last executing test programs:

1.901164073s ago: executing program 0 (id=2141):
r0 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newtaction={0x5c, 0x31, 0x53b, 0x0, 0x0, {0x9}, [{0x48, 0x1, [@m_sample={0x44, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x15, 0x6, "fc51c6dddb3669f174c19dd93c9df2e162"}, {0xc}, {0xc, 0x4, {0x0, 0x2}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x44}, 0x0)

1.450989954s ago: executing program 2 (id=2146):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000002b0009ef"], 0x14}}, 0x84)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x5, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x2e}, @call={0x85, 0x0, 0x0, 0x23}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="b9ff03316844268cb89e14f00800", 0x0, 0x9, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
r3 = epoll_create1(0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r4, 0x29, 0x46, &(0x7f00000000c0), 0x4)
epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000001400)={0xe0000017})
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0)
epoll_wait(r3, &(0x7f0000001940)=[{}], 0x1, 0x0)

900.8565ms ago: executing program 0 (id=2147):
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000003000)={0x1c, 0x52, 0x1, 0x70bd2a, 0x0, {0xa}, [@generic="76ae529d48"]}, 0x1c}}, 0x20008040)

900.590605ms ago: executing program 2 (id=2148):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x3, 0x0, 0x7}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}}, 0x0)

869.526161ms ago: executing program 0 (id=2149):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
unshare(0x22020400)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=[@ip_tos_int={{0x14}}, @ip_retopts={{0x10, 0x110, 0xb}}], 0x28}, 0x0)
unshare(0x24020400)
sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0x23}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}}, 0x0)

860.32442ms ago: executing program 2 (id=2151):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x3100, 0x11, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

767.609135ms ago: executing program 0 (id=2153):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000b00), r0)
sendmsg$NLBL_MGMT_C_LISTDEF(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000b40)={0x14, r1, 0xb1b2ac2cb93dc4b3, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x8090}, 0x20000000)

767.346899ms ago: executing program 2 (id=2154):
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x3f}]}}}]}, 0x40}}, 0x0)
sendto$packet(r0, &(0x7f0000000000)='1', 0x26, 0x0, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @local}, 0x14)

708.485511ms ago: executing program 0 (id=2155):
r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
connect$llc(r0, &(0x7f00000004c0)={0x1a, 0x302, 0x4a, 0xe3, 0xb, 0x24, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}}, 0x10)

706.893908ms ago: executing program 2 (id=2157):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b7020000b0ffffffbfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d64050000000000650404000100010104040000f1000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x57)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x702, 0xe, 0x0, &(0x7f0000000040)="c674ed63e46033c470d8d400eb00", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

660.458025ms ago: executing program 0 (id=2159):
r0 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
r1 = socket$unix(0x1, 0x2, 0x0)
r2 = socket$unix(0x1, 0x2, 0x0)
connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
sendmmsg(r2, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0)
connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
ppoll(&(0x7f0000000200)=[{r1, 0x6600}], 0x1, 0x0, 0x0, 0x0)
connect$unix(r1, &(0x7f0000000340)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)

600.101739ms ago: executing program 2 (id=2161):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='dctcp-reno\x00', 0xb)
setsockopt$sock_int(r0, 0x1, 0xc, &(0x7f0000000200), 0x4)

440.799153ms ago: executing program 1 (id=2166):
r0 = socket$inet(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000000)=0x48, 0x4)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @dev, @multicast1}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0)
recvmmsg(r0, &(0x7f0000003000)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x40, 0x0)

370.732528ms ago: executing program 1 (id=2167):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000001e000100000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="000080"], 0x30}}, 0x0)

370.317768ms ago: executing program 1 (id=2168):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket(0x400000000010, 0x3, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x18)
socket$alg(0x26, 0x5, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x28}}, 0x0)
sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x4000)
setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000060a010400000000000000"], 0x88}}, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r4, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)
unshare(0x6a040000)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r6, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r5)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=ANY=[@ANYBLOB="580000001000010009000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000000da44000024001a8020000a8014000700fe8000000000000000020040000000000500080002000000140003007866726d30"], 0x58}}, 0x40408c4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x4000)
socketpair$tipc(0x1e, 0x1, 0x0, 0x0)
sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)}, 0x0)
r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0xa, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x12, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@map_fd={0x18, 0x1, 0x1, 0x0, r8}, @call={0x85, 0x0, 0x0, 0x75}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$kcm(0x10, 0x2, 0x0)

53.506879ms ago: executing program 1 (id=2169):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x24008844, &(0x7f0000000040)={0xa, 0x2, 0x80398, @empty, 0xfffffffe}, 0x1c)
r1 = socket$inet_sctp(0x2, 0x5, 0x84)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0)
r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
getsockopt$sock_buf(r2, 0x1, 0x1a, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
unshare(0x20040600)
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, 0x0, 0x0)
unshare(0x20000400)
socket$inet_mptcp(0x2, 0x1, 0x106)
pselect6(0x2000, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300}, 0x0, &(0x7f0000000100)={0x8}, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)
r3 = socket$l2tp6(0xa, 0x2, 0x73)
setsockopt$inet6_opts(r3, 0x29, 0x37, 0x0, 0x8)
sendto$inet6(r3, 0x0, 0x0, 0x4000000, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)

253.03µs ago: executing program 1 (id=2170):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}}, 0x0)

0s ago: executing program 1 (id=2171):
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cast5)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a91", 0x5)
r1 = accept$alg(r0, 0x0, 0x0)
sendmmsg$alg(r1, &(0x7f0000001040)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c004}], 0x1, 0x51)
recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x1, 0x2101, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:15956' (ED25519) to the list of known hosts.
syzkaller login: [   49.334543][ T5791] cgroup: Unknown subsys name 'net'
[   49.423234][ T5791] cgroup: Unknown subsys name 'cpuset'
[   49.427088][ T5791] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   51.087703][ T5791] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.263927][ T5203] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.267124][ T5203] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.270131][ T5203] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.276206][ T5814] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.279701][ T5814] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.284142][ T5816] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.287285][ T5816] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.291367][ T5816] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.293931][ T5816] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.296908][ T5816] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.299748][ T5816] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.303168][ T5816] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.305487][ T5816] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.320709][ T5819] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.327508][ T5816] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.544966][ T5808] chnl_net:caif_netlink_parms(): no params data found
[   55.723788][ T5812] chnl_net:caif_netlink_parms(): no params data found
[   55.783701][ T5808] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.787062][ T5808] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.790462][ T5808] bridge_slave_0: entered allmulticast mode
[   55.795120][ T5808] bridge_slave_0: entered promiscuous mode
[   55.804583][ T5808] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.807679][ T5808] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.810772][ T5808] bridge_slave_1: entered allmulticast mode
[   55.815010][ T5808] bridge_slave_1: entered promiscuous mode
[   55.840876][ T5813] chnl_net:caif_netlink_parms(): no params data found
[   55.899888][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.903512][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.906562][ T5812] bridge_slave_0: entered allmulticast mode
[   55.910419][ T5812] bridge_slave_0: entered promiscuous mode
[   55.918467][ T5808] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.922559][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.924976][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.927524][ T5812] bridge_slave_1: entered allmulticast mode
[   55.931380][ T5812] bridge_slave_1: entered promiscuous mode
[   55.952072][ T5808] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.996559][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.026968][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.033419][ T5808] team0: Port device team_slave_0 added
[   56.036417][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.038892][ T5813] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.041928][ T5813] bridge_slave_0: entered allmulticast mode
[   56.044725][ T5813] bridge_slave_0: entered promiscuous mode
[   56.049770][ T5808] team0: Port device team_slave_1 added
[   56.067928][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.072299][ T5813] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.075323][ T5813] bridge_slave_1: entered allmulticast mode
[   56.078164][ T5813] bridge_slave_1: entered promiscuous mode
[   56.106767][ T5812] team0: Port device team_slave_0 added
[   56.110304][ T5812] team0: Port device team_slave_1 added
[   56.133597][ T5813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.137531][ T5808] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.141041][ T5808] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.152683][ T5808] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.173267][ T5813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.176799][ T5808] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.179933][ T5808] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.190096][ T5808] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.209545][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.212052][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.220232][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.229690][ T5813] team0: Port device team_slave_0 added
[   56.233518][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.236041][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.244983][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.253418][ T5813] team0: Port device team_slave_1 added
[   56.311362][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.314082][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.324754][ T5813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.348349][ T5808] hsr_slave_0: entered promiscuous mode
[   56.352479][ T5808] hsr_slave_1: entered promiscuous mode
[   56.356431][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.359297][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.370251][ T5813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.392728][ T5812] hsr_slave_0: entered promiscuous mode
[   56.396035][ T5812] hsr_slave_1: entered promiscuous mode
[   56.399011][ T5812] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.403246][ T5812] Cannot create hsr debugfs directory
[   56.482519][ T5813] hsr_slave_0: entered promiscuous mode
[   56.485633][ T5813] hsr_slave_1: entered promiscuous mode
[   56.488709][ T5813] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.492571][ T5813] Cannot create hsr debugfs directory
[   56.747644][ T5812] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.755928][ T5812] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.762124][ T5812] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.767519][ T5812] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.823393][ T5808] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.832894][ T5808] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.839422][ T5808] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.847185][ T5808] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.917904][ T5813] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.924621][ T5813] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.944768][ T5813] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.957704][ T5813] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   57.016313][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.053010][ T5808] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.058262][ T5812] 8021q: adding VLAN 0 to HW filter on device team0
[   57.091444][ T1378] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.094750][ T1378] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.103726][ T1378] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.106747][ T1378] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.134657][ T5808] 8021q: adding VLAN 0 to HW filter on device team0
[   57.164883][ T1378] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.167887][ T1378] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.222038][ T1094] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.224945][ T1094] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.236133][ T5813] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.289687][ T5813] 8021q: adding VLAN 0 to HW filter on device team0
[   57.316885][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.320030][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.333867][ T5811] Bluetooth: hci1: command tx timeout
[   57.337909][ T1090] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.341154][ T1090] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.410957][ T5811] Bluetooth: hci2: command tx timeout
[   57.411181][ T5819] Bluetooth: hci0: command tx timeout
[   57.466338][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.499129][ T5808] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.527793][ T5812] veth0_vlan: entered promiscuous mode
[   57.549434][ T5812] veth1_vlan: entered promiscuous mode
[   57.559002][ T5813] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.587044][ T5808] veth0_vlan: entered promiscuous mode
[   57.603352][ T5812] veth0_macvtap: entered promiscuous mode
[   57.607243][ T5808] veth1_vlan: entered promiscuous mode
[   57.619302][ T5812] veth1_macvtap: entered promiscuous mode
[   57.640098][ T5813] veth0_vlan: entered promiscuous mode
[   57.657015][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.669538][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.675113][ T5813] veth1_vlan: entered promiscuous mode
[   57.692385][ T5808] veth0_macvtap: entered promiscuous mode
[   57.696050][ T5812] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.699869][ T5812] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.705381][ T5812] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.709044][ T5812] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.719420][ T5808] veth1_macvtap: entered promiscuous mode
[   57.767585][ T5808] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.794051][ T5813] veth0_macvtap: entered promiscuous mode
[   57.799795][ T5808] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.829648][ T5808] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.834981][ T5808] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.838555][ T5808] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.843741][ T5808] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.854259][ T5813] veth1_macvtap: entered promiscuous mode
[   57.862131][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.868016][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.919562][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.945676][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.955550][ T5118] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.961652][ T5118] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.971454][ T5813] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.974927][ T5813] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.978385][ T5813] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.983572][ T5813] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   58.010708][ T1090] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.017137][ T1090] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.081431][ T5812] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   58.094234][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.102869][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.141971][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.145102][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.187001][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.191038][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.254964][ T5886] delete_channel: no stack
[   58.783515][ T5906] warning: `syz.2.12' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   59.356437][    T9] IPVS: starting estimator thread 0...
[   59.415804][ T5819] Bluetooth: hci1: command tx timeout
[   59.440982][ T5934] IPVS: using max 80 ests per chain, 192000 per kthread
[   59.491624][ T5819] Bluetooth: hci0: command tx timeout
[   59.493913][ T5819] Bluetooth: hci2: command tx timeout
[   59.699140][ T5948] bridge0: port 2(bridge_slave_1) entered disabled state
[   59.702523][ T5948] bridge0: port 1(bridge_slave_0) entered disabled state
[   59.773423][ T5948] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   59.783161][ T5948] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   59.866634][ T5948] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   59.871510][ T5948] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   59.875296][ T5948] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   59.878985][ T5948] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   60.157173][ T5969] syzkaller1: entered promiscuous mode
[   60.159019][ T5969] syzkaller1: entered allmulticast mode
[   60.605964][ T5999] netlink: 'syz.0.55': attribute type 21 has an invalid length.
[   60.608901][ T5999] netlink: 'syz.0.55': attribute type 22 has an invalid length.
[   60.613707][ T5999] netlink: 'syz.0.55': attribute type 23 has an invalid length.
[   60.616727][ T5999] netlink: 'syz.0.55': attribute type 25 has an invalid length.
[   60.622606][ T5999] netlink: 'syz.0.55': attribute type 26 has an invalid length.
[   60.625800][ T5999] netlink: 16 bytes leftover after parsing attributes in process `syz.0.55'.
[   60.972062][ T6025] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   61.490948][ T5819] Bluetooth: hci1: command tx timeout
[   61.571135][ T5819] Bluetooth: hci2: command tx timeout
[   61.581005][ T5819] Bluetooth: hci0: command tx timeout
[   61.816742][ T6058] syz.0.81 uses obsolete (PF_INET,SOCK_PACKET)
[   62.023691][ T6066] netlink: 12 bytes leftover after parsing attributes in process `syz.0.85'.
[   62.065390][ T6072] netlink: 4 bytes leftover after parsing attributes in process `syz.1.88'.
[   62.473367][ T6096] netlink: 'syz.2.100': attribute type 10 has an invalid length.
[   62.495345][ T6096] 8021q: adding VLAN 0 to HW filter on device team0
[   62.504648][ T6096] bond0: (slave team0): Enslaving as an active interface with an up link
[   62.670339][ T6106] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check.
[   63.142580][ T6137] netlink: 28 bytes leftover after parsing attributes in process `syz.1.120'.
[   63.145817][ T6137] netlink: 28 bytes leftover after parsing attributes in process `syz.1.120'.
[   63.163181][ T6139] netlink: 4 bytes leftover after parsing attributes in process `syz.0.121'.
[   63.270051][ T6143] netlink: 'syz.1.123': attribute type 10 has an invalid length.
[   63.278319][ T6143] 8021q: adding VLAN 0 to HW filter on device team0
[   63.571273][ T5819] Bluetooth: hci1: command tx timeout
[   63.585791][ T6159] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[   63.653764][ T5819] Bluetooth: hci0: command tx timeout
[   63.655739][ T5811] Bluetooth: hci2: command tx timeout
[   64.070303][ T6190] Zero length message leads to an empty skb
[   64.098211][ T6192] netlink: 24 bytes leftover after parsing attributes in process `syz.2.146'.
[   64.453380][ T6218] Driver unsupported XDP return value 0 on prog  (id 35) dev N/A, expect packet loss!
[   64.538256][ T6223] netlink: 12 bytes leftover after parsing attributes in process `syz.0.160'.
[   64.594602][ T6225] syzkaller1: entered promiscuous mode
[   64.596908][ T6225] syzkaller1: entered allmulticast mode
[   64.824814][ T6254] netlink: 'syz.2.174': attribute type 1 has an invalid length.
[   64.848111][ T6254] 8021q: adding VLAN 0 to HW filter on device bond1
[   64.868664][ T6254] bond1: (slave ip6erspan0): making interface the new active one
[   64.874638][ T6254] bond1: (slave ip6erspan0): Enslaving as an active interface with an up link
[   64.996088][ T6264] pim6reg: entered allmulticast mode
[   65.014164][ T6264] pim6reg: left allmulticast mode
[   65.062911][ T6274] netlink: 12 bytes leftover after parsing attributes in process `syz.2.182'.
[   66.029632][ T6349] netlink: 40 bytes leftover after parsing attributes in process `syz.1.212'.
[   66.038636][ T6349] netlink: 60 bytes leftover after parsing attributes in process `syz.1.212'.
[   67.065338][ T6420] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   67.173813][ T6428] netlink: 24 bytes leftover after parsing attributes in process `syz.2.245'.
[   67.254575][ T6434] netlink: 8 bytes leftover after parsing attributes in process `syz.2.248'.
[   67.546242][ T6460] netlink: 'syz.2.259': attribute type 3 has an invalid length.
[   67.907967][ T6476] netlink: 104 bytes leftover after parsing attributes in process `syz.0.268'.
[   68.166536][ T6489] netlink: 8 bytes leftover after parsing attributes in process `syz.0.273'.
[   68.295993][ T6505] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.277'.
[   68.348991][ T6508] openvswitch: netlink: VXLAN extension 274 out of range max 1
[   68.554818][ T6525] netlink: 16 bytes leftover after parsing attributes in process `syz.0.284'.
[   68.561546][ T6526] netlink: 16 bytes leftover after parsing attributes in process `syz.1.283'.
[   68.907038][ T6552] sctp: [Deprecated]: syz.1.296 (pid 6552) Use of int in max_burst socket option deprecated.
[   68.907038][ T6552] Use struct sctp_assoc_value instead
[   69.698574][ T6571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.305'.
[   69.859823][ T6580] syzkaller1: entered promiscuous mode
[   69.862792][ T6580] syzkaller1: entered allmulticast mode
[   70.552335][ T6612] bond0: option lp_interval: invalid value (18446744073709551604)
[   70.555268][ T6612] bond0: option lp_interval: allowed values 1 - 2147483647
[   70.598224][ T6616] IPv6: NLM_F_CREATE should be specified when creating new route
[   70.817210][ T6640] tipc: Started in network mode
[   70.819005][ T6640] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711
[   70.822818][ T6640] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[   70.963158][ T6654] macvtap1: entered allmulticast mode
[   70.964926][ T6654] veth0_macvtap: entered allmulticast mode
[   70.968486][ T5865] IPVS: starting estimator thread 0...
[   71.048172][ T6666] netlink: 8 bytes leftover after parsing attributes in process `syz.1.349'.
[   71.062228][ T6655] IPVS: using max 79 ests per chain, 189600 per kthread
[   71.107718][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   71.113022][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   71.226062][ T6680] netlink: 52 bytes leftover after parsing attributes in process `syz.0.355'.
[   71.377328][ T6692] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   71.380822][ T6692] IPv6: NLM_F_CREATE should be set when creating new route
[   71.383936][ T6692] IPv6: NLM_F_CREATE should be set when creating new route
[   71.386915][ T6692] IPv6: NLM_F_CREATE should be set when creating new route
[   71.393537][ T6692] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   71.458108][ T6698] netlink: 16 bytes leftover after parsing attributes in process `syz.0.364'.
[   71.810779][ T5819] Bluetooth: hci2: command tx timeout
[   72.238924][ T6768] netlink: 'syz.0.397': attribute type 21 has an invalid length.
[   72.241999][ T6768] netlink: 128 bytes leftover after parsing attributes in process `syz.0.397'.
[   72.245124][ T6768] netlink: 3 bytes leftover after parsing attributes in process `syz.0.397'.
[   72.261404][ T6766] netlink: 16 bytes leftover after parsing attributes in process `syz.2.394'.
[   72.316040][ T6770] 8021q: adding VLAN 0 to HW filter on device bond1
[   72.321891][ T6770] team0: Port device bond1 added
[   72.503567][ T6781] netlink: 'syz.0.403': attribute type 13 has an invalid length.
[   72.607380][ T6787] netlink: 4 bytes leftover after parsing attributes in process `syz.1.406'.
[   72.611287][ T6787] netlink: 12 bytes leftover after parsing attributes in process `syz.1.406'.
[   72.828660][ T6803] netlink: 4 bytes leftover after parsing attributes in process `syz.0.414'.
[   72.835824][ T6803] ipvlan0: entered promiscuous mode
[   73.023344][ T6818] netlink: 28 bytes leftover after parsing attributes in process `syz.1.419'.
[   73.592160][ T6866] netlink: 'syz.0.438': attribute type 1 has an invalid length.
[   73.595420][ T6866] netlink: 'syz.0.438': attribute type 2 has an invalid length.
[   73.683772][ T6874] veth0: entered promiscuous mode
[   73.688532][ T6870] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[   73.813788][ T6876] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   74.479727][ T6923] netlink: 'syz.1.458': attribute type 10 has an invalid length.
[   74.626871][ T6930] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   74.715923][ T6940] netlink: 'syz.2.465': attribute type 3 has an invalid length.
[   75.157648][ T6976] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   75.865577][ T7016] netlink: 'syz.2.500': attribute type 10 has an invalid length.
[   75.869317][ T7016] veth1_vlan: entered allmulticast mode
[   75.884683][ T7016] team0: Device veth1_vlan failed to register rx_handler
[   76.058027][ T7022] __nla_validate_parse: 12 callbacks suppressed
[   76.058037][ T7022] netlink: 36 bytes leftover after parsing attributes in process `syz.2.503'.
[   76.362910][ T7033] bond0: (slave team0): Releasing backup interface
[   76.376922][ T7033] team0 (unregistering): Port device team_slave_0 removed
[   76.392414][ T7033] team0 (unregistering): Port device team_slave_1 removed
[   76.610197][ T7043] netlink: 40 bytes leftover after parsing attributes in process `syz.2.511'.
[   76.616343][ T7043] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check.
[   76.714314][ T7045] netlink: 28 bytes leftover after parsing attributes in process `syz.2.512'.
[   76.718222][ T7045] netlink: 28 bytes leftover after parsing attributes in process `syz.2.512'.
[   76.722487][ T7045] netlink: 28 bytes leftover after parsing attributes in process `syz.2.512'.
[   77.356488][ T7073] set match dimension is over the limit!
[   77.536718][ T7096] netlink: 72 bytes leftover after parsing attributes in process `syz.1.537'.
[   77.544349][ T7096] netlink: 72 bytes leftover after parsing attributes in process `syz.1.537'.
[   77.728301][ T7114] netlink: 8 bytes leftover after parsing attributes in process `syz.2.546'.
[   77.732158][ T7114] netlink: 7 bytes leftover after parsing attributes in process `syz.2.546'.
[   77.770318][ T7118] netlink: 'syz.1.547': attribute type 5 has an invalid length.
[   77.844878][ T7126] netlink: 'syz.1.552': attribute type 5 has an invalid length.
[   77.934170][ T7136] netlink: 'syz.2.557': attribute type 13 has an invalid length.
[   77.953323][ T7136] gretap0: refused to change device tx_queue_len
[   77.955713][ T7136] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[   78.494480][ T7169] netlink: 4 bytes leftover after parsing attributes in process `syz.0.573'.
[   78.497702][ T7169] netlink: 'syz.0.573': attribute type 1 has an invalid length.
[   78.822054][ T7197] netlink: 'syz.0.587': attribute type 1 has an invalid length.
[   78.974095][ T7208] netlink: 'syz.2.590': attribute type 3 has an invalid length.
[   78.982487][ T7208] xt_CT: You must specify a L4 protocol and not use inversions on it
[   78.997723][ T7210] tipc: Started in network mode
[   79.000928][ T7210] tipc: Node identity ff020000000000000000000000000001, cluster identity 4711
[   79.004874][ T7210] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[   79.776161][ T7260] netlink: 'syz.2.617': attribute type 10 has an invalid length.
[   79.807790][ T7260] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   80.071697][ T7281] netlink: 'syz.0.624': attribute type 4 has an invalid length.
[   80.294207][ T7288] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   80.631761][ T7260] syz.2.617 (7260) used greatest stack depth: 19672 bytes left
[   80.904637][ T7337] netlink: 'syz.2.645': attribute type 1 has an invalid length.
[   81.077401][ T7355] netlink: 'syz.1.655': attribute type 32 has an invalid length.
[   81.089017][ T7355] __nla_validate_parse: 9 callbacks suppressed
[   81.089033][ T7355] netlink: 60 bytes leftover after parsing attributes in process `syz.1.655'.
[   81.334542][ T1269] cfg80211: failed to load regulatory.db
[   81.457353][ T7383] xt_CT: No such helper "snmp"
[   81.635743][ T7401] netlink: 'syz.0.671': attribute type 6 has an invalid length.
[   81.710322][ T7405] netlink: 48 bytes leftover after parsing attributes in process `syz.0.673'.
[   82.003316][ T7420] netlink: 'syz.0.679': attribute type 1 has an invalid length.
[   82.008259][ T7420] netlink: 'syz.0.679': attribute type 2 has an invalid length.
[   82.013084][ T7420] netlink: 4 bytes leftover after parsing attributes in process `syz.0.679'.
[   82.085030][ T7425] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.182175][ T7425] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.239408][ T7431] netlink: 'syz.0.681': attribute type 1 has an invalid length.
[   82.243494][ T7431] netlink: 224 bytes leftover after parsing attributes in process `syz.0.681'.
[   82.463716][ T7425] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.557795][ T7425] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   82.657142][ T7425] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   82.686973][ T7425] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   82.705332][ T7425] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   82.736577][ T7425] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   83.342875][ T7470] netlink: 8 bytes leftover after parsing attributes in process `syz.1.700'.
[   83.458646][ T7483] netlink: 8 bytes leftover after parsing attributes in process `syz.2.706'.
[   83.464707][ T7483] netlink: 44 bytes leftover after parsing attributes in process `syz.2.706'.
[   83.509885][ T7488] netlink: 8 bytes leftover after parsing attributes in process `syz.1.709'.
[   83.567579][ T7493] netlink: 8 bytes leftover after parsing attributes in process `syz.2.712'.
[   83.651943][ T7506] netlink: 28 bytes leftover after parsing attributes in process `syz.0.718'.
[   83.833138][ T7528] netlink: 'syz.0.728': attribute type 4 has an invalid length.
[   83.881602][ T7532] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) !
[   83.938304][ T7536] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   83.942373][ T7536] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   83.946006][ T7536] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   83.949679][ T7536] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   83.956593][ T7536] bond0: (slave vxlan0): Enslaving as an active interface with an up link
[   84.026075][ T7540] xt_CT: No such helper "snmp_trap"
[   84.171724][ T7555] netlink: 'syz.0.741': attribute type 1 has an invalid length.
[   84.217455][ T7555] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link
[   84.224496][ T7555] 8021q: adding VLAN 0 to HW filter on device bond2
[   84.224546][   T13] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   84.242501][ T7555] veth1: entered promiscuous mode
[   84.247356][ T7555] bond2: (slave veth1): Enslaving as a backup interface with a down link
[   84.362164][   T13] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   84.408105][ T7571] ipvlan2: entered promiscuous mode
[   84.412053][ T7571] bridge0: port 3(ipvlan2) entered blocking state
[   84.415589][ T7571] bridge0: port 3(ipvlan2) entered disabled state
[   84.419468][ T7571] ipvlan2: entered allmulticast mode
[   84.422440][ T7571] bridge0: entered allmulticast mode
[   84.427494][ T7571] ipvlan2: left allmulticast mode
[   84.429663][ T7571] bridge0: left allmulticast mode
[   84.936777][ T7594] netlink: 'syz.1.755': attribute type 8 has an invalid length.
[   84.943350][ T7594] bridge_slave_0: left allmulticast mode
[   84.945768][ T7594] bridge_slave_0: left promiscuous mode
[   84.948450][ T7594] bridge0: port 1(bridge_slave_0) entered disabled state
[   84.963292][ T7594] bridge_slave_1: left allmulticast mode
[   84.965662][ T7594] bridge_slave_1: left promiscuous mode
[   84.968607][ T7594] bridge0: port 2(bridge_slave_1) entered disabled state
[   84.976574][ T7594] bond0: (slave bond_slave_0): Releasing backup interface
[   84.985609][ T7594] bond0: (slave bond_slave_1): Releasing backup interface
[   84.995597][ T7594] team0: Port device team_slave_0 removed
[   84.999877][ T7594] team0: Port device team_slave_1 removed
[   85.005653][ T7594] batman_adv: batadv0: Removing interface: batadv_slave_0
[   85.008970][ T7594] batman_adv: batadv0: Removing interface: batadv_slave_1
[   85.413107][ T7617] sit1: entered promiscuous mode
[   85.414782][ T7617] sit1: entered allmulticast mode
[   86.029719][ T7659] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check.
[   86.120312][ T7672] Cannot find del_set index 4 as target
[   86.216497][ T7685] dvmrp1: entered allmulticast mode
[   86.276353][ T7694] __nla_validate_parse: 3 callbacks suppressed
[   86.276364][ T7694] netlink: 20 bytes leftover after parsing attributes in process `syz.2.803'.
[   86.354075][ T7706] netlink: 'syz.0.807': attribute type 21 has an invalid length.
[   86.356770][ T7706] netlink: 8 bytes leftover after parsing attributes in process `syz.0.807'.
[   86.570010][ T7719] netlink: 4 bytes leftover after parsing attributes in process `syz.1.812'.
[   86.903096][ T7754] netlink: 'syz.1.826': attribute type 1 has an invalid length.
[   86.905868][ T7754] netlink: 'syz.1.826': attribute type 1 has an invalid length.
[   87.028523][ T7770] netlink: 20 bytes leftover after parsing attributes in process `syz.1.834'.
[   87.195560][ T7786] netlink: 20 bytes leftover after parsing attributes in process `syz.1.841'.
[   87.693509][ T7818] netlink: 8 bytes leftover after parsing attributes in process `syz.2.852'.
[   87.699431][ T7818] netlink: 12 bytes leftover after parsing attributes in process `syz.2.852'.
[   87.898681][ T7839] netlink: 8 bytes leftover after parsing attributes in process `syz.0.862'.
[   88.183409][ T7873] netlink: 14 bytes leftover after parsing attributes in process `syz.2.879'.
[   88.216742][ T7875] netlink: 8 bytes leftover after parsing attributes in process `syz.2.880'.
[   88.220365][ T7875] netlink: 'syz.2.880': attribute type 30 has an invalid length.
[   88.229133][ T7875] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[   88.232229][ T7875] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[   88.235669][ T7875] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[   88.239131][ T7875] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[   88.245083][ T7875] netlink: 'syz.2.880': attribute type 30 has an invalid length.
[   88.287718][ T7879] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   88.357167][ T7883] bridge_slave_0: left allmulticast mode
[   88.359274][ T7883] bridge_slave_0: left promiscuous mode
[   88.362219][ T7883] bridge0: port 1(bridge_slave_0) entered disabled state
[   88.368279][ T7883] bridge_slave_1: left allmulticast mode
[   88.370314][ T7883] bridge_slave_1: left promiscuous mode
[   88.378236][ T7883] bridge0: port 2(bridge_slave_1) entered disabled state
[   88.389913][ T7883] bond0: (slave bond_slave_0): Releasing backup interface
[   88.397205][ T7883] bond0: (slave bond_slave_1): Releasing backup interface
[   88.402439][ T7883] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   88.405012][ T7883] batman_adv: batadv0: Removing interface: batadv_slave_0
[   88.408461][ T7883] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   88.413599][ T7883] batman_adv: batadv0: Removing interface: batadv_slave_1
[   88.421215][ T7883] bond0: (slave wlan1): Releasing backup interface
[   88.431408][ T7883] bond1: (slave ip6erspan0): Releasing active interface
[   88.678771][ T7902] netlink: 'syz.0.893': attribute type 11 has an invalid length.
[   88.682952][ T7902] netlink: 'syz.0.893': attribute type 11 has an invalid length.
[   89.132014][ T7944] netlink: 'syz.0.911': attribute type 1 has an invalid length.
[   89.157144][ T7944] 8021q: adding VLAN 0 to HW filter on device bond3
[   89.200029][ T7944] bond3: (slave gretap1): making interface the new active one
[   89.203251][ T7944] bond3: (slave gretap1): Enslaving as an active interface with an up link
[   89.584803][ T7944] bond3 (unregistering): (slave gretap1): Releasing active interface
[   89.592925][ T7944] bond3 (unregistering): Released all slaves
[   89.898441][ T7981] sctp: [Deprecated]: syz.0.929 (pid 7981) Use of struct sctp_assoc_value in delayed_ack socket option.
[   89.898441][ T7981] Use struct sctp_sack_info instead
[   89.914413][ T7977] can: request_module (can-proto-0) failed.
[   89.923258][ T7977] Bluetooth: MGMT ver 1.23
[   90.046495][ T7998] netlink: 'syz.1.937': attribute type 3 has an invalid length.
[   90.049614][ T7998] netlink: 'syz.1.937': attribute type 3 has an invalid length.
[   90.112789][ T8002] sctp: [Deprecated]: syz.2.938 (pid 8002) Use of int in maxseg socket option.
[   90.112789][ T8002] Use struct sctp_assoc_value instead
[   90.577441][ T8057] xt_ecn: cannot match TCP bits for non-tcp packets
[   90.885128][ T8086] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[   90.889269][ T8086] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[   90.964822][ T8083] 8021q: VLANs not supported on ipvlan1
[   91.039082][ T8100] veth1_to_bond: entered allmulticast mode
[   91.092751][ T8100] veth1_to_bond (unregistering): left allmulticast mode
[   91.129188][ T8106] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[   91.377682][ T8120] netlink: 'syz.2.995': attribute type 72 has an invalid length.
[   91.392453][ T8120] __nla_validate_parse: 20 callbacks suppressed
[   91.392463][ T8120] netlink: 1016 bytes leftover after parsing attributes in process `syz.2.995'.
[   91.519897][ T8130] vcan0: tx drop: invalid sa for name 0x0000000000000003
[   91.850402][ T8167] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1017'.
[   91.854286][ T8167] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1017'.
[   92.235944][ T8186] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1027'.
[   92.435845][ T8201] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1034'.
[   92.479946][ T8203] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   92.483791][ T8203] batadv_slave_1: entered promiscuous mode
[   92.494754][ T8203] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1035'.
[   93.088093][ T8226] 8021q: adding VLAN 0 to HW filter on device bond0
[   93.092800][ T8226] 8021q: adding VLAN 0 to HW filter on device team0
[   93.099559][ T8226] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   93.241441][ T8232] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1047'.
[   93.245607][ T8232] netlink: 43 bytes leftover after parsing attributes in process `syz.2.1047'.
[   93.248503][ T8232] netlink: 'syz.2.1047': attribute type 5 has an invalid length.
[   93.253241][ T8232] netlink: 43 bytes leftover after parsing attributes in process `syz.2.1047'.
[   93.296936][ T8237] netlink: 'syz.2.1049': attribute type 58 has an invalid length.
[   93.564052][ T8256] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1058'.
[   93.567087][ T8256] nbd: illegal input index 65508
[   94.385163][ T8326] IPVS: sync thread started: state = BACKUP, mcast_ifn = vlan0, syncid = 1, id = 0
[   94.388779][ T8325] IPVS: stopping backup sync thread 8326 ...
[   94.791091][ T8348] nbd1: detected capacity change from 0 to 63
[   94.796017][ T8352] block nbd1: NBD_DISCONNECT
[   94.798551][ T8352] block nbd1: Disconnected due to user request.
[   94.802081][ T8352] block nbd1: shutting down sockets
[   94.806103][    C0] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.810250][    C0] Buffer I/O error on dev nbd1, logical block 0, async page read
[   94.813519][    C0] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.816987][    C0] Buffer I/O error on dev nbd1, logical block 1, async page read
[   94.820110][    C0] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.823580][    C0] Buffer I/O error on dev nbd1, logical block 2, async page read
[   94.826623][    C0] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.830257][    C0] Buffer I/O error on dev nbd1, logical block 3, async page read
[   94.834966][ T5822] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.838815][ T5822] Buffer I/O error on dev nbd1, logical block 0, async page read
[   94.842846][ T5822] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.846244][ T5822] Buffer I/O error on dev nbd1, logical block 1, async page read
[   94.849404][ T5822] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.869499][ T5822] Buffer I/O error on dev nbd1, logical block 2, async page read
[   94.873046][ T5822] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.876597][ T5822] Buffer I/O error on dev nbd1, logical block 3, async page read
[   94.881931][ T5822] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.885631][ T5822] Buffer I/O error on dev nbd1, logical block 0, async page read
[   94.889093][ T5822] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   94.893280][ T5822] Buffer I/O error on dev nbd1, logical block 1, async page read
[   94.899293][ T5822] ldm_validate_partition_table(): Disk read failed.
[   94.904022][ T5822] Dev nbd1: unable to read RDB block 0
[   94.907699][ T5822]  nbd1: unable to read partition table
[   94.922782][ T5822] ldm_validate_partition_table(): Disk read failed.
[   94.932775][ T5822] Dev nbd1: unable to read RDB block 0
[   94.936568][ T5822]  nbd1: unable to read partition table
[   94.983681][ T8361] netlink: 'syz.1.1106': attribute type 1 has an invalid length.
[   95.101157][ T8367] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on
[   95.132659][ T8367] bond1: entered promiscuous mode
[   95.134290][ T8367] bond1: entered allmulticast mode
[   95.136056][ T8367] 8021q: adding VLAN 0 to HW filter on device bond1
[   95.846315][ T8429] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   96.203171][ T8469] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   96.208819][ T8469] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma?
[   96.443326][ T8496] netlink: 'syz.2.1167': attribute type 11 has an invalid length.
[   96.445995][ T8496] netlink: 'syz.2.1167': attribute type 4 has an invalid length.
[   96.448818][ T8496] __nla_validate_parse: 4 callbacks suppressed
[   96.448850][ T8496] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1167'.
[   96.513999][ T8504] netlink: 'syz.2.1170': attribute type 9 has an invalid length.
[   96.516583][ T8504] netlink: 212260 bytes leftover after parsing attributes in process `syz.2.1170'.
[   97.208891][ T8546] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw'
[   97.242293][ T8548] unknown channel width for channel at 909000KHz?
[   97.244767][ T8548] unknown channel width for channel at 909000KHz?
[   97.247081][ T8548] unknown channel width for channel at 909000KHz?
[   97.916868][ T8581] xt_CT: You must specify a L4 protocol and not use inversions on it
[   98.583041][ T8627] netlink: 'syz.0.1224': attribute type 12 has an invalid length.
[   98.586240][ T8627] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1224'.
[   98.755309][ T8645] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20000
[   98.853475][ T8658] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains
[   98.929859][ T8662] bridge0: port 2(bridge_slave_1) entered disabled state
[   98.933204][ T8662] bridge0: port 1(bridge_slave_0) entered disabled state
[   98.998089][ T8662] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   99.027705][ T8662] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   99.032092][ T8662] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   99.035354][ T8662] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   99.038198][ T8662] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   99.069667][ T8662] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[   99.073122][ T8662] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[   99.075996][ T8662] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[   99.078991][ T8662] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[   99.152526][ T8674] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1245'.
[   99.156357][ T8674] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1245'.
[  100.022126][ T8733] netlink: 'syz.2.1272': attribute type 6 has an invalid length.
[  100.189407][   T33] audit: type=1800 audit(1751708549.361:2): pid=8759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1285" name="bpf-map" dev="anon_inodefs" ino=32 res=0 errno=0
[  100.312592][ T8771] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1290'.
[  100.454558][ T8781] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[  100.534411][ T8787] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1298'.
[  100.896208][ T8821] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[  101.365345][ T8853] netlink: 92 bytes leftover after parsing attributes in process `syz.1.1328'.
[  101.618238][ T8867] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1334'.
[  102.034417][ T8898] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1349'.
[  102.396692][ T8935] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1367'.
[  102.459880][ T8941] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1370'.
[  102.550420][ T8954] netlink: 'syz.1.1376': attribute type 1 has an invalid length.
[  102.628496][ T8963] syzkaller1: entered promiscuous mode
[  102.630589][ T8963] syzkaller1: entered allmulticast mode
[  102.633089][ T8963] PF_CAN: dropped non conform CAN skbuff: dev type 779, len 324
[  103.715811][ T9055] syzkaller0: entered promiscuous mode
[  103.720640][ T9055] syzkaller0: entered allmulticast mode
[  104.675484][ T9073] syzkaller1: entered promiscuous mode
[  104.677403][ T9073] syzkaller1: entered allmulticast mode
[  104.887687][ T9091] netlink: 'syz.2.1442': attribute type 3 has an invalid length.
[  104.895185][ T9091] netlink: 'syz.2.1442': attribute type 1 has an invalid length.
[  104.898522][ T9091] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.1442'.
[  105.008638][ T9100] netlink: 'syz.0.1446': attribute type 1 has an invalid length.
[  105.129225][ T9111] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1451'.
[  105.142566][ T9111] netlink: 15 bytes leftover after parsing attributes in process `syz.1.1451'.
[  105.146311][ T9111] netlink: 15 bytes leftover after parsing attributes in process `syz.1.1451'.
[  105.163663][ T9115] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1452'.
[  105.591069][ T9170] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1471'.
[  106.682479][ T9230] xt_l2tp: v2 tid > 0xffff: 4294967295
[  106.809603][ T9240] __nla_validate_parse: 4 callbacks suppressed
[  106.809613][ T9240] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1502'.
[  107.037878][ T9256] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1510'.
[  107.043399][ T9256] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1510'.
[  107.047356][ T9256] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1510'.
[  107.052054][ T9256] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1510'.
[  107.432304][ T9285] netlink: 'syz.0.1522': attribute type 1 has an invalid length.
[  108.087603][ T9316] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1535'.
[  108.098595][ T9316] smc: net device bond0 applied user defined pnetid SYZ
[  108.206245][ T9322] netlink: 3696 bytes leftover after parsing attributes in process `syz.0.1537'.
[  108.209930][ T9322] netlink: 3696 bytes leftover after parsing attributes in process `syz.0.1537'.
[  108.266220][ T9330] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1541'.
[  108.269572][ T9330] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1541'.
[  108.620230][ T9367] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check.
[  108.770379][ T9378] x_tables: unsorted entry at hook 2
[  110.192763][ T5865] IPVS: starting estimator thread 0...
[  110.206124][ T9429] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.209785][ T9429] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.214263][ T9429] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.217745][ T9429] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.247234][ T9429] veth0_macvtap: left allmulticast mode
[  110.257380][ T9429] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.260178][ T9429] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.263062][ T9429] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.266231][ T9429] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.280980][ T9447] IPVS: using max 79 ests per chain, 189600 per kthread
[  110.595046][ T9460] vlan0: entered allmulticast mode
[  110.868954][ T9476] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  111.413133][ T9526] netlink: 'syz.0.1616': attribute type 2 has an invalid length.
[  111.416256][ T9526] netlink: 'syz.0.1616': attribute type 1 has an invalid length.
[  111.524892][ T9540] ieee802154 phy1 wpan1: encryption failed: -22
[  111.738735][ T9569] netlink: 'syz.2.1636': attribute type 1 has an invalid length.
[  111.793514][ T9569] bond2: (slave ip6gretap2): Enslaving as a backup interface with an up link
[  111.810276][ T9569] 8021q: adding VLAN 0 to HW filter on device bond2
[  111.814206][ T5843] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  111.836496][ T9569] veth5: entered promiscuous mode
[  111.840256][ T9569] bond2: (slave veth5): Enslaving as a backup interface with a down link
[  111.856986][ T9569] bond2: (slave ip6gretap2): Removing an active aggregator
[  111.862417][ T9569] bond2: (slave ip6gretap2): Releasing backup interface
[  111.864891][ T9569] bond2: (slave ip6gretap2): the permanent HWaddr of slave - 02:7f:a6:a2:38:cf - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  111.877591][ T9569] bond2: (slave veth5): Releasing backup interface
[  112.238467][ T9602] bond0: entered promiscuous mode
[  112.332423][ T9614] netlink: 'syz.1.1658': attribute type 6 has an invalid length.
[  112.555409][ T9641] netlink: 'syz.0.1671': attribute type 15 has an invalid length.
[  112.656984][ T9653] netlink: 'syz.0.1676': attribute type 4 has an invalid length.
[  112.728796][ T9660] __nla_validate_parse: 7 callbacks suppressed
[  112.728806][ T9660] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1678'.
[  112.769915][ T9667] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1682'.
[  112.779670][ T9667] hsr_slave_0: left promiscuous mode
[  112.785536][ T9667] hsr_slave_1: left promiscuous mode
[  112.839191][ T9674] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1686'.
[  113.078298][ T9698] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  113.206280][ T9717] netlink: 'syz.0.1706': attribute type 3 has an invalid length.
[  113.244594][ T9723] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1708'.
[  113.290776][ T9728] netlink: 'syz.2.1711': attribute type 4 has an invalid length.
[  113.296692][ T9728] netlink: 'syz.2.1711': attribute type 4 has an invalid length.
[  113.423683][ T9735] dvmrp0: entered allmulticast mode
[  113.494513][ T9739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1716'.
[  113.625744][ T9743] lo: entered promiscuous mode
[  113.628229][ T9743] lo: entered allmulticast mode
[  113.639628][ T9743] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  113.932702][ T9762] bond0: left promiscuous mode
[  113.939303][ T9762] 8021q: adding VLAN 0 to HW filter on device bond0
[  113.951274][ T9762] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  114.091159][ T9766] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1727'.
[  114.148364][ T9766] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1727'.
[  114.465159][ T9772] netlink: 'syz.0.1729': attribute type 303 has an invalid length.
[  114.472484][ T9772] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1729'.
[  114.477089][ T9772] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[  114.481656][ T9772] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[  114.850114][ T9787] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1733'.
[  114.892281][ T9791] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1734'.
[  114.902314][ T9791] netlink: zone id is out of range
[  114.904458][ T9791] netlink: zone id is out of range
[  114.906594][ T9791] netlink: zone id is out of range
[  114.908686][ T9791] netlink: zone id is out of range
[  114.912161][ T9791] netlink: zone id is out of range
[  114.914900][ T9791] netlink: zone id is out of range
[  114.916982][ T9791] netlink: zone id is out of range
[  114.918857][ T9791] netlink: zone id is out of range
[  115.018012][ T9802] batadv_slave_1: entered promiscuous mode
[  115.478004][ T5819] Bluetooth: hci2: link tx timeout
[  115.481381][ T5819] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  115.847504][ T9860] Cannot find set identified by id 2 to match
[  116.421598][ T9907] IPv6: Can't replace route, no match found
[  116.479705][ T9911] veth0: entered promiscuous mode
[  116.483498][ T9911] veth0: left promiscuous mode
[  116.675630][ T9932] netlink: 'syz.1.1797': attribute type 8 has an invalid length.
[  117.118907][ T9962] netlink: 'syz.1.1812': attribute type 1 has an invalid length.
[  117.143054][ T9962] 8021q: adding VLAN 0 to HW filter on device bond4
[  117.188038][ T9962] bond4: (slave veth3): Enslaving as an active interface with a down link
[  117.223546][ T9962] 8021q: adding VLAN 0 to HW filter on device batadv1
[  117.229146][ T9962] bond4: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open
[  117.492795][ T5811] Bluetooth: hci2: command 0x0406 tx timeout
[  117.618464][ T9991] netlink: 'syz.0.1826': attribute type 1 has an invalid length.
[  117.810422][T10001] __nla_validate_parse: 12 callbacks suppressed
[  117.810439][T10001] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1830'.
[  117.816994][T10001] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1830'.
[  117.940929][T10007] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1833'.
[  118.384247][T10034] block nbd2: not configured, cannot reconfigure
[  118.408086][T10036] netlink: 'syz.0.1846': attribute type 1 has an invalid length.
[  118.431396][T10036] netlink: 'syz.0.1846': attribute type 1 has an invalid length.
[  118.444497][T10040] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1849'.
[  118.457109][T10040] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1849'.
[  118.466273][T10040] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1849'.
[  118.470162][T10040] vlan0: entered promiscuous mode
[  118.482964][T10040] syzkaller1: entered promiscuous mode
[  118.488805][T10040] syzkaller1: entered allmulticast mode
[  118.585643][T10053] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1852'.
[  118.670320][T10061] netlink: 504 bytes leftover after parsing attributes in process `syz.0.1856'.
[  119.107680][T10112] netlink: 'syz.2.1879': attribute type 4 has an invalid length.
[  119.153966][T10114] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1880'.
[  119.210264][T10114] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  119.219713][T10114] netlink: 'syz.2.1880': attribute type 4 has an invalid length.
[  119.245159][T10124] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1884'.
[  119.336728][T10133] netlink: 'syz.2.1888': attribute type 1 has an invalid length.
[  120.208002][T10166] syzkaller0: entered promiscuous mode
[  120.209906][T10166] syzkaller0: entered allmulticast mode
[  120.652451][T10198] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  120.679170][T10200] netlink: 'syz.2.1916': attribute type 11 has an invalid length.
[  120.689005][T10198] syzkaller0: entered promiscuous mode
[  120.692569][T10198] syzkaller0: entered allmulticast mode
[  120.695198][T10198] tipc: Resetting bearer <eth:syzkaller0>
[  120.708317][T10197] tipc: Resetting bearer <eth:syzkaller0>
[  121.546006][T10197] tipc: Disabling bearer <eth:syzkaller0>
[  122.485752][T10211] (unnamed net_device) (uninitialized): option packets_per_slave: mode dependency failed, not supported in mode active-backup(1)
[  122.847016][T10256] syzkaller0: refused to change device tx_queue_len
[  122.976903][T10267] __nla_validate_parse: 12 callbacks suppressed
[  122.976918][T10267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1945'.
[  123.147424][T10284] netlink: 'syz.2.1953': attribute type 1 has an invalid length.
[  123.282421][T10296] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1959'.
[  123.286301][T10296] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1959'.
[  123.299649][T10296] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1959'.
[  123.303532][T10296] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1959'.
[  123.645497][T10332] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1976'.
[  123.700355][T10338] netlink: 'syz.0.1980': attribute type 1 has an invalid length.
[  123.917220][T10355] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1988'.
[  123.975746][T10360] netlink: 'syz.2.1990': attribute type 1 has an invalid length.
[  124.007698][T10360] 8021q: adding VLAN 0 to HW filter on device bond4
[  124.042870][T10360] 8021q: adding VLAN 0 to HW filter on device bond4
[  124.046036][T10360] bond4: (slave vxcan5): The slave device specified does not support setting the MAC address
[  124.052300][T10360] bond4: (slave vxcan5): Error -95 calling set_mac_address
[  124.060861][T10363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1991'.
[  124.074693][T10363] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1991'.
[  124.085619][T10370] veth7: entered promiscuous mode
[  124.089739][T10370] bond4: (slave veth7): Enslaving as an active interface with a down link
[  124.106365][T10360] erspan0: entered allmulticast mode
[  124.110427][T10360] bond4: (slave erspan0): making interface the new active one
[  124.114526][T10360] bond4: (slave erspan0): Enslaving as an active interface with an up link
[  124.554990][T10404] netlink: 'syz.0.2007': attribute type 10 has an invalid length.
[  124.558030][T10404] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2007'.
[  124.561483][T10404] dummy0: entered promiscuous mode
[  124.563340][T10404] dummy0: entered allmulticast mode
[  124.566421][T10404] bridge0: port 3(dummy0) entered blocking state
[  124.568706][T10404] bridge0: port 3(dummy0) entered disabled state
[  125.117493][T10440] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0)
[  125.139147][T10438] netlink: 'syz.0.2023': attribute type 10 has an invalid length.
[  125.143518][T10438] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  125.146571][T10438] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  125.160157][T10438] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  125.163566][T10438] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  125.173202][T10438] team0: Port device geneve0 added
[  125.582928][   T33] audit: type=1107 audit(1751708574.751:3): pid=10479 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
[  125.632666][T10489] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5
[  125.863979][T10512] syz_tun: entered allmulticast mode
[  125.877852][T10511] syz_tun: left allmulticast mode
[  125.972652][T10524] ieee802154 phy1 wpan1: encryption failed: -22
[  126.102728][T10541] netlink: 'syz.1.2065': attribute type 13 has an invalid length.
[  126.105469][T10541] netlink: 'syz.1.2065': attribute type 12 has an invalid length.
[  126.255037][T10551] xt_l2tp: missing protocol rule (udp|l2tpip)
[  126.282936][T10557] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw'
[  126.423318][T10573] netlink: 'syz.0.2077': attribute type 1 has an invalid length.
[  126.586649][T10587] netlink: 'syz.2.2084': attribute type 21 has an invalid length.
[  126.589935][T10587] IPv6: NLM_F_CREATE should be specified when creating new route
[  126.595421][T10587] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  126.598195][T10587] IPv6: NLM_F_CREATE should be set when creating new route
[  126.600619][T10587] IPv6: NLM_F_CREATE should be set when creating new route
[  126.602999][T10587] IPv6: NLM_F_CREATE should be set when creating new route
[  127.600932][T10638] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING
[  127.986546][T10668] syzkaller0: entered allmulticast mode
[  128.159736][T10680] __nla_validate_parse: 15 callbacks suppressed
[  128.159753][T10680] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2124'.
[  128.167575][T10680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2124'.
[  128.492446][T10701] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2133'.
[  128.496230][T10701] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2133'.
[  129.003477][T10711] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  129.013313][T10710] tipc: Resetting bearer <eth:syzkaller0>
[  129.988608][T10710] tipc: Disabling bearer <eth:syzkaller0>
[  130.029855][T10731] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2147'.
[  130.575599][T10776] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2168'.
[  131.107602][   T13] 
[  131.108700][   T13] ============================================
[  131.111351][   T13] WARNING: possible recursive locking detected
[  131.113948][   T13] 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 Not tainted
[  131.118072][   T13] --------------------------------------------
[  131.120644][   T13] kworker/u8:1/13 is trying to acquire lock:
[  131.123182][   T13] ffff888028da0558 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x153/0x4b0
[  131.127142][   T13] 
[  131.127142][   T13] but task is already holding lock:
[  131.130247][   T13] ffff88802ffd1558 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __dev_queue_xmit+0x15bd/0x3a70
[  131.134413][   T13] 
[  131.134413][   T13] other info that might help us debug this:
[  131.137701][   T13]  Possible unsafe locking scenario:
[  131.137701][   T13] 
[  131.140893][   T13]        CPU0
[  131.142343][   T13]        ----
[  131.143804][   T13]   lock(&qdisc_xmit_lock_key#4);
[  131.146003][   T13]   lock(&qdisc_xmit_lock_key#4);
[  131.148091][   T13] 
[  131.148091][   T13]  *** DEADLOCK ***
[  131.148091][   T13] 
[  131.150956][   T13]  May be due to missing lock nesting notation
[  131.150956][   T13] 
[  131.153661][   T13] 12 locks held by kworker/u8:1/13:
[  131.155439][   T13]  #0: ffff888109080148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  131.159494][   T13]  #1: ffffc90000107bc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  131.164597][   T13]  #2: ffffffff8f50ffc8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0
[  131.168423][   T13]  #3: ffff88810e99f538 (&idev->mc_lock){+.+.}-{4:4}, at: ipv6_mc_dad_complete+0x32/0x4b0
[  131.171536][   T13]  #4: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x1de/0xd80
[  131.175266][   T13]  #5: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: ip6_finish_output2+0x701/0x16a0
[  131.179297][   T13]  #6: ffffffff8e13eec0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70
[  131.183370][   T13]  #7: ffff88802ffd1558 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: __dev_queue_xmit+0x15bd/0x3a70
[  131.187294][   T13]  #8: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x452/0x1160
[  131.190529][   T13]  #9: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x23/0x270
[  131.193501][   T13]  #10: ffffffff8e13eec0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x27e/0x3a70
[  131.197160][   T13]  #11: ffff88803044b258 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#2){+...}-{3:3}, at: __dev_queue_xmit+0x1300/0x3a70
[  131.201321][   T13] 
[  131.201321][   T13] stack backtrace:
[  131.203282][   T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  131.203292][   T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  131.203297][   T13] Workqueue: ipv6_addrconf addrconf_dad_work
[  131.203307][   T13] Call Trace:
[  131.203311][   T13]  <TASK>
[  131.203315][   T13]  dump_stack_lvl+0x189/0x250
[  131.203327][   T13]  ? __pfx_dump_stack_lvl+0x10/0x10
[  131.203337][   T13]  ? __pfx__printk+0x10/0x10
[  131.203343][   T13]  ? __kasan_check_byte+0x12/0x40
[  131.203351][   T13]  ? print_lock_name+0xde/0x100
[  131.203358][   T13]  print_deadlock_bug+0x28b/0x2a0
[  131.203365][   T13]  validate_chain+0x1a3f/0x2140
[  131.203372][   T13]  ? validate_xmit_xfrm+0xbf/0x1130
[  131.203382][   T13]  ? unwind_next_frame+0xa5/0x2390
[  131.203392][   T13]  ? __pfx_validate_xmit_xfrm+0x10/0x10
[  131.203403][   T13]  __lock_acquire+0xab9/0xd20
[  131.203413][   T13]  ? sch_direct_xmit+0x153/0x4b0
[  131.203419][   T13]  lock_acquire+0x120/0x360
[  131.203428][   T13]  ? sch_direct_xmit+0x153/0x4b0
[  131.203436][   T13]  _raw_spin_lock+0x2e/0x40
[  131.203445][   T13]  ? sch_direct_xmit+0x153/0x4b0
[  131.203450][   T13]  sch_direct_xmit+0x153/0x4b0
[  131.203457][   T13]  ? __pfx_sch_direct_xmit+0x10/0x10
[  131.203465][   T13]  __dev_queue_xmit+0x17b6/0x3a70
[  131.203474][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[  131.203484][   T13]  ? __dev_queue_xmit+0x27e/0x3a70
[  131.203493][   T13]  ? arpt_do_table+0x1dc4/0x1fd0
[  131.203503][   T13]  ? __pfx___dev_queue_xmit+0x10/0x10
[  131.203513][   T13]  ? arpt_do_table+0x238/0x1fd0
[  131.203521][   T13]  ? __pfx_arpt_do_table+0x10/0x10
[  131.203531][   T13]  ? NF_HOOK+0x9e/0x3a0
[  131.203541][   T13]  NF_HOOK+0x310/0x3a0
[  131.203550][   T13]  ? __pfx_arp_xmit_finish+0x10/0x10
[  131.203560][   T13]  ? NF_HOOK+0x9e/0x3a0
[  131.203568][   T13]  ? __pfx_NF_HOOK+0x10/0x10
[  131.203577][   T13]  ? __pfx_arp_xmit_finish+0x10/0x10
[  131.203588][   T13]  arp_xmit+0x16c/0x270
[  131.203597][   T13]  ? arp_xmit+0x23/0x270
[  131.203606][   T13]  arp_solicit+0xc1d/0xe60
[  131.203616][   T13]  ? arp_solicit+0x11a/0xe60
[  131.203626][   T13]  ? __pfx_arp_solicit+0x10/0x10
[  131.203636][   T13]  ? __neigh_event_send+0xf08/0x1560
[  131.203647][   T13]  ? __pfx_arp_solicit+0x10/0x10
[  131.203656][   T13]  __neigh_event_send+0xf70/0x1560
[  131.203668][   T13]  neigh_resolve_output+0x198/0x750
[  131.203675][   T13]  ? __pfx_ip_neigh_gw4+0x10/0x10
[  131.203686][   T13]  ip_finish_output2+0xd40/0x1160
[  131.203695][   T13]  ? ip_skb_dst_mtu+0x147/0xc50
[  131.203705][   T13]  ? ip_finish_output2+0x452/0x1160
[  131.203714][   T13]  ? __pfx_ip_finish_output2+0x10/0x10
[  131.203723][   T13]  ? ip_skb_dst_mtu+0x147/0xc50
[  131.203731][   T13]  ? ip_skb_dst_mtu+0x147/0xc50
[  131.203740][   T13]  ? ip_skb_dst_mtu+0x970/0xc50
[  131.203749][   T13]  ? __ip_finish_output+0x336/0x3f0
[  131.203764][   T13]  iptunnel_xmit+0x571/0xa00
[  131.203773][   T13]  ip_tunnel_xmit+0x1c3c/0x2380
[  131.203787][   T13]  ? __pfx_ip_tunnel_xmit+0x10/0x10
[  131.203796][   T13]  ? gre_build_header+0x3fd/0xa40
[  131.203806][   T13]  ? __pfx_gre_build_header+0x10/0x10
[  131.203814][   T13]  ? iptunnel_handle_offloads+0x2fd/0x630
[  131.203842][   T13]  ipgre_xmit+0x89e/0xc50
[  131.203855][   T13]  ? __pfx_ipgre_xmit+0x10/0x10
[  131.203863][   T13]  ? __lock_acquire+0xab9/0xd20
[  131.203873][   T13]  dev_hard_start_xmit+0x2d7/0x830
[  131.203884][   T13]  __dev_queue_xmit+0x1adf/0x3a70
[  131.203892][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[  131.203902][   T13]  ? __dev_queue_xmit+0x27e/0x3a70
[  131.203912][   T13]  ? __pfx___dev_queue_xmit+0x10/0x10
[  131.203920][   T13]  ? __local_bh_enable_ip+0x12d/0x1c0
[  131.203930][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[  131.203939][   T13]  ? __local_bh_enable_ip+0x12d/0x1c0
[  131.203948][   T13]  ? __pfx___local_bh_enable_ip+0x10/0x10
[  131.203957][   T13]  ? ___neigh_create+0x1c83/0x2260
[  131.203966][   T13]  ? ___neigh_create+0x1c83/0x2260
[  131.203980][   T13]  ip6_finish_output2+0x11fe/0x16a0
[  131.203989][   T13]  ? ip6_finish_output2+0x701/0x16a0
[  131.203998][   T13]  ? __pfx_ip6_finish_output2+0x10/0x10
[  131.204006][   T13]  ? ip6_mtu+0x7d/0x3f0
[  131.204015][   T13]  ? ip6_mtu+0x7d/0x3f0
[  131.204022][   T13]  ip6_finish_output+0x234/0x7d0
[  131.204030][   T13]  NF_HOOK+0x9e/0x380
[  131.204039][   T13]  ? NF_HOOK+0x101/0x380
[  131.204046][   T13]  ? __pfx_NF_HOOK+0x10/0x10
[  131.204053][   T13]  ? __pfx_dst_output+0x10/0x10
[  131.204060][   T13]  ? icmp6_dst_alloc+0x3a5/0x420
[  131.204068][   T13]  ? icmp6_dst_alloc+0x3a5/0x420
[  131.204075][   T13]  mld_sendpack+0x800/0xd80
[  131.204083][   T13]  ? __asan_memcpy+0x40/0x70
[  131.204093][   T13]  ? mld_sendpack+0x1de/0xd80
[  131.204101][   T13]  ? __pfx_mld_sendpack+0x10/0x10
[  131.204111][   T13]  ? mld_send_initial_cr+0x2f7/0x4c0
[  131.204118][   T13]  ipv6_mc_dad_complete+0x88/0x4b0
[  131.204126][   T13]  addrconf_dad_completed+0x6d5/0xd60
[  131.204134][   T13]  ? __pfx_addrconf_dad_completed+0x10/0x10
[  131.204143][   T13]  addrconf_dad_work+0xc36/0x14b0
[  131.204149][   T13]  ? __lock_acquire+0xab9/0xd20
[  131.204159][   T13]  ? __pfx_addrconf_dad_work+0x10/0x10
[  131.204165][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[  131.204176][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[  131.204184][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[  131.204193][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[  131.204202][   T13]  process_scheduled_works+0xae1/0x17b0
[  131.204216][   T13]  ? __pfx_process_scheduled_works+0x10/0x10
[  131.204228][   T13]  worker_thread+0x8a0/0xda0
[  131.204241][   T13]  kthread+0x711/0x8a0
[  131.204249][   T13]  ? __pfx_worker_thread+0x10/0x10
[  131.204259][   T13]  ? __pfx_kthread+0x10/0x10
[  131.204267][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[  131.204275][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[  131.204283][   T13]  ? __pfx_kthread+0x10/0x10
[  131.204290][   T13]  ret_from_fork+0x3fc/0x770
[  131.204299][   T13]  ? __pfx_ret_from_fork+0x10/0x10
[  131.204309][   T13]  ? __switch_to_asm+0x39/0x70
[  131.204315][   T13]  ? __switch_to_asm+0x33/0x70
[  131.204321][   T13]  ? __pfx_kthread+0x10/0x10
[  131.204328][   T13]  ret_from_fork_asm+0x1a/0x30
[  131.204337][   T13]  </TASK>
[  132.542360][ T1361] ieee802154 phy1 wpan1: encryption failed: -22

VM DIAGNOSIS:
09:43:00  Registers:
info registers vcpu 0

CPU#0
RAX=ffffffff81b4d920 RBX=ffff88804b03b1c0 RCX=ffff888107a0d640 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc90003b2f6c0 RSP=ffffc90003b2f560
R8 =ffffffff8fa10df7 R9 =1ffffffff1f421be R10=dffffc0000000000 R11=fffffbfff1f421bf
R12=1ffff11026cc7f5d R13=dffffc0000000000 R14=0000000000000001 R15=ffff88813663fae8
RIP=ffffffff81b4d909 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00005555675dd500 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2f01bff8 CR3=0000000120880000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007fd9ccf84478 00007fd9ccf84450 XMM03=00007fd9ccf84488 00007fd9ccf84480
XMM04=00007fd9cdaed100 00007fd9ccf84440 XMM05=00007fd9ccf84458 00007fd9ccf844a0
XMM06=00007fd9ccf84498 00007fd9ccf84490 XMM07=00007fd9ccf84488 00007fd9ccf84480
XMM08=5f7265705f736574 6174735f78616d20 XMM09=0000000000000000 00007fd9cce11c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000065 RBX=0000000000000065 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900001059d0
R8 =ffff888108080237 R9 =1ffff11021010046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac48f7 R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f7c31ee56c0 CR3=0000000120880000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 00007f7c31211c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
