last executing test programs:

1.770519965s ago: executing program 1 (id=2369):
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_RESVSP(r0, 0x4030582a, &(0x7f0000000380)={0x0, 0x0, 0x10, 0x7})

1.770450905s ago: executing program 1 (id=2370):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001800010000000000fedbdf25020000000001000900000000060015000400000014001680100008800c000380050001"], 0x38}, 0x1, 0x0, 0x0, 0x880}, 0x0)

1.697921228s ago: executing program 1 (id=2373):
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
pipe(&(0x7f00000000c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r1, &(0x7f0000000240)="94", 0x1)
vmsplice(r2, &(0x7f0000000380)=[{&(0x7f0000013580)='\r', 0x1}], 0x1, 0x0)
tee(r0, r3, 0x8f5, 0x100000000000000)

1.610873951s ago: executing program 1 (id=2375):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xc0}, [@ldst={0x5}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48)

1.610387068s ago: executing program 1 (id=2377):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010003000000000000002600000018000180140002006c6f"], 0x2c}}, 0x0)

1.560478179s ago: executing program 1 (id=2379):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$int_in(r0, 0x0, &(0x7f0000000140)=0xd)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
socket$kcm(0x2, 0x0, 0x2)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.events\x00', 0x275a, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0)
syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0)
r2 = socket$nl_sock_diag(0x10, 0x3, 0x4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff3, 0xffff}}}, 0x24}}, 0x0)
sendmsg$DCCPDIAG_GETSOCK(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="50000000130008002abd7000ffdbdf252606008e4e204e240300000007000000000000c048ea00009ccfffff03000000ffffff7f00010000", @ANYRES32, @ANYBLOB="052a670006000000010000000100000004000100"], 0x50}, 0x1, 0x0, 0x0, 0x20000040}, 0x800)
r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000020605000000000000000000000000050500010007000000090000050004000000000013000300686173683a6e65742c69666163650000"], 0x44}}, 0x0)
bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0)
r6 = syz_init_net_socket$ax25(0x3, 0x3, 0x0)
bind$ax25(r6, &(0x7f0000000380)={{0x3, @null, 0x1}, [@null={0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x2}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x3c)
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007b243ce4b3daa7804f"], 0x48)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r8 = socket$alg(0x26, 0x5, 0x0)
accept4(r8, 0x0, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000cc0)='mmap_lock_acquire_returned\x00', r7}, 0x10)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r9=>0xffffffffffffffff, <r10=>0xffffffffffffffff})
recvmsg(r9, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00)
sendmsg$tipc(r10, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0)

1.240806671s ago: executing program 0 (id=2388):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @empty}, 0x10)
setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000d10ffc), 0x4)

1.080510999s ago: executing program 2 (id=2391):
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000340)=@bpf_lsm={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000061114c0000000000850000006300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2e}, 0x94)

1.080311225s ago: executing program 2 (id=2392):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x44, r1, 0x1, 0x170bd2c, 0x8000, {0x34}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x73}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x44}}, 0x20000000)

1.080027852s ago: executing program 2 (id=2393):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000000d060103000000000000000002000003050001"], 0x1c}, 0x1, 0x0, 0x0, 0x2400c090}, 0x4)

1.011216036s ago: executing program 2 (id=2394):
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
close(r2)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @random="e5db029ea53c"})
write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="1e000300008c71ef28ff4b"], 0xffdd)

379.646234ms ago: executing program 0 (id=2395):
r0 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$inet_opts(r0, 0x0, 0x5, 0x0, 0x0)

288.647913ms ago: executing program 0 (id=2396):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b04000000000000000002000000400004803c0001800b00010065787468647200002c000280080004400000000408000740000300040800064000000001050002000000000008000340000000040900010073797a30000000000900020073797a32"], 0x94}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x5c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0x30, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'veth1_to_bridge\x00'}]}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x84}, 0x1, 0x0, 0x0, 0x40044}, 0x20008000)

230.167371ms ago: executing program 0 (id=2397):
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r2 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r3 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f00000000c0)=0x4, 0x4)
bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r4 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4)
bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r5 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r5, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r6 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r6, &(0x7f0000000000)={0xa, 0xe20, 0x0, @empty}, 0x1c)
r7 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000080)=0x5, 0x4)
bind$inet6(r7, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r8 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
r9 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r9, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c)
r10 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(r10, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4)
bind$inet6(r10, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c)
r11 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r11, &(0x7f0000000480)={0xa, 0xe20, 0x0, @empty}, 0x1c)

119.466052ms ago: executing program 0 (id=2398):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r1)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000))
ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'})
r2 = socket$unix(0x1, 0x1, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r4, {}, {0x2, 0xb}, {0xfffe, 0xd}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x38, 0x2, [@TCA_TBF_RATE64={0xc, 0x4, 0xdf69a3e9e9fe1f26}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x2, 0x3, 0x9, 0x6, 0x4}, {0x8, 0x1, 0x7, 0x2, 0x686}, 0x1, 0x6, 0x124}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000)

414.508µs ago: executing program 2 (id=2399):
unshare(0x400)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001d80)={@ifindex, r0, 0x36, 0x14}, 0x20)

185.458µs ago: executing program 2 (id=2400):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="380000000314010028bd7000f6dbdf250900020073797a31001800000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x810)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r3, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1d, 0x8e, 0xe365e39d0c265083}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x20048080)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}]}, 0x50}}, 0x0)

0s ago: executing program 0 (id=2401):
r0 = socket$xdp(0x2c, 0x3, 0x0)
getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, 0x0, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:23068' (ED25519) to the list of known hosts.
syzkaller login: [   39.969713][ T5745] cgroup: Unknown subsys name 'net'
[   40.056818][ T5745] cgroup: Unknown subsys name 'cpuset'
[   40.060426][ T5745] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   41.399092][ T5745] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   48.598751][ T5845] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   50.325290][ T5858] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   50.330446][ T5858] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   50.333223][ T5858] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   50.337097][ T5858] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   50.339787][ T5858] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   50.356195][ T5858] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   50.358907][ T5858] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   50.362412][ T5858] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   50.366031][ T5858] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   50.369306][ T5858] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   50.419235][ T5210] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   50.422041][ T5210] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   50.434139][ T5210] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   50.440051][ T5210] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   50.442518][ T5210] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   50.601879][ T5856] chnl_net:caif_netlink_parms(): no params data found
[   50.676558][ T5859] chnl_net:caif_netlink_parms(): no params data found
[   50.740107][ T5856] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.742742][ T5856] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.745219][ T5856] bridge_slave_0: entered allmulticast mode
[   50.747957][ T5856] bridge_slave_0: entered promiscuous mode
[   50.754767][ T5856] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.757093][ T5856] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.759349][ T5856] bridge_slave_1: entered allmulticast mode
[   50.761973][ T5856] bridge_slave_1: entered promiscuous mode
[   50.786253][ T5856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   50.792670][ T5861] chnl_net:caif_netlink_parms(): no params data found
[   50.799546][ T5856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   50.827474][ T5859] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.829845][ T5859] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.832119][ T5859] bridge_slave_0: entered allmulticast mode
[   50.835157][ T5859] bridge_slave_0: entered promiscuous mode
[   50.838310][ T5859] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.840537][ T5859] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.842803][ T5859] bridge_slave_1: entered allmulticast mode
[   50.846260][ T5859] bridge_slave_1: entered promiscuous mode
[   50.881403][ T5856] team0: Port device team_slave_0 added
[   50.889474][ T5859] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   50.896979][ T5856] team0: Port device team_slave_1 added
[   50.900209][ T5859] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   50.949205][ T5859] team0: Port device team_slave_0 added
[   50.951780][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_0
[   50.953969][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   50.962534][ T5856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   50.981580][ T5861] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.984705][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.987879][ T5861] bridge_slave_0: entered allmulticast mode
[   50.991613][ T5861] bridge_slave_0: entered promiscuous mode
[   50.997414][ T5859] team0: Port device team_slave_1 added
[   51.000142][ T5861] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.002476][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state
[   51.005035][ T5861] bridge_slave_1: entered allmulticast mode
[   51.007642][ T5861] bridge_slave_1: entered promiscuous mode
[   51.010389][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_1
[   51.012583][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   51.021080][ T5856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   51.064562][ T5861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   51.068085][ T5859] batman_adv: batadv0: Adding interface: batadv_slave_0
[   51.070318][ T5859] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   51.078474][ T5859] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   51.084061][ T5861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   51.108920][ T5859] batman_adv: batadv0: Adding interface: batadv_slave_1
[   51.111126][ T5859] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   51.119701][ T5859] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   51.138106][ T5861] team0: Port device team_slave_0 added
[   51.141886][ T5861] team0: Port device team_slave_1 added
[   51.183881][ T5856] hsr_slave_0: entered promiscuous mode
[   51.186835][ T5856] hsr_slave_1: entered promiscuous mode
[   51.197852][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_0
[   51.200104][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   51.208623][ T5861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   51.213615][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_1
[   51.216408][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   51.226612][ T5861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   51.241564][ T5859] hsr_slave_0: entered promiscuous mode
[   51.243822][ T5859] hsr_slave_1: entered promiscuous mode
[   51.246470][ T5859] debugfs: 'hsr0' already exists in 'hsr'
[   51.248306][ T5859] Cannot create hsr debugfs directory
[   51.299572][ T5861] hsr_slave_0: entered promiscuous mode
[   51.302256][ T5861] hsr_slave_1: entered promiscuous mode
[   51.305322][ T5861] debugfs: 'hsr0' already exists in 'hsr'
[   51.307160][ T5861] Cannot create hsr debugfs directory
[   51.499363][ T5856] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   51.514871][ T5856] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   51.519401][ T5856] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   51.528797][ T5856] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   51.559755][ T5859] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   51.566425][ T5859] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   51.581805][ T5859] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   51.588937][ T5859] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   51.636430][ T5861] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   51.642517][ T5861] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   51.648050][ T5861] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   51.657319][ T5861] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   51.733807][ T5859] 8021q: adding VLAN 0 to HW filter on device bond0
[   51.739280][ T5856] 8021q: adding VLAN 0 to HW filter on device bond0
[   51.760914][ T5859] 8021q: adding VLAN 0 to HW filter on device team0
[   51.771971][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.774303][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.782136][ T5856] 8021q: adding VLAN 0 to HW filter on device team0
[   51.790558][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.792843][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.800842][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.803127][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.828001][ T5859] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   51.835301][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.837611][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.843075][ T5861] 8021q: adding VLAN 0 to HW filter on device bond0
[   51.893621][ T5861] 8021q: adding VLAN 0 to HW filter on device team0
[   51.926902][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   51.929256][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   51.945303][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   51.947544][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   51.964120][ T5861] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   51.967785][ T5861] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   51.990605][ T5859] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.018860][ T5859] veth0_vlan: entered promiscuous mode
[   52.036325][ T5859] veth1_vlan: entered promiscuous mode
[   52.050586][ T5856] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.077311][ T5859] veth0_macvtap: entered promiscuous mode
[   52.087003][ T5859] veth1_macvtap: entered promiscuous mode
[   52.107178][ T5856] veth0_vlan: entered promiscuous mode
[   52.113387][ T5856] veth1_vlan: entered promiscuous mode
[   52.119920][ T5859] batman_adv: batadv0: Interface activated: batadv_slave_0
[   52.123664][ T5861] 8021q: adding VLAN 0 to HW filter on device batadv0
[   52.133855][ T5859] batman_adv: batadv0: Interface activated: batadv_slave_1
[   52.157238][ T5896] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   52.170081][ T5896] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   52.172818][ T5896] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   52.182052][ T5896] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   52.196861][ T5856] veth0_macvtap: entered promiscuous mode
[   52.218525][ T5856] veth1_macvtap: entered promiscuous mode
[   52.221478][ T5861] veth0_vlan: entered promiscuous mode
[   52.231939][ T5861] veth1_vlan: entered promiscuous mode
[   52.249472][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_0
[   52.255616][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_1
[   52.263938][  T390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.271782][ T5861] veth0_macvtap: entered promiscuous mode
[   52.274124][  T390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.291105][ T5861] veth1_macvtap: entered promiscuous mode
[   52.296307][ T5695] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   52.305056][ T5695] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   52.311122][ T5695] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   52.319973][  T584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.327980][ T5695] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   52.331076][  T584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.365647][  T390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.366485][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_0
[   52.368199][  T390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.395391][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_1
[   52.403784][  T390] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.408116][   T54] Bluetooth: hci1: command tx timeout
[   52.410101][   T54] Bluetooth: hci0: command tx timeout
[   52.410477][ T5866] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   52.412902][  T390] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.417930][ T5866] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   52.420942][ T5866] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   52.423700][ T5866] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   52.485580][ T5864] Bluetooth: hci2: command tx timeout
[   52.518904][  T403] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.521422][  T403] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.543331][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   52.553575][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   52.628533][ T5933] warning: `syz.1.25' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   52.725983][ T5948] netlink: 24 bytes leftover after parsing attributes in process `syz.2.32'.
[   52.790564][ T5956] netlink: 8 bytes leftover after parsing attributes in process `syz.0.36'.
[   52.804615][ T5956] netlink: 'syz.0.36': attribute type 5 has an invalid length.
[   52.817056][ T5956] netlink: 20 bytes leftover after parsing attributes in process `syz.0.36'.
[   52.833477][ T5956] geneve2: entered promiscuous mode
[   52.836577][ T5956] geneve2: entered allmulticast mode
[   52.839694][ T5866] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0
[   52.845565][ T5866] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0
[   52.848565][ T5866] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0
[   52.863775][ T5866] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0
[   52.902131][ T5964] netlink: 12 bytes leftover after parsing attributes in process `syz.0.41'.
[   52.920216][ T5966] netlink: 24 bytes leftover after parsing attributes in process `syz.1.40'.
[   52.949785][ T5970] tipc: Started in network mode
[   52.955762][ T5970] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711
[   52.962589][ T5970] tipc: Enabled bearer <eth:team0>, priority 10
[   53.010632][ T5976] netlink: 'syz.0.46': attribute type 1 has an invalid length.
[   53.193567][ T5998] netlink: 12 bytes leftover after parsing attributes in process `syz.2.55'.
[   53.268200][ T6002] Zero length message leads to an empty skb
[   53.376872][ T6016] tipc: Started in network mode
[   53.378507][ T6016] tipc: Node identity 2e2c7d365de3, cluster identity 4711
[   53.380885][ T6016] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   53.382916][ T6018] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.65'.
[   53.386753][ T6016] syzkaller0: entered promiscuous mode
[   53.388554][ T6016] syzkaller0: entered allmulticast mode
[   53.410055][ T6016] tipc: Resetting bearer <eth:syzkaller0>
[   53.432108][ T6013] tipc: Resetting bearer <eth:syzkaller0>
[   53.440854][ T6013] tipc: Disabling bearer <eth:syzkaller0>
[   53.467171][ T6027] netlink: 32 bytes leftover after parsing attributes in process `syz.0.70'.
[   53.518299][ T6033] pim6reg: entered allmulticast mode
[   53.519366][ T6031] netlink: 4 bytes leftover after parsing attributes in process `syz.2.71'.
[   53.527464][ T6031] batadv0: entered promiscuous mode
[   53.533510][ T6031] batadv0: left promiscuous mode
[   54.014101][ T6086] syz.1.97 uses obsolete (PF_INET,SOCK_PACKET)
[   54.067436][ T6094] netlink: 'syz.2.102': attribute type 1 has an invalid length.
[   54.070091][ T6094] netlink: 244 bytes leftover after parsing attributes in process `syz.2.102'.
[   54.075351][ T5903] tipc: Node number set to 11578026
[   54.260803][ T5903] IPVS: starting estimator thread 0...
[   54.355548][ T6122] IPVS: using max 79 ests per chain, 189600 per kthread
[   54.394863][ T6142] syzkaller1: entered promiscuous mode
[   54.396700][ T6142] syzkaller1: entered allmulticast mode
[   54.494487][ T5864] Bluetooth: hci0: command tx timeout
[   54.495381][   T54] Bluetooth: hci1: command tx timeout
[   54.565138][   T54] Bluetooth: hci2: command tx timeout
[   54.621363][ T6146] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   54.625234][ T6146] syzkaller0: MTU too low for tipc bearer
[   54.627232][ T6146] tipc: Disabling bearer <eth:syzkaller0>
[   54.718640][ T6150] netlink: 'syz.1.129': attribute type 1 has an invalid length.
[   55.326258][ T6196] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   55.626016][ T6227] trusted_key: syz.1.165 sent an empty control message without MSG_MORE.
[   55.696959][ T6233] netlink: 'syz.1.168': attribute type 1 has an invalid length.
[   55.910372][ T6242] Driver unsupported XDP return value 0 on prog  (id 32) dev N/A, expect packet loss!
[   55.983951][ T6248] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   56.286726][ T6275] geneve2: entered promiscuous mode
[   56.289727][ T6273] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   56.293028][ T6273] syzkaller0: entered promiscuous mode
[   56.296858][ T6273] syzkaller0: entered allmulticast mode
[   56.318857][ T6273] tipc: Resetting bearer <eth:syzkaller0>
[   56.323957][ T6272] tipc: Resetting bearer <eth:syzkaller0>
[   56.333785][ T6272] tipc: Disabling bearer <eth:syzkaller0>
[   56.496850][ T6290] netlink: 'syz.1.194': attribute type 13 has an invalid length.
[   56.560079][ T6290] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   56.566576][   T54] Bluetooth: hci1: command tx timeout
[   56.576879][   T54] Bluetooth: hci0: command tx timeout
[   56.645659][   T54] Bluetooth: hci2: command tx timeout
[   56.664746][ T6305] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   56.707236][ T6309] veth1: entered promiscuous mode
[   56.712189][ T6309] netlink: 'syz.2.204': attribute type 1 has an invalid length.
[   56.715214][ T6309] A link change request failed with some changes committed already. Interface veth1 may have been left with an inconsistent configuration, please check.
[   57.259732][ T6393] pim6reg1: entered promiscuous mode
[   57.261554][ T6393] pim6reg1: entered allmulticast mode
[   57.263907][ T6395] syzkaller1: entered promiscuous mode
[   57.268257][ T6395] syzkaller1: entered allmulticast mode
[   57.312827][ T6399] tipc: Enabled bearer <eth:ipvlan1>, priority 14
[   57.736106][ T6452] IPVS: nq: UDP 224.0.0.2:0 - no destination available
[   57.919382][ T6477] ieee802154 phy0 wpan0: encryption failed: -22
[   57.922308][ T6477] __nla_validate_parse: 20 callbacks suppressed
[   57.922317][ T6477] netlink: 196 bytes leftover after parsing attributes in process `syz.0.274'.
[   58.072558][ T6493] syzkaller0: entered promiscuous mode
[   58.074701][ T6493] syzkaller0: entered allmulticast mode
[   58.424602][ T5847] tipc: Node number set to 1942977846
[   58.654722][ T5864] Bluetooth: hci1: command tx timeout
[   58.656560][   T54] Bluetooth: hci0: command tx timeout
[   58.734759][   T54] Bluetooth: hci2: command tx timeout
[   58.741568][ T6506] netlink: 4 bytes leftover after parsing attributes in process `syz.0.288'.
[   58.876804][ T5847] IPVS: starting estimator thread 0...
[   58.975184][ T6514] IPVS: using max 51 ests per chain, 122400 per kthread
[   59.112026][ T6540] netlink: 'syz.1.304': attribute type 1 has an invalid length.
[   59.166842][ T6540] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link
[   59.177465][ T5695] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[   59.185605][ T6540] 8021q: adding VLAN 0 to HW filter on device bond1
[   59.253740][ T6540] bond1 (unregistering): (slave ip6gretap1): Removing an active aggregator
[   59.257732][ T6540] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface
[   59.262446][ T6540] bond1 (unregistering): Released all slaves
[   59.332188][ T6540] syz.1.304 (6540) used greatest stack depth: 19192 bytes left
[   59.356525][ T6563] netlink: 12 bytes leftover after parsing attributes in process `syz.0.315'.
[   59.423719][ T6572] netlink: 260 bytes leftover after parsing attributes in process `syz.0.319'.
[   59.510382][ T6574] netlink: 'syz.0.320': attribute type 10 has an invalid length.
[   59.517230][ T6574] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   59.623708][ T6581] netlink: 8 bytes leftover after parsing attributes in process `syz.1.323'.
[   59.720355][ T6590] netlink: 32 bytes leftover after parsing attributes in process `syz.1.327'.
[   60.739905][ T6611] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   61.279907][ T6656] veth1_to_batadv: entered promiscuous mode
[   61.326627][ T6666] netlink: 32 bytes leftover after parsing attributes in process `syz.0.357'.
[   61.333295][ T6666] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048)
[   61.351641][ T6659] netlink: del zone limit has 4 unknown bytes
[   61.591740][ T6710] netlink: 4 bytes leftover after parsing attributes in process `syz.2.375'.
[   61.597433][ T6710] vlan0: entered promiscuous mode
[   61.602655][ T6710] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check.
[   61.630538][ T6718] ICMPv6: NA: aa:aa:aa:aa:aa:00 advertised our address fe80::aa on syz_tun!
[   61.681426][   T10] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0
[   61.691273][   T10] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0
[   61.706488][   T10] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[   61.729221][ T6731] tipc: Enabling of bearer <et:g> rejected, media not registered
[   61.841041][ T6745] netlink: 'syz.1.386': attribute type 5 has an invalid length.
[   62.097779][ T6774] netlink: 12 bytes leftover after parsing attributes in process `syz.0.400'.
[   62.100878][ T6774] netlink: 4 bytes leftover after parsing attributes in process `syz.0.400'.
[   63.021696][ T6809] netlink: 'syz.2.416': attribute type 2 has an invalid length.
[   63.269537][ T6823] netlink: 248 bytes leftover after parsing attributes in process `syz.2.423'.
[   63.965549][ T6923] openvswitch: netlink: Flow actions attr not present in new flow.
[   64.261014][ T6952] Bluetooth: MGMT ver 1.23
[   64.358006][ T6959] netlink: 12 bytes leftover after parsing attributes in process `syz.1.470'.
[   64.361037][ T6959] netlink: 48 bytes leftover after parsing attributes in process `syz.1.470'.
[   64.751991][ T7004] netlink: 4 bytes leftover after parsing attributes in process `syz.0.485'.
[   64.762445][ T7002] syzkaller0: entered promiscuous mode
[   64.764316][ T7002] syzkaller0: entered allmulticast mode
[   64.779882][ T7004] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.801451][ T7004] bridge_slave_1 (unregistering): left allmulticast mode
[   64.806850][ T7004] bridge_slave_1 (unregistering): left promiscuous mode
[   64.809425][ T7004] bridge0: port 2(bridge_slave_1) entered disabled state
[   66.789836][ T7118] GUP no longer grows the stack in syz.1.531 (7118): 200000002000-20000000a000 (200000001000)
[   66.793367][ T7118] CPU: 0 UID: 0 PID: 7118 Comm: syz.1.531 Not tainted 6.16.0-syzkaller-06600-g1dbf1d590d10-dirty #0 PREEMPT(full) 
[   66.793380][ T7118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   66.793385][ T7118] Call Trace:
[   66.793389][ T7118]  <TASK>
[   66.793393][ T7118]  dump_stack_lvl+0x189/0x250
[   66.793408][ T7118]  ? __pfx_dump_stack_lvl+0x10/0x10
[   66.793416][ T7118]  ? __pfx__printk+0x10/0x10
[   66.793425][ T7118]  ? find_vma+0xe7/0x160
[   66.793442][ T7118]  __get_user_pages+0x2a60/0x30b0
[   66.793466][ T7118]  ? __pfx___get_user_pages+0x10/0x10
[   66.793479][ T7118]  __gup_longterm_locked+0xd66/0x15b0
[   66.793492][ T7118]  ? try_grab_folio_fast+0x35b/0x4f0
[   66.793504][ T7118]  ? sanity_check_pinned_pages+0x11c8/0x12c0
[   66.793517][ T7118]  gup_fast_fallback+0x1cd4/0x2260
[   66.793541][ T7118]  ? __pfx_gup_fast_fallback+0x10/0x10
[   66.793553][ T7118]  ? stack_depot_save_flags+0x429/0x900
[   66.793585][ T7118]  ? pin_user_pages_fast+0x4d/0xb0
[   66.793597][ T7118]  iov_iter_extract_pages+0x35a/0x5e0
[   66.793612][ T7118]  extract_iter_to_sg+0xe46/0x24e0
[   66.793628][ T7118]  ? __pfx_extract_iter_to_sg+0x10/0x10
[   66.793644][ T7118]  ? __asan_memset+0x22/0x50
[   66.793655][ T7118]  af_alg_get_rsgl+0x436/0x810
[   66.793676][ T7118]  aead_recvmsg+0x4cc/0x13f0
[   66.793694][ T7118]  ? __pfx_aead_recvmsg+0x10/0x10
[   66.793701][ T7118]  ? __schedule+0x1755/0x4d30
[   66.793713][ T7118]  ? bpf_lsm_socket_recvmsg+0x9/0x20
[   66.793723][ T7118]  ? __pfx_aead_recvmsg+0x10/0x10
[   66.793730][ T7118]  sock_recvmsg_nosec+0x186/0x1c0
[   66.793743][ T7118]  ____sys_recvmsg+0x3aa/0x460
[   66.793755][ T7118]  ? __pfx_____sys_recvmsg+0x10/0x10
[   66.793769][ T7118]  ? import_iovec+0x74/0xa0
[   66.793780][ T7118]  ___sys_recvmsg+0x1b5/0x510
[   66.793790][ T7118]  ? __pfx____sys_recvmsg+0x10/0x10
[   66.793811][ T7118]  ? __might_fault+0xb0/0x130
[   66.793824][ T7118]  do_recvmmsg+0x307/0x770
[   66.793836][ T7118]  ? __pfx_do_recvmmsg+0x10/0x10
[   66.793843][ T7118]  ? __ia32_sys_rt_sigreturn+0x6a2/0x7b0
[   66.793858][ T7118]  ? __pfx_do_futex+0x10/0x10
[   66.793875][ T7118]  __x64_sys_recvmmsg+0x190/0x240
[   66.793885][ T7118]  ? __pfx___x64_sys_recvmmsg+0x10/0x10
[   66.793892][ T7118]  ? rcu_is_watching+0x15/0xb0
[   66.793906][ T7118]  ? do_syscall_64+0xbe/0x3b0
[   66.793918][ T7118]  do_syscall_64+0xfa/0x3b0
[   66.793927][ T7118]  ? lockdep_hardirqs_on+0x9c/0x150
[   66.793937][ T7118]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   66.793944][ T7118]  ? exc_page_fault+0x9f/0xf0
[   66.793959][ T7118]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   66.793967][ T7118] RIP: 0033:0x7fcf84d8eb69
[   66.793974][ T7118] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   66.793981][ T7118] RSP: 002b:00007fcf82bf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
[   66.793991][ T7118] RAX: ffffffffffffffda RBX: 00007fcf84fb5fa0 RCX: 00007fcf84d8eb69
[   66.793997][ T7118] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 000000000000000b
[   66.794002][ T7118] RBP: 00007fcf84e11df1 R08: 0000000000000000 R09: 0000000000000000
[   66.794007][ T7118] R10: 0000000000000101 R11: 0000000000000246 R12: 0000000000000000
[   66.794011][ T7118] R13: 0000000000000000 R14: 00007fcf84fb5fa0 R15: 00007fff8b584888
[   66.794023][ T7118]  </TASK>
[   66.926460][   T33] audit: type=1804 audit(1754399337.607:2): pid=7118 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.531" name="x000000000000000400000000000000000000004" dev="tmpfs" ino=978 res=1 errno=0
[   66.936419][   T33] audit: type=1800 audit(1754399337.607:3): pid=7118 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.531" name="x000000000000000400000000000000000000004" dev="tmpfs" ino=978 res=0 errno=0
[   66.990554][ T7127] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   67.021458][ T7127] batman_adv: batadv0: Removing interface: batadv_slave_1
[   67.264117][ T7137] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   67.267965][ T7137] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[   67.327669][ T7137] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   67.331135][ T7137] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[   67.339293][ T7154] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.548'.
[   67.382795][ T7137] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   67.387647][ T7137] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[   67.439442][ T7137] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   67.443012][ T7137] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0
[   67.502912][ T5866] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 256 - 0
[   67.511508][ T5866] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0
[   67.521213][ T5866] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 256 - 0
[   67.527587][ T5866] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0
[   67.531413][ T5866] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 256 - 0
[   67.534298][ T5866] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0
[   67.549344][ T5866] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 256 - 0
[   67.554140][ T5866] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0
[   67.651259][ T7180] netlink: 24 bytes leftover after parsing attributes in process `syz.1.560'.
[   67.660695][ T7181] netlink: 8 bytes leftover after parsing attributes in process `syz.2.561'.
[   67.678952][ T7180] netlink: 4 bytes leftover after parsing attributes in process `syz.1.560'.
[   67.702831][ T7184] netlink: 8 bytes leftover after parsing attributes in process `syz.2.562'.
[   67.778060][ T7189] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check.
[   67.941744][ T7221] netlink: 12 bytes leftover after parsing attributes in process `syz.0.580'.
[   67.947894][ T7221] netlink: 'syz.0.580': attribute type 14 has an invalid length.
[   67.955647][ T5866] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[   67.959845][ T7221] netlink: 'syz.0.580': attribute type 14 has an invalid length.
[   67.963775][ T5866] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[   67.974428][ T5866] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[   67.977504][ T5866] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[   68.248182][ T7267] syzkaller1: entered promiscuous mode
[   68.250091][ T7267] syzkaller1: entered allmulticast mode
[   68.363001][ T7281] __nla_validate_parse: 1 callbacks suppressed
[   68.363012][ T7281] netlink: 84 bytes leftover after parsing attributes in process `syz.1.606'.
[   68.369224][ T7281] netlink: 28 bytes leftover after parsing attributes in process `syz.1.606'.
[   68.421517][ T7289] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.610'.
[   68.554851][ T7303] syzkaller0: entered allmulticast mode
[   68.571349][ T7305] tipc: Invalid UDP bearer configuration
[   68.571390][ T7305] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[   68.837431][ T7339] netlink: 92 bytes leftover after parsing attributes in process `syz.2.635'.
[   68.926052][ T7350] netlink: 'syz.1.641': attribute type 10 has an invalid length.
[   68.935991][ T7350] team0: Port device dummy0 added
[   68.939957][ T7350] netlink: 'syz.1.641': attribute type 10 has an invalid length.
[   68.946794][ T7350] team0: Port device dummy0 removed
[   68.950460][ T7350] bond0: (slave dummy0): Enslaving as an active interface with an up link
[   69.092249][ T7369] netlink: 56 bytes leftover after parsing attributes in process `syz.1.645'.
[   69.281586][ T7388] netlink: 24 bytes leftover after parsing attributes in process `syz.1.652'.
[   69.543790][ T7411] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[   69.576023][ T7415] netlink: 'syz.2.665': attribute type 2 has an invalid length.
[   69.578586][ T7415] netlink: 'syz.2.665': attribute type 2 has an invalid length.
[   69.653368][ T7425] netlink: 28 bytes leftover after parsing attributes in process `syz.1.670'.
[   69.658274][ T7425] netlink: 28 bytes leftover after parsing attributes in process `syz.1.670'.
[   69.789488][ T7441] netlink: 4 bytes leftover after parsing attributes in process `syz.1.677'.
[   69.949619][ T7457] openvswitch: netlink: Either Ethernet header or EtherType is required.
[   70.486052][ T7502] netlink: 8 bytes leftover after parsing attributes in process `syz.2.706'.
[   70.892615][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   70.895469][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   72.472301][ T7654] netlink: 'syz.0.757': attribute type 10 has an invalid length.
[   72.501623][ T7654] team0: Port device dummy0 added
[   72.511392][ T7654] netlink: 'syz.0.757': attribute type 10 has an invalid length.
[   72.540157][ T7654] team0: Port device dummy0 removed
[   72.550214][ T7654] bond0: (slave dummy0): Enslaving as an active interface with an up link
[   73.155964][ T7703] sctp: [Deprecated]: syz.1.765 (pid 7703) Use of int in max_burst socket option deprecated.
[   73.155964][ T7703] Use struct sctp_assoc_value instead
[   73.368616][ T7717] openvswitch: netlink: Duplicate or invalid key (type 0).
[   73.371914][ T7717] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   73.491112][ T7729] netlink: 'syz.1.778': attribute type 1 has an invalid length.
[   73.501117][ T7729] __nla_validate_parse: 7 callbacks suppressed
[   73.501128][ T7729] netlink: 224 bytes leftover after parsing attributes in process `syz.1.778'.
[   73.550383][ T7735] netlink: 20 bytes leftover after parsing attributes in process `syz.0.781'.
[   73.921693][   T33] audit: type=1800 audit(1754399344.607:4): pid=7737 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.782" name="cgroup.controllers" dev="tmpfs" ino=1531 res=0 errno=0
[   74.335072][ T7789] netlink: 4 bytes leftover after parsing attributes in process `syz.2.804'.
[   74.401476][ T7795] netlink: 'syz.0.806': attribute type 32 has an invalid length.
[   74.406788][ T7795] syzkaller0: entered promiscuous mode
[   74.409652][ T7795] syzkaller0: entered allmulticast mode
[   74.417805][ T7795] tipc: Failed to remove unknown binding: 66,1,1/11578026:2801835838/2801835840
[   74.422322][ T7795] tipc: Failed to remove unknown binding: 66,1,1/11578026:2801835838/2801835840
[   74.430366][ T7799] netlink: 280 bytes leftover after parsing attributes in process `syz.2.809'.
[   74.598494][ T7813] netlink: 12 bytes leftover after parsing attributes in process `syz.0.814'.
[   75.122654][ T7842] netlink: 'syz.2.826': attribute type 2 has an invalid length.
[   75.125362][ T7842] netlink: 64 bytes leftover after parsing attributes in process `syz.2.826'.
[   75.232127][ T7848] netlink: 8 bytes leftover after parsing attributes in process `syz.2.829'.
[   75.488657][ T7857] netlink: 8 bytes leftover after parsing attributes in process `syz.2.833'.
[   75.492333][ T7857] openvswitch: netlink: nsh attribute has 2338 unknown bytes.
[   75.508115][ T7857] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   75.703391][ T7868] 8021q: adding VLAN 0 to HW filter on device bond2
[   75.723926][ T7868] bond_slave_0: entered promiscuous mode
[   75.726554][ T7868] bond_slave_1: entered promiscuous mode
[   75.730530][ T7868] 8021q: adding VLAN 0 to HW filter on device macvlan3
[   75.737452][ T7868] bond2: (slave macvlan3): Enslaving as a backup interface with an up link
[   75.964855][ T7883] netlink: 260 bytes leftover after parsing attributes in process `syz.2.845'.
[   75.968978][ T7883] netlink: 260 bytes leftover after parsing attributes in process `syz.2.845'.
[   76.904578][ T7892] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   76.908252][ T7893] syzkaller0: entered promiscuous mode
[   76.910521][ T7893] syzkaller0: entered allmulticast mode
[   76.923408][ T7889] tipc: Resetting bearer <eth:syzkaller0>
[   76.928190][ T7888] tipc: Resetting bearer <eth:syzkaller0>
[   76.940876][ T7888] tipc: Disabling bearer <eth:syzkaller0>
[   77.079040][ T7913] netlink: 'syz.2.855': attribute type 1 has an invalid length.
[   77.081627][ T7913] netlink: 'syz.2.855': attribute type 4 has an invalid length.
[   77.089441][ T7913] netlink: 'syz.2.855': attribute type 1 has an invalid length.
[   77.092060][ T7913] netlink: 'syz.2.855': attribute type 4 has an invalid length.
[   77.098672][ T7915] netlink: 'syz.0.856': attribute type 3 has an invalid length.
[   77.687689][ T7970] hsr_slave_0: hsr_addr_subst_dest: Unknown node
[   77.690157][ T7970] hsr_slave_1: hsr_addr_subst_dest: Unknown node
[   78.040500][ T8000] netlink: 'syz.0.895': attribute type 10 has an invalid length.
[   78.106935][ T8006] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   78.110791][ T8006] syzkaller0: entered promiscuous mode
[   78.113167][ T8006] syzkaller0: entered allmulticast mode
[   78.133673][ T8006] tipc: Resetting bearer <eth:syzkaller0>
[   78.140665][ T8005] tipc: Resetting bearer <eth:syzkaller0>
[   78.150016][ T8005] tipc: Disabling bearer <eth:syzkaller0>
[   78.365045][ T8027] block nbd0: server does not support multiple connections per device.
[   78.373434][ T8027] block nbd0: shutting down sockets
[   78.533547][ T8049] IPv6: Can't replace route, no match found
[   78.688763][ T8064] __nla_validate_parse: 7 callbacks suppressed
[   78.688777][ T8064] netlink: 4 bytes leftover after parsing attributes in process `syz.0.925'.
[   79.606150][ T8071] netlink: 4 bytes leftover after parsing attributes in process `syz.0.928'.
[   79.640387][ T8076] netlink: 'syz.1.931': attribute type 2 has an invalid length.
[   79.644317][ T8076] netlink: 119 bytes leftover after parsing attributes in process `syz.1.931'.
[   79.739921][ T8085] vlan0: entered promiscuous mode
[   79.742337][ T8085] bond0: entered promiscuous mode
[   79.747592][ T8085] bond_slave_0: entered promiscuous mode
[   79.750280][ T8085] bond_slave_1: entered promiscuous mode
[   79.752978][ T8085] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode
[   79.759338][ T8085] dummy0: entered promiscuous mode
[   79.911177][ T8103] netlink: 'syz.2.944': attribute type 11 has an invalid length.
[   80.049082][ T8116] RDS: rds_bind could not find a transport for ::4000:0:20:0, load rds_tcp or rds_rdma?
[   80.094021][ T8122] Bluetooth: MGMT ver 1.23
[   80.512276][ T8150] netlink: 'syz.0.966': attribute type 5 has an invalid length.
[   80.657537][ T8162] netlink: 'syz.1.971': attribute type 1 has an invalid length.
[   80.765803][ T8172] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.977'.
[   80.770078][ T8172] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[   80.773611][ T8172] openvswitch: netlink: Flow get message rejected, Key attribute missing.
[   80.830816][ T8178] erspan0: entered promiscuous mode
[   80.837612][ T8178] batman_adv: batadv0: Adding interface: macvlan0
[   80.841064][ T8178] batman_adv: batadv0: The MTU of interface macvlan0 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   80.852717][ T8178] batman_adv: batadv0: Interface activated: macvlan0
[   80.963635][ T8196] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   80.969659][ T8198] netlink: 64 bytes leftover after parsing attributes in process `syz.2.989'.
[   80.976411][ T8196] syzkaller0: entered promiscuous mode
[   80.978257][ T8196] syzkaller0: entered allmulticast mode
[   81.016315][ T8196] sch_tbf: burst 12 is lower than device syzkaller0 mtu (1514) !
[   81.030684][ T8196] tipc: Resetting bearer <eth:syzkaller0>
[   81.035164][ T8195] tipc: Resetting bearer <eth:syzkaller0>
[   81.071346][ T8195] tipc: Disabling bearer <eth:syzkaller0>
[   81.084851][ T8208] netlink: 248 bytes leftover after parsing attributes in process `syz.0.994'.
[   81.114072][ T8210] netlink: 'syz.2.996': attribute type 10 has an invalid length.
[   81.129082][  T793] cfg80211: failed to load regulatory.db
[   81.135434][ T8208] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   81.140426][ T8210] netlink: 40 bytes leftover after parsing attributes in process `syz.2.996'.
[   81.144238][ T8210] veth0_vlan: entered allmulticast mode
[   81.148004][ T8210] bridge0: port 3(veth0_vlan) entered blocking state
[   81.151046][ T8210] bridge0: port 3(veth0_vlan) entered disabled state
[   81.163657][ T8210] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check.
[   81.258685][ T8219] netlink: 'syz.2.998': attribute type 2 has an invalid length.
[   81.335216][ T8225] netlink: 68 bytes leftover after parsing attributes in process `syz.1.999'.
[   81.491876][ T8235] syzkaller1: entered promiscuous mode
[   81.493984][ T8235] syzkaller1: entered allmulticast mode
[   82.042413][ T8279] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1021'.
[   82.101973][ T8285] netlink: 'syz.0.1024': attribute type 10 has an invalid length.
[   82.109750][ T8285] openvswitch: netlink: Flow set message rejected, Key attribute missing.
[   82.191056][ T8292] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1027'.
[   82.508011][ T8316] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   83.620402][ T8339] tap0: tun_chr_ioctl cmd 1074025677
[   83.622551][ T8339] tap0: linktype set to 776
[   83.732978][ T8348] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   83.737728][ T8348] syzkaller0: entered promiscuous mode
[   83.740205][ T8348] syzkaller0: entered allmulticast mode
[   83.760008][ T8348] tipc: Resetting bearer <eth:syzkaller0>
[   83.790336][ T8347] tipc: Resetting bearer <eth:syzkaller0>
[   83.817992][ T8347] tipc: Disabling bearer <eth:syzkaller0>
[   84.294968][ T8366] __nla_validate_parse: 2 callbacks suppressed
[   84.295036][ T8366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1058'.
[   84.301173][ T8366] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   84.458114][ T8371] netlink: 'syz.1.1059': attribute type 6 has an invalid length.
[   84.461751][ T8371] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1059'.
[   84.629481][ T8381] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1065'.
[   84.631283][ T8383] netlink: 'syz.2.1066': attribute type 12 has an invalid length.
[   84.632953][ T8381] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   84.666798][ T8381] batman_adv: batadv0: Removing interface: batadv_slave_1
[   84.814738][ T8400] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 0, id = 0
[   84.945204][ T8414] IPVS: nq: UDP 224.0.0.2:0 - no destination available
[   84.961565][ T8417] netlink: 'syz.1.1082': attribute type 26 has an invalid length.
[   85.230349][ T8442] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1094'.
[   85.533593][ T8455] lo: entered allmulticast mode
[   85.536912][ T8454] lo: left allmulticast mode
[   85.752002][ T8476] netlink: 'syz.0.1110': attribute type 7 has an invalid length.
[   85.797100][ T8479] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1112'.
[   85.832234][ T8479] 8021q: adding VLAN 0 to HW filter on device bond1
[   85.835919][ T8482] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[   85.859250][ T8479] bond1: (slave batadv1): Opening slave failed
[   85.876146][ T8484] Unsupported ieee802154 address type: 0
[   86.250293][ T8509] bridge0: port 3(erspan0) entered blocking state
[   86.253600][ T8509] bridge0: port 3(erspan0) entered disabled state
[   86.264870][ T8509] erspan0: entered allmulticast mode
[   86.269314][ T8509] erspan0: entered promiscuous mode
[   86.272466][ T8509] bridge0: port 3(erspan0) entered blocking state
[   86.275526][ T8509] bridge0: port 3(erspan0) entered forwarding state
[   86.351520][ T8520] erspan0: left allmulticast mode
[   86.353854][ T8520] erspan0: left promiscuous mode
[   86.357372][ T8520] bridge0: port 3(erspan0) entered disabled state
[   86.767905][ T8555] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1137'.
[   87.306447][ T8607] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20004
[   87.378130][ T8610] tipc: Started in network mode
[   87.380299][ T8610] tipc: Node identity ac14140f, cluster identity 4711
[   87.383601][ T8610] tipc: New replicast peer: 255.255.255.255
[   87.427522][ T8610] tipc: Enabled bearer <udp:syz2>, priority 10
[   87.444870][ T8611] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1157'.
[   88.257233][ T8623] tipc: Enabling of bearer <udp:syz2> rejected, failed to enable media
[   88.322728][ T8630] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1169'.
[   88.366728][ T8634] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1171'.
[   88.404877][  T584] wlan1: Trigger new scan to find an IBSS to join
[   88.452532][ T5903] tipc: Node number set to 2886997007
[   88.559229][ T8652] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1179'.
[   90.628718][ T8718] netlink: 'syz.0.1203': attribute type 11 has an invalid length.
[   90.917567][ T8743] lo speed is unknown, defaulting to 1000
[   90.920251][ T8743] lo speed is unknown, defaulting to 1000
[   90.927171][ T8743] lo speed is unknown, defaulting to 1000
[   90.934765][ T8743] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   90.946444][ T8743] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[   90.971065][ T8743] lo speed is unknown, defaulting to 1000
[   90.976517][ T8743] lo speed is unknown, defaulting to 1000
[   90.987447][ T8743] lo speed is unknown, defaulting to 1000
[   91.108894][ T8755] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1217'.
[   91.364622][   T36] wlan1: Trigger new scan to find an IBSS to join
[   91.892528][ T8792] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1230'.
[   91.946656][ T8796] netlink: 'syz.2.1232': attribute type 3 has an invalid length.
[   91.949793][ T8796] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1232'.
[   91.953876][ T8796] netlink: 'syz.2.1232': attribute type 3 has an invalid length.
[   91.960732][ T8796] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1232'.
[   92.031798][ T8802] netlink: 'syz.2.1234': attribute type 10 has an invalid length.
[   92.036811][ T8802] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1234'.
[   92.040877][ T8802] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1234'.
[   92.046858][ T8802] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1234'.
[   92.056004][ T8802] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1234'.
[   92.209665][ T8809] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1237'.
[   92.217368][ T8809] batadv0: entered promiscuous mode
[   92.220082][ T8809] 8021q: adding VLAN 0 to HW filter on device macvlan4
[   92.223404][ T8809] batadv0: left promiscuous mode
[   92.837477][ T8841] lo speed is unknown, defaulting to 1000
[   93.225597][ T8861] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1256'.
[   93.477271][ T8867] bridge2: entered allmulticast mode
[   93.514071][ T8871] Bluetooth: MGMT ver 1.23
[   93.592390][ T8876] netlink: 'syz.1.1263': attribute type 8 has an invalid length.
[   93.633112][ T8876] 8021q: adding VLAN 0 to HW filter on device bond2
[   93.636778][ T8876] bond0: (slave bond2): Enslaving as an active interface with an up link
[   94.334674][   T36] wlan1: Trigger new scan to find an IBSS to join
[   94.665913][ T8943] lo speed is unknown, defaulting to 1000
[   94.961149][ T8952] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   95.235776][  T581] wlan1: Creating new IBSS network, BSSID 8a:85:3c:62:1b:f1
[   95.527317][ T8962] netlink: 'syz.0.1293': attribute type 5 has an invalid length.
[   95.620613][ T8962] lo speed is unknown, defaulting to 1000
[   96.253926][ T9014] bridge: RTM_NEWNEIGH with invalid ether address
[   96.287616][ T9018] __nla_validate_parse: 9 callbacks suppressed
[   96.287628][ T9018] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1311'.
[   96.325095][ T5864] Bluetooth: hci2: command 0x0405 tx timeout
[   96.460952][ T9038] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1319'.
[   96.464860][ T9038] netlink: 84 bytes leftover after parsing attributes in process `syz.0.1319'.
[   96.572403][ T9046] syzkaller0: entered promiscuous mode
[   96.574127][ T9046] syzkaller0: entered allmulticast mode
[   96.622773][ T9050] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1325'.
[   97.512897][ T9068] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   97.527108][ T9068] syzkaller0: entered promiscuous mode
[   97.529430][ T9068] syzkaller0: entered allmulticast mode
[   97.560898][ T9068] tipc: Resetting bearer <eth:syzkaller0>
[   97.578326][ T9066] tipc: Resetting bearer <eth:syzkaller0>
[   97.609555][ T9066] tipc: Disabling bearer <eth:syzkaller0>
[   97.956602][ T9102] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1349'.
[   97.987004][ T9107] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1351'.
[   97.991126][ T9107] netlink: 19 bytes leftover after parsing attributes in process `syz.0.1351'.
[   97.996813][ T9107] netlink: 'syz.0.1351': attribute type 6 has an invalid length.
[   97.999351][ T9107] netlink: 'syz.0.1351': attribute type 4 has an invalid length.
[   98.219294][ T9123] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1358'.
[   98.506199][ T9142] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1367'.
[   98.559014][ T9151] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   98.703789][   T33] audit: type=1800 audit(1754399369.387:5): pid=9162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1376" name=33FFFF dev="tmpfs" ino=2060 res=0 errno=0
[   99.830064][ T9253] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1416'.
[   99.833834][ T9253] netlink: 'syz.1.1416': attribute type 4 has an invalid length.
[   99.881365][ T9254] netlink: 'syz.0.1417': attribute type 9 has an invalid length.
[   99.884148][ T9254] netlink: 'syz.0.1417': attribute type 9 has an invalid length.
[  100.866301][   T33] audit: type=1804 audit(1754399371.557:6): pid=9286 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1430" name="/newroot/418/cgroup.controllers" dev="tmpfs" ino=2121 res=1 errno=0
[  100.882216][   T33] audit: type=1800 audit(1754399371.557:7): pid=9286 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1430" name="cgroup.controllers" dev="tmpfs" ino=2121 res=0 errno=0
[  100.900997][   T33] audit: type=1800 audit(1754399371.557:8): pid=9286 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1430" name="cgroup.controllers" dev="tmpfs" ino=2121 res=0 errno=0
[  101.373736][ T9349] __nla_validate_parse: 4 callbacks suppressed
[  101.373753][ T9349] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1460'.
[  102.336701][ T9398] bridge0: entered promiscuous mode
[  102.339437][ T9398] macsec1: entered promiscuous mode
[  102.343914][ T9398] bridge0: port 2(macsec1) entered blocking state
[  102.348476][ T9398] bridge0: port 2(macsec1) entered disabled state
[  102.351450][ T9398] macsec1: entered allmulticast mode
[  102.353832][ T9398] bridge0: entered allmulticast mode
[  102.359093][ T9398] macsec1: left allmulticast mode
[  102.361223][ T9398] bridge0: left allmulticast mode
[  102.365192][ T9398] bridge0: left promiscuous mode
[  102.484287][ T9402] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1482'.
[  102.647846][    C1] vcan0: j1939_tp_rxtimer: 0xffff8881139a7c00: rx timeout, send abort
[  102.652797][    C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8881139a7c00: 0x2fe01: (3) A timeout occurred and this is the connection abort to close the session.
[  102.684185][ T9410] IPVS: lblc: UDP 224.0.0.2:0 - no destination available
[  103.319407][ T9457] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  103.364170][ T9457] syzkaller0: entered promiscuous mode
[  103.367164][ T9457] syzkaller0: entered allmulticast mode
[  103.370496][ T9457] tipc: Resetting bearer <eth:syzkaller0>
[  103.395004][ T9456] tipc: Resetting bearer <eth:syzkaller0>
[  104.318197][ T9456] tipc: Disabling bearer <eth:syzkaller0>
[  104.897361][ T9471] 8021q: adding VLAN 0 to HW filter on device bond4
[  104.900512][ T9479] openvswitch: netlink: IPv4 frag type 255 is out of range max 2
[  104.917536][ T9471] bond0: (slave bond4): Enslaving as an active interface with an up link
[  105.230053][ T9487] netlink: 'syz.1.1520': attribute type 10 has an invalid length.
[  105.256756][ T9487] bond0: (slave dummy0): Releasing backup interface
[  105.279167][ T9487] team0: Port device dummy0 added
[  105.392887][ T9491] netlink: 'syz.2.1522': attribute type 9 has an invalid length.
[  105.405544][ T9491] netlink: 212260 bytes leftover after parsing attributes in process `syz.2.1522'.
[  105.593770][ T9501] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1527'.
[  105.603306][ T9501] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1527'.
[  105.715875][ T9507] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1530'.
[  105.744706][ T9509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1531'.
[  107.256316][ T9546] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  107.260165][ T9546] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0
[  107.264003][ T9546] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0
[  107.292429][ T9546] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  107.297871][ T9546] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0
[  107.301612][ T9546] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0
[  107.347841][ T9546] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  107.351497][ T9546] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0
[  107.356458][ T9546] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0
[  107.399738][ T9546] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  107.403050][ T9546] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0
[  107.408202][ T9546] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0
[  107.519713][   T13] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  107.522528][   T13] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 256 - 0
[  107.528751][   T13] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0
[  107.552941][   T13] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  107.557093][   T13] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 256 - 0
[  107.560245][   T13] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0
[  107.563612][   T13] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  107.573484][   T13] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 256 - 0
[  107.576286][ T9556] netlink: 332 bytes leftover after parsing attributes in process `syz.2.1554'.
[  107.580872][ T9556] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1554'.
[  107.581103][ T9557] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1553'.
[  107.587526][ T9556] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1554'.
[  107.589032][   T13] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0
[  107.616954][   T13] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  107.624513][   T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 256 - 0
[  107.627252][   T13] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0
[  107.655018][ T9557] team0: Port device dummy0 removed
[  107.661534][ T9557] bridge_slave_0: left allmulticast mode
[  107.663518][ T9557] bridge_slave_0: left promiscuous mode
[  107.676962][ T9557] bridge0: port 1(bridge_slave_0) entered disabled state
[  107.708566][ T9557] bridge_slave_1: left allmulticast mode
[  107.711432][ T9557] bridge_slave_1: left promiscuous mode
[  107.713980][ T9557] bridge0: port 2(bridge_slave_1) entered disabled state
[  107.744933][ T9557] bond0: (slave bond_slave_0): Releasing backup interface
[  107.753985][ T9557] bond0: (slave bond_slave_1): Releasing backup interface
[  107.767691][ T9557] team0: Port device team_slave_0 removed
[  107.772611][ T9557] team0: Port device team_slave_1 removed
[  107.777058][ T9557] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  107.779733][ T9557] batman_adv: batadv0: Removing interface: batadv_slave_0
[  107.788300][ T9557] bond0: (slave bond2): Releasing backup interface
[  107.792884][ T9557] bond0: (slave bond4): Releasing backup interface
[  107.798914][ T5904] lo speed is unknown, defaulting to 1000
[  107.802897][ T9563] team0: Mode changed to "broadcast"
[  107.866145][ T9568] syzkaller0: entered promiscuous mode
[  107.870224][ T9568] syzkaller0: entered allmulticast mode
[  109.096492][ T9607] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  109.397597][ T9621] syz_tun: entered promiscuous mode
[  109.399322][ T9621] syz_tun: entered allmulticast mode
[  109.551455][ T9630] bridge0: entered promiscuous mode
[  109.555078][ T9630] bridge0: port 3(macvlan5) entered blocking state
[  109.557407][ T9630] bridge0: port 3(macvlan5) entered disabled state
[  109.559598][ T9630] macvlan5: entered allmulticast mode
[  109.561533][ T9630] bridge0: entered allmulticast mode
[  109.565550][ T9630] macvlan5: left allmulticast mode
[  109.567418][ T9630] bridge0: left allmulticast mode
[  109.569788][ T9630] bridge0: left promiscuous mode
[  109.900419][ T9655] netlink: 'syz.2.1595': attribute type 4 has an invalid length.
[  109.909027][ T9655] netlink: 'syz.2.1595': attribute type 4 has an invalid length.
[  110.310622][ T9678] netlink: 216 bytes leftover after parsing attributes in process `syz.1.1605'.
[  110.313495][ T9678] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1605'.
[  110.315008][ T9680] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1606'.
[  110.317295][ T9678] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1605'.
[  110.803131][   T13] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  110.809271][   T13] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  110.812270][   T13] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  110.816893][   T13] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  110.833805][ T9727] netlink: 'syz.1.1629': attribute type 1 has an invalid length.
[  111.017905][ T9752] netlink: 'syz.1.1639': attribute type 2 has an invalid length.
[  111.021367][ T9752] netlink: 'syz.1.1639': attribute type 1 has an invalid length.
[  111.024312][ T9752] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1639'.
[  111.132055][ T9762] netlink: 5636 bytes leftover after parsing attributes in process `syz.1.1644'.
[  111.215370][ T9772] rdma_op ffff88803da441f0 conn xmit_rdma 0000000000000000
[  111.792457][ T9807] netlink: 'syz.2.1665': attribute type 282 has an invalid length.
[  111.886175][ T9813] bridge3: the hash_elasticity option has been deprecated and is always 16
[  111.889600][ T9813] bridge3: entered allmulticast mode
[  111.960660][ T9821] sctp: [Deprecated]: syz.2.1672 (pid 9821) Use of struct sctp_assoc_value in delayed_ack socket option.
[  111.960660][ T9821] Use struct sctp_sack_info instead
[  112.416355][ T9870] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  112.419161][ T9870] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  112.456094][ T9877] lo speed is unknown, defaulting to 1000
[  112.708281][ T9883] netlink: 'syz.1.1699': attribute type 1 has an invalid length.
[  112.710928][ T9883] __nla_validate_parse: 7 callbacks suppressed
[  112.710936][ T9883] netlink: 244 bytes leftover after parsing attributes in process `syz.1.1699'.
[  113.256762][ T9892] netlink: 'syz.2.1703': attribute type 1 has an invalid length.
[  113.259861][ T9892] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1703'.
[  113.264264][ T9892] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1703'.
[  113.545257][ T9912] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1711'.
[  113.548896][ T9912] netlink: 216 bytes leftover after parsing attributes in process `syz.2.1711'.
[  113.579591][ T9914] netlink: zone id is out of range
[  113.581357][ T9914] netlink: zone id is out of range
[  113.583094][ T9914] netlink: set zone limit has 4 unknown bytes
[  114.043564][ T9950] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1728'.
[  114.170841][ T9962] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  114.329308][ T9982] syz_tun: entered allmulticast mode
[  114.336813][ T9981] syz_tun: left allmulticast mode
[  114.464727][ T9998] team0: No ports can be present during mode change
[  114.467563][T10000] netlink: 'syz.0.1752': attribute type 28 has an invalid length.
[  114.543185][T10011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1756'.
[  114.636682][T10014] block nbd0: server does not support multiple connections per device.
[  114.644062][T10014] block nbd0: shutting down sockets
[  114.976134][T10060] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1781'.
[  114.979133][T10060] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1781'.
[  114.991387][T10062] nbd: must specify a device to reconfigure
[  115.063311][T10069] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode
[  115.193777][T10079] netlink: 'syz.2.1789': attribute type 3 has an invalid length.
[  115.203778][T10079] netlink: 'syz.2.1789': attribute type 3 has an invalid length.
[  115.216691][T10079] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1789'.
[  115.760520][T10120] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048)
[  115.846386][T10128] openvswitch: netlink: nsh attr 2560 is out of range max 3
[  115.848868][T10128] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  115.938972][T10138] netlink: 'syz.0.1817': attribute type 10 has an invalid length.
[  115.951157][T10138] bond0: (slave dummy0): Releasing backup interface
[  115.960547][T10138] dummy0: left promiscuous mode
[  115.966783][T10138] team0: Failed to send options change via netlink (err -105)
[  115.969810][T10138] team0: Port device dummy0 added
[  115.979511][T10138] netlink: 'syz.0.1817': attribute type 10 has an invalid length.
[  115.983183][T10138] team0: Failed to send port change of device dummy0 via netlink (err -105)
[  115.990957][T10138] team0: Failed to send options change via netlink (err -105)
[  115.993992][T10138] team0: Failed to send port change of device dummy0 via netlink (err -105)
[  115.998029][T10138] team0: Port device dummy0 removed
[  116.001712][T10138] dummy0: entered promiscuous mode
[  116.004139][T10138] bond0: (slave dummy0): Enslaving as an active interface with an up link
[  116.188630][T10163] lo speed is unknown, defaulting to 1000
[  116.282725][T10171] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check.
[  116.667790][T10206] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  116.694231][T10210] netlink: 'syz.0.1850': attribute type 1 has an invalid length.
[  116.702062][T10210] netlink: 'syz.0.1850': attribute type 1 has an invalid length.
[  116.749338][T10220] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  116.751778][T10220] IPv6: NLM_F_CREATE should be set when creating new route
[  116.754291][T10220] IPv6: NLM_F_CREATE should be set when creating new route
[  117.001292][T10246] netdevsim netdevsim1 netdevsim0: entered promiscuous mode
[  117.007634][T10246] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  117.264259][T10293] netlink: 'syz.1.1886': attribute type 3 has an invalid length.
[  117.427523][   T54] Bluetooth: hci2: link tx timeout
[  117.429560][   T54] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  117.548820][T10339] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0
[  117.635349][T10344] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies.
[  117.862821][T10359] __nla_validate_parse: 15 callbacks suppressed
[  117.862835][T10359] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1916'.
[  117.869622][T10359] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1916'.
[  118.319815][T10372] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1921'.
[  118.587920][T10398] netlink: 'syz.2.1934': attribute type 1 has an invalid length.
[  118.631916][T10398] bond3: (slave gretap1): making interface the new active one
[  118.635388][T10398] bond3: (slave gretap1): Enslaving as an active interface with an up link
[  118.646349][T10398] vlan3: entered allmulticast mode
[  118.648627][T10398] bond3: entered allmulticast mode
[  118.650852][T10398] gretap1: entered allmulticast mode
[  118.654775][T10398] bond3: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  119.096458][T10436] netlink: 'syz.1.1951': attribute type 21 has an invalid length.
[  119.099585][T10436] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1951'.
[  119.102639][T10436] netlink: 'syz.1.1951': attribute type 5 has an invalid length.
[  119.105761][T10436] netlink: 3 bytes leftover after parsing attributes in process `syz.1.1951'.
[  119.373779][T10451] netlink: 'syz.1.1958': attribute type 1 has an invalid length.
[  119.389167][T10451] 8021q: adding VLAN 0 to HW filter on device bond5
[  119.438479][T10451] bond5: (slave veth7): Enslaving as an active interface with a down link
[  119.445859][ T5864] Bluetooth: hci2: command 0x0405 tx timeout
[  119.941145][T10455] netlink: 'syz.2.1959': attribute type 1 has an invalid length.
[  120.053382][T10457] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1959'.
[  120.203187][T10450] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  120.220061][T10451] vlan3: entered allmulticast mode
[  120.221894][T10451] veth1: entered allmulticast mode
[  120.223947][T10451] veth1: entered promiscuous mode
[  120.226334][T10451] veth1: left promiscuous mode
[  120.229867][T10451] bond5: (slave vlan3): making interface the new active one
[  120.233224][T10451] veth1: entered promiscuous mode
[  120.235372][T10451] vlan3: entered promiscuous mode
[  120.237371][T10451] bond5: (slave vlan3): Enslaving as an active interface with an up link
[  120.251680][T10455] 8021q: adding VLAN 0 to HW filter on device bond4
[  120.332132][T10456] netlink: 240 bytes leftover after parsing attributes in process `syz.2.1959'.
[  120.372351][T10471] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1964'.
[  120.477064][T10483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  120.531740][T10483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  120.588056][T10483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  120.640022][T10491] bridge_slave_0: invalid flags given to default FDB implementation
[  120.836562][T10503] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1979'.
[  120.842997][T10503] macsec1: entered promiscuous mode
[  120.845302][T10503] team0: entered promiscuous mode
[  120.846994][T10503] macsec1: entered allmulticast mode
[  120.848654][T10503] team0: entered allmulticast mode
[  120.850700][T10503] team0: Device macsec1 is already an upper device of the team interface
[  120.854052][T10503] team0: left allmulticast mode
[  120.855833][T10503] team0: left promiscuous mode
[  121.499995][T10536] validate_nla: 2 callbacks suppressed
[  121.500008][T10536] netlink: 'syz.1.1994': attribute type 16 has an invalid length.
[  121.504653][T10536] netlink: 'syz.1.1994': attribute type 17 has an invalid length.
[  121.517931][T10536] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  121.721469][T10544] netlink: 'syz.2.1998': attribute type 1 has an invalid length.
[  121.740516][T10544] bond5: entered promiscuous mode
[  121.742663][T10544] 8021q: adding VLAN 0 to HW filter on device bond5
[  121.762806][T10544] bond5: (slave bridge5): making interface the new active one
[  121.765595][T10544] bridge5: entered promiscuous mode
[  121.768330][T10544] bond5: (slave bridge5): Enslaving as an active interface with an up link
[  121.961728][T10553] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2002'.
[  122.017331][T10555] lo speed is unknown, defaulting to 1000
[  123.213599][T10603] __nla_validate_parse: 1 callbacks suppressed
[  123.213608][T10603] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2024'.
[  123.348604][T10605] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.
[  123.364111][T10605] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2025'.
[  123.378975][T10605] bridge4: entered promiscuous mode
[  123.381252][T10605] bridge4: entered allmulticast mode
[  123.388359][T10605] team0: Port device bridge4 added
[  123.448798][T10616] ipvlan2: entered promiscuous mode
[  123.451686][T10616] bridge0: port 1(ipvlan2) entered blocking state
[  123.457863][T10616] bridge0: port 1(ipvlan2) entered disabled state
[  123.460693][T10616] ipvlan2: entered allmulticast mode
[  123.463351][T10616] bridge0: entered allmulticast mode
[  123.467779][T10616] ipvlan2: left allmulticast mode
[  123.469925][T10616] bridge0: left allmulticast mode
[  123.503835][T10618] netlink: 'syz.0.2028': attribute type 1 has an invalid length.
[  123.507699][T10618] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2028'.
[  123.650771][T10630] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2034'.
[  123.752651][T10638] sctp: [Deprecated]: syz.1.2038 (pid 10638) Use of struct sctp_assoc_value in delayed_ack socket option.
[  123.752651][T10638] Use struct sctp_sack_info instead
[  123.817262][T10642] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2040'.
[  123.821195][T10642] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2040'.
[  123.967937][T10658] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2048'.
[  124.080785][T10667] netlink: 248 bytes leftover after parsing attributes in process `syz.1.2052'.
[  124.542304][T10708] netlink: 'syz.0.2063': attribute type 1 has an invalid length.
[  124.545746][T10708] netlink: 'syz.0.2063': attribute type 2 has an invalid length.
[  124.548966][T10708] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2063'.
[  124.617857][T10716] netlink: 'syz.1.2066': attribute type 9 has an invalid length.
[  124.620786][T10716] netlink: 184 bytes leftover after parsing attributes in process `syz.1.2066'.
[  124.660487][T10720] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  124.663354][T10720] syzkaller0: entered promiscuous mode
[  124.666303][T10720] syzkaller0: entered allmulticast mode
[  124.677808][T10720] tipc: Resetting bearer <eth:syzkaller0>
[  124.681211][T10718] tipc: Resetting bearer <eth:syzkaller0>
[  124.690759][T10718] tipc: Disabling bearer <eth:syzkaller0>
[  124.897180][T10746] bond0: invalid ARP target 0.0.0.0 specified for addition
[  124.900031][T10746] bond0: option arp_ip_target: invalid value (0)
[  126.051831][T10873] netlink: 'syz.0.2137': attribute type 1 has an invalid length.
[  127.013433][T10914] netlink: 'syz.1.2155': attribute type 10 has an invalid length.
[  127.026930][T10914] team0: Port device geneve0 added
[  127.056018][T10914] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1
[  127.083639][T10920] netlink: 'syz.2.2158': attribute type 4 has an invalid length.
[  127.366016][T10949] (unnamed net_device) (uninitialized): option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0)
[  127.466801][T10966] netlink: 'syz.1.2182': attribute type 1 has an invalid length.
[  127.480723][T10966] bond6: entered promiscuous mode
[  127.482644][T10966] 8021q: adding VLAN 0 to HW filter on device bond6
[  127.518451][T10966] 8021q: adding VLAN 0 to HW filter on device bond6
[  127.520779][T10966] bond6: (slave wireguard0): The slave device specified does not support setting the MAC address
[  127.524542][T10966] bond6: (slave wireguard0): Setting fail_over_mac to active for active-backup mode
[  127.535819][T10966] bond6: (slave wireguard0): making interface the new active one
[  127.538390][T10966] wireguard0: entered promiscuous mode
[  127.543036][T10966] bond6: (slave wireguard0): Enslaving as an active interface with an up link
[  127.562825][T10966] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  127.565369][T10966] IPv6: NLM_F_CREATE should be set when creating new route
[  127.567833][T10966] IPv6: NLM_F_CREATE should be set when creating new route
[  127.571796][T10966] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  127.579971][T10966] bond6: (slave wireguard1): The slave device specified does not support setting the MAC address
[  127.589230][T10966] bond6: (slave wireguard1): Enslaving as a backup interface with an up link
[  127.939928][T11012] netlink: 'syz.0.2195': attribute type 1 has an invalid length.
[  127.946158][T11020] tc_dump_action: action bad kind
[  128.154317][T11044] (unnamed net_device) (uninitialized): option mode: invalid value (254)
[  128.190163][T11048] netlink: 'syz.2.2218': attribute type 17 has an invalid length.
[  128.447787][T11069] __nla_validate_parse: 25 callbacks suppressed
[  128.447797][T11069] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2228'.
[  128.643557][T11081] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2234'.
[  128.650969][T11083] ieee802154 phy0 wpan0: encryption failed: -22
[  128.654433][T11081] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2234'.
[  128.776948][T11096] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2242'.
[  128.779916][T11096] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2242'.
[  128.782859][T11096] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2242'.
[  128.801145][T11096] bridge_slave_0: left allmulticast mode
[  128.807020][T11096] bridge_slave_0: left promiscuous mode
[  128.809134][T11096] bridge0: port 1(bridge_slave_0) entered disabled state
[  128.820703][T11096] bridge_slave_1: left allmulticast mode
[  128.823279][T11096] bridge_slave_1: left promiscuous mode
[  128.830035][T11096] bridge0: port 2(bridge_slave_1) entered disabled state
[  128.840511][T11096] bond0: (slave bond_slave_0): Releasing backup interface
[  128.850294][T11096] bond_slave_0: left promiscuous mode
[  128.872055][T11096] bond0: (slave bond_slave_1): Releasing backup interface
[  128.877783][T11096] bond_slave_1: left promiscuous mode
[  128.890354][T11096] team0: Port device team_slave_0 removed
[  128.897667][T11096] team0: Port device team_slave_1 removed
[  128.901418][T11096] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  128.904045][T11096] batman_adv: batadv0: Removing interface: batadv_slave_0
[  128.910941][T11096] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  128.914498][T11096] batman_adv: batadv0: Removing interface: batadv_slave_1
[  128.936558][T11096] bond2: (slave macvlan3): Removing an active aggregator
[  128.939367][T11096] bond2: (slave macvlan3): Releasing backup interface
[  128.953383][T11096] bond3: (slave gretap1): Releasing active interface
[  128.956461][T11096] gretap1: left allmulticast mode
[  128.968160][T11096] bond5: (slave bridge5): Releasing backup interface
[  128.976097][T11096] bridge5: left promiscuous mode
[  129.195606][T11141] bond0: option mode: unable to set because the bond device has slaves
[  129.436426][T11175] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2278'.
[  129.573889][T11197] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2289'.
[  129.653913][T11202] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2290'.
[  129.675767][T11207] syzkaller0: entered promiscuous mode
[  129.677576][T11207] syzkaller0: entered allmulticast mode
[  129.769125][T11222] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2300'.
[  129.887158][T11231] lo speed is unknown, defaulting to 1000
[  130.769342][T11256] openvswitch: netlink: Tunnel attr 0 has unexpected len 0 expected 8
[  130.931754][T11274] netlink: 'syz.2.2325': attribute type 31 has an invalid length.
[  131.223549][T11297] syz_tun: entered allmulticast mode
[  131.239202][T11297] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check.
[  131.416824][ T5896] vlan3: left promiscuous mode
[  131.634192][T11357] netlink: 'syz.2.2363': attribute type 7 has an invalid length.
[  131.637851][T11357] netlink: 'syz.2.2363': attribute type 8 has an invalid length.
[  131.778724][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  131.782027][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  131.793929][T11371] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  131.982404][T11395] lo speed is unknown, defaulting to 1000
[  132.326443][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  132.328498][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  132.469469][T11427] syzkaller0: entered promiscuous mode
[  132.471416][T11427] syzkaller0: entered allmulticast mode
[  133.500910][T11440] siw: device registration error -23
[  133.513601][T11440] __nla_validate_parse: 7 callbacks suppressed
[  133.513619][T11440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2400'.
[  133.520339][T11440] wg1: entered promiscuous mode
[  133.521945][T11440] wg1: entered allmulticast mode
[  133.539988][T11444] ==================================================================
[  133.542657][T11444] BUG: KASAN: slab-use-after-free in xfrm_alloc_spi+0x570/0xf30
[  133.545110][T11444] Read of size 4 at addr ffff88811b008544 by task syz.0.2402/11444
[  133.548477][T11444] 
[  133.549295][T11444] CPU: 0 UID: 0 PID: 11444 Comm: syz.0.2402 Not tainted 6.16.0-syzkaller-06600-g1dbf1d590d10-dirty #0 PREEMPT(full) 
[  133.549305][T11444] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  133.549310][T11444] Call Trace:
[  133.549314][T11444]  <TASK>
[  133.549318][T11444]  dump_stack_lvl+0x189/0x250
[  133.549330][T11444]  ? __kasan_check_byte+0x12/0x40
[  133.549343][T11444]  ? __pfx_dump_stack_lvl+0x10/0x10
[  133.549350][T11444]  ? lock_release+0x4b/0x3e0
[  133.549362][T11444]  ? __virt_addr_valid+0x4a5/0x5c0
[  133.549371][T11444]  print_report+0xca/0x240
[  133.549383][T11444]  ? xfrm_alloc_spi+0x570/0xf30
[  133.549391][T11444]  kasan_report+0x118/0x150
[  133.549402][T11444]  ? xfrm_alloc_spi+0x570/0xf30
[  133.549410][T11444]  xfrm_alloc_spi+0x570/0xf30
[  133.549418][T11444]  ? xfrm_alloc_spi+0x2a0/0xf30
[  133.549427][T11444]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  133.549434][T11444]  ? xfrm_find_acq+0x87/0xa0
[  133.549443][T11444]  xfrm_alloc_userspi+0x70b/0xc90
[  133.549452][T11444]  ? __pfx_aa_get_newest_label+0x10/0x10
[  133.549464][T11444]  ? apparmor_capable+0x137/0x1b0
[  133.549470][T11444]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  133.549479][T11444]  ? __nla_parse+0x40/0x60
[  133.549488][T11444]  xfrm_user_rcv_msg+0x7a3/0xab0
[  133.549497][T11444]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  133.549510][T11444]  ? __pfx___mutex_trylock_common+0x10/0x10
[  133.549518][T11444]  ? rcu_is_watching+0x15/0xb0
[  133.549528][T11444]  ? trace_contention_end+0x39/0x120
[  133.549535][T11444]  ? __mutex_lock+0x335/0x1340
[  133.549547][T11444]  netlink_rcv_skb+0x208/0x470
[  133.549558][T11444]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  133.549566][T11444]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  133.549578][T11444]  ? netlink_deliver_tap+0x2e/0x1b0
[  133.549587][T11444]  ? netlink_deliver_tap+0x2e/0x1b0
[  133.549597][T11444]  xfrm_netlink_rcv+0x79/0x90
[  133.549605][T11444]  netlink_unicast+0x82f/0x9e0
[  133.549616][T11444]  ? __pfx_netlink_unicast+0x10/0x10
[  133.549625][T11444]  ? netlink_sendmsg+0x642/0xb30
[  133.549635][T11444]  ? skb_put+0x11b/0x210
[  133.549642][T11444]  netlink_sendmsg+0x805/0xb30
[  133.549653][T11444]  ? __pfx_netlink_sendmsg+0x10/0x10
[  133.549664][T11444]  ? aa_sock_msg_perm+0x94/0x160
[  133.549673][T11444]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  133.549682][T11444]  ? __pfx_netlink_sendmsg+0x10/0x10
[  133.549692][T11444]  __sock_sendmsg+0x21c/0x270
[  133.549702][T11444]  ____sys_sendmsg+0x505/0x830
[  133.549710][T11444]  ? __pfx_____sys_sendmsg+0x10/0x10
[  133.549718][T11444]  ? import_iovec+0x74/0xa0
[  133.549728][T11444]  ___sys_sendmsg+0x21f/0x2a0
[  133.549736][T11444]  ? __pfx____sys_sendmsg+0x10/0x10
[  133.549748][T11444]  ? __fget_files+0x2a/0x420
[  133.549755][T11444]  ? __fget_files+0x3a0/0x420
[  133.549763][T11444]  __x64_sys_sendmsg+0x19b/0x260
[  133.549770][T11444]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  133.549779][T11444]  ? rcu_is_watching+0x15/0xb0
[  133.549790][T11444]  ? do_syscall_64+0xbe/0x3b0
[  133.549800][T11444]  do_syscall_64+0xfa/0x3b0
[  133.549810][T11444]  ? lockdep_hardirqs_on+0x9c/0x150
[  133.549819][T11444]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.549826][T11444]  ? exc_page_fault+0x9f/0xf0
[  133.549835][T11444]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.549842][T11444] RIP: 0033:0x7f647238eb69
[  133.549849][T11444] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  133.549856][T11444] RSP: 002b:00007f647322e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  133.549864][T11444] RAX: ffffffffffffffda RBX: 00007f64725b5fa0 RCX: 00007f647238eb69
[  133.549869][T11444] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003
[  133.549874][T11444] RBP: 00007f6472411df1 R08: 0000000000000000 R09: 0000000000000000
[  133.549878][T11444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  133.549882][T11444] R13: 0000000000000000 R14: 00007f64725b5fa0 R15: 00007ffc3ecc4c98
[  133.549890][T11444]  </TASK>
[  133.549893][T11444] 
[  133.680941][T11444] Allocated by task 10167:
[  133.682627][T11444]  kasan_save_track+0x3e/0x80
[  133.684328][T11444]  __kasan_slab_alloc+0x6c/0x80
[  133.685920][T11444]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  133.687834][T11444]  xfrm_state_alloc+0x24/0x2f0
[  133.689431][T11444]  __find_acq_core+0x8a7/0x1c00
[  133.691044][T11444]  xfrm_find_acq+0x78/0xa0
[  133.692583][T11444]  xfrm_alloc_userspi+0x6b3/0xc90
[  133.694291][T11444]  xfrm_user_rcv_msg+0x7a3/0xab0
[  133.696044][T11444]  netlink_rcv_skb+0x208/0x470
[  133.697771][T11444]  xfrm_netlink_rcv+0x79/0x90
[  133.699553][T11444]  netlink_unicast+0x82f/0x9e0
[  133.701311][T11444]  netlink_sendmsg+0x805/0xb30
[  133.702978][T11444]  __sock_sendmsg+0x21c/0x270
[  133.704567][T11444]  ____sys_sendmsg+0x505/0x830
[  133.706267][T11444]  ___sys_sendmsg+0x21f/0x2a0
[  133.708213][T11444]  __x64_sys_sendmsg+0x19b/0x260
[  133.709973][T11444]  do_syscall_64+0xfa/0x3b0
[  133.711578][T11444]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.713476][T11444] 
[  133.714252][T11444] Freed by task 10:
[  133.715491][T11444]  kasan_save_track+0x3e/0x80
[  133.716985][T11444]  kasan_save_free_info+0x46/0x50
[  133.718553][T11444]  __kasan_slab_free+0x62/0x70
[  133.720053][T11444]  kmem_cache_free+0x18f/0x400
[  133.721572][T11444]  xfrm_state_gc_task+0x518/0x6a0
[  133.723151][T11444]  process_scheduled_works+0xae1/0x17b0
[  133.724965][T11444]  worker_thread+0x8a0/0xda0
[  133.726471][T11444]  kthread+0x711/0x8a0
[  133.727784][T11444]  ret_from_fork+0x3fc/0x770
[  133.729271][T11444]  ret_from_fork_asm+0x1a/0x30
[  133.730849][T11444] 
[  133.731640][T11444] The buggy address belongs to the object at ffff88811b008480
[  133.731640][T11444]  which belongs to the cache xfrm_state of size 928
[  133.735979][T11444] The buggy address is located 196 bytes inside of
[  133.735979][T11444]  freed 928-byte region [ffff88811b008480, ffff88811b008820)
[  133.740478][T11444] 
[  133.741305][T11444] The buggy address belongs to the physical page:
[  133.743392][T11444] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88811b008480 pfn:0x11b008
[  133.746808][T11444] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  133.749468][T11444] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  133.752061][T11444] page_type: f5(slab)
[  133.753443][T11444] raw: 057ff00000000040 ffff888104f2d640 dead000000000122 0000000000000000
[  133.756348][T11444] raw: ffff88811b008480 00000000800e000b 00000000f5000000 0000000000000000
[  133.759336][T11444] head: 057ff00000000040 ffff888104f2d640 dead000000000122 0000000000000000
[  133.762411][T11444] head: ffff88811b008480 00000000800e000b 00000000f5000000 0000000000000000
[  133.765285][T11444] head: 057ff00000000002 ffffea00046c0201 00000000ffffffff 00000000ffffffff
[  133.768147][T11444] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  133.771469][T11444] page dumped because: kasan: bad access detected
[  133.773680][T11444] page_owner tracks the page as allocated
[  133.775795][T11444] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 8434, tgid 8433 (syz.1.1090), ts 85489905846, free_ts 78047115573
[  133.782561][T11444]  post_alloc_hook+0x240/0x2a0
[  133.784597][T11444]  get_page_from_freelist+0x21e4/0x22c0
[  133.786882][T11444]  __alloc_frozen_pages_noprof+0x181/0x370
[  133.789267][T11444]  alloc_pages_mpol+0x232/0x4a0
[  133.791336][T11444]  allocate_slab+0x8a/0x3b0
[  133.793224][T11444]  ___slab_alloc+0xbfc/0x1480
[  133.795211][T11444]  kmem_cache_alloc_noprof+0x283/0x3c0
[  133.797476][T11444]  xfrm_state_alloc+0x24/0x2f0
[  133.799462][T11444]  xfrm_state_find+0x37d4/0x5400
[  133.801463][T11444]  xfrm_resolve_and_create_bundle+0x768/0x2f80
[  133.803993][T11444]  xfrm_lookup_with_ifid+0x58a/0x1a70
[  133.806252][T11444]  xfrm_lookup_route+0x3c/0x1c0
[  133.808285][T11444]  udp_sendmsg+0x142e/0x2170
[  133.810239][T11444]  __sock_sendmsg+0x19c/0x270
[  133.812211][T11444]  ____sys_sendmsg+0x52d/0x830
[  133.814194][T11444]  ___sys_sendmsg+0x21f/0x2a0
[  133.815842][T11444] page last free pid 15 tgid 15 stack trace:
[  133.818159][T11444]  __free_frozen_pages+0xc71/0xe70
[  133.820246][T11444]  __tlb_remove_table+0x2d2/0x3b0
[  133.822237][T11444]  tlb_remove_table_rcu+0x85/0x100
[  133.824322][T11444]  rcu_core+0xca8/0x1710
[  133.826050][T11444]  handle_softirqs+0x286/0x870
[  133.828090][T11444]  run_ksoftirqd+0x9b/0x100
[  133.829996][T11444]  smpboot_thread_fn+0x542/0xa60
[  133.832038][T11444]  kthread+0x711/0x8a0
[  133.833697][T11444]  ret_from_fork+0x3fc/0x770
[  133.835552][T11444]  ret_from_fork_asm+0x1a/0x30
[  133.837389][T11444] 
[  133.838270][T11444] Memory state around the buggy address:
[  133.840472][T11444]  ffff88811b008400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  133.842947][T11444]  ffff88811b008480: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.845638][T11444] >ffff88811b008500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.848765][T11444]                                            ^
[  133.851490][T11444]  ffff88811b008580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.854867][T11444]  ffff88811b008600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.858234][T11444] ==================================================================
[  133.861826][T11444] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  133.864898][T11444] CPU: 0 UID: 0 PID: 11444 Comm: syz.0.2402 Not tainted 6.16.0-syzkaller-06600-g1dbf1d590d10-dirty #0 PREEMPT(full) 
[  133.869875][T11444] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  133.874018][T11444] Call Trace:
[  133.875375][T11444]  <TASK>
[  133.876682][T11444]  dump_stack_lvl+0x99/0x250
[  133.878504][T11444]  ? __asan_memcpy+0x40/0x70
[  133.880542][T11444]  ? __pfx_dump_stack_lvl+0x10/0x10
[  133.882706][T11444]  ? __pfx__printk+0x10/0x10
[  133.884741][T11444]  panic+0x2db/0x790
[  133.886359][T11444]  ? __pfx_panic+0x10/0x10
[  133.887922][T11444]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  133.890239][T11444]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  133.892764][T11444]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  133.894868][T11444]  ? print_memory_metadata+0x314/0x400
[  133.896797][T11444]  ? xfrm_alloc_spi+0x570/0xf30
[  133.898353][T11444]  check_panic_on_warn+0x89/0xb0
[  133.899961][T11444]  ? xfrm_alloc_spi+0x570/0xf30
[  133.901544][T11444]  end_report+0x78/0x160
[  133.902995][T11444]  kasan_report+0x129/0x150
[  133.904789][T11444]  ? xfrm_alloc_spi+0x570/0xf30
[  133.906482][T11444]  xfrm_alloc_spi+0x570/0xf30
[  133.908034][T11444]  ? xfrm_alloc_spi+0x2a0/0xf30
[  133.909779][T11444]  ? __pfx_xfrm_alloc_spi+0x10/0x10
[  133.911830][T11444]  ? xfrm_find_acq+0x87/0xa0
[  133.913551][T11444]  xfrm_alloc_userspi+0x70b/0xc90
[  133.915357][T11444]  ? __pfx_aa_get_newest_label+0x10/0x10
[  133.917500][T11444]  ? apparmor_capable+0x137/0x1b0
[  133.919189][T11444]  ? __pfx_xfrm_alloc_userspi+0x10/0x10
[  133.921114][T11444]  ? __nla_parse+0x40/0x60
[  133.922780][T11444]  xfrm_user_rcv_msg+0x7a3/0xab0
[  133.924663][T11444]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  133.926805][T11444]  ? __pfx___mutex_trylock_common+0x10/0x10
[  133.929082][T11444]  ? rcu_is_watching+0x15/0xb0
[  133.930758][T11444]  ? trace_contention_end+0x39/0x120
[  133.932805][T11444]  ? __mutex_lock+0x335/0x1340
[  133.934572][T11444]  netlink_rcv_skb+0x208/0x470
[  133.936200][T11444]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  133.938119][T11444]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  133.939984][T11444]  ? netlink_deliver_tap+0x2e/0x1b0
[  133.941746][T11444]  ? netlink_deliver_tap+0x2e/0x1b0
[  133.943532][T11444]  xfrm_netlink_rcv+0x79/0x90
[  133.945197][T11444]  netlink_unicast+0x82f/0x9e0
[  133.946875][T11444]  ? __pfx_netlink_unicast+0x10/0x10
[  133.948825][T11444]  ? netlink_sendmsg+0x642/0xb30
[  133.950674][T11444]  ? skb_put+0x11b/0x210
[  133.952194][T11444]  netlink_sendmsg+0x805/0xb30
[  133.953833][T11444]  ? __pfx_netlink_sendmsg+0x10/0x10
[  133.955560][T11444]  ? aa_sock_msg_perm+0x94/0x160
[  133.957111][T11444]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  133.958817][T11444]  ? __pfx_netlink_sendmsg+0x10/0x10
[  133.960525][T11444]  __sock_sendmsg+0x21c/0x270
[  133.962034][T11444]  ____sys_sendmsg+0x505/0x830
[  133.963754][T11444]  ? __pfx_____sys_sendmsg+0x10/0x10
[  133.965935][T11444]  ? import_iovec+0x74/0xa0
[  133.967804][T11444]  ___sys_sendmsg+0x21f/0x2a0
[  133.969728][T11444]  ? __pfx____sys_sendmsg+0x10/0x10
[  133.971850][T11444]  ? __fget_files+0x2a/0x420
[  133.973746][T11444]  ? __fget_files+0x3a0/0x420
[  133.975707][T11444]  __x64_sys_sendmsg+0x19b/0x260
[  133.977742][T11444]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  133.979661][T11444]  ? rcu_is_watching+0x15/0xb0
[  133.981274][T11444]  ? do_syscall_64+0xbe/0x3b0
[  133.983131][T11444]  do_syscall_64+0xfa/0x3b0
[  133.984929][T11444]  ? lockdep_hardirqs_on+0x9c/0x150
[  133.986944][T11444]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.989316][T11444]  ? exc_page_fault+0x9f/0xf0
[  133.990883][T11444]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.992993][T11444] RIP: 0033:0x7f647238eb69
[  133.994828][T11444] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  134.002629][T11444] RSP: 002b:00007f647322e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  134.005873][T11444] RAX: ffffffffffffffda RBX: 00007f64725b5fa0 RCX: 00007f647238eb69
[  134.008938][T11444] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003
[  134.011614][T11444] RBP: 00007f6472411df1 R08: 0000000000000000 R09: 0000000000000000
[  134.014621][T11444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  134.017942][T11444] R13: 0000000000000000 R14: 00007f64725b5fa0 R15: 00007ffc3ecc4c98
[  134.021362][T11444]  </TASK>
[  134.023479][T11444] Kernel Offset: disabled
[  134.025146][T11444] Rebooting in 86400 seconds..

VM DIAGNOSIS:
13:10:04  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000031 RBX=0000000000000031 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000001107 RDI=0000000000001108 RBP=00000000000003f8 RSP=ffffc900030de9f0
R8 =ffff88801f960237 R9 =1ffff11003f2c046 R10=dffffc0000000000 R11=ffffffff854c1d90
R12=dffffc0000000000 R13=ffffffff99a95917 R14=ffffffff99d9a4e0 R15=0000000000000000
RIP=ffffffff854c1e0c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f647322e6c0 ffffffff 00c00000
GS =0000 ffff8880b8680000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000280 CR3=0000000026fe4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f6472587498 00007f6472587470 XMM03=00007f64725874a8 00007f64725874a0
XMM04=00007f64730ed100 00007f6472587460 XMM05=00007f6472587478 00007f64725874c0
XMM06=00007f64725874b8 00007f64725874b0 XMM07=00007f64725874a8 00007f64725874a0
XMM08=0000000000000000 00007f6472412eab XMM09=0000000000000000 00007f6472412f89
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000000 RBX=ffffffff82185a08 RCX=857fba1681ad5300 RDX=0000000000000000
RSI=ffffffff82185a08 RDI=1ffff11026cc8122 RBP=ffffffff821859f0 RSP=ffffc90003fefc10
R8 =0000000000000001 R9 =0000000000000000 R10=dffffc0000000000 R11=fffffbfff1f40f9f
R12=0000000000000000 R13=ffff888136640910 R14=ffff888136640910 R15=0000000000000001
RIP=ffffffff8222bdf6 RFL=00000806 [-O---P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555568365500 ffffffff 00c00000
GS =0000 ffff8881a3c80000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fc6649ee998 CR3=00000000276a8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f48bf612e17
XMM06=0000000000000000 00007f48bf612e11 XMM07=0000000000000000 00007f48bf612e25
XMM08=0000000000000000 00007f48bf612eab XMM09=0000000000000000 00007f48bf612f89
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
