. [ 323.997523][T15237] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2905'. [ 324.091779][ T13] IPVS: stopping backup sync thread 13884 ... [ 324.219005][T15264] netlink: 'syz.1.2908': attribute type 1 has an invalid length. [ 324.235108][T15269] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2909'. [ 324.324672][T15121] bridge0: port 1(bridge_slave_0) entered blocking state [ 324.343821][T15121] bridge0: port 1(bridge_slave_0) entered disabled state [ 324.373271][T15121] bridge_slave_0: entered allmulticast mode [ 324.397223][T15121] bridge_slave_0: entered promiscuous mode [ 324.418581][T15121] bridge0: port 2(bridge_slave_1) entered blocking state [ 324.430915][T15121] bridge0: port 2(bridge_slave_1) entered disabled state [ 324.452459][T15121] bridge_slave_1: entered allmulticast mode [ 324.453938][T15276] xt_CT: You must specify a L4 protocol and not use inversions on it [ 324.476139][T15121] bridge_slave_1: entered promiscuous mode [ 324.670848][T15121] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 324.716018][T15121] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 324.818801][T15300] IPVS: set_ctl: invalid protocol: 73 127.0.0.1:20000 [ 324.860965][T15297] tipc: Enabled bearer , priority 10 [ 324.895720][T15121] team0: Port device team_slave_0 added [ 324.931556][T15121] team0: Port device team_slave_1 added [ 325.120858][T15309] netlink: 'syz.0.2920': attribute type 1 has an invalid length. [ 325.131380][T15121] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 325.172583][T15121] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 325.221127][ T5840] Bluetooth: hci2: command 0x041b tx timeout [ 325.249190][T15121] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 325.400057][T15121] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 325.407059][T15121] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 325.447393][T15334] netlink: 'syz.1.2924': attribute type 1 has an invalid length. [ 325.457274][T15334] netlink: 'syz.1.2924': attribute type 1 has an invalid length. [ 325.499895][T15121] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 325.562669][ T13] hsr_slave_0: left promiscuous mode [ 325.578284][ T13] hsr_slave_1: left promiscuous mode [ 325.590380][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 325.603807][T15341] __nla_validate_parse: 2 callbacks suppressed [ 325.603827][T15341] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2925'. [ 325.608593][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 325.616202][T15324] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2921'. [ 325.652781][ T13] veth0_macvtap: left promiscuous mode [ 325.658590][ T13] veth1_vlan: left promiscuous mode [ 325.664316][ T13] veth0_vlan: left promiscuous mode [ 325.796329][ T13] team0 (unregistering): Port device batadv1 removed [ 325.965921][ T13] team0 (unregistering): Port device team_slave_1 removed [ 325.979223][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 325.987273][ C1] lec:lec_tx_timeout: lec0 [ 325.992334][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 326.004248][ T13] team0 (unregistering): Port device team_slave_0 removed [ 326.132324][T15329] pimreg: entered allmulticast mode [ 326.138139][T15313] syzkaller0: entered promiscuous mode [ 326.145640][T15313] syzkaller0: entered allmulticast mode [ 326.254073][T15351] netlink: 'syz.2.2927': attribute type 1 has an invalid length. [ 326.279871][T15349] .: renamed from bridge_slave_1 (while UP) [ 326.453397][T15121] hsr_slave_0: entered promiscuous mode [ 326.470593][T15121] hsr_slave_1: entered promiscuous mode [ 326.494151][T15121] debugfs: 'hsr0' already exists in 'hsr' [ 326.501429][T15121] Cannot create hsr debugfs directory [ 326.527252][T15366] netlink: 'syz.4.2932': attribute type 1 has an invalid length. [ 326.613488][T15369] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 326.644142][T15369] bond1 (unregistering): Released all slaves [ 326.880390][T15391] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2938'. [ 327.289864][ T5840] Bluetooth: hci2: command 0x041b tx timeout [ 327.320065][T15409] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2940'. [ 327.469268][T15417] lec:lec_atm_send: lec0: Unknown message type -1 [ 327.534504][ T13] IPVS: stop unused estimator thread 0... [ 327.686516][T15380] lec:lec_atm_close: lec0: Shut down! [ 327.786970][T15431] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2947'. [ 327.799186][T15432] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2946'. [ 327.827579][T15432] .: left allmulticast mode [ 327.844110][T15432] .: left promiscuous mode [ 327.848911][T15432] bridge0: port 2(.) entered disabled state [ 327.879315][T15432] bridge_slave_0: left allmulticast mode [ 327.894492][T15437] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2947'. [ 327.915862][T15432] bridge_slave_0: left promiscuous mode [ 327.930035][T15432] bridge0: port 1(bridge_slave_0) entered disabled state [ 328.547527][T15459] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2954'. [ 328.696766][T15121] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 328.722357][T15121] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 328.763963][T15121] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 328.824464][T15121] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 328.970210][T15485] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2958'. [ 329.132550][T15121] 8021q: adding VLAN 0 to HW filter on device bond0 [ 329.220400][T15121] 8021q: adding VLAN 0 to HW filter on device team0 [ 329.251942][T14813] bridge0: port 1(bridge_slave_0) entered blocking state [ 329.259242][T14813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 329.284645][T14813] bridge0: port 2(bridge_slave_1) entered blocking state [ 329.291910][T14813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 329.366616][T15121] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 329.377708][ T5840] Bluetooth: hci2: command 0x041b tx timeout [ 329.912278][T15121] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 330.044919][T15542] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.2972'. [ 330.098026][T15121] veth0_vlan: entered promiscuous mode [ 330.128754][T15121] veth1_vlan: entered promiscuous mode [ 330.238892][T15554] bond9: Removing last arp target with arp_interval on [ 330.322157][T15559] bond10: Removing last arp target with arp_interval on [ 330.458170][T15558] syzkaller0: entered promiscuous mode [ 330.470162][T15558] syzkaller0: entered allmulticast mode [ 330.481331][T15564] tipc: Enabled bearer , priority 0 [ 330.514895][T15121] veth0_macvtap: entered promiscuous mode [ 330.577145][T15121] veth1_macvtap: entered promiscuous mode [ 330.616862][T15572] batadv_slave_1: default FDB implementation only supports local addresses [ 330.681463][T15121] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 330.723339][T15121] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 330.779655][ T1339] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.821976][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.869789][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 330.892044][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.090350][T15556] tipc: Resetting bearer [ 331.171450][T15556] tipc: Disabling bearer [ 331.288187][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 331.340625][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 331.557890][ T3475] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 331.572644][ T3475] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 331.759822][T15624] xt_NFQUEUE: number of queues (62232) out of range (got 67565) [ 331.841262][T15632] ipt_REJECT: ECHOREPLY no longer supported. [ 331.930366][ T1703] block nbd0: Possible stuck request ffff8880264b8000: control (read@0,1024B). Runtime 60 seconds [ 331.941272][ T1703] block nbd0: Possible stuck request ffff8880264b8200: control (read@1024,1024B). Runtime 60 seconds [ 331.952783][ T1703] block nbd0: Possible stuck request ffff8880264b8400: control (read@2048,1024B). Runtime 60 seconds [ 331.966871][ T1703] block nbd0: Possible stuck request ffff8880264b8600: control (read@3072,1024B). Runtime 60 seconds [ 332.596146][T15669] tipc: Enabling of bearer rejected, already enabled [ 332.616560][T15669] __nla_validate_parse: 2 callbacks suppressed [ 332.616580][T15669] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3000'. [ 332.829776][T15676] mac80211_hwsim hwsim27 wlan0: entered promiscuous mode [ 332.889181][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5210 ms [ 332.897268][ C1] lec:lec_tx_timeout: lec0 [ 332.902235][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 333.420354][T15697] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 333.449492][T15697] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 333.707335][ T5143] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 333.720839][ T5143] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 333.728793][ T5143] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 333.761436][ T5143] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 333.770625][ T5143] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 334.276807][T15721] syzkaller0: entered promiscuous mode [ 334.292131][T15721] syzkaller0: entered allmulticast mode [ 334.355493][T15739] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3014'. [ 334.424714][T15737] bridge_slave_0: left allmulticast mode [ 334.453226][T15737] bridge_slave_0: left promiscuous mode [ 334.476251][T15737] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.526531][T15737] bridge_slave_1: left allmulticast mode [ 334.554540][T15737] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.623593][T15748] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3017'. [ 334.660353][T15737] bond5: (slave veth0_to_bond): Releasing active interface [ 334.667867][T15737] veth0_to_bond: left promiscuous mode [ 334.676767][T15737] veth0_to_bond: left allmulticast mode [ 334.705399][T15737] bond0: (slave bond_slave_0): Releasing backup interface [ 334.738408][T15737] bond0: (slave bond_slave_1): Releasing backup interface [ 334.760576][T15737] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 334.792150][T15738] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 335.852191][ T5143] Bluetooth: hci3: command tx timeout [ 336.555244][T15793] syzkaller0: entered promiscuous mode [ 336.572113][T15793] syzkaller0: entered allmulticast mode [ 336.588465][T15704] chnl_net:caif_netlink_parms(): no params data found [ 336.617582][T15796] netlink: 'syz.4.3028': attribute type 1 has an invalid length. [ 336.639300][T15796] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3028'. [ 336.740917][T15802] netlink: 'syz.3.3030': attribute type 64 has an invalid length. [ 337.057673][T15816] tipc: Enabled bearer , priority 2 [ 337.069746][T15816] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3035'. [ 337.100663][T15704] bridge0: port 1(bridge_slave_0) entered blocking state [ 337.107846][T15704] bridge0: port 1(bridge_slave_0) entered disabled state [ 337.124098][T15704] bridge_slave_0: entered allmulticast mode [ 337.183197][T15704] bridge_slave_0: entered promiscuous mode [ 337.194828][T15798] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 337.218896][T15704] bridge0: port 2(bridge_slave_1) entered blocking state [ 337.241172][ T5192] udevd[5192]: worker [12168] /devices/virtual/block/nbd0 is taking a long time [ 337.269990][T15704] bridge0: port 2(bridge_slave_1) entered disabled state [ 337.285456][T15704] bridge_slave_1: entered allmulticast mode [ 337.301370][T15704] bridge_slave_1: entered promiscuous mode [ 337.416919][T15704] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 337.447237][T15704] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 337.544247][T15704] team0: Port device team_slave_0 added [ 337.585179][T15704] team0: Port device team_slave_1 added [ 337.673078][T15845] x_tables: duplicate underflow at hook 1 [ 337.687183][T15845] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3043'. [ 337.714736][T15704] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 337.734664][T15704] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 337.775589][T15704] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 337.813696][T15704] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 337.829781][T15704] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 337.897667][T15704] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 337.929294][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 337.937374][ C1] lec:lec_tx_timeout: lec0 [ 337.942522][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 337.950563][ T5143] Bluetooth: hci3: command tx timeout [ 337.960984][T15852] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3043'. [ 338.031590][T15862] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3048'. [ 338.150960][T15704] hsr_slave_0: entered promiscuous mode [ 338.158071][T15704] hsr_slave_1: entered promiscuous mode [ 338.178010][T15704] debugfs: 'hsr0' already exists in 'hsr' [ 338.199280][T15704] Cannot create hsr debugfs directory [ 338.548788][T15883] syzkaller0: entered promiscuous mode [ 338.560862][T15883] syzkaller0: entered allmulticast mode [ 340.005901][T15913] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3062'. [ 340.014935][ T5143] Bluetooth: hci3: command tx timeout [ 340.034079][T15704] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.140550][T15704] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.243444][T15704] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.319920][T15938] netlink: 'syz.4.3067': attribute type 1 has an invalid length. [ 340.350896][T15704] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.475007][T15938] 8021q: adding VLAN 0 to HW filter on device bond9 [ 340.530768][T15950] macvlan2: entered promiscuous mode [ 340.539564][T15950] macvlan2: entered allmulticast mode [ 340.577366][T15938] bond9: (slave ip6gretap1): making interface the new active one [ 340.586504][T15938] bond9: (slave ip6gretap1): Enslaving as an active interface with an up link [ 340.698744][T15959] sctp: [Deprecated]: syz.2.3075 (pid 15959) Use of int in maxseg socket option. [ 340.698744][T15959] Use struct sctp_assoc_value instead [ 340.735812][T15704] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 340.757065][T15704] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 340.790372][T15704] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 340.830295][T15704] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 340.873320][T15970] xt_l2tp: v2 tid > 0xffff: 1114244 [ 340.885333][T15973] netlink: 'syz.2.3078': attribute type 5 has an invalid length. [ 340.907073][T15973] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3078'. [ 340.976279][T15980] netlink: 'syz.0.3079': attribute type 83 has an invalid length. [ 341.046412][T15704] 8021q: adding VLAN 0 to HW filter on device bond0 [ 341.067984][T15985] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3081'. [ 341.089780][T15704] 8021q: adding VLAN 0 to HW filter on device team0 [ 341.138598][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 341.145802][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 341.199971][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 341.207148][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 341.232840][T15990] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3083'. [ 341.288319][T15990] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3083'. [ 341.304335][T15994] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3085'. [ 341.414771][T16000] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 341.506502][T15997] bond1: entered promiscuous mode [ 341.534636][T15997] bond1: entered allmulticast mode [ 341.548042][T15997] 8021q: adding VLAN 0 to HW filter on device bond1 [ 341.585016][T16007] sch_fq: defrate 0 ignored. [ 341.631422][T16004] openvswitch: netlink: IP tunnel dst address not specified [ 341.743059][T16019] netlink: 'syz.2.3090': attribute type 9 has an invalid length. [ 341.903553][T15704] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 342.032066][T15704] veth0_vlan: entered promiscuous mode [ 342.072724][T15704] veth1_vlan: entered promiscuous mode [ 342.090987][ T5143] Bluetooth: hci3: command tx timeout [ 342.192231][T15704] veth0_macvtap: entered promiscuous mode [ 342.209461][T16043] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3096'. [ 342.229244][T15704] veth1_macvtap: entered promiscuous mode [ 342.287184][T15704] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 342.343436][T15704] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 342.395195][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.427181][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.455898][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.465668][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.722708][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 342.750940][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 342.764694][ T5915] IPVS: starting estimator thread 0... [ 342.838002][T16076] __nla_validate_parse: 2 callbacks suppressed [ 342.838023][T16076] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3109'. [ 342.890576][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 342.921775][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 342.929369][T16077] IPVS: using max 26 ests per chain, 62400 per kthread [ 342.949211][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 342.957298][ C1] lec:lec_tx_timeout: lec0 [ 342.962397][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 343.151427][T16094] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3112'. [ 343.172911][T16091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3111'. [ 343.273249][T16100] netlink: 'syz.1.3114': attribute type 1 has an invalid length. [ 343.282487][T16100] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3114'. [ 343.365870][T16109] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3115'. [ 343.375401][T16109] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3115'. [ 343.541057][T16117] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3119'. [ 343.718381][T16128] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3122'. [ 343.741083][T16128] syzkaller0: entered promiscuous mode [ 343.747073][T16128] syzkaller0: entered allmulticast mode [ 343.768311][T16128] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3122'. [ 344.245722][ T5840] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 344.257667][ T5840] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 344.267360][ T5840] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 344.280646][ T5840] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 344.288649][ T5840] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 344.324114][T16141] netlink: 'syz.1.3127': attribute type 21 has an invalid length. [ 344.332178][T16139] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3125'. [ 344.379351][T16141] netlink: 'syz.1.3127': attribute type 1 has an invalid length. [ 344.684295][T16160] netlink: 'syz.2.3131': attribute type 10 has an invalid length. [ 344.831694][T16160] team0: Device veth1_macvtap failed to register rx_handler [ 345.251210][T16135] chnl_net:caif_netlink_parms(): no params data found [ 345.632250][T16135] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.641950][T16135] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.655893][T16135] bridge_slave_0: entered allmulticast mode [ 345.665512][T16135] bridge_slave_0: entered promiscuous mode [ 345.674196][T16135] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.681931][T16135] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.689699][T16135] bridge_slave_1: entered allmulticast mode [ 345.698582][T16135] bridge_slave_1: entered promiscuous mode [ 345.758898][T16135] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 345.782717][T16135] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 345.863737][T16135] team0: Port device team_slave_0 added [ 345.897225][T16135] team0: Port device team_slave_1 added [ 345.903321][T16197] netlink: 'syz.2.3142': attribute type 13 has an invalid length. [ 346.058992][T16135] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 346.075106][T16135] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.104717][T16135] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 346.150833][T16135] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 346.157831][T16135] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.184825][T16135] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 346.226447][T16210] gretap0: entered promiscuous mode [ 346.295442][T16135] hsr_slave_0: entered promiscuous mode [ 346.303089][T16135] hsr_slave_1: entered promiscuous mode [ 346.311092][T16135] debugfs: 'hsr0' already exists in 'hsr' [ 346.317066][T16135] Cannot create hsr debugfs directory [ 346.329435][ T5143] Bluetooth: hci4: command tx timeout [ 346.442754][T16221] netlink: 'syz.1.3150': attribute type 1 has an invalid length. [ 346.912958][T16135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 346.957073][T16248] sit0: Caught tx_queue_len zero misconfig [ 347.095925][T16135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.139335][T16265] lo: Caught tx_queue_len zero misconfig [ 347.147338][T16265] netlink: 'syz.2.3161': attribute type 1 has an invalid length. [ 347.253295][T16135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.406701][T16135] bond0: (slave netdevsim0): Releasing backup interface [ 347.446725][T16135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.735419][T16292] bond10: entered promiscuous mode [ 347.743160][T16292] bond10: entered allmulticast mode [ 347.748983][T16292] 8021q: adding VLAN 0 to HW filter on device bond10 [ 347.773841][T16135] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 347.824498][T16135] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 347.844241][T16135] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 347.882835][T16135] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 347.969138][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 347.977216][ C1] lec:lec_tx_timeout: lec0 [ 347.982233][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 348.051644][T16312] netlink: 'syz.3.3174': attribute type 1 has an invalid length. [ 348.239672][T16322] netlink: 'syz.2.3177': attribute type 1 has an invalid length. [ 348.262770][T16320] syzkaller1: entered promiscuous mode [ 348.268736][T16320] syzkaller1: entered allmulticast mode [ 348.302975][T16320] netlink: 'syz.1.3176': attribute type 1 has an invalid length. [ 348.374364][T16320] bond1 (unregistering): Released all slaves [ 348.410163][ T5143] Bluetooth: hci4: command tx timeout [ 348.678669][T16135] 8021q: adding VLAN 0 to HW filter on device bond0 [ 348.774871][T16135] 8021q: adding VLAN 0 to HW filter on device team0 [ 348.824458][ T3475] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.831759][ T3475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 348.852746][T16356] __nla_validate_parse: 18 callbacks suppressed [ 348.852764][T16356] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3183'. [ 348.896247][ T3475] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.903466][ T3475] bridge0: port 2(bridge_slave_1) entered forwarding state [ 349.174798][T16373] netlink: 'syz.1.3187': attribute type 1 has an invalid length. [ 349.271124][T16362] nbd2: detected capacity change from 0 to 63 [ 349.366484][ T5143] block nbd2: Receive control failed (result -104) [ 349.424356][T16349] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3182'. [ 349.441478][T16381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3188'. [ 349.460373][T16384] team0: Caught tx_queue_len zero misconfig [ 349.617414][T16135] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 349.661874][T16392] netlink: 'syz.4.3190': attribute type 3 has an invalid length. [ 349.700035][T16392] netlink: 'syz.4.3190': attribute type 1 has an invalid length. [ 349.731473][T16390] bond0: Error: Cannot enslave bond to itself. [ 349.802211][T16135] veth0_vlan: entered promiscuous mode [ 349.841412][T16135] veth1_vlan: entered promiscuous mode [ 349.917402][T16135] veth0_macvtap: entered promiscuous mode [ 349.946352][T16135] veth1_macvtap: entered promiscuous mode [ 350.005060][T16135] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 350.074271][T16135] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 350.108583][T16411] netlink: 'syz.3.3197': attribute type 1 has an invalid length. [ 350.194500][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.212411][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.252919][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.285796][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 350.353139][T16423] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3201'. [ 350.490098][ T5143] Bluetooth: hci4: command tx timeout [ 350.558228][T16432] delete_channel: no stack [ 350.584123][T16431] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3204'. [ 350.596447][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.610986][T16432] netlink: 'syz.2.3203': attribute type 13 has an invalid length. [ 350.627354][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.779871][T12463] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 350.816980][T12463] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 350.836752][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.856788][T16440] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3206'. [ 350.875791][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.900691][T12463] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 350.934027][T12463] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 350.984830][T16445] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3207'. [ 351.680636][T16469] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3214'. [ 351.824297][ T5840] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 351.835170][ T5840] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 351.843173][ T5840] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 351.859638][ T5840] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 351.871127][ T5840] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 352.031903][T16480] x_tables: duplicate underflow at hook 1 [ 352.058685][T16480] netlink: 96 bytes leftover after parsing attributes in process `syz.0.3218'. [ 352.095933][ T49] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.119332][ T49] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.284300][ T49] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.305375][ T49] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.338454][T16485] netlink: 'syz.1.3219': attribute type 3 has an invalid length. [ 352.346839][T16485] netlink: 666 bytes leftover after parsing attributes in process `syz.1.3219'. [ 352.360023][T16485] netlink: 'syz.1.3219': attribute type 1 has an invalid length. [ 352.421996][ T49] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.454096][ T49] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.567525][ T49] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.578844][ T5143] Bluetooth: hci4: command tx timeout [ 352.579943][ T49] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.852252][T16507] sctp: [Deprecated]: syz.3.3225 (pid 16507) Use of int in max_burst socket option deprecated. [ 352.852252][T16507] Use struct sctp_assoc_value instead [ 352.989154][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 352.997252][ C1] lec:lec_tx_timeout: lec0 [ 353.002285][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 353.164680][T16525] netlink: 'syz.1.3231': attribute type 2 has an invalid length. [ 353.347789][ T49] bond9 (unregistering): (slave ip6gretap1): Releasing active interface [ 353.498941][ T49] bridge0 (unregistering): left allmulticast mode [ 353.786863][ T49] bond0 (unregistering): Released all slaves [ 353.798174][ T49] bond1 (unregistering): Released all slaves [ 353.813539][ T49] bond2 (unregistering): Released all slaves [ 353.829036][ T49] bond3 (unregistering): Released all slaves [ 353.844442][ T49] bond4 (unregistering): Released all slaves [ 353.871519][ T49] bond5 (unregistering): Released all slaves [ 353.888160][ T49] bond6 (unregistering): Released all slaves [ 353.911361][ T49] bond7 (unregistering): Released all slaves [ 353.926163][ T49] bond8 (unregistering): Released all slaves [ 353.939467][ T5143] Bluetooth: hci0: command tx timeout [ 353.953738][ T49] bond9 (unregistering): Released all slaves [ 353.977873][ T49] bond10 (unregistering): Released all slaves [ 354.076568][T16476] chnl_net:caif_netlink_parms(): no params data found [ 354.296129][ T49] tipc: Disabling bearer [ 354.359774][ T49] tipc: Disabling bearer [ 354.370540][T16558] IPVS: set_ctl: invalid protocol: 0 172.20.20.170:20000 [ 354.390655][T16559] __nla_validate_parse: 2 callbacks suppressed [ 354.390675][T16559] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3238'. [ 354.407853][ T49] tipc: Disabling bearer [ 354.470368][ T49] tipc: Left network mode [ 354.616479][T16476] bridge0: port 1(bridge_slave_0) entered blocking state [ 354.627530][T16476] bridge0: port 1(bridge_slave_0) entered disabled state [ 354.634963][T16476] bridge_slave_0: entered allmulticast mode [ 354.646633][T16476] bridge_slave_0: entered promiscuous mode [ 354.661951][T16476] bridge0: port 2(bridge_slave_1) entered blocking state [ 354.680397][T16476] bridge0: port 2(bridge_slave_1) entered disabled state [ 354.687661][T16476] bridge_slave_1: entered allmulticast mode [ 354.725381][T16476] bridge_slave_1: entered promiscuous mode [ 354.754102][T16574] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3240'. [ 354.760768][T16569] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 354.904543][T16573] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3242'. [ 354.928701][T16476] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 354.961455][T16476] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 355.171385][T16476] team0: Port device team_slave_0 added [ 355.196420][T16591] openvswitch: netlink: IP tunnel dst address not specified [ 355.232612][T16476] team0: Port device team_slave_1 added [ 355.366587][T16600] xt_cluster: node mask cannot exceed total number of nodes [ 355.402075][T16476] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 355.417415][T16476] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 355.448436][T16476] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 355.472865][T16476] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 355.480569][T16476] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 355.517748][T16476] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 355.710396][T16610] netlink: 'syz.1.3251': attribute type 29 has an invalid length. [ 355.728959][T16610] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3251'. [ 355.757951][T16476] hsr_slave_0: entered promiscuous mode [ 355.781512][T16615] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3253'. [ 355.802313][T16476] hsr_slave_1: entered promiscuous mode [ 355.808740][T16476] debugfs: 'hsr0' already exists in 'hsr' [ 355.831529][T16476] Cannot create hsr debugfs directory [ 356.011938][ T5143] Bluetooth: hci0: command tx timeout [ 356.115070][T16633] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 356.421358][ T49] hsr_slave_0: left promiscuous mode [ 356.456395][ T49] hsr_slave_1: left promiscuous mode [ 356.486925][ T49] veth1_vlan: left promiscuous mode [ 356.502129][T16648] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3262'. [ 356.503182][ T49] veth0_vlan: left promiscuous mode [ 356.723045][T16650] x_tables: duplicate underflow at hook 1 [ 357.025064][ T49] pimreg (unregistering): left allmulticast mode [ 357.457778][T16679] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3268'. [ 357.492230][T16648] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 357.507015][T16648] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 357.518651][T16648] bond0 (unregistering): Released all slaves [ 357.535595][T16658] syzkaller0: entered promiscuous mode [ 357.541361][T16658] syzkaller0: entered allmulticast mode [ 357.577694][T16675] vxlan1: entered promiscuous mode [ 357.583146][T16675] vxlan1: entered allmulticast mode [ 357.624683][T16681] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3269'. [ 357.970244][T16693] tipc: Failed to remove unknown binding: 66,0,0/0:1226242023/1226242024 [ 357.998030][T16693] tipc: Failed to remove unknown binding: 66,0,0/0:1226242023/1226242024 [ 358.010663][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 358.018697][ C1] lec:lec_tx_timeout: lec0 [ 358.023642][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 358.089297][ T5143] Bluetooth: hci0: command tx timeout [ 358.448339][ T49] IPVS: stop unused estimator thread 0... [ 358.556332][T16725] IPVS: length: 226 != 24 [ 358.573804][T16719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3279'. [ 358.946551][T16738] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3284'. [ 359.026573][T16739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 359.065030][T16476] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 359.106181][T16476] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 359.163785][T16476] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 359.175114][T16752] netlink: 'syz.3.3286': attribute type 20 has an invalid length. [ 359.193837][T16752] IPv6: NLM_F_CREATE should be specified when creating new route [ 359.226351][T16476] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 359.234216][T16751] netlink: 'syz.0.3287': attribute type 17 has an invalid length. [ 359.250358][T16752] netlink: 'syz.3.3286': attribute type 12 has an invalid length. [ 359.259329][T16752] netlink: 'syz.3.3286': attribute type 29 has an invalid length. [ 359.267184][T16752] netlink: 'syz.3.3286': attribute type 2 has an invalid length. [ 359.455032][T16769] __nla_validate_parse: 4 callbacks suppressed [ 359.455052][T16769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3291'. [ 359.491940][T16769] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3291'. [ 359.509748][T16769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3291'. [ 359.523707][T16775] syzkaller0: create flow: hash 285596532 index 1 [ 359.530065][T16769] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3291'. [ 359.566885][ T34] syzkaller0: tun_net_xmit 76 [ 359.578559][ T34] syzkaller0: tun_net_xmit 48 [ 359.589844][ T5890] syzkaller0: tun_net_xmit 76 [ 359.676839][T16783] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3294'. [ 359.732803][T16765] syzkaller0: delete flow: hash 285596532 index 1 [ 360.169555][ T5143] Bluetooth: hci0: command tx timeout [ 361.268988][T16790] mac80211_hwsim hwsim28 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 361.417655][T16476] 8021q: adding VLAN 0 to HW filter on device bond0 [ 361.481182][T16476] 8021q: adding VLAN 0 to HW filter on device team0 [ 361.495706][T14813] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.502904][T14813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 361.515563][T16845] Bluetooth: MGMT ver 1.23 [ 361.538183][T14813] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.545411][T14813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 361.595343][T16850] netlink: 207952 bytes leftover after parsing attributes in process `syz.0.3299'. [ 361.682942][T16476] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 362.024459][ T1703] block nbd0: Possible stuck request ffff8880264b8000: control (read@0,1024B). Runtime 90 seconds [ 362.035576][ T1703] block nbd0: Possible stuck request ffff8880264b8200: control (read@1024,1024B). Runtime 90 seconds [ 362.046639][ T1703] block nbd0: Possible stuck request ffff8880264b8400: control (read@2048,1024B). Runtime 90 seconds [ 362.057676][ T1703] block nbd0: Possible stuck request ffff8880264b8600: control (read@3072,1024B). Runtime 90 seconds [ 362.258386][T16476] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 362.409047][T16891] netlink: 'syz.3.3306': attribute type 6 has an invalid length. [ 362.472888][T16893] netlink: 'syz.3.3306': attribute type 6 has an invalid length. [ 362.780204][T16905] netlink: 'syz.1.3309': attribute type 1 has an invalid length. [ 362.788167][T16905] netlink: 236 bytes leftover after parsing attributes in process `syz.1.3309'. [ 362.800794][T16905] netlink: 'syz.1.3309': attribute type 13 has an invalid length. [ 362.859346][T16906] netlink: 'syz.1.3309': attribute type 16 has an invalid length. [ 363.040735][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 363.048261][T16910] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3310'. [ 363.048782][ C1] lec:lec_tx_timeout: lec0 [ 363.062872][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 363.931240][ T49] wlan1: Trigger new scan to find an IBSS to join [ 364.092376][T16906] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 364.147936][T16911] dvmrp6: entered allmulticast mode [ 364.296388][T16930] xt_HMARK: spi-set and port-set can't be combined [ 364.314213][T16930] tipc: Enabling of bearer rejected, media not registered [ 364.355702][T16931] netlink: 100 bytes leftover after parsing attributes in process `syz.3.3314'. [ 364.536466][T16476] veth0_vlan: entered promiscuous mode [ 364.555981][T16943] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3318'. [ 364.598999][T16944] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3318'. [ 364.607794][T16950] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3321'. [ 364.625388][T16476] veth1_vlan: entered promiscuous mode [ 364.640850][T16946] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3319'. [ 364.652294][T16946] bridge0: port 3(syz_tun) entered blocking state [ 364.658836][T16946] bridge0: port 3(syz_tun) entered disabled state [ 364.677653][T16946] syz_tun: entered allmulticast mode [ 364.695871][T16946] syz_tun: entered promiscuous mode [ 364.754397][T16950] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3321'. [ 364.822440][T16476] veth0_macvtap: entered promiscuous mode [ 364.846862][T16476] veth1_macvtap: entered promiscuous mode [ 364.856437][T16960] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3323'. [ 364.912024][T16965] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3323'. [ 364.939405][T16960] validate_nla: 1 callbacks suppressed [ 364.939423][T16960] netlink: 'syz.3.3323': attribute type 1 has an invalid length. [ 364.980616][T16960] netlink: 'syz.3.3323': attribute type 2 has an invalid length. [ 365.133061][T16965] netlink: 'syz.3.3323': attribute type 1 has an invalid length. [ 365.141094][T16965] netlink: 'syz.3.3323': attribute type 2 has an invalid length. [ 365.155956][T16972] syzkaller0: entered promiscuous mode [ 365.164483][T16972] syzkaller0: entered allmulticast mode [ 365.270592][T16476] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 365.287966][T16476] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 365.317296][T14813] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.330471][T14813] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.362575][T14813] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.400621][T14813] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 365.584514][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 365.605759][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 365.751811][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 365.771169][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 365.868862][ T1208] IPVS: starting estimator thread 0... [ 365.959328][T17002] IPVS: using max 27 ests per chain, 64800 per kthread [ 365.985708][T17005] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 366.002738][T17012] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 366.006365][T17005] netlink: 'syz.0.3334': attribute type 13 has an invalid length. [ 366.031418][T17010] netdevsim netdevsim1: Direct firmware load for .. failed with error -2 [ 366.042365][T17010] netdevsim netdevsim1: Falling back to sysfs fallback for: .. [ 366.051907][T17005] gretap0: refused to change device tx_queue_len [ 366.058676][T17005] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 366.153191][T17018] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3338'. [ 366.305348][T17024] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3340'. [ 366.357760][T17029] syzkaller0: entered promiscuous mode [ 366.364871][T17029] syzkaller0: entered allmulticast mode [ 366.377410][T17029] tipc: Started in network mode [ 366.383205][T17025] netlink: 'syz.3.3339': attribute type 1 has an invalid length. [ 366.386577][T17029] tipc: Node identity a2aa107ef71d, cluster identity 4711 [ 366.401142][T17029] tipc: Enabled bearer , priority 0 [ 366.413503][T17023] tipc: Resetting bearer [ 366.498701][T17023] tipc: Disabling bearer [ 366.575699][T17035] syzkaller0: entered allmulticast mode [ 366.760612][T17044] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3345'. [ 366.896878][ T34] wlan1: Trigger new scan to find an IBSS to join [ 367.240472][T17063] openvswitch: netlink: Multiple metadata blocks provided [ 367.480973][T17076] can: request_module (can-proto-0) failed. [ 367.593626][T17083] bridge0: port 3(veth0_to_bridge) entered blocking state [ 367.601297][T17083] bridge0: port 3(veth0_to_bridge) entered disabled state [ 367.615349][T17083] veth0_to_bridge: entered allmulticast mode [ 367.647708][T17083] veth0_to_bridge: entered promiscuous mode [ 367.657499][T17083] bridge0: adding interface veth0_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 367.689810][T17083] bridge0: port 3(veth0_to_bridge) entered blocking state [ 367.697165][T17083] bridge0: port 3(veth0_to_bridge) entered forwarding state [ 367.724525][T17085] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.077714][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 368.085912][ C1] lec:lec_tx_timeout: lec0 [ 368.091666][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 368.104982][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 368.118237][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 368.131458][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 368.144630][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 368.164403][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 368.474452][ T49] bridge_slave_1: left allmulticast mode [ 368.481812][ T49] bridge_slave_1: left promiscuous mode [ 368.490713][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.542287][ T49] bridge_slave_0: left allmulticast mode [ 368.548149][ T49] bridge_slave_0: left promiscuous mode [ 368.562350][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 369.100253][ C1] net_ratelimit: 1156 callbacks suppressed [ 369.100275][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 369.118631][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 369.131028][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 369.143915][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 369.157355][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 369.169725][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 369.182151][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 369.194649][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 369.208016][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 369.220394][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 369.686456][ T49] bond1 (unregistering): (slave bridge2): Releasing backup interface [ 369.697620][ T49] bridge2 (unregistering): left promiscuous mode [ 369.892930][ T49] bond5 (unregistering): (slave bridge4): Removing an active aggregator [ 369.904808][ T49] bond5 (unregistering): (slave bridge4): Releasing backup interface [ 369.914447][ T49] bond5 (unregistering): (slave bridge4): the permanent HWaddr of slave - ae:a5:18:99:41:7f - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 369.933537][ T1339] wlan1: Trigger new scan to find an IBSS to join [ 369.943385][ T49] bridge4 (unregistering): left promiscuous mode [ 369.950247][ T49] bridge4 (unregistering): left allmulticast mode [ 370.062692][ T49] bond5 (unregistering): (slave bridge5): Releasing backup interface [ 370.077479][ T49] bridge5 (unregistering): left promiscuous mode [ 370.086192][ T49] bridge5 (unregistering): left allmulticast mode [ 370.434049][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.460262][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 370.475426][ T49] bond0 (unregistering): Released all slaves [ 370.488338][ T49] bond1 (unregistering): Released all slaves [ 370.511717][ T49] bond2 (unregistering): Released all slaves [ 370.532835][ T49] bond3 (unregistering): Released all slaves [ 370.551557][ T49] bond4 (unregistering): Released all slaves [ 370.599644][ T49] bond5 (unregistering): Released all slaves [ 370.623809][ T49] bond6 (unregistering): Released all slaves [ 370.646149][ T49] bond7 (unregistering): Released all slaves [ 370.767023][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880584bc800: rx timeout, send abort [ 370.775624][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880584bc800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 370.962001][ T12] wlan1: Creating new IBSS network, BSSID 4e:d5:4c:1e:c4:0e [ 371.008483][ T49] : left promiscuous mode [ 371.295611][ T49] tipc: Left network mode [ 371.546622][T17173] __nla_validate_parse: 7 callbacks suppressed [ 371.546643][T17173] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3381'. [ 371.949328][T17189] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3387'. [ 371.990628][T17189] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3387'. [ 372.056551][T17189] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3387'. [ 372.107429][T17189] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3387'. [ 372.146323][T17199] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3390'. [ 372.218946][T17203] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3389'. [ 372.730473][T17217] atomic_op ffff88807e20b998 conn xmit_atomic 0000000000000000 [ 372.783732][T17221] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3395'. [ 373.854123][T17250] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3402'. [ 373.941446][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5770 ms [ 373.949537][ C1] lec:lec_tx_timeout: lec0 [ 373.967270][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 374.109471][ C1] net_ratelimit: 7949 callbacks suppressed [ 374.109491][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 374.127843][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 374.141335][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 374.158191][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 374.170749][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 374.183284][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 374.196849][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 374.209357][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 374.221911][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 374.234365][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 374.356193][T17252] gre1: entered promiscuous mode [ 374.389261][T17252] gre1: entered allmulticast mode [ 374.398360][T17259] netlink: 'syz.2.3405': attribute type 1 has an invalid length. [ 374.470093][T17259] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3405'. [ 374.796791][T17270] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 375.047789][ T49] hsr_slave_0: left promiscuous mode [ 375.082542][ T49] hsr_slave_1: left promiscuous mode [ 375.090285][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 375.102231][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 376.897333][T17319] __nla_validate_parse: 2 callbacks suppressed [ 376.897352][T17319] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3419'. [ 376.979042][T17318] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3419'. [ 377.303970][ T49] IPVS: stop unused estimator thread 0... [ 377.685742][T17340] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3425'. [ 378.314192][T17337] netlink: 'syz.1.3423': attribute type 1 has an invalid length. [ 378.901884][T17378] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3431'. [ 378.987171][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 378.995278][ C1] lec:lec_tx_timeout: lec0 [ 379.009021][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 379.119253][ C1] net_ratelimit: 6406 callbacks suppressed [ 379.119273][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 379.137759][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 379.150608][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 379.163769][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 379.176167][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 379.188630][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 379.201053][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 379.213481][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 379.225874][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 379.238304][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 379.292231][ T1703] block nbd2: Possible stuck request ffff8880535d0000: control (read@0,1024B). Runtime 30 seconds [ 379.303048][ T1703] block nbd2: Possible stuck request ffff8880535d0200: control (read@1024,1024B). Runtime 30 seconds [ 379.314043][ T1703] block nbd2: Possible stuck request ffff8880535d0400: control (read@2048,1024B). Runtime 30 seconds [ 379.325135][ T1703] block nbd2: Possible stuck request ffff8880535d0600: control (read@3072,1024B). Runtime 30 seconds [ 382.161239][T17378] vlan0: entered allmulticast mode [ 382.181833][T17378] gretap0: entered allmulticast mode [ 382.454552][T17394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3434'. [ 382.696365][T17403] netlink: 'syz.1.3436': attribute type 10 has an invalid length. [ 382.725780][ T1208] hid-generic 0005:0C49:1012.0001: unknown main item tag 0x1 [ 382.766940][T17403] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3436'. [ 382.799309][ T1208] hid-generic 0005:0C49:1012.0001: ignoring exceeding usage max [ 382.830712][ T1208] hid-generic 0005:0C49:1012.0001: unknown main item tag 0x4 [ 382.851967][ T1208] hid-generic 0005:0C49:1012.0001: unknown main item tag 0x5 [ 382.871722][ T1208] hid-generic 0005:0C49:1012.0001: reserved main item tag 0xd [ 382.894162][ T1208] hid-generic 0005:0C49:1012.0001: item fetching failed at offset 31/106 [ 382.926225][ T1208] hid-generic 0005:0C49:1012.0001: probe with driver hid-generic failed with error -22 [ 383.501943][T17422] syzkaller0: entered promiscuous mode [ 383.522565][T17422] syzkaller0: entered allmulticast mode [ 383.678487][T17437] xt_TCPMSS: Only works on TCP SYN packets [ 383.825939][T17409] netlink: 'syz.1.3436': attribute type 10 has an invalid length. [ 383.881459][T17409] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3436'. [ 384.031978][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 384.040081][ C1] lec:lec_tx_timeout: lec0 [ 384.060504][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 384.121894][T17445] FAULT_INJECTION: forcing a failure. [ 384.121894][T17445] name failslab, interval 1, probability 0, space 0, times 0 [ 384.129804][ C1] net_ratelimit: 8897 callbacks suppressed [ 384.129855][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 384.153002][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 384.165541][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 384.178005][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 384.190465][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 384.203069][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 384.216475][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 384.219675][T17445] CPU: 0 UID: 0 PID: 17445 Comm: syz.2.3446 Not tainted syzkaller #0 PREEMPT(full) [ 384.219743][T17445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 384.219786][T17445] Call Trace: [ 384.219808][T17445] [ 384.219831][T17445] dump_stack_lvl+0xe8/0x150 [ 384.219918][T17445] should_fail_ex+0x412/0x560 [ 384.220017][T17445] should_failslab+0xa8/0x100 [ 384.220103][T17445] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 384.220172][T17445] ? __alloc_skb+0x1d0/0x7d0 [ 384.220234][T17445] ? __local_bh_enable_ip+0xd0/0x130 [ 384.220310][T17445] __alloc_skb+0x1d0/0x7d0 [ 384.220390][T17445] alloc_skb_with_frags+0xca/0x890 [ 384.220473][T17445] ? __lock_acquire+0x6b5/0x2cf0 [ 384.220544][T17445] sock_alloc_send_pskb+0x878/0x990 [ 384.220685][T17445] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 384.220793][T17445] ? __local_bh_enable_ip+0xd0/0x130 [ 384.220890][T17445] j1939_sk_sendmsg+0x6da/0x1380 [ 384.220972][T17445] ? aa_sk_perm+0x82d/0x960 [ 384.221090][T17445] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 384.221163][T17445] ? aa_sock_msg_perm+0xf1/0x1b0 [ 384.221240][T17445] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 384.221344][T17445] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 384.221401][T17445] ____sys_sendmsg+0xa68/0xad0 [ 384.221474][T17445] ? __might_fault+0xaf/0x130 [ 384.221562][T17445] ? __pfx_____sys_sendmsg+0x10/0x10 [ 384.221658][T17445] ? import_iovec+0x73/0xa0 [ 384.221724][T17445] ___sys_sendmsg+0x2a5/0x360 [ 384.221795][T17445] ? __lock_acquire+0x6b5/0x2cf0 [ 384.221870][T17445] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.221957][T17445] ? kstrtouint+0x6e/0xe0 [ 384.222081][T17445] ? __fget_files+0x2a/0x420 [ 384.222132][T17445] ? __fget_files+0x3a0/0x420 [ 384.222243][T17445] __sys_sendmmsg+0x27c/0x4e0 [ 384.222352][T17445] ? __pfx___sys_sendmmsg+0x10/0x10 [ 384.222417][T17445] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 384.222544][T17445] ? ksys_write+0x242/0x270 [ 384.222620][T17445] ? __pfx_ksys_write+0x10/0x10 [ 384.222706][T17445] __x64_sys_sendmmsg+0xa0/0xc0 [ 384.222789][T17445] do_syscall_64+0x14d/0xf80 [ 384.222856][T17445] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.222917][T17445] ? trace_irq_disable+0x37/0x100 [ 384.222972][T17445] ? clear_bhb_loop+0x40/0x90 [ 384.223043][T17445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.223095][T17445] RIP: 0033:0x7fbd9e79c629 [ 384.223146][T17445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.223190][T17445] RSP: 002b:00007fbd9f71f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 384.223245][T17445] RAX: ffffffffffffffda RBX: 00007fbd9ea15fa0 RCX: 00007fbd9e79c629 [ 384.223289][T17445] RDX: 0000000000000001 RSI: 0000200000002a00 RDI: 0000000000000003 [ 384.223328][T17445] RBP: 00007fbd9f71f090 R08: 0000000000000000 R09: 0000000000000000 [ 384.223361][T17445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 384.223393][T17445] R13: 00007fbd9ea16038 R14: 00007fbd9ea15fa0 R15: 00007ffe73140418 [ 384.223477][T17445] [ 384.527299][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 384.540743][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 384.553271][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 384.662029][T17455] netlink: 'syz.0.3449': attribute type 1 has an invalid length. [ 386.077537][T17477] netlink: 11562 bytes leftover after parsing attributes in process `syz.4.3451'. [ 386.183801][T17501] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3453'. [ 386.198099][T17502] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3452'. [ 387.423145][T17456] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 387.774396][T17532] netlink: 294 bytes leftover after parsing attributes in process `syz.3.3461'. [ 388.024940][T17542] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3463'. [ 388.243970][T17546] veth3: entered promiscuous mode [ 388.261584][T17549] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3469'. [ 388.272511][T17549] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3469'. [ 388.480451][T17555] FAULT_INJECTION: forcing a failure. [ 388.480451][T17555] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 388.549666][T17559] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3473'. [ 388.569558][T17560] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3470'. [ 388.579385][T17555] CPU: 0 UID: 0 PID: 17555 Comm: syz.4.3472 Not tainted syzkaller #0 PREEMPT(full) [ 388.579411][T17555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 388.579424][T17555] Call Trace: [ 388.579433][T17555] [ 388.579442][T17555] dump_stack_lvl+0xe8/0x150 [ 388.579475][T17555] should_fail_ex+0x412/0x560 [ 388.579511][T17555] _copy_from_iter+0x3b0/0x1670 [ 388.579548][T17555] ? rcu_is_watching+0x15/0xb0 [ 388.579575][T17555] ? skb_ext_add+0x148/0x8f0 [ 388.579601][T17555] ? __pfx__copy_from_iter+0x10/0x10 [ 388.579637][T17555] ? skb_ext_add+0x3b3/0x8f0 [ 388.579663][T17555] ? skb_put+0x11b/0x210 [ 388.579691][T17555] j1939_sk_sendmsg+0x7cb/0x1380 [ 388.579739][T17555] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 388.579764][T17555] ? aa_sock_msg_perm+0xf1/0x1b0 [ 388.579795][T17555] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 388.579826][T17555] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 388.579850][T17555] ____sys_sendmsg+0xa68/0xad0 [ 388.579875][T17555] ? __might_fault+0xaf/0x130 [ 388.579907][T17555] ? __pfx_____sys_sendmsg+0x10/0x10 [ 388.579944][T17555] ? import_iovec+0x73/0xa0 [ 388.579969][T17555] ___sys_sendmsg+0x2a5/0x360 [ 388.579994][T17555] ? __lock_acquire+0x6b5/0x2cf0 [ 388.580021][T17555] ? __pfx____sys_sendmsg+0x10/0x10 [ 388.580052][T17555] ? kstrtouint+0x6e/0xe0 [ 388.580117][T17555] ? __fget_files+0x2a/0x420 [ 388.580136][T17555] ? __fget_files+0x3a0/0x420 [ 388.580168][T17555] __sys_sendmmsg+0x27c/0x4e0 [ 388.580201][T17555] ? __pfx___sys_sendmmsg+0x10/0x10 [ 388.580226][T17555] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 388.580283][T17555] ? ksys_write+0x242/0x270 [ 388.580311][T17555] ? __pfx_ksys_write+0x10/0x10 [ 388.580343][T17555] __x64_sys_sendmmsg+0xa0/0xc0 [ 388.580373][T17555] do_syscall_64+0x14d/0xf80 [ 388.580399][T17555] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.580419][T17555] ? trace_irq_disable+0x37/0x100 [ 388.580441][T17555] ? clear_bhb_loop+0x40/0x90 [ 388.580467][T17555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.580486][T17555] RIP: 0033:0x7fafa199c629 [ 388.580505][T17555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.580523][T17555] RSP: 002b:00007fafa292e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 388.580545][T17555] RAX: ffffffffffffffda RBX: 00007fafa1c15fa0 RCX: 00007fafa199c629 [ 388.580560][T17555] RDX: 0000000000000001 RSI: 0000200000002a00 RDI: 0000000000000003 [ 388.580573][T17555] RBP: 00007fafa292e090 R08: 0000000000000000 R09: 0000000000000000 [ 388.580586][T17555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 388.580598][T17555] R13: 00007fafa1c16038 R14: 00007fafa1c15fa0 R15: 00007ffc0512fd68 [ 388.580633][T17555] [ 389.071996][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 389.080138][ C1] lec:lec_tx_timeout: lec0 [ 389.098643][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 389.139402][ C1] net_ratelimit: 7276 callbacks suppressed [ 389.139422][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 389.157827][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 389.170340][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 389.183713][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 389.195856][T17565] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3473'. [ 389.198851][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 389.217237][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 389.230680][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 389.243208][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 389.255691][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 389.268143][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 389.637513][T17576] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3475'. [ 389.650761][T17558] lec:lec_atm_close: lec0: Shut down! [ 389.671786][T17570] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 389.726510][T17570] tipc: Failed to obtain node identity [ 389.765661][T17570] tipc: Enabling of bearer rejected, failed to enable media [ 390.101095][T17590] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3477'. [ 390.139311][T17590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3477'. [ 390.734101][T17604] netlink: 'syz.4.3484': attribute type 1 has an invalid length. [ 392.099615][ T1703] block nbd0: Possible stuck request ffff8880264b8000: control (read@0,1024B). Runtime 120 seconds [ 392.112829][ T1703] block nbd0: Possible stuck request ffff8880264b8200: control (read@1024,1024B). Runtime 120 seconds [ 392.124181][ T1703] block nbd0: Possible stuck request ffff8880264b8400: control (read@2048,1024B). Runtime 120 seconds [ 392.135395][ T1703] block nbd0: Possible stuck request ffff8880264b8600: control (read@3072,1024B). Runtime 120 seconds [ 392.262054][T17661] netlink: 'syz.1.3497': attribute type 10 has an invalid length. [ 392.315688][T17661] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 392.817047][T17679] __nla_validate_parse: 4 callbacks suppressed [ 392.817068][T17679] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3502'. [ 394.151089][ C1] net_ratelimit: 7069 callbacks suppressed [ 394.151110][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 394.169408][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 394.181894][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 394.194419][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 394.206834][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 394.219379][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 394.231783][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 394.244241][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 394.257546][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 394.269969][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 394.544059][T17697] 8021q: VLANs not supported on ip_vti0 [ 394.682274][T17728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3508'. [ 394.893736][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5250 ms [ 394.901808][ C1] lec:lec_tx_timeout: lec0 [ 394.916851][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 395.043974][ T5487] veth0_macvtap: left promiscuous mode [ 395.318813][T17728] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 395.453696][T17737] netlink: 'syz.0.3510': attribute type 1 has an invalid length. [ 395.502593][T17728] netlink: 184 bytes leftover after parsing attributes in process `syz.1.3508'. [ 395.524110][T17740] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3510'. [ 395.741391][T17737] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 395.748770][T17740] vxcan2: entered promiscuous mode [ 395.834366][T17740] vxcan2: entered allmulticast mode [ 395.925914][T17748] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 395.926734][T17749] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 396.545977][T17775] netlink: 'syz.3.3515': attribute type 142 has an invalid length. [ 396.835918][T17775] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3515'. [ 398.072136][T17810] netlink: 'syz.0.3522': attribute type 1 has an invalid length. [ 398.235619][T17814] netlink: 'syz.0.3522': attribute type 1 has an invalid length. [ 398.246175][T17814] netlink: 'syz.0.3522': attribute type 2 has an invalid length. [ 398.623857][T17810] 8021q: adding VLAN 0 to HW filter on device bond2 [ 398.787496][T17813] bond2: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 398.912243][T17827] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3525'. [ 399.159367][ C1] net_ratelimit: 7497 callbacks suppressed [ 399.159397][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 399.178420][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 399.190781][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 399.203185][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 399.215649][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 399.229623][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 399.242123][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 399.254778][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 399.267244][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:8e:c7:d6:50:f8:72, vlan:0) [ 399.281227][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 399.295147][T17836] netlink: 207952 bytes leftover after parsing attributes in process `syz.0.3527'. [ 399.444189][T17841] netlink: 'syz.1.3529': attribute type 1 has an invalid length. [ 399.665321][T17848] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3530'. [ 399.763509][T17841] 8021q: adding VLAN 0 to HW filter on device bond3 [ 399.936135][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 399.944234][ C1] lec:lec_tx_timeout: lec0 [ 399.960950][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 400.336280][T17873] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3535'. [ 400.427243][T17873] 0·: renamed from hsr_slave_1 (while UP) [ 400.453558][T17873] 0·: entered allmulticast mode [ 400.669297][T17878] netlink: 'syz.1.3536': attribute type 8 has an invalid length. [ 400.677261][T17877] netlink: 'syz.1.3536': attribute type 8 has an invalid length. [ 400.734130][T17877] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3536'. [ 400.819315][T17878] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3536'. [ 400.850409][T17877] bond0: entered promiscuous mode [ 400.883231][T17877] bond_slave_0: entered promiscuous mode [ 400.913085][T17877] bond_slave_1: entered promiscuous mode [ 400.951248][T17877] ip6gretap0: entered promiscuous mode [ 400.993287][T17877] hsr1: entered promiscuous mode [ 401.326954][T17887] syzkaller1: entered promiscuous mode [ 401.341843][T17887] syzkaller1: entered allmulticast mode [ 402.477348][T17928] IPv6: NLM_F_CREATE should be specified when creating new route [ 402.973974][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 403.382474][T17958] netlink: 256 bytes leftover after parsing attributes in process `syz.1.3555'. [ 403.392004][T17918] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 403.581712][T17961] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3556'. [ 403.775317][T17961] bridge0: port 3(veth0_to_bridge) entered disabled state [ 403.782863][T17961] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.791038][T17961] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.922631][T17973] ip6tnl0: Caught tx_queue_len zero misconfig [ 404.107015][T17991] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3558'. [ 404.240026][T17995] netlink: 516 bytes leftover after parsing attributes in process `syz.4.3564'. [ 404.462709][T18012] sctp: [Deprecated]: syz.1.3565 (pid 18012) Use of int in maxseg socket option. [ 404.462709][T18012] Use struct sctp_assoc_value instead [ 404.501969][T18012] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3565'. [ 404.727193][T17972] delete_channel: no stack [ 404.969221][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 404.977447][ C1] lec:lec_tx_timeout: lec0 [ 404.982535][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 405.083918][T18045] netlink: 6040 bytes leftover after parsing attributes in process `syz.0.3576'. [ 405.118434][T18045] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3576'. [ 405.162017][T18050] syz.1.3578 uses old SIOCAX25GETINFO [ 405.436425][T18061] netlink: 'syz.1.3581': attribute type 9 has an invalid length. [ 405.563491][T18071] ip6t_rpfilter: unknown options [ 405.887379][T18087] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3588'. [ 405.996231][T18090] tipc: Enabled bearer , priority 0 [ 406.133137][T18087] syzkaller0: entered promiscuous mode [ 406.138803][T18087] syzkaller0: entered allmulticast mode [ 406.153463][T18087] tipc: Resetting bearer [ 406.227406][T18086] tipc: Resetting bearer [ 406.268422][T18107] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3596'. [ 406.319318][T18107] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3596'. [ 406.479842][T18113] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3598'. [ 407.108787][T18133] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3599'. [ 407.685621][T18086] tipc: Disabling bearer [ 407.770187][ T795] tipc: Node number set to 1438060670 [ 407.831121][T18139] net_ratelimit: 6397 callbacks suppressed [ 407.831142][T18139] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 408.063971][T18154] netlink: 'syz.1.3603': attribute type 5 has an invalid length. [ 408.108739][T18143] bond2: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 408.146129][T18143] bond2 (unregistering): Released all slaves [ 408.249396][T18159] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 408.333100][ T5143] Bluetooth: hci0: command tx timeout [ 408.827753][T18186] : entered promiscuous mode [ 408.934762][T18193] openvswitch: netlink: IP tunnel dst address not specified [ 408.957254][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 408.965429][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 409.011149][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 409.370914][ T1703] block nbd2: Possible stuck request ffff8880535d0000: control (read@0,1024B). Runtime 60 seconds [ 409.382771][ T1703] block nbd2: Possible stuck request ffff8880535d0200: control (read@1024,1024B). Runtime 60 seconds [ 409.394313][ T1703] block nbd2: Possible stuck request ffff8880535d0400: control (read@2048,1024B). Runtime 60 seconds [ 409.406569][ T1703] block nbd2: Possible stuck request ffff8880535d0600: control (read@3072,1024B). Runtime 60 seconds [ 409.648689][T18210] bond0: Caught tx_queue_len zero misconfig [ 409.698105][T18188] infiniband syz2: set down [ 409.705374][T18211] __nla_validate_parse: 6 callbacks suppressed [ 409.705394][T18211] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3621'. [ 409.722288][T18188] infiniband syz2: added ip6_vti0 [ 409.730022][T18188] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 409.735580][T18188] infiniband syz2: Couldn't open port 1 [ 409.797433][T18188] RDS/IB: syz2: added [ 409.808351][T18188] smc: adding ib device syz2 with port count 1 [ 409.815411][T18188] smc: ib device syz2 port 1 has pnetid SYZ1 (user defined) [ 409.866090][ T29] ip6_vti0 speed is unknown, defaulting to 1000 [ 409.882485][ T860] ip6_vti0 speed is unknown, defaulting to 1000 [ 409.891899][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 409.989112][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 409.997195][ C1] lec:lec_tx_timeout: lec0 [ 410.002040][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 410.114997][T18225] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3626'. [ 410.191316][T18228] netlink: 'syz.0.3628': attribute type 21 has an invalid length. [ 410.215314][T18228] IPv6: NLM_F_CREATE should be specified when creating new route [ 410.233260][T18228] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 410.240591][T18228] IPv6: NLM_F_CREATE should be set when creating new route [ 410.247880][T18228] IPv6: NLM_F_CREATE should be set when creating new route [ 410.255182][T18228] IPv6: NLM_F_CREATE should be set when creating new route [ 410.371543][T18235] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 410.422779][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 410.472066][T18242] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3632'. [ 410.903774][T18265] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3638'. [ 410.948503][T18265] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3638'. [ 410.971825][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 411.038215][T18276] netdevsim netdevsim3: Direct firmware load for .. failed with error -2 [ 411.047939][T18276] netdevsim netdevsim3: Falling back to sysfs fallback for: .. [ 411.068626][T18278] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3640'. [ 411.077843][T18278] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3640'. [ 411.088017][T18278] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3640'. [ 411.097775][T18278] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3640'. [ 411.295274][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 411.411823][T18249] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 411.425721][T18249] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 411.495774][T18249] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 411.512068][T18249] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 411.622251][T18249] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 411.628234][T18249] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 411.681666][T18297] netlink: 'syz.1.3644': attribute type 4 has an invalid length. [ 411.803139][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 411.803705][T18249] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 411.817308][T18301] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.3645'. [ 411.826664][T18249] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 411.850002][T18301] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 411.911728][T18249] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 411.921093][T18249] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 412.005964][T18301] bond4: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 412.051663][T18301] bond4 (unregistering): Released all slaves [ 412.335509][T18188] ip6_vti0 speed is unknown, defaulting to 1000 [ 412.384470][T18318] xt_hashlimit: size too large, truncated to 1048576 [ 412.822227][T18344] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 412.935075][T18344] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 413.321408][T18369] netlink: 'syz.0.3661': attribute type 1 has an invalid length. [ 413.398618][T18369] bond3: entered promiscuous mode [ 413.411602][T18369] bond3: entered allmulticast mode [ 413.422938][T18369] 8021q: adding VLAN 0 to HW filter on device bond3 [ 413.441732][T18375] bridge0: port 2(bridge_slave_1) entered disabled state [ 413.449527][T18375] bridge0: port 1(bridge_slave_0) entered disabled state [ 413.515987][T18377] macvlan2: entered promiscuous mode [ 413.540632][T18377] macvlan2: entered allmulticast mode [ 413.548572][T18377] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 414.127917][T18423] syzkaller0: entered promiscuous mode [ 414.150564][T18423] syzkaller0: entered allmulticast mode [ 414.314993][T18435] netlink: 'syz.2.3674': attribute type 1 has an invalid length. [ 414.323058][T18435] netlink: 'syz.2.3674': attribute type 3 has an invalid length. [ 414.348437][T18435] NCSI netlink: No device for ifindex 813332851 [ 414.441259][T18440] netlink: 'syz.4.3675': attribute type 1 has an invalid length. [ 414.538007][T18444] netdevsim netdevsim2: Direct firmware load for .. failed with error -2 [ 414.553519][T18444] netdevsim netdevsim2: Falling back to sysfs fallback for: .. [ 414.738732][T18456] __nla_validate_parse: 13 callbacks suppressed [ 414.738753][T18456] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3680'. [ 414.790825][T18455] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3679'. [ 414.813791][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805847f000: rx timeout, send abort [ 414.822576][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805847f000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 414.849957][T18455] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3679'. [ 414.984878][T18465] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3681'. [ 415.009140][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 415.009493][T18465] netlink: 35 bytes leftover after parsing attributes in process `syz.0.3681'. [ 415.017206][ C1] lec:lec_tx_timeout: lec0 [ 415.017606][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 415.059749][T18469] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3682'. [ 415.089385][T18469] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3682'. [ 415.091043][T18465] netlink: 'syz.0.3681': attribute type 5 has an invalid length. [ 415.109022][T18465] netlink: 'syz.0.3681': attribute type 6 has an invalid length. [ 415.117166][T18465] netlink: 35 bytes leftover after parsing attributes in process `syz.0.3681'. [ 415.342142][T18483] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3685'. [ 415.910103][T18520] netlink: 'syz.1.3697': attribute type 1 has an invalid length. [ 415.996037][T18531] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3698'. [ 416.442072][T18562] netlink: 'syz.3.3708': attribute type 1 has an invalid length. [ 416.827904][T18582] xt_TPROXY: Can be used only with -p tcp or -p udp [ 417.037566][T18590] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 417.081551][T18590] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 417.127029][T18593] erspan0: entered promiscuous mode [ 417.290379][T18600] netlink: 'syz.3.3720': attribute type 33 has an invalid length. [ 417.469003][ T12] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.489057][ T12] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.519199][ T12] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.545755][ T12] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 417.605678][T18618] netlink: 'syz.0.3726': attribute type 1 has an invalid length. [ 417.677142][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a174400: rx timeout, send abort [ 417.685638][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805a174400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 417.763253][T18618] 8021q: adding VLAN 0 to HW filter on device bond4 [ 417.771843][T18625] bond4: up delay (35976) is not a multiple of miimon (100), value rounded to 35900 ms [ 417.917001][T18618] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 417.957895][T12463] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI [ 417.969932][T12463] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 417.978378][T12463] CPU: 1 UID: 0 PID: 12463 Comm: kworker/u8:11 Not tainted syzkaller #0 PREEMPT(full) [ 417.988039][T12463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 417.998117][T12463] Workqueue: krdsd rds_tcp_accept_worker [ 418.003796][T12463] RIP: 0010:rds_tcp_accept_one+0xa5b/0xd70 [ 418.009648][T12463] Code: 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 33 2d 46 f7 48 8b 1b 48 83 c3 12 49 89 de 49 c1 ee 03 <43> 0f b6 04 2e 84 c0 0f 85 53 02 00 00 44 0f b6 2b bf 08 00 00 00 [ 418.029283][T12463] RSP: 0018:ffffc9001c477960 EFLAGS: 00010202 [ 418.035378][T12463] RAX: 1ffff1100b02839b RBX: 0000000000000012 RCX: 0000000000000000 [ 418.043365][T12463] RDX: 0000000000000006 RSI: ffffffff8dee2767 RDI: 00000000ffffffff [ 418.051352][T12463] RBP: ffffc9001c477ad8 R08: ffffffff90109177 R09: 1ffffffff202122e [ 418.059345][T12463] R10: dffffc0000000000 R11: fffffbfff202122f R12: ffff888055378918 [ 418.067345][T12463] R13: dffffc0000000000 R14: 0000000000000002 R15: 1ffff9200388ef34 [ 418.075344][T12463] FS: 0000000000000000(0000) GS:ffff8881255ae000(0000) knlGS:0000000000000000 [ 418.084291][T12463] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 418.090888][T12463] CR2: 00007fbd9ea0de00 CR3: 000000003081c000 CR4: 00000000003526f0 [ 418.098879][T12463] Call Trace: [ 418.102185][T12463] [ 418.105141][T12463] ? __pfx_rds_tcp_accept_one+0x10/0x10 [ 418.110714][T12463] ? do_raw_spin_lock+0x12b/0x2f0 [ 418.115758][T12463] ? lock_acquire+0x106/0x330 [ 418.120451][T12463] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 418.125857][T12463] ? process_scheduled_works+0xa0f/0x17a0 [ 418.131591][T12463] ? process_scheduled_works+0xa0f/0x17a0 [ 418.137333][T12463] rds_tcp_accept_worker+0x1d/0x70 [ 418.142467][T12463] ? process_scheduled_works+0xa0f/0x17a0 [ 418.148206][T12463] process_scheduled_works+0xaec/0x17a0 [ 418.153793][T12463] ? __pfx_process_scheduled_works+0x10/0x10 [ 418.159793][T12463] ? assign_work+0x3d5/0x5e0 [ 418.164400][T12463] worker_thread+0xa50/0xfc0 [ 418.169019][T12463] kthread+0x388/0x470 [ 418.173125][T12463] ? __pfx_worker_thread+0x10/0x10 [ 418.178279][T12463] ? __pfx_kthread+0x10/0x10 [ 418.182903][T12463] ret_from_fork+0x51e/0xb90 [ 418.187531][T12463] ? __pfx_ret_from_fork+0x10/0x10 [ 418.192662][T12463] ? __switch_to+0xc7d/0x1400 [ 418.197402][T12463] ? __pfx_kthread+0x10/0x10 [ 418.202022][T12463] ret_from_fork_asm+0x1a/0x30 [ 418.206819][T12463] [ 418.209898][T12463] Modules linked in: [ 418.214242][T12463] ---[ end trace 0000000000000000 ]--- [ 418.243483][T12463] RIP: 0010:rds_tcp_accept_one+0xa5b/0xd70 [ 418.249492][ T3503] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 418.249934][T12463] Code: 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 33 2d 46 f7 48 8b 1b 48 83 c3 12 49 89 de 49 c1 ee 03 <43> 0f b6 04 2e 84 c0 0f 85 53 02 00 00 44 0f b6 2b bf 08 00 00 00 [ 418.286416][T12463] RSP: 0018:ffffc9001c477960 EFLAGS: 00010202 [ 418.292613][T12463] RAX: 1ffff1100b02839b RBX: 0000000000000012 RCX: 0000000000000000 [ 418.300693][T12463] RDX: 0000000000000006 RSI: ffffffff8dee2767 RDI: 00000000ffffffff [ 418.308826][T12463] RBP: ffffc9001c477ad8 R08: ffffffff90109177 R09: 1ffffffff202122e [ 418.316937][T12463] R10: dffffc0000000000 R11: fffffbfff202122f R12: ffff888055378918 [ 418.324974][T12463] R13: dffffc0000000000 R14: 0000000000000002 R15: 1ffff9200388ef34 [ 418.334471][T12463] FS: 0000000000000000(0000) GS:ffff8881255ae000(0000) knlGS:0000000000000000 [ 418.347112][T12463] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 418.353787][T12463] CR2: 00007f6160de82f8 CR3: 000000001ab1a000 CR4: 00000000003526f0 [ 418.361862][ T1339] bond4: (slave ip6gretap1): link status up, enabling it in 0 ms [ 418.369775][T12463] Kernel panic - not syncing: Fatal exception [ 418.376459][T12463] Kernel Offset: disabled [ 418.380877][T12463] Rebooting in 86400 seconds..