last executing test programs:

1m7.966173764s ago: executing program 2 (id=1588):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
r1 = socket(0x2a, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0)
getsockname$packet(r1, &(0x7f0000000700)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000500)=0x14)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x20800001, 0x4)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffd, @empty}, 0x1c)
listen(r4, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4)
bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
setsockopt$sock_int(r4, 0x1, 0x2e, &(0x7f0000000100)=0x3, 0x4)
shutdown(r4, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x888, 0x2c, 0xd2f, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x2}}, @filter_kind_options=@f_fw={{0x7}, {0x854, 0x2, [@TCA_FW_POLICE={0x850, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x6, 0x3ff, 0x5, 0xfffffffd, {0x8, 0x1, 0x2, 0xf801, 0xa6d, 0x12b}, {0x5, 0x2, 0x4, 0x6, 0xcc42, 0x7}, 0x0, 0xf3b, 0x6}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x5}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x401, 0xe, 0x80000001, 0x8, 0x200, 0x6, 0x8, 0x4, 0x10200000, 0x4, 0x3, 0x9, 0x3, 0xffffffff, 0xb, 0x9, 0x4, 0xd4ae, 0x5, 0x300000, 0xe1b5, 0xc5b, 0x6, 0x4, 0x9, 0x6, 0x9, 0x8, 0x3, 0x9, 0xd, 0x7f, 0x7, 0xce0, 0x1ff, 0x6, 0x6, 0x41, 0xff, 0x800, 0x2, 0x7, 0x9, 0xd, 0x4, 0xffffff1f, 0xa, 0xc, 0x8, 0xfffffffa, 0x155, 0x7, 0x0, 0x18000, 0xc, 0x9, 0x40000, 0x101, 0x6, 0x3ff, 0x1, 0x3, 0x7554, 0x2, 0x4, 0x1, 0x4, 0xd, 0x8000, 0xff, 0x0, 0xeac2, 0x87, 0x3, 0xfe000000, 0x3, 0x8001, 0xff, 0xffff1cac, 0x2892, 0x6, 0x8c5e, 0x1, 0x5, 0xffffffff, 0x80, 0xffffffac, 0x3, 0xff1, 0x2, 0x2, 0x8, 0x2, 0x1, 0x8, 0x8, 0xfff, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x487, 0x6, 0x8, 0x1000, 0x1ff800, 0x6, 0xfffffffe, 0x3c78, 0xfa1, 0x3, 0x6, 0x9, 0xffffffff, 0x7fffffff, 0x2, 0xda, 0x9, 0x401, 0x6, 0x7, 0x2, 0x2, 0xe, 0x835, 0x4, 0x3, 0x6cc7, 0x6, 0x8, 0x8, 0x400, 0x8, 0x4, 0x3, 0x5, 0x5, 0x0, 0x9, 0x400, 0x3, 0x0, 0x4cc, 0xb, 0x0, 0xce, 0x6, 0x0, 0xc8, 0x4, 0x5, 0x4, 0x1ff, 0x1ff, 0x968, 0x5, 0x68cff086, 0x2, 0xfff, 0x2, 0x7ff, 0x1000, 0x80000001, 0x9, 0x9, 0x0, 0x8001, 0x1000, 0x8b7f, 0xfe, 0xc, 0x8, 0x7, 0x8000000, 0x0, 0x7fff, 0xfffffffd, 0x5, 0x815d, 0x5, 0x44, 0x4, 0x6, 0x3, 0x1, 0x8, 0x0, 0x7ff, 0x3, 0x8, 0x1, 0x2, 0x800, 0x7, 0x5, 0x10, 0xfffffff7, 0x8, 0x40, 0x1, 0x10001, 0x1000, 0xe42c, 0x1, 0x101, 0x6, 0x8, 0x4, 0x9a14, 0x4, 0x81, 0x7, 0x0, 0x8, 0x8, 0xfffffffa, 0x0, 0x30000, 0x7ff, 0x4, 0x3, 0xd, 0x5, 0x0, 0xfff, 0x3, 0x7b0, 0x7, 0x9, 0xffff, 0x5, 0xff, 0x4, 0x0, 0x4, 0x9, 0x6, 0x100, 0x81, 0x0, 0x7fc, 0x2, 0x5, 0x80, 0x2, 0xe, 0x1, 0x40, 0x1ff, 0x3, 0x380, 0x6, 0x7, 0x8, 0xfffffffb]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x7, 0x8, 0x7, 0xffff, 0x2, 0x3, 0x7fff, 0x8, 0x0, 0x401, 0x4, 0x0, 0xf7b1, 0xa, 0x40, 0x200, 0x0, 0x1, 0x9, 0x9, 0x8, 0xbf2, 0x2, 0xffff9374, 0x9, 0x1, 0x5, 0x3ff, 0x3, 0x6, 0x5, 0x2, 0x7, 0xe, 0x5, 0x4, 0x9, 0x8, 0xf0, 0x5, 0x8000, 0x0, 0x7, 0xff, 0x2, 0x2, 0x400, 0x0, 0x5, 0x2, 0x401, 0x100, 0xf30, 0x8001, 0x9, 0x370, 0x3, 0x1, 0xfffffff9, 0x9, 0x3, 0x5, 0xb9b, 0x1, 0x5, 0x0, 0x4, 0x7, 0x6, 0x3ff, 0x3, 0x7, 0x76, 0x9, 0xffff, 0x8, 0xd, 0x80, 0x4, 0x9, 0x7ff, 0x80000001, 0x9, 0x6, 0x7f, 0x9, 0x7ff, 0x3, 0x8, 0x31, 0x1, 0x2d, 0x0, 0xf02, 0x15200, 0xa, 0x1, 0xe148, 0x7, 0x1, 0x3, 0x6, 0x6, 0xb, 0xfffffffa, 0x4, 0xdf, 0x80000000, 0x8001, 0x2, 0x3, 0x2971010e, 0x3b655406, 0x1, 0x8, 0x6, 0x6, 0x4, 0x4, 0x8, 0x80000001, 0x5dd, 0x2d3, 0x7, 0x8, 0x5, 0x79d5, 0x2, 0x800, 0x8d, 0x1, 0x2, 0x1, 0x5, 0x6, 0x338, 0x6, 0x2, 0x4, 0x0, 0x3, 0x0, 0x0, 0x8, 0x1, 0x3ff, 0x8, 0x56, 0x7, 0x401, 0x7, 0x0, 0x0, 0x0, 0xda, 0x5, 0x42, 0x18, 0xfffffff7, 0x5, 0xed2, 0x7, 0x211, 0x0, 0x2, 0xc9, 0x3, 0x8, 0x1, 0x9, 0x58, 0x8, 0x5e5, 0x5, 0x3, 0xfffffffb, 0x3, 0xff, 0x2, 0x10, 0xf7ee907a, 0xff, 0xc9, 0x9, 0x0, 0x400, 0x0, 0x7, 0x6, 0x9, 0x8, 0x8, 0x0, 0x0, 0x7, 0x0, 0x4, 0x7, 0x2, 0x3, 0x9, 0x9, 0x0, 0x7, 0x4, 0x0, 0x4, 0x4, 0x4, 0x6f3, 0x6, 0x10, 0x0, 0x7, 0xfffffff9, 0xfffffffa, 0x9, 0x53a, 0x8, 0x1, 0x4, 0xb, 0x8, 0xfffffff9, 0x400, 0x461, 0x81, 0x8, 0x2, 0x7ff, 0x2, 0x8000, 0x7, 0x4, 0xba95, 0x4, 0x4706, 0x7ff, 0x4, 0xffffffff, 0xf7b1, 0x3, 0x2, 0x5, 0x9, 0x1fffc, 0x80000000, 0x8001, 0x9, 0x4, 0x9, 0x3, 0x6, 0xce, 0x8]}]}]}}]}, 0x888}, 0x1, 0x0, 0x0, 0x20000005}, 0x40)
r6 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0)
ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x42, 0x800000, 0x8, 0x7})
write$bt_hci(r0, &(0x7f0000000080)=ANY=[], 0x6)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000060a0b040000000000000000020000001400048010000180090001006d617371000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x68}}, 0x0)
r9 = socket$kcm(0x2, 0x3, 0x84)
sendmsg$inet(r9, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000b00)="79dfe4263f037de282e588f3", 0xc}], 0x1, &(0x7f0000000580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @loopback}}}], 0x20}, 0x44000)
sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb001480c70007"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)

1m7.873089076s ago: executing program 2 (id=1591):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88)
r1 = socket$netlink(0x10, 0x3, 0x0)
bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="240000002e0001002aab70000000000008000000"], 0x24}], 0x1}, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000104000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x40040)
close(0x3)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r6 = socket(0x400000000010, 0x3, 0x0)
r7 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
socket$vsock_stream(0x28, 0x1, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000940)=@newtfilter={0x178, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r8, {0xe, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x148, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x1c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x49}]}]}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0xfc, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x6, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3000000}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xc00}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xff}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x5, 0x1, 0x5ac}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x2c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x86}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x47, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x34, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8c}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x0, 0x3, 0x10}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xe7}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x2c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x46}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x24, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x7fffffff}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xb5}]}]}, @TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}}, @TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_ENC_IPV4_SRC={0x8, 0x1b, @local}]}}]}, 0x178}, 0x1, 0x0, 0x0, 0x80}, 0x0)
sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000100000040000180060001000a00000008000500000000000c000700000000000000000008000900710000000700060072720000080008000000000008000b"], 0x54}}, 0x0)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000080)=0x4, 0x4)
setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310)
setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @empty}}}, 0x108)

1m7.804118069s ago: executing program 2 (id=1593):
r0 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000100))
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x180}, 0x8)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000001c0)={0x0, 0x81}, 0x8)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), 0xffffffffffffffff)
sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x14, r3, 0x711, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x24004894}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2)
sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, 0x0, 0x40080c0)
sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00)

1m7.706393584s ago: executing program 2 (id=1596):
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
bind$802154_dgram(r1, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0002}}}, 0x9)
r2 = socket$isdn_base(0x22, 0x3, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
syz_emit_ethernet(0x76, &(0x7f00000006c0)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x40, 0x3a, 0x0, @remote, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b29ab", 0x0, 0x11, 0x0, @private1, @private2, [@dstopts={0x0, 0x0, '\x00', [@generic={0x40}]}]}}}}}}}, 0x0)
r4 = syz_genetlink_get_family_id$team(&(0x7f0000001880), 0xffffffffffffffff)
sendmsg$TEAM_CMD_NOOP(r3, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f00000018c0)={0x14, r4, 0x1, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20040090}, 0x4000080)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r6=>0xffffffffffffffff})
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000800)={0x304, r5, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x9, 0x42}}}}, [@NL80211_ATTR_REKEY_DATA={0x6c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="01400f1453d703a2d5d8e97d438a80b6"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "35de6132ab2f114a"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="363d95099258e6a7d8ff6de7ae52d520cdfb086bef017690"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="e448758577fb5ec3b435434154d00b9a"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x5}]}, @NL80211_ATTR_REKEY_DATA={0x20, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="eb3240b38a26dd7bcc30542dd86931570bffda121708715e"}]}, @NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="fbfbb8afa2791255ea4127f5f55e790900"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="4a8da499f81fed577ac0058d7d016df3"}]}, @NL80211_ATTR_REKEY_DATA={0x80, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x8, 0x1, @kek="1c1b14b997d8a79021158670eb378d8c"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="eb46bfbc8f221c2834753091c17b314f2e764b7372db9fb0"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "ffffff00"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="483f5debbbf3dcb333759cfce80c8cd6"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="b0ce71994eba1284334511e89bade6fd0ecd8bf99e87c9374a73119abd3db279"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x4}]}, @NL80211_ATTR_REKEY_DATA={0xbc, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7f}, @NL80211_REKEY_DATA_KCK={0x0, 0x2, @kck_ext="4c7d5f29225ad1e3490f99f00807791d444b9462e018c7ce"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="ac469ac57e2df3dfc05fe374367c2c4d75226e76e6d041014570f47cb755d11c"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="0a3ba2b192917fab134da151d3a6f55a"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x6}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="b2008d258b7548caa190cd7d510a778a"}, @NL80211_REKEY_DATA_KCK={0xfffffce4, 0x2, @kck_ext="2c7f672d0fdab43ae36488301ab4c97a6e04f17800001000"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="30609a1d8bbcf12ed3ca347dcb8391feb86bb5f601aeef56"}]}, @NL80211_ATTR_REKEY_DATA={0x4}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x1000}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "61832835f0514afc"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "38355f8e08a2d126"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="76a0d01ab0ff5c3fbd16617225945c18"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="07083f1237ea9a9dc51a20a773579bb2"}]}, @NL80211_ATTR_REKEY_DATA={0xc, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x5}]}, @NL80211_ATTR_REKEY_DATA={0x54, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="e50305415fae8fb19404d346fddea4b1"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="83529b1216cfb43d07d4673859c500"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "f6545d1ff84f7060"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x40000}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "0473a8db33e0feed"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x45}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="3fa46a5324be5b3daae1f6c32b922f0ed517c8398c5d3aee"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xf7}]}]}, 0x304}, 0x1, 0x0, 0x0, 0x4040011}, 0x20040048)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x54, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}, {0x20, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1a}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa8}}, 0x0)
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000001940)={r2, 0x1, 0x3})
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r10, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r10, 0x117, 0x1, 0x0, 0x0)
r11 = accept4(r10, 0x0, 0x0, 0x0)
sendmmsg$alg(r11, &(0x7f0000001800)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0)
recvmmsg(r11, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000c80)=""/157, 0x9d}], 0x1}, 0x6}], 0x1, 0x28101, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x401, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_DOWNDELAY={0x8, 0x1f}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}}, 0x0)

1m7.614773268s ago: executing program 2 (id=1598):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$NL80211_CMD_VENDOR(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010200000000000000006700000008000300", @ANYRES32=r3, @ANYBLOB="0800c300741300000800c40001000000", @ANYRESOCT=r3], 0x30}}, 0x40000)
r4 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10)
listen(r4, 0x0)
r5 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r5, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10)
r6 = accept(r4, 0x0, 0x0)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x12, 0x14, 0x4, 0x5}, 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r7, &(0x7f0000000300), &(0x7f00000002c0)=@tcp6=r6}, 0x47)
shutdown(r6, 0x0)
recvfrom$unix(r6, 0x0, 0x0, 0x140, 0x0, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000000)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@mcast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, {@in6=@mcast1, 0x0, 0x6c}, @in6=@local, {0x0, 0x2, 0x0, 0x8, 0xfffffffffffffffd, 0x8}, {0x0, 0x2}, {0x1, 0x3}, 0x10, 0x4000, 0x2, 0x4}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0)

1m7.427918358s ago: executing program 2 (id=1600):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x34}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)

1m7.418837349s ago: executing program 32 (id=1600):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x34}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)

1.809211612s ago: executing program 0 (id=2428):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x1ff)
r1 = gettid()
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f0000000100)=0x7, 0x4)
setsockopt$sock_attach_bpf(r2, 0x1, 0x10, &(0x7f00000003c0), 0x4)
write$cgroup_devices(r3, &(0x7f0000000200)=ANY=[], 0x9)
recvmsg$unix(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c0400002b0007010000000000000000017c00000800fa00", @ANYRES32=r1, @ANYBLOB="08004e00090000000900028097f09726550000000b04e08008003e00e00000015bfa31e8989c90cf0b5aec37f0453e855448a41bb018ddb8840b12ab7869d852822b30db3690541171389dcea5dfcaaee54bfe26c5b72452c24e11d08fad59cf6e10455f3ffbb39fdb8f8db5518ebc7407b902a17772fba8d8cbc6a1cd975aa18efb1bd0ec268dbbd1a7260cbd74f972031c8094cd2d0f1ed34e1bea2d0bb2d1191e9a41a363b6a8d52ccebd52316838f656569bd12fb076d379314a9c1322ccd715d43c685420969faee481b449ea0199aa15444c74c1a96c941ec03037caadedd2be2381f6ab17b64f37bc4db44aff64abf2670bd59fc49dff6ed72b5a96acd2a8e0b694b5f7d058755e5106b5a22d577b506b1595144809491e4cf78c9a26e6ee43c9370ee11cfdf8e873741c137210ee051a762a06b0aaeec31cc06fea30321a7da73b24009d002015524703b2a3f85c016a36a18422f91c6b3a363df2e7147dc4520c38ff243b14008900fe880000000000000000000000000001d73f73cf6e3feb02964a0383d170a888eb1cf830f67123635e9976d5a11cbf1e1ce1d7856c1970fa29433ae68922e0c08c9bc5e2d95fade09474e6079c9b69ff81ce5f9797fc07b06222f3c9be770f090097b7b55f31d70d43916c568a021c21b9d8330ddcf64b33e29d31bed69de64a802b5ca237d5314057bc416c2fca30dae8c572ba8cd172deb2ab5b524d18230c0a0e1514b2dc18bc963b180f4b3ab031e80e1a4e558c69bca3a540bbba05692913fbc126e36728328b6413eeb1432a44473271f455414a45281f214fec4a695e5869ef3bc129fee5bc5b7def81bec6baebced3003300301911051097ab89725bde47e61a7cf484efe0016ef50a1fa821d1259555e95ebba4a5522a7b5a23e74cf805000000000000002bb31cf72fc04b83949cfb681bb56ccaa4691a089c3d906b33483b14c993e2f24fd1d1fa04de8dff897021293896590f70b88370d60a93a4e07c29c4c16119199e051c67a3dbedeca9b4699e2acb832df1aba8d153e948f199ce766a5ecef57134656a59675509ee50da9860a522d8a05da9a618a323c5c7c9354d7c8b02c3eb9d3e54ab28377fb32d90d2a46c2fe1da5e1569c26339572514d1e8f1000400648004007780deb4d746bda2debda970a5deef817a3628711204c9c80fd838c50523f9a6dae43c3900b04d170400ba8021fa7e15310605b2d82fc40c211e86b34d8b734b91ac6bebfe9b676aaa61b28e2fe524cf873265fd3d6aa81ac0bb27ed6befe0a06f6e2c56aa1a2af9f84b3b3956b67158dd8b06f8c8683add988f58943ce6af2b52df16f5953b2a7fad96310aa104bbfe4d5e15ff514a432b3f40468aa14ad3832e3d6c59421bdd095df381afb5fdd02b4d32c702e982c4c1a0fc408cd7212c093eb0a02a762aeb28173b0312cdec34f50a0b590f8cf6", @ANYRES32=r1, @ANYBLOB="14001700ff02000000000000000000000000000100"], 0x43c}, 0x1, 0x0, 0x0, 0xc000}, 0x4040)

1.749839558s ago: executing program 0 (id=2429):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000e40)={'wlan0\x00'})
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'dummy0\x00', 0x4000})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000880)=@gettclass={0x24, 0x2a, 0x635, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xffff, 0x6}, {0xd, 0x10}, {0x2, 0x7}}, ["", "", "", "", ""]}, 0x24}}, 0x4040000)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000400)={'team0\x00', <r3=>0x0})
sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x403, 0x20000000, 0x0, {0x0, 0x0, 0x4, r3, 0x311}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r3}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x8044)
r4 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r5 = socket$packet(0x11, 0x3, 0x300)
r6 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c00000068009753d74093eaf656df2500000000000000000c00020001000000060000000800010001"], 0x2c}}, 0x4000)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'wg2\x00', <r8=>0x0})
sendto$packet(r6, &(0x7f0000000180)="0b036812e0ff64000200475400f6a13bb1000006890086", 0x17, 0x0, &(0x7f0000000140)={0x11, 0x0, r8}, 0x14)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r9=>0x0})
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="b4cd61e2030800000000000000513ae0e1c022a403d2b42ff069733f3de8b660e8aba509c53e9c77500000000000000000254e3cc392739b8663dc21ea3159ab7d19b4ee2ac4", @ANYRES16=r4, @ANYBLOB="200029bd7000fcdbdf253700000008000300", @ANYRES32=r9, @ANYBLOB="0c0099000200000036000000080057000100000008002700000000000500190105000000050018010300000008009f00070000000800a000550000000800a000070000000800a0000500000008009f00010000000800a100090000000800220157010000080026006c0900000800270001000000080057000900000005001901400000000800a10000000000050019010500000008005700a5010000"], 0xb8}, 0x1, 0x0, 0x0, 0x4008080}, 0x8081)
r10 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r10, 0x29, 0x20, &(0x7f0000000040)={@local, 0x800, 0x0, 0x2, 0x1, 0x3}, 0x20)
r11 = accept$packet(r5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14)
getpeername$packet(r11, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000400)=0x14)
setsockopt$inet6_int(r10, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r10, 0x29, 0x20, 0x0, 0x0)
r12 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000240)={'syz_tun\x00', <r13=>0x0})
bind$packet(r12, &(0x7f0000000300)={0x11, 0x0, r13, 0x1, 0x0, 0x6, @remote}, 0x14)
socket$packet(0x11, 0x3, 0x300)
ioctl$sock_inet6_SIOCADDRT(r10, 0x890b, &(0x7f0000000280)={@remote, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x8, 0xf, 0x100, 0x8000000000000000, 0x20200, r13})

1.690147443s ago: executing program 0 (id=2430):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000018c0), r3)
sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000001c0)={0x44, r4, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_hsr\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000700)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0x44, r4, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_FWMARK={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x800}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xaf}]}, 0x44}, 0x1, 0x0, 0x0, 0x24004040}, 0x40008)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.numa_stat\x00', 0x26e1, 0x0)
close(r5)
r6 = socket$nl_route(0x10, 0x3, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x11, 0xffffffff, 0x0, 0x0, 0x255}, 0x48)
sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@delneigh={0x44, 0x1a, 0x1, 0x0, 0xfffffffd, {0xa}, [@NDA_CACHEINFO={0x14, 0x3, {0x7}}, @NDA_DST_IPV6={0x14, 0x1, @mcast2}]}, 0x44}}, 0x0)
r7 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0xfe79, &(0x7f0000000480)=[@in6={0xa, 0x4e22, 0x1, @remote, 0x7}]}, &(0x7f0000000100)=0x10)
setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f0000000500)={0x1, 0x4, 0xa4, 0x8003, @vifc_lcl_addr=@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfffffffffffffef9)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000000)={0x1, [<r8=>0x0]}, &(0x7f0000000040)=0x8)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, &(0x7f0000000040)={r8, 0x180}, 0x8)
setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000001c0)={r8, 0x81}, 0x8)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYRES64=r0], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x48985)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), 0xffffffffffffffff)
sendmsg$IPVS_CMD_GET_SERVICE(r9, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)={0x14, r10, 0x711, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x24004894}, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0)
r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r9)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000340)={'wlan0\x00', <r12=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r7, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0x19, &(0x7f00000004c0)={&(0x7f0000000a00)={0x90, r11, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0xa, 0xc}}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x7}, @NL80211_ATTR_SCAN_SSIDS={0x30, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}, {0xa, 0x0, @default_ap_ssid}, {0xa, 0x0, @default_ap_ssid}, {0x8, 0x0, @random="60978bcfdf63c009465d20099e"}]}, @NL80211_ATTR_BSSID={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0xa}, @NL80211_ATTR_SCAN_SUPP_RATES={0x0, 0x7d, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x0, 0x3, "0f3b5b2003c3d4aa857615251d047b5c310600000034c58cc422a5e4c616db061f3902f91afc65142f1feb20491bc586c0a767aeb280acd1af5dd0a671692fe5cca08afda8768b430367f12d8acfbe830ace3149c3c296bb819aa9c03d5683fc1245fd359063402ff4"}, @NL80211_BAND_60GHZ={0x0, 0x2, "b01d01e587592cade7b2d3e3f088d41c215645e4b764d0d93df01bd1e05cb7d1911def08d8b3c75ed8f92d6fa1acfe7f0943542aba16cf4b612d4a19e8ab0654e4e3bf6dcb1ec9e4800a17929390e20232"}, @NL80211_BAND_5GHZ={0x0, 0x1, "c491e127c7f39873111e383069ede061b3f1842953dc62b1da3d274e"}, @NL80211_BAND_2GHZ={0x0, 0x0, "60ff9dee396ab4cef06cfbe2bedae4daef422c27d416c1e00ac2749c96acea5cfd34dc2baaf33c46193e0bd948b54e66fcfb6e89ed37919a325bfbb5891247746893ec598f81948fb11358f54dbf2b9095a8bbf0823d557dcbdecf8a6f6284"}]}]}, 0xffffffffffffff0f}, 0x1, 0x0, 0x0, 0x1}, 0x40080c0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="7800000010000305000000000000000000cf0100", @ANYRES32=0x0, @ANYBLOB="83000000000000002000128008000100677265001400028008000700e000000208000600ac14"], 0x78}}, 0x0)

1.578821671s ago: executing program 0 (id=2431):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x19, &(0x7f0000000240)=[@in6={0xa, 0x2, 0x0, @local, 0x2}]}, &(0x7f00000002c0)=0x10)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f0000000300)=0x8)
getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000040)={r3}, &(0x7f0000000100)=0x8)
getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000400)={r3, 0xa6, "d991576276606961239592e6137e12532897c32d5959c35b2c8a7631ec8b80601fedae95382a777f6ea783edfd3d75f27994d265e39c227994e6c7d225678088563a47892fde20adcf18a4c7e3e76f6f21621a87cba9bd075e85391440ec682acdb400d1da19f9d4ef1e02929daf79c04aea3cd934fae8997504dcd26435170ad37f066b53dcb846a06316d8ece4d7b0605f60144bb121d9840f214f5dff87913d660da74880"}, &(0x7f0000000040)=0xae)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x190b87f9}, {0x6, 0x0, 0x6, 0x1}]}, 0x10)
sendmmsg(0xffffffffffffffff, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f0000000100)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000a40)="118db76e8efb27d530b26a8302bad647e35540226c4052b6d573165d39ad8ead67632e8fe108cf55473bc22914286359c3bb3decf99ed04d34d1a73ae48dae0e69ee69fe", 0x44}], 0x4}}], 0x1, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c00000010001fff001201000006000043be4354", @ANYRES32=0x0, @ANYBLOB="ff7f000000000000140012800a00010076786c616e00000004000280080004"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0)
r5 = socket(0x10, 0x80002, 0x0)
sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
write(0xffffffffffffffff, &(0x7f0000000140)="24000000010006", 0x7)
unshare(0x62040200)
r6 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x28, 0x140f, 0x1, 0x70bd25, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x8, 0x45, 'srp\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x8, 0x45, 'cma\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000340)={'wg1\x00', 0x4000})
mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040080)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000002c00010324bd7002f9dbdf2506"], 0x14}, 0x1, 0x0, 0x0, 0xc850}, 0x40000)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0xc, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "5060dbe7"}]}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x110}}, 0x0)
r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
bind$802154_dgram(r7, &(0x7f0000005080)={0x24, @short={0x2, 0x1, 0xaaa0}}, 0x14)
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)

1.147732177s ago: executing program 0 (id=2434):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000005"], 0x50)
r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
bind$rose(r2, &(0x7f00000000c0)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x1, [@null, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40)
r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0xe, 0x200000000000029b, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r5, &(0x7f0000000140)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r6, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r6], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0)
r8 = socket(0x10, 0x3, 0x0)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14)
sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800)
sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f40)=@newtfilter={0x38, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r9, {0x4, 0x9}, {}, {0xe, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x8, 0x2, [@TCA_CGROUP_ACT={0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', <r10=>0x0})
r11 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'tunl0\x00', &(0x7f0000000280)={'gre0\x00', <r12=>r10, 0x700, 0x7800, 0x1, 0x8, {{0x23, 0x4, 0x0, 0x2b, 0x8c, 0x68, 0x0, 0x3, 0x2f, 0x0, @local, @empty, {[@ssrr={0x89, 0x27, 0x18, [@broadcast, @multicast2, @dev={0xac, 0x14, 0x14, 0x2a}, @multicast1, @rand_addr=0x64010100, @loopback, @multicast2, @local, @remote]}, @timestamp={0x44, 0x28, 0x30, 0x0, 0x4, [0x3, 0x2, 0x8, 0x2, 0x9c6c, 0x4, 0x50f, 0x6, 0x1]}, @timestamp={0x44, 0x14, 0x1c, 0x0, 0x3, [0xd4, 0x3, 0x4, 0x100]}, @timestamp_addr={0x44, 0x14, 0xa8, 0x1, 0xe, [{@private=0xa010100, 0x5}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8000}]}, @noop]}}}}})
sendmsg$nl_route_sched(r11, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@getchain={0x3c, 0x66, 0x10, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r12, {0xd, 0xa}, {0xe, 0x10}, {0xffe0, 0x3}}, [{0x8, 0xb, 0x72a}, {0x8, 0xb, 0xfffffff9}, {0x8, 0xb, 0x7ff}]}, 0x3c}}, 0x2000a804)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r10], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x4884)

804.471728ms ago: executing program 0 (id=2439):
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b36, &(0x7f0000000000)={'wlan0\x00'})
openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x28, r2, 0x5, 0x70bd29, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0x5, 0x34, @random="8b"}, @crypto_settings=[@NL80211_ATTR_SAE_PASSWORD={0x4}]]}, 0x28}}, 0x0)
socket$netlink(0x10, 0x3, 0x9)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0)
close(r4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000140)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0xfffffffffffffff0}, @map_fd={0x18, 0x7}]}, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5}, 0x94)
ioctl$SIOCSIFHWADDR(r4, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @random="7cf1e97c9e4f"})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'})
r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d)
ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000))
r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]})
r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r8, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c)
connect$rose(r8, &(0x7f0000000240)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null, @bcast, @default]}, 0x40)

480.528105ms ago: executing program 1 (id=2446):
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000240)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null, @bcast, @default]}, 0x40)

475.648132ms ago: executing program 3 (id=2447):
unshare(0x20000400)
r0 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000080)="1400000096000b63d25a8044963550d0e85e1b31", 0x14}], 0x1}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb001480c7000d"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
unshare(0x20000400) (async)
socket$kcm(0x10, 0x3, 0x10) (async)
sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000080)="1400000096000b63d25a8044963550d0e85e1b31", 0x14}], 0x1}, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb001480c7000d"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async)

474.981379ms ago: executing program 1 (id=2448):
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x9)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0)
close(r1)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00002000000000000000fb000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001600)=@bpf_ext={0x1c, 0x24, &(0x7f0000001340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@map_idx_val={0x18, 0xc, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0xada}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @map_fd={0x18, 0x5, 0x1, 0x0, r2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x4}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001100)='syzkaller\x00', 0x1, 0x68, &(0x7f0000001200)=""/104, 0x40f00, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001480)={0x7, 0x9}, 0x8, 0x10, &(0x7f00000014c0)={0x3, 0x10, 0x1ff, 0x8}, 0x10, 0x94b6, r1, 0x0, &(0x7f00000015c0)=[0xffffffffffffffff, 0xffffffffffffffff, r1, r1, 0xffffffffffffffff, r1, r1, r1], 0x0, 0x10, 0xb}, 0x94)
ioctl$SIOCSIFHWADDR(r1, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @random="7cf1e97c9e4f"})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'})
r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d)
ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000))
r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCADDRT(r5, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]})
r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r6, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c)
connect$rose(r6, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @null, @null, @default, @bcast, @default]}, 0x40)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000001a0001000000000000000a0080000000", @ANYRES32=0x0, @ANYBLOB="000000000800020000000000140001"], 0x38}}, 0x0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8)
r7 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r7, &(0x7f0000002d00)=[{{&(0x7f0000001080)={0xa, 0x4e22, 0x1, @private2, 0x10001}, 0x1c, &(0x7f00000010c0)=[{&(0x7f00000011c0)="e6", 0x1}], 0x1}}], 0x1, 0x48040)
shutdown(r7, 0x1)
getsockopt$bt_hci(r7, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9)
r8 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r8, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
r9 = socket$inet6(0xa, 0x3, 0x87)
setsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in=@multicast1, 0xfffd, 0x0, 0x4e20, 0x0, 0x2}, {0xfffffffffffffffe, 0x4, 0x1, 0x0, 0x0, 0x9, 0xf0e}, {0x3, 0xb, 0x4053e5, 0x20}, 0xa, 0x1, 0x1, 0x0, 0x1, 0x2}, {{@in6=@loopback, 0x1, 0x32}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x3502, 0x1, 0x0, 0x0, 0x2, 0x1}}, 0xe8)
connect$inet6(r9, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback, 0x9df}, 0x1c)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x10, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x2, 0x2, 0x0, 0x1, 0x4}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94)

380.515055ms ago: executing program 3 (id=2449):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001b80)={'wlan1\x00', <r3=>0x0})
sendmsg$NL80211_CMD_DEAUTHENTICATE(r1, &(0x7f0000001d00)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001cc0)={&(0x7f0000001bc0)={0xf4, r2, 0x1, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_IE={0xd0, 0x2a, [@dsss={0x3, 0x1, 0x99}, @fast_bss_trans={0x37, 0xc7, {0x3, 0x4, "0279bec188b7f26109d486d55b8c0a40", "a52bcd9c415b0003a851b59bb491be1d43e6447863f6e9e475e383f9a0348558", "6d19d156529c5f72a5b5e2926103580277a0ebadde99d1a789ec0b8f9940113e", [{0x2, 0x21, "a7bf3879a98c3bd5496b6f96a7b5bdae18f0f6627732a754ed82fec2f00b2b5e24"}, {0xfc, 0x18, "6195562a60632e99385b391d2f9937d619722886f47c894c"}, {0x3, 0x1c, "c28d0f4b63f7df722f9441f3e5cce02bc19bce6a70d800bc2618251f"}, {0x3, 0x18, "8a5e51531bc035696f4a4d4f5c0483e6156e7a928e826d6d"}]}}]}, @NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000a0)

377.169406ms ago: executing program 1 (id=2450):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800)
r4 = socket$netlink(0x10, 0x3, 0x0)
bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x88, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0xc, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_KEY_ENC_UDP_SRC_PORT_MASK={0x6, 0x2c, 0xff84}, @TCA_FLOWER_KEY_PORT_SRC_MAX={0x6, 0x58, 0x4e23}, @TCA_FLOWER_KEY_VLAN_ID={0x6, 0x17, 0xffd}, @TCA_FLOWER_KEY_IPV4_DST={0x8, 0xc, @initdev={0xac, 0x1e, 0x1, 0x0}}, @TCA_FLOWER_KEY_ICMPV4_CODE={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_CT_ZONE_MASK={0x6, 0x5e, 0x724}, @TCA_FLOWER_KEY_ENC_IPV6_SRC_MASK={0x14, 0x20, [0xffffff00, 0xffffffff, 0xff000000]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x0)

296.557276ms ago: executing program 3 (id=2451):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_int(r1, 0x29, 0x4c, 0x0, &(0x7f0000000100))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
writev(r2, &(0x7f0000000400)=[{&(0x7f0000000440)="8d8967f40c49cf041bd5530d", 0xf000}, {0x0, 0x27}], 0x2)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r0)
sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={&(0x7f00000000c0)=ANY=[@ANYRESDEC, @ANYRES16=r3, @ANYBLOB="010028bd7000fddbdf25090000003c0003800800010001000000140002006272696467655f736c6176655f300000080003000000000014000600ff010000000000000000000000000001"], 0x50}}, 0x48040)

296.014196ms ago: executing program 1 (id=2452):
socket$unix(0x1, 0x1, 0x0) (async)
r0 = socket$unix(0x1, 0x1, 0x0)
close(r0) (async)
close(r0)
socket(0xa, 0x3, 0x3a) (async)
r1 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_DEL_MIF(r1, 0x29, 0xc8, 0x0, 0xc000000)
setsockopt$MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x4, 0x0, @mcast2}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x100]}}, 0x5c)
setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x1}, 0x5c) (async)
setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x1}, 0x5c)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='pids.current\x00', 0x0, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0)
r4 = socket(0x10, 0x803, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'caif0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'caif0\x00', <r5=>0x0})
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r5, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) (async)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r5, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r6, 0x0) (async)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r6, 0x0)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000004c0)={0x1, <r8=>0xffffffffffffffff}, 0x4)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x50) (async)
r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x50)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x5, 0x5}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x17, 0x14, &(0x7f0000000380)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x4}, @map_idx={0x18, 0x7, 0x5, 0x0, 0x5}, @map_idx_val={0x18, 0x6, 0x6, 0x0, 0x5}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}], &(0x7f0000000200)='GPL\x00', 0x8, 0x6f, &(0x7f0000000440)=""/111, 0x41100, 0x1, '\x00', r5, @cgroup_sysctl=0x12, r6, 0x8, &(0x7f0000000240)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xa, &(0x7f00000008c0)=[r7, r8, r9, r10, 0xffffffffffffffff], &(0x7f0000000900)=[{0x4, 0x2, 0x10, 0x4}, {0x0, 0x4, 0x2, 0x8}, {0x3, 0x5, 0xe, 0xb}, {0x5, 0x2, 0x2, 0x7}, {0x3, 0x2, 0x7, 0x2}, {0x4, 0x1, 0x8, 0x8}, {0x5, 0x1, 0xc, 0xc}, {0x5, 0x2, 0x7, 0x6}, {0x4, 0x2, 0x3, 0x1}, {0x0, 0x2, 0xc, 0x1}], 0x10, 0x3}, 0x94)
sendto$ax25(r1, &(0x7f0000000080)="91e3e06cc157f8c7ebf4a7e2aa8f560404d1ed97f10e5c9ef09cb080c154524d05ab240a6aa2ce600285ef23da040c0e3ab162d9518ef76a9d8d3b8518029f83828cdbff6a3b84fda687d5d4ee5ccde81962297e5dae244081612d652d722543ca90a92f10d460c42ce665e6ecc1623083c4f6d73ded4cec9aa26d01761499e6ee323b6d03126c70d0312a87e156b6774a4fc34d5b7a07e991a3c5adedc656a17e2e30b9667c0ed21a4f481605045e0292488753f862cdc9461460193ddd19c19f", 0xc1, 0x8000, &(0x7f0000000180)={{0x3, @bcast, 0x4}, [@default, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @default]}, 0x48)
socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'gretap0\x00', &(0x7f0000000540)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x1000005, 0x100000, 0x765, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0x400, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x6, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x82, 0xd, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0x5, 0x2a2, 0xfff, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff], "9c787b0db25c8b3312d608f5150add722eb5f8af5e52ace4c53a15882d0a7aa544185b377301e020f3f42fbde28ef0428c3de21ba3065996ce3153081fa1b4375eb51626bcb27b36171095f55652bc856f9ef34ca4732adb76ea3353708ff9e19a5a08dab67e1c3df819026da226fb3e5866f629"}})
poll(&(0x7f0000000000), 0x20000000000000b5, 0x9)

260.36102ms ago: executing program 3 (id=2453):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendmmsg$inet6(r0, &(0x7f0000007cc0)=[{{&(0x7f0000000800)={0xa, 0x4e21, 0x6, @dev={0xfe, 0x80, '\x00', 0xd}, 0x6}, 0x1c, &(0x7f0000001880)=[{&(0x7f0000000340)="28b3", 0x2}], 0x1, &(0x7f00000019c0)=ANY=[@ANYBLOB="24000000000000002001000000000000000000000000000e14b65b156c4d1400", @ANYRES32=0x0, @ANYBLOB="00000000400000000000000029000000360000001d04000000000000000100c90300000000000000000000ffffac1414aac910fe8800000000000000000000000001010014000000000000002900000008000000070000000000000014000000000000002900000008000000060000000000000014"], 0xb0}}, {{&(0x7f0000001a80)={0xa, 0x4e23, 0x9, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x3}, 0x1c, &(0x7f0000002e00)=[{&(0x7f0000001ac0)="01", 0x1}], 0x1}}], 0x2, 0x931766f6319eed40) (async)
shutdown(r0, 0x1) (async)
setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000040)={0x0, 0x8, 0xb}, 0x8)

119.236807ms ago: executing program 3 (id=2454):
sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x2a, 0x2, 0x0)
getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14)
setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000080)=@req3={0x9, 0x5, 0xfffffff7, 0x3, 0x3, 0x0, 0x2c}, 0x1c)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000)
getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000180)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x6, 0x8, 0x800, 0x4, 0x131f]}, &(0x7f00000003c0)=0x78)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r3 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0)
sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0)
sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) (async)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$netlink(0x10, 0x3, 0x0) (async)
socket(0x2a, 0x2, 0x0) (async)
getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) (async)
setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000080)=@req3={0x9, 0x5, 0xfffffff7, 0x3, 0x3, 0x0, 0x2c}, 0x1c) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) (async)
getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000180)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x6, 0x8, 0x800, 0x4, 0x131f]}, &(0x7f00000003c0)=0x78) (async)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async)
socket$netlink(0x10, 0x3, 0x0) (async)
sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async)
sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async)

118.760837ms ago: executing program 1 (id=2455):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r1 = socket$netlink(0x10, 0x3, 0x13) (async)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12812, r2, 0x0)
pipe(&(0x7f0000000380)={0xffffffffffffffff, <r3=>0xffffffffffffffff}) (async)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) (async)
setsockopt$inet_tcp_int(r4, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) (async)
connect$inet(r4, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) (async)
sendto$inet(r4, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0) (async)
splice(r4, 0x0, r3, 0x0, 0x30fea7, 0xa) (async)
sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x4c, 0x1402, 0x400, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r2}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r3}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44}, 0x40000)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2, 0x0, 0xfffc}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14}}, 0x98}}, 0x0) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x2) (async)
r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r6 = openat$cgroup_ro(r5, &(0x7f0000000300)='pids.current\x00', 0x275a, 0x0)
preadv(r6, &(0x7f00000004c0)=[{&(0x7f0000000080)=""/20, 0x14}], 0x1, 0x4, 0x0)
write$cgroup_subtree(r6, &(0x7f0000000280)={[{0x2d, 'blkio'}]}, 0x7) (async)
socket(0x15, 0x0, 0xdf)

652.516µs ago: executing program 1 (id=2456):
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xe, 0x4, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1800000000000000000000000000000071100a000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000280)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, <r2=>0x0}, {0x0, @struct}})
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000680)={r2, 0x4, 0xfb})

0s ago: executing program 3 (id=2457):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000030085000000a8000000850000000800000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000019c0)={r0, 0x0, 0x0, 0xb, 0x0, &(0x7f0000000080)=""/11, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x50)
socket$nl_route(0x10, 0x3, 0x0)
socket(0x2b, 0x80801, 0x1)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x18)
r1 = socket(0x2b, 0x80801, 0x1)
r2 = socket$inet6(0xa, 0x80803, 0x83)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@private1, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xae}, {0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0xfffffffffffffffe}, {0x0, 0x0, 0x0, 0x4}, 0x5, 0x0, 0x1}, {{@in=@local, 0x4d4, 0x3c}, 0x0, @in=@remote, 0x4000, 0x0, 0x0, 0x0, 0x9, 0xffffffff}}, 0xe8)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000780)={'gre0\x00', &(0x7f0000000680)={'gre0\x00', 0x0, 0x7800, 0x40, 0x6, 0x6, {{0x29, 0x4, 0x1, 0x0, 0xa4, 0x65, 0x0, 0x4, 0x4, 0x0, @multicast2, @multicast2, {[@lsrr={0x83, 0x27, 0x38, [@remote, @empty, @rand_addr=0x64010101, @multicast1, @broadcast, @loopback, @multicast1, @private=0xa010101, @remote]}, @ra={0x94, 0x4}, @generic={0x7, 0x5, "2ea939"}, @lsrr={0x83, 0x13, 0xd5, [@private=0xa010101, @dev={0xac, 0x14, 0x14, 0x26}, @multicast1, @multicast2]}, @lsrr={0x83, 0x17, 0xa0, [@empty, @multicast2, @loopback, @dev={0xac, 0x14, 0x14, 0x18}, @empty]}, @cipso={0x86, 0x33, 0x1, [{0x4, 0x8, "96eb9008531e"}, {0x2, 0x4, "da11"}, {0x0, 0xf, "218c7d5de6e7af1efcd0b354f9"}, {0x4, 0x12, "77c3266c2a2397d9b729f097b2cc4f5c"}]}]}}}}})
setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8)
r4 = socket$kcm(0x2, 0x3, 0x84)
sendmsg$inet(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e068000000110000000000000000dbc790ad000000fc000000000000001400000000000000000000000200000004000000000000001c000000000000000000000008"], 0x68}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

kernel console output (not intermixed with test programs):

 an invalid length.
[   95.662615][ T7492] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   95.856969][ T7504] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check.
[   95.868582][ T7474] tipc: Resetting bearer <eth:syzkaller0>
[   96.145271][   T10] tipc: Node number set to 1323443965
[   97.026098][ T7474] tipc: Disabling bearer <eth:syzkaller0>
[   97.330215][ T7524] delete_channel: no stack
[   97.421326][ T7530] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   97.452041][ T7530] batman_adv: batadv0: Removing interface: batadv_slave_1
[   97.671392][ T7550] __nla_validate_parse: 10 callbacks suppressed
[   97.671412][ T7550] netlink: 180 bytes leftover after parsing attributes in process `syz.1.410'.
[   97.716863][ T7552] Bluetooth: MGMT ver 1.23
[   97.736575][ T7554] netlink: 8 bytes leftover after parsing attributes in process `syz.2.412'.
[   97.740941][ T7554] syz_tun: tun_net_xmit 86
[   97.778460][ T7557] netlink: 8 bytes leftover after parsing attributes in process `syz.0.411'.
[   97.779123][ T7556] netlink: 24 bytes leftover after parsing attributes in process `syz.1.413'.
[   97.829236][ T7556] netlink: 8 bytes leftover after parsing attributes in process `syz.1.413'.
[   97.832033][ T7556] netlink: 4 bytes leftover after parsing attributes in process `syz.1.413'.
[   97.864760][ T7556] validate_nla: 3 callbacks suppressed
[   97.864777][ T7556] netlink: 'syz.1.413': attribute type 11 has an invalid length.
[   98.378414][ T7594] 8021q: adding VLAN 0 to HW filter on device bond0
[   98.389025][ T7594] bond0: (slave rose0): Enslaving as an active interface with an up link
[   98.743586][    C1] syz_tun: tun_net_xmit 86
[   98.772501][ T7612] netlink: 104 bytes leftover after parsing attributes in process `syz.0.425'.
[   98.848849][ T7618] netlink: 'syz.0.427': attribute type 4 has an invalid length.
[   99.044298][ T7632] netlink: 56 bytes leftover after parsing attributes in process `syz.1.432'.
[   99.047702][ T7632] netlink: 19 bytes leftover after parsing attributes in process `syz.1.432'.
[   99.049409][ T7635] netlink: 24 bytes leftover after parsing attributes in process `syz.0.431'.
[   99.177999][ T7642] lo speed is unknown, defaulting to 1000
[   99.347624][ T7650] openvswitch: netlink: Geneve option length err (len 256, max 255).
[   99.354642][ T7650] netlink: 'syz.1.436': attribute type 1 has an invalid length.
[   99.369629][ T7650] netlink: 'syz.1.436': attribute type 1 has an invalid length.
[   99.556242][ T7663] smc: net device bond0 applied user defined pnetid SYZ2
[   99.793574][    C1] syz_tun: tun_net_xmit 86
[   99.837583][ T7663] smc: removing net device bond0 with user defined pnetid SYZ2
[   99.847703][ T7663] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   99.861179][ T7663] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   99.869562][ T7663] bond0 (unregistering): Released all slaves
[  100.021440][ T7686] tun0: tun_chr_ioctl cmd 35111
[  100.024932][ T7689] tipc: Started in network mode
[  100.026836][ T7689] tipc: Node identity ac1414aa, cluster identity 4711
[  100.030663][ T7689] syz_tun: tun_net_xmit 118
[  100.036463][ T7689] tipc: Enabled bearer <udp:syz2>, priority 10
[  100.055182][    C0] syz_tun: tun_net_xmit 46
[  100.163577][    C0] syz_tun: tun_net_xmit 118
[  100.203619][    C0] syz_tun: tun_net_xmit 46
[  100.303532][    C0] syz_tun: tun_net_xmit 118
[  100.338091][ T7712] IPVS: sed: UDP 224.0.0.2:0 - no destination available
[  100.443460][    C0] syz_tun: tun_net_xmit 118
[  100.583532][    C0] syz_tun: tun_net_xmit 118
[  100.723483][    C0] syz_tun: tun_net_xmit 118
[  100.863410][    C0] syz_tun: tun_net_xmit 118
[  101.003565][    C0] syz_tun: tun_net_xmit 118
[  101.146974][ T1278] tipc: Node number set to 2886997162
[  101.190265][ T7767] netlink: 'syz.1.458': attribute type 3 has an invalid length.
[  101.283488][    C0] syz_tun: tun_net_xmit 118
[  101.553659][    C0] syz_tun: tun_net_xmit 118
[  102.083533][    C0] syz_tun: tun_net_xmit 118
[  102.369245][ T7799] No such timeout policy "syz0"
[  102.832843][ T7829] netlink: 'syz.2.476': attribute type 10 has an invalid length.
[  102.935311][ T7834] lo speed is unknown, defaulting to 1000
[  103.143511][    C0] syz_tun: tun_net_xmit 118
[  103.259841][ T7839] delete_channel: no stack
[  103.563096][   T55] block nbd0: Receive control failed (result -32)
[  103.575281][ T7855] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  103.580184][ T7855] syzkaller0: entered promiscuous mode
[  103.582582][ T7855] syzkaller0: entered allmulticast mode
[  103.600923][ T7855] tipc: Resetting bearer <eth:syzkaller0>
[  103.607918][ T7854] tipc: Resetting bearer <eth:syzkaller0>
[  103.627296][ T7854] tipc: Disabling bearer <eth:syzkaller0>
[  103.663662][ T7857] syzkaller1: entered promiscuous mode
[  103.665848][ T7857] syzkaller1: entered allmulticast mode
[  103.720759][ T7859] __nla_validate_parse: 10 callbacks suppressed
[  103.720782][ T7859] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.483'.
[  103.728087][ T7860] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.483'.
[  104.073696][ T7875] IPv6: Can't replace route, no match found
[  104.151002][ T7874] bridge_slave_0: left allmulticast mode
[  104.153021][ T7874] bridge_slave_0: left promiscuous mode
[  104.156902][ T7874] bridge0: port 1(bridge_slave_0) entered disabled state
[  104.176088][ T1278] syz_tun: tun_net_xmit 110
[  104.183544][    C0] syz_tun: tun_net_xmit 118
[  104.199409][ T7874] bridge_slave_1: left allmulticast mode
[  104.201888][ T7874] bridge_slave_1: left promiscuous mode
[  104.207228][ T7874] bridge0: port 2(bridge_slave_1) entered disabled state
[  104.242950][ T7874] team0: Port device team_slave_0 removed
[  104.275630][ T7874] team0: Port device team_slave_1 removed
[  104.279800][ T7874] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  104.282895][ T7874] batman_adv: batadv0: Removing interface: batadv_slave_0
[  104.310718][ T7874] bond2: (slave bridge1): Releasing backup interface
[  104.475324][ T7877] smc: adding net device bond0 with user defined pnetid SYZ2
[  104.479912][ T7877] bond0: entered promiscuous mode
[  104.483989][ T7877] bond0: entered allmulticast mode
[  104.486317][ T7877] 8021q: adding VLAN 0 to HW filter on device bond0
[  104.553727][ T1278] syz_tun: tun_net_xmit 110
[  104.638865][   T12] nci: nci_add_new_protocol: the target found does not have the desired protocol
[  105.223567][    C0] syz_tun: tun_net_xmit 118
[  105.545989][ T7916] infiniband srz1: RDMA CMA: cma_listen_on_dev, error -98
[  105.825447][ T7945] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  105.828573][ T7945] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  105.886997][ T7945] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  105.890641][ T7945] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  105.938500][ T7945] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  105.941865][ T7945] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.008425][ T7945] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  106.011549][ T7945] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.086175][ T7945] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  106.089272][ T7945] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  106.098638][ T7945] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  106.101288][ T7945] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  106.110949][ T7945] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  106.115595][ T7945] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  106.124471][ T7945] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  106.127139][ T7945] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  106.132595][ T7945] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  106.137037][ T7945] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.187273][ T7945] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  106.190545][ T7945] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.240168][ T7945] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  106.243469][ T7945] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  106.263432][    C0] syz_tun: tun_net_xmit 118
[  106.282019][ T7945] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  106.288525][ T7945] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  107.022508][ T7986] netlink: 20 bytes leftover after parsing attributes in process `syz.1.519'.
[  107.026764][ T7986] netlink: 36 bytes leftover after parsing attributes in process `syz.1.519'.
[  107.188616][ T7993] netlink: 'syz.1.521': attribute type 10 has an invalid length.
[  107.191663][ T7993] netlink: 40 bytes leftover after parsing attributes in process `syz.1.521'.
[  107.239225][ T7993] team0: Port device geneve0 added
[  107.303445][    C0] syz_tun: tun_net_xmit 118
[  107.311201][ T8004] netlink: 4 bytes leftover after parsing attributes in process `syz.1.522'.
[  107.780442][ T8023] lo speed is unknown, defaulting to 1000
[  108.247756][ T8027] pim6reg1: entered allmulticast mode
[  108.343543][    C0] syz_tun: tun_net_xmit 118
[  108.493002][ T8034] netlink: 8 bytes leftover after parsing attributes in process `syz.1.533'.
[  108.496949][ T8034] netlink: 16 bytes leftover after parsing attributes in process `syz.1.533'.
[  108.510294][ T5700] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  108.517002][ T5700] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  108.543870][ T5893] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  108.813426][ T8038] Cannot find add_set index 0 as target
[  108.827975][ T8038] netlink: 'syz.2.535': attribute type 1 has an invalid length.
[  108.830822][ T8038] netlink: 224 bytes leftover after parsing attributes in process `syz.2.535'.
[  108.839831][ T8038] syzkaller1: entered promiscuous mode
[  108.841568][ T8038] syzkaller1: entered allmulticast mode
[  108.873812][ T5893] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  108.968839][ T8041] IPVS: sync thread started: state = BACKUP, mcast_ifn = vlan0, syncid = 1, id = 0
[  108.969162][ T8040] IPVS: stopping backup sync thread 8041 ...
[  109.026637][ T5893] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  109.182636][ T8050] netlink: 24 bytes leftover after parsing attributes in process `syz.2.538'.
[  109.293353][ T8054] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  109.383466][    C0] syz_tun: tun_net_xmit 118
[  109.386805][ T8062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.543'.
[  109.390208][ T8062] netlink: 312 bytes leftover after parsing attributes in process `syz.1.543'.
[  109.393016][ T8062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.543'.
[  109.442542][ T8062] netlink: 68 bytes leftover after parsing attributes in process `syz.1.543'.
[  109.553130][ T8069] netlink: 'syz.2.542': attribute type 16 has an invalid length.
[  109.559364][ T8069] netlink: 'syz.2.542': attribute type 17 has an invalid length.
[  109.584783][ T8069] 8021q: adding VLAN 0 to HW filter on device team0
[  109.592972][ T8069] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  109.604641][   T10] syz_tun: tun_net_xmit 110
[  109.753864][ T5879] syz_tun: tun_net_xmit 110
[  109.759364][ T7945] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  109.766264][ T7945] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  109.785128][ T7945] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  109.788444][ T7945] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  109.805420][ T7945] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  109.808853][ T7945] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  109.826944][ T7945] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  109.830152][ T7945] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  110.424171][    C0] syz_tun: tun_net_xmit 118
[  110.540490][ T8085] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  110.563123][ T8085] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  110.591632][ T8085] 0: left allmulticast mode
[  110.648771][ T8085] veth1_vlan: left allmulticast mode
[  110.651266][ T8085] macvlan0: left allmulticast mode
[  110.707531][ T8085] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.710488][ T8085] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.713245][ T8085] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.715997][ T8085] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0
[  110.721019][ T8085] macsec1: left promiscuous mode
[  110.722597][ T8085] macsec1: left allmulticast mode
[  110.735284][ T8085] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.737922][ T8085] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.740597][ T8085] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.743161][ T8085] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  110.746673][ T8085] geneve2: left promiscuous mode
[  110.757904][ T5893] lo speed is unknown, defaulting to 1000
[  110.759877][ T5893] syz1: Port: 1 Link DOWN
[  110.910127][ T8116] netlink: 'syz.1.551': attribute type 9 has an invalid length.
[  111.350124][ T8154] netlink: 24 bytes leftover after parsing attributes in process `syz.2.561'.
[  111.353095][ T8154] netlink: 84 bytes leftover after parsing attributes in process `syz.2.561'.
[  111.444032][ T8160] netlink: 8 bytes leftover after parsing attributes in process `syz.1.562'.
[  111.455877][ T8163] netlink: 24 bytes leftover after parsing attributes in process `syz.0.560'.
[  111.463444][    C0] syz_tun: tun_net_xmit 118
[  111.575931][ T8172] lo speed is unknown, defaulting to 1000
[  111.844911][   T56] block nbd1: Receive control failed (result -32)
[  112.215960][ T8213] vlan3: entered promiscuous mode
[  112.217648][ T8213] vlan3: entered allmulticast mode
[  112.219870][ T8213] bridge0: entered allmulticast mode
[  112.443867][ T8232] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  112.450312][ T8232] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  112.472367][ T8236] block nbd2: Unsupported socket: shutdown callout must be supported.
[  112.503562][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  112.513564][    C0] syz_tun: tun_net_xmit 118
[  112.539990][ T8238] : renamed from lo
[  112.813007][ T8254] netlink: 'syz.0.593': attribute type 1 has an invalid length.
[  112.946119][ T8264] veth0_vlan: entered allmulticast mode
[  112.975497][ T8264] : renamed from vlan0
[  113.260109][ T8286] netlink: 'syz.1.603': attribute type 39 has an invalid length.
[  113.326683][ T8284] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  113.329112][ T8285] syzkaller0: entered promiscuous mode
[  113.330776][ T8285] syzkaller0: entered allmulticast mode
[  113.368684][ T8296] No such timeout policy "syz1"
[  113.437947][ T8286] tipc: Resetting bearer <eth:syzkaller0>
[  113.466575][ T8286] tipc: Disabling bearer <eth:syzkaller0>
[  113.555113][    C0] syz_tun: tun_net_xmit 118
[  113.590157][ T8302] xt_policy: output policy not valid in PREROUTING and INPUT
[  113.775421][ T8310] tipc: Enabling <ib:lo> not permitted
[  113.777275][ T8310] tipc: Enabling of bearer <ib:lo> rejected, failed to enable media
[  113.894992][ T8315] netlink: 'syz.1.612': attribute type 11 has an invalid length.
[  113.898164][ T8315] __nla_validate_parse: 8 callbacks suppressed
[  113.898177][ T8315] netlink: 244 bytes leftover after parsing attributes in process `syz.1.612'.
[  113.906944][ T8315] netlink: 'syz.1.612': attribute type 1 has an invalid length.
[  114.067921][ T8317] x_tables: ip6_tables: recent.0 match: invalid size 216 (kernel) != (user) 232
[  114.116311][ T8321] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  114.138494][ T8323] bridge_slave_0: left allmulticast mode
[  114.140684][ T8321] netlink: 28 bytes leftover after parsing attributes in process `syz.0.615'.
[  114.140930][ T8323] bridge0: port 1(bridge_slave_0) entered disabled state
[  114.151262][ T8323] bridge_slave_1: left allmulticast mode
[  114.158305][ T8323] bridge_slave_1: left promiscuous mode
[  114.160780][ T8323] bridge0: port 2(bridge_slave_1) entered disabled state
[  114.172517][ T8323] bond0: (slave bond_slave_0): Releasing backup interface
[  114.188072][ T8323] bond0: (slave bond_slave_1): Releasing backup interface
[  114.209150][ T8323] team0: Port device team_slave_0 removed
[  114.222377][ T8323] team0: Port device team_slave_1 removed
[  114.225833][ T8323] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  114.228678][ T8323] batman_adv: batadv0: Removing interface: batadv_slave_0
[  114.233234][ T8323] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  114.236437][ T8323] batman_adv: batadv0: Removing interface: batadv_slave_1
[  114.267426][ T8323] team0: Port device geneve0 removed
[  114.286581][ T8323] bond0: (slave wlan1): Releasing backup interface
[  114.301722][ T8323] bond4: (slave bridge2): Releasing backup interface
[  114.306966][ T8323] bridge2: left allmulticast mode
[  114.344178][   T47] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  114.546789][   T55] block nbd2: Receive control failed (result -32)
[  114.583788][    C0] syz_tun: tun_net_xmit 118
[  114.628034][ T8340] netlink: 8 bytes leftover after parsing attributes in process `syz.0.622'.
[  114.631720][ T8340] netlink: 4 bytes leftover after parsing attributes in process `syz.0.622'.
[  114.635277][ T8340] netlink: 'syz.0.622': attribute type 15 has an invalid length.
[  114.637825][ T8340] netlink: 'syz.0.622': attribute type 18 has an invalid length.
[  114.769179][ T8358] netlink: 'syz.1.626': attribute type 62 has an invalid length.
[  114.933640][   T47] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  115.124994][ T8392] netlink: 'syz.1.638': attribute type 10 has an invalid length.
[  115.253815][ T8406] netlink: 8 bytes leftover after parsing attributes in process `syz.2.642'.
[  115.353828][ T5879] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  115.391182][ T8419] netlink: 44 bytes leftover after parsing attributes in process `syz.1.646'.
[  115.413476][ T8419] netlink: 15 bytes leftover after parsing attributes in process `syz.1.646'.
[  115.416383][ T8419] netlink: 'syz.1.646': attribute type 4 has an invalid length.
[  115.541212][   T12] nci: nci_rsp_packet: unknown rsp opcode 0x204
[  115.623631][    C0] syz_tun: tun_net_xmit 118
[  115.720542][ T8433] netlink: 200 bytes leftover after parsing attributes in process `syz.0.649'.
[  115.724217][ T5879] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  115.729628][ T8433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.649'.
[  115.745367][ T8433] netlink: 'syz.0.649': attribute type 13 has an invalid length.
[  115.748608][ T8433] netlink: 'syz.0.649': attribute type 4 has an invalid length.
[  116.317846][ T8440] netlink: 240 bytes leftover after parsing attributes in process `syz.0.650'.
[  116.422900][ T8451] nbd: couldn't find device at index 536870912
[  116.437395][ T8456] bond0: (slave bond_slave_0): Releasing backup interface
[  116.441631][ T8456] bond0: (slave bond_slave_1): Releasing backup interface
[  116.458275][ T8456] team0: Port device team_slave_0 removed
[  116.467747][ T8456] team0: Port device team_slave_1 removed
[  116.470362][ T8456] batman_adv: batadv0: Removing interface: batadv_slave_0
[  116.486445][ T8456] batman_adv: batadv0: Removing interface: batadv_slave_1
[  116.494298][ T8456] team0: Port device geneve0 removed
[  116.500346][ T8456] bond1: (slave gretap1): Releasing active interface
[  116.508958][ T8456] bond2: (slave bond3): Releasing backup interface
[  116.514841][ T8456] bond2: (slave bond3): the permanent HWaddr of slave - da:fe:ec:ad:1a:b4 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  116.521058][ T8456] bond2: (slave gretap2): making interface the new active one
[  116.531539][ T8456] bond2: (slave gretap2): Releasing backup interface
[  116.547078][   T10] IPVS: starting estimator thread 0...
[  116.585245][ T8459] unsupported nlmsg_type 40
[  116.633995][ T8461] IPVS: using max 61 ests per chain, 146400 per kthread
[  116.663460][    C0] syz_tun: tun_net_xmit 118
[  116.877450][ T8475] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  116.880323][ T8475] IPv6: NLM_F_CREATE should be set when creating new route
[  116.883123][ T8475] IPv6: NLM_F_CREATE should be set when creating new route
[  116.888217][ T8475] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  117.453482][ T8503] 8021q: VLANs not supported on xfrm0
[  117.708898][    C0] syz_tun: tun_net_xmit 118
[  117.895127][ T8518] netlink: 'syz.2.674': attribute type 11 has an invalid length.
[  118.162842][ T8546] x_tables: duplicate underflow at hook 2
[  118.191510][ T8549] syzkaller0: entered promiscuous mode
[  118.195059][ T8549] syzkaller0: entered allmulticast mode
[  118.257012][ T8558]  speed is unknown, defaulting to 1000
[  118.314939][ T8561] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  118.481611][ T8577] netlink: 'syz.0.694': attribute type 2 has an invalid length.
[  118.530498][ T8579] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  118.551158][ T8581] erspan0: entered promiscuous mode
[  118.555182][ T8581] batman_adv: batadv0: Adding interface: macvlan2
[  118.557369][ T8581] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  118.566683][ T8581] batman_adv: batadv0: Interface activated: macvlan2
[  118.618509][ T8584] sch_tbf: peakrate 12 is lower than or equals to rate 6561010854487373889 !
[  118.743520][    C0] syz_tun: tun_net_xmit 118
[  118.747009][   T55] block nbd3: Receive control failed (result -32)
[  118.837150][   T56] block nbd4: Receive control failed (result -32)
[  118.887493][ T8595] netlink: 'syz.1.703': attribute type 1 has an invalid length.
[  119.172561][ T8597] tc_dump_action: action bad kind
[  119.381820][ T8610] __nla_validate_parse: 18 callbacks suppressed
[  119.381833][ T8610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.708'.
[  119.391736][ T8610] netlink: 24 bytes leftover after parsing attributes in process `syz.2.708'.
[  119.434823][ T8614] dvmrp0: entered allmulticast mode
[  119.506698][ T8618] pim6reg: entered allmulticast mode
[  119.520424][ T8616] pim6reg: left allmulticast mode
[  119.650534][ T8625] netlink: 182 bytes leftover after parsing attributes in process `syz.0.712'.
[  119.717273][   T55] block nbd5: Receive control failed (result -32)
[  119.766901][ T8631] netlink: 12 bytes leftover after parsing attributes in process `syz.2.715'.
[  119.769696][ T8631] netlink: 56 bytes leftover after parsing attributes in process `syz.2.715'.
[  119.783474][    C0] syz_tun: tun_net_xmit 118
[  119.809535][ T8634] netlink: 8 bytes leftover after parsing attributes in process `syz.0.716'.
[  119.842030][ T8637] syz_tun: tun_net_xmit 14
[  119.843823][ T8637] syz_tun: tun_net_xmit 14
[  120.056992][ T8656] 8021q: adding VLAN 0 to HW filter on device bond5
[  120.057905][ T8660] netlink: 20 bytes leftover after parsing attributes in process `syz.2.724'.
[  120.061779][ T8660] netlink: 152 bytes leftover after parsing attributes in process `syz.2.724'.
[  120.150506][ T8668] xt_NFQUEUE: number of queues (65532) out of range (got 66665)
[  120.341239][ T8676] netlink: 8 bytes leftover after parsing attributes in process `syz.2.731'.
[  120.626797][ T8685] netlink: 'syz.1.734': attribute type 4 has an invalid length.
[  120.632274][ T8685] netlink: 'syz.1.734': attribute type 23 has an invalid length.
[  120.690442][ T8685] netlink: 44 bytes leftover after parsing attributes in process `syz.1.734'.
[  120.743106][ T8693] openvswitch: netlink: Unknown nsh attribute 0
[  120.746459][ T8693] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  120.823382][    C0] syz_tun: tun_net_xmit 118
[  120.847851][ T8703] bond6: entered promiscuous mode
[  120.850350][ T8703] 8021q: adding VLAN 0 to HW filter on device bond6
[  120.983656][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  121.108541][ T8717] netlink: 'syz.0.743': attribute type 13 has an invalid length.
[  121.111164][ T8717] netlink: 'syz.0.743': attribute type 17 has an invalid length.
[  121.114295][ T8675] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  121.199505][ T8717] 8021q: adding VLAN 0 to HW filter on device bond0
[  121.227403][ T8717] 8021q: adding VLAN 0 to HW filter on device team0
[  121.241607][ T8717] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  121.251348][   T10]  speed is unknown, defaulting to 1000
[  121.257123][   T10] syz1: Port: 1 Link ACTIVE
[  121.554677][   T55] block nbd6: Receive control failed (result -32)
[  121.863548][    C0] syz_tun: tun_net_xmit 118
[  121.879727][ T8756] syz_tun: entered promiscuous mode
[  121.881474][ T8756] macsec1: entered allmulticast mode
[  121.883206][ T8756] syz_tun: entered allmulticast mode
[  121.887487][ T8756] syz_tun: left allmulticast mode
[  121.889136][ T8756] syz_tun: left promiscuous mode
[  122.007853][ T8762] netlink: 'syz.2.758': attribute type 4 has an invalid length.
[  122.051599][ T8765] nbd: must specify a size in bytes for the device
[  122.904925][    C0] syz_tun: tun_net_xmit 118
[  123.260108][ T8840] syz_tun: tun_net_xmit 58
[  123.467459][ T8849] netlink: 'syz.0.779': attribute type 7 has an invalid length.
[  123.501458][ T8849] : entered promiscuous mode
[  123.943509][    C0] syz_tun: tun_net_xmit 118
[  124.439838][ T8894] __nla_validate_parse: 13 callbacks suppressed
[  124.439849][ T8895] netlink: 16 bytes leftover after parsing attributes in process `syz.2.788'.
[  124.439853][ T8894] netlink: 16 bytes leftover after parsing attributes in process `syz.2.788'.
[  124.713929][ T8906] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  124.716298][ T8906] IPv6: NLM_F_CREATE should be set when creating new route
[  124.720484][ T8906] netlink: 56 bytes leftover after parsing attributes in process `syz.0.791'.
[  124.749608][ T8909] netlink: 28 bytes leftover after parsing attributes in process `syz.2.792'.
[  124.752370][ T8909] netlink: 'syz.2.792': attribute type 7 has an invalid length.
[  124.755899][ T8909] netlink: 'syz.2.792': attribute type 8 has an invalid length.
[  124.758182][ T8909] netlink: 4 bytes leftover after parsing attributes in process `syz.2.792'.
[  124.983533][    C0] syz_tun: tun_net_xmit 118
[  125.639504][ T8925] nbd: must specify at least one socket
[  125.840333][ T8942] netlink: 'syz.0.800': attribute type 9 has an invalid length.
[  125.842653][ T8942] netlink: 212260 bytes leftover after parsing attributes in process `syz.0.800'.
[  125.866229][ T5838] syz_tun: tun_net_xmit 110
[  125.872733][ T8944] netlink: 44 bytes leftover after parsing attributes in process `syz.0.801'.
[  125.877140][ T8944] netlink: 43 bytes leftover after parsing attributes in process `syz.0.801'.
[  125.879887][ T8944] netlink: 'syz.0.801': attribute type 6 has an invalid length.
[  125.882306][ T8944] netlink: 'syz.0.801': attribute type 5 has an invalid length.
[  125.885849][ T8944] netlink: 43 bytes leftover after parsing attributes in process `syz.0.801'.
[  126.023846][    C0] syz_tun: tun_net_xmit 118
[  126.252808][ T8964] ipvlan3: entered promiscuous mode
[  126.257694][ T8964] 8021q: adding VLAN 0 to HW filter on device ipvlan3
[  126.460903][ T8975] IPv6: Can't replace route, no match found
[  126.903834][ T5838] syz_tun: tun_net_xmit 110
[  127.063520][    C0] syz_tun: tun_net_xmit 118
[  127.399266][ T8987] netlink: 'syz.0.817': attribute type 1 has an invalid length.
[  127.402572][ T8987] netlink: 224 bytes leftover after parsing attributes in process `syz.0.817'.
[  127.475338][ T8988] xt_CT: No such helper "snmp"
[  127.732654][ T8998] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[  128.113508][    C0] syz_tun: tun_net_xmit 118
[  128.304784][ T9022] netlink: 'syz.2.828': attribute type 3 has an invalid length.
[  129.143374][    C0] syz_tun: tun_net_xmit 118
[  129.465927][ T9059] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check.
[  129.534324][ T9059] nbd7: detected capacity change from 0 to 127
[  129.550456][ T9059] __nla_validate_parse: 4 callbacks suppressed
[  129.550466][ T9059] netlink: 8 bytes leftover after parsing attributes in process `syz.1.842'.
[  129.567285][ T9059] openvswitch: netlink: Missing key (keys=40, expected=100)
[  129.617427][ T9061] netlink: 'syz.2.843': attribute type 303 has an invalid length.
[  129.680005][   T55] block nbd7: Receive control failed (result -104)
[  129.832339][ T9079] mac80211_hwsim hwsim10 wlan1: entered allmulticast mode
[  129.858018][ T9079] netlink: 'syz.2.848': attribute type 10 has an invalid length.
[  129.860437][ T9079] mac80211_hwsim hwsim10 wlan1: left allmulticast mode
[  129.877398][ T5838] syz_tun: tun_net_xmit 110
[  129.968212][ T9089] netlink: 4 bytes leftover after parsing attributes in process `syz.1.852'.
[  130.171008][ T9106] netlink: 212364 bytes leftover after parsing attributes in process `syz.0.855'.
[  130.179359][ T9106] openvswitch: netlink: Message has 5 unknown bytes.
[  130.183528][    C0] syz_tun: tun_net_xmit 118
[  130.570965][ T9128] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  130.575919][ T9128] syzkaller0: entered promiscuous mode
[  130.577675][ T9128] syzkaller0: entered allmulticast mode
[  130.600616][ T9128] tipc: Resetting bearer <eth:syzkaller0>
[  130.605601][ T9127] tipc: Resetting bearer <eth:syzkaller0>
[  130.620592][ T9127] tipc: Disabling bearer <eth:syzkaller0>
[  130.824006][ T5838] syz_tun: tun_net_xmit 110
[  130.888838][ T9146] netlink: 'syz.1.866': attribute type 1 has an invalid length.
[  131.000400][ T9106] syz.0.855 (9106) used greatest stack depth: 19720 bytes left
[  131.223605][    C0] syz_tun: tun_net_xmit 118
[  131.246765][ T9164] netlink: 24 bytes leftover after parsing attributes in process `syz.1.871'.
[  131.376975][ T9171] netlink: 40 bytes leftover after parsing attributes in process `syz.2.875'.
[  131.495926][ T9178] netlink: 180 bytes leftover after parsing attributes in process `syz.1.876'.
[  131.561766][ T9189] netlink: 24 bytes leftover after parsing attributes in process `syz.1.880'.
[  132.263520][    C0] syz_tun: tun_net_xmit 118
[  132.450026][ T9227] raw_sendmsg: syz.0.893 forgot to set AF_INET. Fix it!
[  132.652065][ T9237] netlink: 'syz.2.898': attribute type 8 has an invalid length.
[  132.658727][ T9239] netlink: 'syz.2.898': attribute type 8 has an invalid length.
[  132.717749][ T9242] tipc: Enabled bearer <eth:gre0>, priority 10
[  132.722976][ T9242] netlink: 'syz.0.900': attribute type 7 has an invalid length.
[  132.728035][ T9242] netlink: 12 bytes leftover after parsing attributes in process `syz.0.900'.
[  132.738504][ T9244] netlink: 24 bytes leftover after parsing attributes in process `syz.2.899'.
[  132.889007][ T9258] netlink: 'syz.0.906': attribute type 9 has an invalid length.
[  132.892079][ T9258] netlink: 212260 bytes leftover after parsing attributes in process `syz.0.906'.
[  132.962001][ T9262] openvswitch: netlink: Geneve option length err (len 256, max 255).
[  133.007294][ T9267] netlink: 'syz.0.910': attribute type 2 has an invalid length.
[  133.212299][ T9282] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (3)
[  133.303503][    C0] syz_tun: tun_net_xmit 118
[  133.421671][ T9306] netlink: 'syz.1.925': attribute type 4 has an invalid length.
[  133.527759][ T9313] dvmrp1: entered allmulticast mode
[  133.530448][ T9313] dvmrp0: left allmulticast mode
[  133.532049][ T9313] dvmrp1: left allmulticast mode
[  133.565392][ T9315] netlink: 'syz.1.928': attribute type 2 has an invalid length.
[  133.668237][ T9324] batadv_slave_0: entered promiscuous mode
[  133.696563][ T9325] batadv_slave_0 (unregistering): left promiscuous mode
[  133.779934][ T9336] xt_hashlimit: size too large, truncated to 1048576
[  133.799387][ T9337] xt_hashlimit: size too large, truncated to 1048576
[  134.087780][ T9367] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  134.343488][    C0] syz_tun: tun_net_xmit 118
[  134.581099][ T9430] __nla_validate_parse: 12 callbacks suppressed
[  134.581109][ T9430] netlink: 28 bytes leftover after parsing attributes in process `syz.0.956'.
[  134.608377][ T9432] netlink: 20 bytes leftover after parsing attributes in process `syz.2.957'.
[  134.886652][ T9453] netlink: 92 bytes leftover after parsing attributes in process `syz.1.962'.
[  134.939819][ T9456]  speed is unknown, defaulting to 1000
[  135.005859][ T9460] validate_nla: 5 callbacks suppressed
[  135.005875][ T9460] netlink: 'syz.2.966': attribute type 3 has an invalid length.
[  135.084396][ T9464] netlink: 4 bytes leftover after parsing attributes in process `syz.0.964'.
[  135.239713][ T9476] netlink: 4 bytes leftover after parsing attributes in process `syz.1.967'.
[  135.351241][ T9478] RDS: rds_bind could not find a transport for ::ffff:10.1.1.2, load rds_tcp or rds_rdma?
[  135.383514][    C0] syz_tun: tun_net_xmit 118
[  136.423419][    C0] syz_tun: tun_net_xmit 118
[  137.463404][    C0] syz_tun: tun_net_xmit 118
[  138.179999][ T9490] netlink: 28 bytes leftover after parsing attributes in process `syz.2.972'.
[  138.263502][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  138.368528][ T9505] netlink: 8 bytes leftover after parsing attributes in process `syz.1.974'.
[  138.376583][ T9505] netlink: 4 bytes leftover after parsing attributes in process `syz.1.974'.
[  138.382664][ T9505] netlink: 'syz.1.974': attribute type 7 has an invalid length.
[  138.438458][ T9502] netlink: 'syz.1.974': attribute type 2 has an invalid length.
[  138.501017][ T9507] xt_CT: No such helper "netbios-ns"
[  138.503519][    C0] syz_tun: tun_net_xmit 118
[  138.752773][ T9520] netlink: 'syz.0.979': attribute type 1 has an invalid length.
[  138.863943][ T9526] netlink: 12 bytes leftover after parsing attributes in process `syz.0.980'.
[  138.867309][ T9526] netlink: 8 bytes leftover after parsing attributes in process `syz.0.980'.
[  138.880870][ T9526] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  138.884469][ T9526] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  138.887626][ T9526] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  138.890656][ T9526] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  138.904653][ T9526] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[  138.908332][ T9526] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[  139.124729][ T9535] netlink: 'syz.2.982': attribute type 10 has an invalid length.
[  139.538850][ T9545] bond5: entered promiscuous mode
[  139.540943][ T9545] bond5: entered allmulticast mode
[  139.543695][    C0] syz_tun: tun_net_xmit 118
[  139.656722][ T9563] __nla_validate_parse: 6 callbacks suppressed
[  139.656736][ T9563] netlink: 24 bytes leftover after parsing attributes in process `syz.1.989'.
[  139.798242][ T9573] veth0_to_bridge: entered promiscuous mode
[  139.807485][ T9578] netlink: 8 bytes leftover after parsing attributes in process `syz.2.994'.
[  139.816055][ T9578] xt_hashlimit: size too large, truncated to 1048576
[  139.862884][ T9583] netlink: 8 bytes leftover after parsing attributes in process `syz.1.995'.
[  139.873533][ T9583] netlink: 'syz.1.995': attribute type 29 has an invalid length.
[  139.876529][ T9583] netlink: 4 bytes leftover after parsing attributes in process `syz.1.995'.
[  139.897630][ T9572] veth0_to_bridge: left promiscuous mode
[  139.912990][ T9583] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  139.964171][ T9587] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  140.593581][    C0] syz_tun: tun_net_xmit 118
[  140.736632][ T9595] netlink: 24 bytes leftover after parsing attributes in process `syz.1.998'.
[  140.878071][ T9599] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1000'.
[  140.901017][ T9599] netlink: 'syz.0.1000': attribute type 5 has an invalid length.
[  140.937689][ T9605] x_tables: duplicate underflow at hook 3
[  140.971174][ T9607] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  140.979963][ T9607] syzkaller0: entered promiscuous mode
[  140.981935][ T9607] syzkaller0: entered allmulticast mode
[  140.993147][ T9609] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1005'.
[  141.010278][ T9611] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1006'.
[  141.027988][ T9607] tipc: Resetting bearer <eth:syzkaller0>
[  141.037773][ T9606] tipc: Resetting bearer <eth:syzkaller0>
[  141.054931][ T9606] tipc: Disabling bearer <eth:syzkaller0>
[  141.079855][ T9616] netlink: 'syz.2.1008': attribute type 29 has an invalid length.
[  141.086911][ T9616] netlink: 'syz.2.1008': attribute type 29 has an invalid length.
[  141.103911][ T9616] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1008'.
[  141.116896][ T9616] netlink: 'syz.2.1008': attribute type 12 has an invalid length.
[  141.119310][ T9616] netlink: 9472 bytes leftover after parsing attributes in process `syz.2.1008'.
[  141.138460][ T9618] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  141.140619][ T9618] IPv6: NLM_F_CREATE should be set when creating new route
[  141.477848][   T56] block nbd8: Receive control failed (result -32)
[  141.571943][ T9656] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode
[  141.575246][ T9656] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode
[  141.599477][   T56] block nbd9: Receive control failed (result -32)
[  141.633438][    C0] syz_tun: tun_net_xmit 118
[  141.760303][ T9667] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  141.953096][ T9674] xt_hashlimit: size too large, truncated to 1048576
[  142.015092][ T9676] : renamed from bridge_slave_0
[  142.196737][ T9691] syzkaller1: entered promiscuous mode
[  142.202512][ T9691] syzkaller1: entered allmulticast mode
[  142.428810][ T9706] vlan0: entered promiscuous mode
[  142.437970][ T9706] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[  142.663402][    C0] syz_tun: tun_net_xmit 118
[  142.664358][ T6458] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  142.667770][ T6458] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  143.271144][ T9754] Cannot find add_set index 3 as target
[  143.349131][ T9758] xt_time: invalid argument - start or stop time greater than 23:59:59
[  143.425804][ T9760]  speed is unknown, defaulting to 1000
[  143.703435][    C0] syz_tun: tun_net_xmit 118
[  144.402662][ T9813] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6)
[  144.470362][ T9818] netlink: 'syz.1.1069': attribute type 4 has an invalid length.
[  144.743499][    C0] syz_tun: tun_net_xmit 118
[  145.468796][ T9848] __nla_validate_parse: 9 callbacks suppressed
[  145.468808][ T9848] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1081'.
[  145.569253][ T9856] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1085'.
[  145.605338][ T9861] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1087'.
[  145.611699][ T9861] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1087'.
[  145.635262][ T9863] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1088'.
[  145.725436][ T9868] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1091'.
[  145.762422][ T9872] xt_CT: You must specify a L4 protocol and not use inversions on it
[  145.783465][    C0] syz_tun: tun_net_xmit 118
[  145.848611][ T9876] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1094'.
[  145.852406][ T9876] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1094'.
[  145.866001][ T9876] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1094'.
[  145.916432][ T9881] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1096'.
[  146.550161][   T56] block nbd10: Receive control failed (result -32)
[  146.823507][    C0] syz_tun: tun_net_xmit 118
[  146.874903][   T56] block nbd11: Receive control failed (result -32)
[  147.472721][   T33] audit: type=1107 audit(1752882268.796:3): pid=9998 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='sz'
[  147.863531][    C0] syz_tun: tun_net_xmit 118
[  148.280672][T10088]  speed is unknown, defaulting to 1000
[  148.290106][T10097] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  148.376796][T10104] syz_tun: tun_net_xmit 86
[  148.480528][T10112] xt_ecn: cannot match TCP bits for non-tcp packets
[  148.643185][T10114] netlink: 'syz.1.1154': attribute type 23 has an invalid length.
[  148.903408][    C0] syz_tun: tun_net_xmit 118
[  149.383552][    C1] syz_tun: tun_net_xmit 86
[  149.448029][T10137] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  149.537456][   T56] block nbd12: Receive control failed (result -32)
[  149.699158][T10160] batman_adv: batadv0: Adding interface: dummy0
[  149.701456][T10160] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  149.714451][T10160] batman_adv: batadv0: Interface activated: dummy0
[  149.916571][   T56] block nbd13: Receive control failed (result -32)
[  149.943427][    C0] syz_tun: tun_net_xmit 118
[  150.423618][    C1] syz_tun: tun_net_xmit 86
[  150.670014][T10213] __nla_validate_parse: 25 callbacks suppressed
[  150.670030][T10213] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1186'.
[  150.964068][ T5879] syz_tun: tun_net_xmit 110
[  150.983489][    C0] syz_tun: tun_net_xmit 118
[  151.014876][ T5879] syz_tun: tun_net_xmit 110
[  151.089265][T10232] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  151.092629][T10232] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  151.096246][T10232] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  151.099114][T10232] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  151.231291][T10238] netlink: 'syz.0.1196': attribute type 7 has an invalid length.
[  151.234104][T10238] netlink: 'syz.0.1196': attribute type 8 has an invalid length.
[  151.282962][T10247] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1197'.
[  151.315387][T10250] netlink: 'syz.1.1199': attribute type 1 has an invalid length.
[  151.322219][T10250] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1199'.
[  151.438787][T10267] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[  151.445715][T10267] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  151.533367][   T55] block nbd14: Receive control failed (result -32)
[  151.716700][T10299] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1210'.
[  151.886108][   T55] block nbd15: Receive control failed (result -32)
[  151.990132][T10332] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1218'.
[  151.999137][T10329] sctp: [Deprecated]: syz.2.1218 (pid 10329) Use of int in max_burst socket option.
[  151.999137][T10329] Use struct sctp_assoc_value instead
[  152.023803][    C0] syz_tun: tun_net_xmit 118
[  152.102265][T10338] Bluetooth: MGMT ver 1.23
[  152.571697][   T55] block nbd16: Receive control failed (result -32)
[  152.641184][T10364] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1226'.
[  152.719715][T10369] openvswitch: netlink: Flow get message rejected, Key attribute missing.
[  152.905027][   T56] block nbd17: Receive control failed (result -32)
[  152.997168][T10398] netlink: 'syz.2.1233': attribute type 16 has an invalid length.
[  152.999571][T10405] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1234'.
[  153.003003][T10399] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1233'.
[  153.010332][T10398] netlink: 'syz.2.1233': attribute type 17 has an invalid length.
[  153.190842][T10398] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  153.194556][T10398] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  153.198164][T10398] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  153.201759][T10398] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  153.248156][T10398] tipc: Resetting bearer <eth:syzkaller0>
[  153.255866][T10398] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0
[  153.259453][T10398] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0
[  153.262827][T10398] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0
[  153.266426][T10398] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0
[  153.421696][T10419] bridge4: entered allmulticast mode
[  153.440966][T10423] batadv_slave_0: entered promiscuous mode
[  153.448672][T10423] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1237'.
[  153.483736][T10423] batadv_slave_0 (unregistering): left promiscuous mode
[  153.793142][T10433] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1241'.
[  153.850148][T10439] nbd: couldn't find a device at index 65546
[  153.890822][T10443] veth0_to_bond: entered allmulticast mode
[  153.986466][T10453] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  154.091207][T10463] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  154.270388][T10473] xfrm1: entered allmulticast mode
[  154.879902][T10511] sctp: [Deprecated]: syz.1.1267 (pid 10511) Use of int in max_burst socket option deprecated.
[  154.879902][T10511] Use struct sctp_assoc_value instead
[  154.898029][T10513] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  154.949505][T10518] DL<Y: renamed from lo
[  155.016412][T10522] netlink: 'syz.0.1271': attribute type 13 has an invalid length.
[  155.019521][T10522] netlink: 'syz.0.1271': attribute type 17 has an invalid length.
[  155.031548][T10522] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  155.071841][T10522]  speed is unknown, defaulting to 1000
[  155.568467][   T56] block nbd18: Receive control failed (result -32)
[  155.627400][T10557] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  155.630563][T10561] syzkaller0: entered promiscuous mode
[  155.632753][T10561] syzkaller0: entered allmulticast mode
[  155.656196][T10561] tipc: Resetting bearer <eth:syzkaller0>
[  155.657868][T10566] netlink: 'syz.2.1282': attribute type 2 has an invalid length.
[  155.663553][T10565] netlink: 'syz.2.1282': attribute type 1 has an invalid length.
[  155.666599][T10565] netlink: 'syz.2.1282': attribute type 2 has an invalid length.
[  155.683742][T10561] tipc: Disabling bearer <eth:syzkaller0>
[  155.689765][T10565] netlink: 'syz.2.1282': attribute type 1 has an invalid length.
[  155.693100][T10565] netlink: 'syz.2.1282': attribute type 2 has an invalid length.
[  155.701279][T10565] netlink: 'syz.2.1282': attribute type 1 has an invalid length.
[  155.704591][T10565] netlink: 'syz.2.1282': attribute type 2 has an invalid length.
[  155.707773][T10565] netlink: 'syz.2.1282': attribute type 1 has an invalid length.
[  155.760908][T10569] batman_adv: batadv0: Interface deactivated: dummy0
[  155.764808][T10569] batman_adv: batadv0: Removing interface: dummy0
[  155.778720][T10571] __nla_validate_parse: 16 callbacks suppressed
[  155.778737][T10571] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1284'.
[  155.821115][T10575] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1285'.
[  155.876310][T10569] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check.
[  156.029087][T10596] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1289'.
[  156.142173][T10600] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1291'.
[  156.186964][T10607] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1293'.
[  156.218088][T10609] rdma_op ffff8880285009f0 conn xmit_rdma 0000000000000000
[  156.400765][   T56] block nbd19: Receive control failed (result -32)
[  156.462069][T10625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1299'.
[  156.536873][T10630] netlink: 9 bytes leftover after parsing attributes in process `syz.2.1301'.
[  156.607645][T10636] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1302'.
[  156.830313][T10650] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1307'.
[  156.975831][T10667] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1313'.
[  157.062218][T10670] bond7: (slave bridge0): making interface the new active one
[  157.066945][T10670] bond7: (slave bridge0): Enslaving as an active interface with an up link
[  157.280388][T10688] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  157.414324][T10708] x_tables: duplicate underflow at hook 2
[  158.285053][T10728] syz.0.1330: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  158.292248][T10728] CPU: 1 UID: 0 PID: 10728 Comm: syz.0.1330 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  158.292271][T10728] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  158.292280][T10728] Call Trace:
[  158.292287][T10728]  <TASK>
[  158.292334][T10728]  dump_stack_lvl+0x189/0x250
[  158.292393][T10728]  ? __pfx_dump_stack_lvl+0x10/0x10
[  158.292412][T10728]  ? __pfx__printk+0x10/0x10
[  158.292434][T10728]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  158.292482][T10728]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  158.292504][T10728]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  158.292526][T10728]  warn_alloc+0x214/0x310
[  158.292541][T10728]  ? stack_depot_save_flags+0x40/0x900
[  158.292561][T10728]  ? __pfx_warn_alloc+0x10/0x10
[  158.292577][T10728]  ? kasan_save_track+0x4f/0x80
[  158.292599][T10728]  ? xskq_create+0x56/0x170
[  158.292612][T10728]  ? xsk_init_queue+0xb0/0x110
[  158.292623][T10728]  ? xsk_setsockopt+0x43f/0x710
[  158.292644][T10728]  ? do_sock_setsockopt+0x17c/0x1b0
[  158.292664][T10728]  ? __x64_sys_setsockopt+0x13f/0x1b0
[  158.292683][T10728]  ? do_syscall_64+0xfa/0x3b0
[  158.292697][T10728]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  158.292717][T10728]  __vmalloc_node_range_noprof+0x125/0x12f0
[  158.292764][T10728]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  158.292788][T10728]  ? xskq_create+0x56/0x170
[  158.292803][T10728]  ? __kasan_kmalloc+0x93/0xb0
[  158.292825][T10728]  vmalloc_user_noprof+0xad/0xf0
[  158.292847][T10728]  ? xskq_create+0xbf/0x170
[  158.292862][T10728]  xskq_create+0xbf/0x170
[  158.292879][T10728]  xsk_init_queue+0xb0/0x110
[  158.292895][T10728]  xsk_setsockopt+0x43f/0x710
[  158.292919][T10728]  ? __pfx_xsk_setsockopt+0x10/0x10
[  158.292944][T10728]  ? __fget_files+0x2a/0x420
[  158.292957][T10728]  ? aa_sock_opt_perm+0x74/0x110
[  158.292974][T10728]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  158.292990][T10728]  ? __pfx_xsk_setsockopt+0x10/0x10
[  158.293018][T10728]  do_sock_setsockopt+0x17c/0x1b0
[  158.293044][T10728]  __x64_sys_setsockopt+0x13f/0x1b0
[  158.293070][T10728]  do_syscall_64+0xfa/0x3b0
[  158.293084][T10728]  ? lockdep_hardirqs_on+0x9c/0x150
[  158.293099][T10728]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  158.293112][T10728]  ? exc_page_fault+0x9f/0xf0
[  158.293129][T10728]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  158.293143][T10728] RIP: 0033:0x7fa9b5d8e9a9
[  158.293157][T10728] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  158.293193][T10728] RSP: 002b:00007fa9b6c9c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  158.293210][T10728] RAX: ffffffffffffffda RBX: 00007fa9b5fb6080 RCX: 00007fa9b5d8e9a9
[  158.293222][T10728] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009
[  158.293231][T10728] RBP: 00007fa9b5e10d69 R08: 0000000000000004 R09: 0000000000000000
[  158.293241][T10728] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  158.293251][T10728] R13: 0000000000000000 R14: 00007fa9b5fb6080 R15: 00007fff62b40d78
[  158.293275][T10728]  </TASK>
[  158.405266][T10728] Mem-Info:
[  158.406332][T10728] active_anon:12842 inactive_anon:0 isolated_anon:0
[  158.406332][T10728]  active_file:1061 inactive_file:38250 isolated_file:0
[  158.406332][T10728]  unevictable:1768 dirty:107 writeback:0
[  158.406332][T10728]  slab_reclaimable:10043 slab_unreclaimable:72422
[  158.406332][T10728]  mapped:18359 shmem:2437 pagetables:1021
[  158.406332][T10728]  sec_pagetables:0 bounce:0
[  158.406332][T10728]  kernel_misc_reclaimable:0
[  158.406332][T10728]  free:260535 free_pcp:24441 free_cma:0
[  158.455783][T10728] Node 0 active_anon:12736kB inactive_anon:0kB active_file:2916kB inactive_file:144828kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:44212kB dirty:244kB writeback:0kB shmem:5012kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:7936kB pagetables:2052kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  158.481099][T10728] Node 1 active_anon:38496kB inactive_anon:0kB active_file:1328kB inactive_file:8172kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:29224kB dirty:184kB writeback:0kB shmem:4736kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4328kB pagetables:1964kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  158.499969][T10728] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  158.511883][T10728] lowmem_reserve[]: 0 812 812 812 812
[  158.515990][T10728] Node 0 DMA32 free:201536kB boost:0kB min:33656kB low:42068kB high:50480kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12680kB inactive_anon:0kB active_file:2916kB inactive_file:144828kB unevictable:3536kB writepending:244kB present:1556484kB managed:831988kB mlocked:0kB bounce:0kB free_pcp:44092kB local_pcp:16856kB free_cma:0kB
[  158.526000][T10728] lowmem_reserve[]: 0 0 0 0 0
[  158.539060][T10728] Node 1 DMA32 free:458492kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:116kB local_pcp:0kB free_cma:0kB
[  158.551778][T10728] lowmem_reserve[]: 0 0 854 854 854
[  158.558724][T10728] Node 1 Normal free:368664kB boost:0kB min:36616kB low:45768kB high:54920kB reserved_highatomic:0KB free_highatomic:0KB active_anon:38572kB inactive_anon:0kB active_file:1328kB inactive_file:8172kB unevictable:3536kB writepending:184kB present:1048576kB managed:875016kB mlocked:0kB bounce:0kB free_pcp:51696kB local_pcp:21108kB free_cma:0kB
[  158.571307][T10728] lowmem_reserve[]: 0 0 0 0 0
[  158.577846][T10728] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  158.583013][T10728] Node 0 DMA32: 1160*4kB (UM) 522*8kB (UME) 406*16kB (UM) 181*32kB (UME) 80*64kB (UME) 22*128kB (UM) 14*256kB (UM) 14*512kB (UME) 10*1024kB (UM) 8*2048kB (UME) 33*4096kB (M) = 201584kB
[  158.620290][T10728] Node 1 DMA32: 3*4kB (UM) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 3*2048kB (UM) 109*4096kB (M) = 458492kB
[  158.636696][T10728] Node 1 Normal: 523*4kB (UE) 831*8kB (UE) 698*16kB (U) 276*32kB (UE) 173*64kB (UME) 83*128kB (U) 32*256kB (UME) 15*512kB (UME) 11*1024kB (UM) 4*2048kB (UM) 69*4096kB (UM) = 368388kB
[  158.644956][T10728] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  158.649784][T10728] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  158.652922][T10728] 41751 total pagecache pages
[  158.664234][T10728] 0 pages in swap cache
[  158.665681][T10728] Free swap  = 124996kB
[  158.666950][T10728] Total swap = 124996kB
[  158.668862][T10728] 786301 pages RAM
[  158.670065][T10728] 0 pages HighMem/MovableOnly
[  158.671736][T10728] 241056 pages reserved
[  158.673214][T10728] 0 pages cma reserved
[  158.715175][T10750] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  158.718492][T10750] syzkaller0: entered promiscuous mode
[  158.721036][T10750] syzkaller0: entered allmulticast mode
[  158.744291][T10750] tipc: Resetting bearer <eth:syzkaller0>
[  158.772002][T10749] tipc: Resetting bearer <eth:syzkaller0>
[  158.782011][T10749] tipc: Disabling bearer <eth:syzkaller0>
[  159.111393][T10786] 8021q: adding VLAN 0 to HW filter on device bond8
[  159.138216][T10786] 8021q: adding VLAN 0 to HW filter on device bond8
[  159.140707][T10786] bond8: (slave vxcan1): The slave device specified does not support setting the MAC address
[  159.147583][T10786] bond8: (slave vxcan1): Error -95 calling set_mac_address
[  159.242517][T10797] bond8: (slave bridge4): Enslaving as an active interface with a down link
[  159.326661][T10797] 8021q: adding VLAN 0 to HW filter on device bond8
[  159.435129][T10813] x_tables: duplicate underflow at hook 2
[  159.458422][T10806] pim6reg1: entered promiscuous mode
[  159.460151][T10806] pim6reg1: entered allmulticast mode
[  159.543736][T10822] xt_hashlimit: max too large, truncated to 1048576
[  159.546573][T10822] Cannot find add_set index 3 as target
[  159.552254][T10822] openvswitch: netlink: Flow key attr not present in new flow.
[  159.578516][T10824] xt_policy: output policy not valid in PREROUTING and INPUT
[  159.803101][   T56] block nbd20: Receive control failed (result -32)
[  159.926397][T10850] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5
[  160.026106][  T128] block nbd7: Possible stuck request ffff888020900000: control (read@0,1024B). Runtime 30 seconds
[  160.029563][  T128] block nbd7: Possible stuck request ffff888020900200: control (read@1024,1024B). Runtime 30 seconds
[  160.032924][  T128] block nbd7: Possible stuck request ffff888020900400: control (read@2048,1024B). Runtime 30 seconds
[  160.036744][  T128] block nbd7: Possible stuck request ffff888020900600: control (read@3072,1024B). Runtime 30 seconds
[  160.836679][T10915] __nla_validate_parse: 19 callbacks suppressed
[  160.836698][T10915] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1380'.
[  161.411954][T10938] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1387'.
[  161.467468][T10945] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1390'.
[  161.536243][T10950] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1391'.
[  161.555665][T10950] 8021q: adding VLAN 0 to HW filter on device bond3
[  161.642887][T10953] pim6reg1: entered promiscuous mode
[  161.645259][T10953] pim6reg1: entered allmulticast mode
[  161.820241][T10979] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1398'.
[  161.976173][T10994] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16)
[  161.979397][T10994] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  162.082685][T11001] validate_nla: 135 callbacks suppressed
[  162.082696][T11001] netlink: 'syz.2.1404': attribute type 4 has an invalid length.
[  162.141950][T11012] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1407'.
[  162.148850][T11014] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes.
[  162.162776][T11014] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes.
[  162.262797][T11028] tap0: tun_chr_ioctl cmd 1074025677
[  162.267884][T11028] tap0: linktype set to 0
[  162.388447][T11036] netlink: 'syz.0.1415': attribute type 1 has an invalid length.
[  162.391299][T11036] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1415'.
[  162.453638][T11042] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  162.492837][T11044] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1418'.
[  162.815166][   T55] block nbd21: Receive control failed (result -32)
[  162.868827][T11061] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1423'.
[  162.981861][T11068] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.1425'.
[  162.981986][T11071] vxcan3: entered allmulticast mode
[  163.161942][T11085] netlink: 'syz.0.1430': attribute type 2 has an invalid length.
[  163.374709][T11094] bond0: entered promiscuous mode
[  163.380444][T11094] macvlan1: entered promiscuous mode
[  163.385941][T11094] hsr1: entered allmulticast mode
[  163.388758][T11094] bond0: entered allmulticast mode
[  163.390844][T11094] macvlan1: entered allmulticast mode
[  163.393032][T11094] veth1_vlan: entered allmulticast mode
[  163.551074][T11109] netlink: 'syz.2.1434': attribute type 1 has an invalid length.
[  163.592036][T11115] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6
[  163.679635][T11118] netlink: 'syz.1.1436': attribute type 4 has an invalid length.
[  163.734341][T11122] netlink: 'syz.1.1436': attribute type 4 has an invalid length.
[  164.509999][T11150] netlink: 'syz.1.1441': attribute type 20 has an invalid length.
[  164.652351][T11161] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0)
[  164.662111][T11161] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535
[  164.671339][T11161] xt_cgroup: invalid path, errno=-2
[  164.781160][T11172]  speed is unknown, defaulting to 1000
[  165.338208][ T9479] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  165.342403][ T9479] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  165.363946][ T5880] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  165.396941][T11200] nbd: must specify at least one socket
[  165.472541][T11209] tap0: tun_chr_ioctl cmd 1074025678
[  165.482988][T11209] tap0: group set to 0
[  165.633522][ T5298] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  165.854034][ T5298] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  165.924319][T11263] __nla_validate_parse: 17 callbacks suppressed
[  165.924335][T11263] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1473'.
[  165.950018][T11263] xt_cgroup: xt_cgroup: no path or classid specified
[  166.067846][T11268] netlink: 'syz.1.1477': attribute type 11 has an invalid length.
[  166.436592][T11273] netlink: 'syz.1.1478': attribute type 1 has an invalid length.
[  166.439704][T11273] netlink: 5624 bytes leftover after parsing attributes in process `syz.1.1478'.
[  166.452195][T11275] veth40: entered allmulticast mode
[  166.497104][T11277] tipc: New replicast peer: 0.0.0.0
[  166.509006][T11277] tipc: Enabled bearer <udp:syz2>, priority 10
[  166.514459][T11270] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00aa
[  166.517806][T11270] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.1479'.
[  166.536461][T11282] netlink: 'syz.1.1481': attribute type 9 has an invalid length.
[  166.539433][T11282] netlink: 204732 bytes leftover after parsing attributes in process `syz.1.1481'.
[  166.627907][T11278] tc_dump_action: action bad kind
[  166.760196][T11296] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1484'.
[  166.829111][T11300] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1486'.
[  166.903018][T11307] bond6: entered promiscuous mode
[  167.129507][T11328] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1494'.
[  167.203698][T11329] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1495'.
[  168.131927][T11353] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  168.137255][T11353] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode
[  168.140381][T11353] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode
[  168.197794][T11356] netlink: 'syz.2.1503': attribute type 7 has an invalid length.
[  168.200962][T11356] netlink: 'syz.2.1503': attribute type 3 has an invalid length.
[  168.213579][T11356] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1503'.
[  168.254152][T11356] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1503'.
[  168.264743][T11354] sctp: [Deprecated]: syz.1.1498 (pid 11354) Use of int in maxseg socket option.
[  168.264743][T11354] Use struct sctp_assoc_value instead
[  169.010635][ T9479] nci: nci_ntf_packet: unknown ntf opcode 0x206
[  169.223746][   T54] Bluetooth: hci0: Opcode 0x0c03 failed: -110
[  169.383610][    C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  169.962739][T11435] openvswitch: netlink: Geneve opt len 126 is not a multiple of 4.
[  170.079635][T11447] netlink: 'syz.1.1527': attribute type 1 has an invalid length.
[  170.118250][T11445] delete_channel: no stack
[  170.122672][T11447] veth29: entered promiscuous mode
[  170.137036][T11447] erspan0: entered allmulticast mode
[  170.172411][T11449] netlink: 'syz.2.1528': attribute type 4 has an invalid length.
[  170.177558][T11449] netlink: 'syz.2.1528': attribute type 4 has an invalid length.
[  170.261218][T11453] netdevsim netdevsim2 netdevsim0: left promiscuous mode
[  170.266921][T11453] netdevsim netdevsim2 netdevsim0: entered allmulticast mode
[  170.270519][T11453] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  170.276273][T11457] openvswitch: netlink: Flow key attr not present in new flow.
[  170.344435][T11459] netlink: 'syz.2.1532': attribute type 3 has an invalid length.
[  170.386120][T11464] netlink: 'syz.1.1533': attribute type 4 has an invalid length.
[  170.766692][T11486] RDS: rds_bind could not find a transport for fe80::18, load rds_tcp or rds_rdma?
[  170.920861][T11496]  speed is unknown, defaulting to 1000
[  171.372721][T11506] __nla_validate_parse: 11 callbacks suppressed
[  171.372738][T11506] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1545'.
[  171.443176][T11510] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  171.457175][T11511] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  171.499451][T11513] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1547'.
[  171.630213][T11518] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1549'.
[  171.951913][T11544] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1555'.
[  172.010063][T11552] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1559'.
[  172.014262][T11554] netlink: 'syz.2.1557': attribute type 1 has an invalid length.
[  172.062627][T11554] 8021q: adding VLAN 0 to HW filter on device bond4
[  172.072462][T11555] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1560'.
[  172.080388][T11555] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1560'.
[  172.092841][T11557] ipvlan4: entered allmulticast mode
[  172.099383][T11557] bond4: entered allmulticast mode
[  172.125059][T11554] bond4: (slave gretap2): making interface the new active one
[  172.127986][T11554] gretap2: entered allmulticast mode
[  172.131353][T11554] bond4: (slave gretap2): Enslaving as an active interface with an up link
[  172.153030][T11562] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1562'.
[  172.159515][T11562] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1562'.
[  172.172847][T11565] C: renamed from  (while UP)
[  172.178996][T11565] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  172.195917][   T12] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  172.200220][   T12] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  172.224265][ T5880] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  172.249255][T11567] tipc: Can't bind to reserved service type 0
[  172.258295][T11569] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1565'.
[  172.366548][T11575] xt_CT: You must specify a L4 protocol and not use inversions on it
[  172.585587][ T5298] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  172.787964][T11554] syz.2.1557 (11554) used greatest stack depth: 19512 bytes left
[  172.823433][    C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  172.959501][T11623] tc_dump_action: action bad kind
[  173.066452][ T5298] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  173.107154][T11641] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  173.216811][T11647] IPVS: persistence engine module ip_vs_pe_ not found
[  173.412480][T11663] netlink: 'syz.1.1597': attribute type 1 has an invalid length.
[  173.844214][ T6061] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  173.850609][ T6061] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  173.857131][ T6061] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  173.864174][ T6061] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  173.868357][ T6061] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  173.897504][T11679] C speed is unknown, defaulting to 1000
[  174.054265][T11693] netlink: 'syz.1.1608': attribute type 1 has an invalid length.
[  174.108708][ T6061] Bluetooth: hci2: command 0x0419 tx timeout
[  174.124824][T11693] nbd: socks must be embedded in a SOCK_ITEM attr
[  174.127297][T11693] block nbd22: shutting down sockets
[  174.137141][T11679] chnl_net:caif_netlink_parms(): no params data found
[  174.251285][T11679] bridge0: port 1(bridge_slave_0) entered blocking state
[  174.257958][T11679] bridge0: port 1(bridge_slave_0) entered disabled state
[  174.262685][T11679] bridge_slave_0: entered allmulticast mode
[  174.267236][T11679] bridge_slave_0: entered promiscuous mode
[  174.270845][T11679] bridge0: port 2(bridge_slave_1) entered blocking state
[  174.273106][T11679] bridge0: port 2(bridge_slave_1) entered disabled state
[  174.281160][T11679] bridge_slave_1: entered allmulticast mode
[  174.287651][T11679] bridge_slave_1: entered promiscuous mode
[  174.291598][T11714] batadv_slave_1: entered promiscuous mode
[  174.329869][T11679] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  174.341163][T11679] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  174.375274][T11679] team0: Port device team_slave_0 added
[  174.381223][T11679] team0: Port device team_slave_1 added
[  174.424675][T11679] batman_adv: batadv0: Adding interface: batadv_slave_0
[  174.428453][T11679] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  174.436673][T11679] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  174.442956][T11679] batman_adv: batadv0: Adding interface: batadv_slave_1
[  174.446333][T11679] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  174.455555][T11679] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  174.492862][T11679] hsr_slave_0: entered promiscuous mode
[  174.495528][T11679] hsr_slave_1: entered promiscuous mode
[  174.497752][T11679] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  174.500827][T11679] Cannot create hsr debugfs directory
[  174.681074][T11679] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  174.687830][T11679] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  174.693239][T11679] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  174.705660][T11679] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  174.742485][T11679] bridge0: port 2(bridge_slave_1) entered blocking state
[  174.744877][T11679] bridge0: port 2(bridge_slave_1) entered forwarding state
[  174.747351][T11679] bridge0: port 1(bridge_slave_0) entered blocking state
[  174.749709][T11679] bridge0: port 1(bridge_slave_0) entered forwarding state
[  174.831330][T11748] batman_adv: batadv0: Interface deactivated: macvlan2
[  174.841868][T11748] batman_adv: batadv0: Removing interface: macvlan2
[  174.853768][ T5298] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  174.862539][T11754] xt_cgroup: xt_cgroup: no path or classid specified
[  174.872075][   T26] bridge0: port 1(bridge_slave_0) entered disabled state
[  174.878556][   T26] bridge0: port 2(bridge_slave_1) entered disabled state
[  174.883653][ T5298] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  174.893766][ T5298] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  174.950438][T11679] 8021q: adding VLAN 0 to HW filter on device bond0
[  174.986801][T11679] 8021q: adding VLAN 0 to HW filter on device team0
[  174.997135][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[  174.999848][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[  175.007949][ T4190] bridge0: port 2(bridge_slave_1) entered blocking state
[  175.010294][ T4190] bridge0: port 2(bridge_slave_1) entered forwarding state
[  175.129639][T11774] syzkaller1: tun_chr_ioctl cmd 1074025672
[  175.131440][T11774] syzkaller1: ignored: set checksum disabled
[  175.133823][ T5298] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  175.258276][T11679] 8021q: adding VLAN 0 to HW filter on device batadv0
[  175.291720][T11679] veth0_vlan: entered promiscuous mode
[  175.298311][T11679] veth1_vlan: entered promiscuous mode
[  175.340195][T11679] veth0_macvtap: entered promiscuous mode
[  175.346073][T11789] C speed is unknown, defaulting to 1000
[  175.357849][T11679] veth1_macvtap: entered promiscuous mode
[  175.378107][T11679] batman_adv: batadv0: Interface activated: batadv_slave_0
[  175.390992][T11679] batman_adv: batadv0: Interface activated: batadv_slave_1
[  175.398581][T11679] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  175.401210][T11679] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  175.406351][T11679] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  175.408948][T11679] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  175.510468][ T6452] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  175.518691][ T6452] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  175.584118][ T6452] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  175.594949][ T6452] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  175.756266][T11808] netlink: 'syz.3.1601': attribute type 14 has an invalid length.
[  175.850817][T11812] syz_tun: entered allmulticast mode
[  175.868269][T11812] dvmrp8: entered allmulticast mode
[  175.943964][ T6061] Bluetooth: hci0: command tx timeout
[  176.640133][T11838] __nla_validate_parse: 20 callbacks suppressed
[  176.640151][T11838] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1646'.
[  176.682095][T11811] syz_tun: left allmulticast mode
[  176.761995][T11840] xt_socket: unknown flags 0xfc
[  176.873194][T11847] bridge5: entered promiscuous mode
[  176.877106][T11847] bridge5: entered allmulticast mode
[  176.887203][T11847] team0: Port device bridge5 added
[  177.200922][T11864] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue
[  177.313443][    C1] ip6_tnl_xmit_ctl: 3 callbacks suppressed
[  177.313475][    C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  177.456861][T11873] team0 (unregistering): Port device team_slave_0 removed
[  177.465659][T11873] team0 (unregistering): Port device team_slave_1 removed
[  177.841765][T11908] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1668'.
[  178.023509][ T6061] Bluetooth: hci0: command tx timeout
[  178.056324][T11920] sctp: [Deprecated]: syz.0.1670 (pid 11920) Use of int in max_burst socket option deprecated.
[  178.056324][T11920] Use struct sctp_assoc_value instead
[  178.620335][T11924] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1671'.
[  178.625438][T11924] netlink: 7994 bytes leftover after parsing attributes in process `syz.1.1671'.
[  178.860844][T11926] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  178.865752][T11926] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (3)
[  178.868925][T11927] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (3)
[  178.904133][T11929] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1673'.
[  178.957429][T11931] netlink: 'syz.0.1674': attribute type 11 has an invalid length.
[  178.960294][T11931] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1674'.
[  179.024550][T11934] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1675'.
[  179.505659][T11967] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1684'.
[  179.540068][T11969] tipc: Bearer <udp:s>: already 2 bearers with priority 10
[  179.542738][T11969] tipc: Bearer <udp:s>: trying with adjusted priority
[  179.549776][T11969] tipc: Invalid UDP bearer configuration
[  179.549804][T11969] tipc: Enabling of bearer <udp:s> rejected, failed to enable media
[  179.609848][T11974] sctp: [Deprecated]: syz.1.1687 (pid 11974) Use of int in max_burst socket option.
[  179.609848][T11974] Use struct sctp_assoc_value instead
[  179.648524][T11978] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1689'.
[  179.670015][T11978] wg1 speed is unknown, defaulting to 1000
[  179.671958][T11978] wg1 speed is unknown, defaulting to 1000
[  179.674988][T11978] wg1 speed is unknown, defaulting to 1000
[  179.686142][T11978] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[  179.699044][T11978] wg1 speed is unknown, defaulting to 1000
[  179.707846][T11978] wg1 speed is unknown, defaulting to 1000
[  179.710676][T11978] wg1 speed is unknown, defaulting to 1000
[  179.713940][T11978] wg1 speed is unknown, defaulting to 1000
[  179.959940][T11996] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1693'.
[  180.103673][ T6061] Bluetooth: hci0: command tx timeout
[  180.157181][T12014] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  180.265459][T12024] pimreg: entered allmulticast mode
[  180.995248][T12070] hsr_slave_0: left promiscuous mode
[  180.999866][T12070] hsr_slave_1: left promiscuous mode
[  181.062194][T12071] C speed is unknown, defaulting to 1000
[  181.069462][T12071] wg1 speed is unknown, defaulting to 1000
[  181.446683][T12079] macvlan2: entered allmulticast mode
[  181.449002][T12079] veth1_vlan: entered allmulticast mode
[  181.454293][T12079] veth1_vlan: left allmulticast mode
[  181.715823][T12090] bond0: entered promiscuous mode
[  181.717924][T12090] bond_slave_0: entered promiscuous mode
[  181.720142][T12090] bond_slave_1: entered promiscuous mode
[  181.755284][T12092] syzkaller0: entered promiscuous mode
[  181.757070][T12092] syzkaller0: entered allmulticast mode
[  181.810071][T12094] macvlan0: entered promiscuous mode
[  181.815011][T12094] netlink: 'syz.3.1718': attribute type 1 has an invalid length.
[  181.817459][T12094] netlink: 'syz.3.1718': attribute type 2 has an invalid length.
[  181.859014][T12096] __nla_validate_parse: 13 callbacks suppressed
[  181.859025][T12096] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1719'.
[  181.917778][T12098] netlink: 'syz.3.1720': attribute type 1 has an invalid length.
[  181.920653][T12098] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1720'.
[  182.193622][ T6061] Bluetooth: hci0: command tx timeout
[  183.149867][T12107] netlink: 508 bytes leftover after parsing attributes in process `syz.1.1722'.
[  183.238063][T12119] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1725'.
[  183.299380][T12126] vxcan1: entered allmulticast mode
[  183.301512][T12126] vxcan1: left allmulticast mode
[  183.331500][T12128] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1727'.
[  183.334739][T12128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1727'.
[  183.439598][T12137] x_tables: ip_tables: osf match: only valid for protocol 6
[  183.567866][T12146] syz_tun: entered allmulticast mode
[  183.583562][T12146] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check.
[  183.605930][T12151] netlink: 'syz.1.1735': attribute type 72 has an invalid length.
[  183.608368][T12151] netlink: 1016 bytes leftover after parsing attributes in process `syz.1.1735'.
[  183.885248][T12177] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1744'.
[  184.247728][T12202] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1752'.
[  184.504637][T12222] xt_nfacct: accounting object `syz1' does not exists
[  184.534598][T12224] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  184.536844][T12224] IPv6: NLM_F_CREATE should be set when creating new route
[  184.538996][T12224] IPv6: NLM_F_CREATE should be set when creating new route
[  184.541254][T12224] IPv6: NLM_F_CREATE should be set when creating new route
[  184.556475][T12224] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  184.650846][T12235] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1762'.
[  184.993465][    C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  185.185442][T12278] netlink: 'syz.3.1774': attribute type 2 has an invalid length.
[  185.794077][   T54] Bluetooth: hci1: command 0x0406 tx timeout
[  188.297400][T12301] __nla_validate_parse: 14 callbacks suppressed
[  188.297411][T12301] netlink: 320 bytes leftover after parsing attributes in process `syz.0.1779'.
[  188.356094][T12305] netlink: 'syz.3.1781': attribute type 5 has an invalid length.
[  188.359113][T12305] netlink: 'syz.3.1781': attribute type 5 has an invalid length.
[  188.407118][T12311] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1784'.
[  188.410472][T12311] openvswitch: netlink: ct_state flags 0000ee01 unsupported
[  188.440375][T12313] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1783'.
[  188.502989][T12313] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1783'.
[  188.589671][   T33] audit: type=1800 audit(1752882309.926:4): pid=12329 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1788" name="memory.events" dev="tmpfs" ino=3269 res=0 errno=0
[  188.602894][T12329] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1788'.
[  188.607299][T12329] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  188.612368][   T33] audit: type=1800 audit(1752882309.946:5): pid=12334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1788" name="memory.events" dev="tmpfs" ino=3269 res=0 errno=0
[  188.617727][T12335] team0: No ports can be present during mode change
[  189.014593][T12362] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1798'.
[  189.088581][T12365] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1799'.
[  189.128070][T12368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1800'.
[  189.447823][T12379] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1804'.
[  189.501738][T12385] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1806'.
[  190.113239][  T128] block nbd7: Possible stuck request ffff888020900000: control (read@0,1024B). Runtime 60 seconds
[  190.119319][  T128] block nbd7: Possible stuck request ffff888020900200: control (read@1024,1024B). Runtime 60 seconds
[  190.123716][  T128] block nbd7: Possible stuck request ffff888020900400: control (read@2048,1024B). Runtime 60 seconds
[  190.128357][  T128] block nbd7: Possible stuck request ffff888020900600: control (read@3072,1024B). Runtime 60 seconds
[  190.229510][T12380] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  190.287708][T12423] sch_tbf: burst 2 is lower than device lo mtu (11337746) !
[  190.302207][T12423] sch_tbf: burst 2 is lower than device lo mtu (11337746) !
[  190.309628][T12423] sch_tbf: burst 2 is lower than device lo mtu (11337746) !
[  190.327005][T12427] team0: Mode changed to "loadbalance"
[  190.405494][T12430] batadv2: entered promiscuous mode
[  190.409732][T12430] batadv2: entered allmulticast mode
[  190.426152][T12429] C speed is unknown, defaulting to 1000
[  190.431502][T12429] wg1 speed is unknown, defaulting to 1000
[  190.836734][T12457] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  190.842456][T12456] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  191.002448][T12464] xt_CT: No such helper "pptp"
[  191.007330][T12469] xt_CT: No such helper "pptp"
[  191.274145][T12500] netlink: 'syz.3.1837': attribute type 1 has an invalid length.
[  191.277434][T12478] Bluetooth: MGMT ver 1.23
[  191.304535][T12500] 8021q: adding VLAN 0 to HW filter on device bond1
[  191.349701][T12501] 8021q: adding VLAN 0 to HW filter on device bond1
[  191.352218][T12501] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address
[  191.369896][T12501] bond1: (slave vxcan3): Error -95 calling set_mac_address
[  191.391528][T12500] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address
[  191.403657][T12500] bond1: (slave vxcan3): Error -95 calling set_mac_address
[  191.494467][T12509] syzkaller1: entered promiscuous mode
[  191.496203][T12509] syzkaller1: entered allmulticast mode
[  191.586899][T12521] IPv6: addrconf: prefix option has invalid lifetime
[  191.596646][T12521] nft_compat: unsupported protocol 0
[  191.628698][T12523] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on
[  191.745571][T12519] infiniband syz!: set down
[  191.747707][T12519] infiniband syz!: added team_slave_0
[  191.795228][T12519] RDS/IB: syz!: added
[  191.797333][T12519] smc: adding ib device syz! with port count 1
[  191.799406][T12519] smc:    ib device syz! port 1 has pnetid 
[  192.511232][T12555] tun0: tun_chr_ioctl cmd 1074025681
[  192.663502][    C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  192.834114][T12571] tc_dump_action: action bad kind
[  192.854590][T12575] netlink: 'syz.3.1857': attribute type 6 has an invalid length.
[  192.859948][T12575] Cannot find add_set index 0 as target
[  192.909199][T12577] netlink: 'syz.3.1858': attribute type 1 has an invalid length.
[  193.051008][T12583] netlink: 'syz.1.1861': attribute type 11 has an invalid length.
[  193.124470][T12588] netlink: 'syz.1.1864': attribute type 3 has an invalid length.
[  193.186960][T12590] tipc: Started in network mode
[  193.194581][T12590] tipc: Node identity ac14140f, cluster identity 4711
[  193.204939][T12590] tipc: New replicast peer: 255.255.255.255
[  193.215539][T12590] tipc: Enabled bearer <udp:syz2>, priority 10
[  194.152271][T12608] __nla_validate_parse: 34 callbacks suppressed
[  194.152284][T12608] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1868'.
[  194.163025][T12608] netlink: 'syz.3.1868': attribute type 13 has an invalid length.
[  194.167698][T12608] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1868'.
[  194.171754][T12608] (unnamed net_device) (uninitialized): option fail_over_mac: invalid value (6)
[  194.215012][   T47] tipc: Node number set to 2886997007
[  194.358988][T12620] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1871'.
[  194.471252][T12625] netlink: 'syz.3.1871': attribute type 2 has an invalid length.
[  194.499918][T12625] : entered promiscuous mode
[  194.928084][T12641] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  194.931011][T12640] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  195.200539][T12659] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1875'.
[  195.428479][T12679] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1880'.
[  195.431893][T12679] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1880'.
[  196.562420][T12716] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1889'.
[  196.587266][T12716] No such timeout policy "syz0"
[  196.652135][T12720] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1891'.
[  196.813134][T12728] bridge0: port 1(veth0_to_bridge) entered blocking state
[  196.816887][T12728] bridge0: port 1(veth0_to_bridge) entered disabled state
[  196.820015][T12728] veth0_to_bridge: entered allmulticast mode
[  196.827920][T12728] veth0_to_bridge: entered promiscuous mode
[  196.839263][T12730] batman_adv: batadv0: Adding interface: dummy0
[  196.842010][T12730] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  196.852367][T12730] batman_adv: batadv0: Interface activated: dummy0
[  197.157050][T12749] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1903'.
[  197.168897][T12753] IPVS: sync thread started: state = BACKUP, mcast_ifn = wg0, syncid = 4, id = 0
[  197.349839][T12767] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1910'.
[  197.369929][T12767] mac80211_hwsim hwsim3 wlan0: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[  197.376917][T12763] Cannot find add_set index 0 as target
[  197.504285][T12759] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  197.506961][T12759] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  197.509533][T12759] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  197.512152][T12759] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  197.518479][T12759] geneve4: entered promiscuous mode
[  199.046365][T12840] tipc: Failed to remove unknown binding: 66,1,1/1323443965:4075421759/4075421761
[  199.050341][T12840] tipc: Failed to remove unknown binding: 66,1,1/1323443965:4075421759/4075421761
[  199.079563][T12842] sch_tbf: burst 14 is lower than device lo mtu (65550) !
[  199.095950][T12843] sch_tbf: burst 14 is lower than device lo mtu (65550) !
[  199.225469][T12852] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  199.236916][T12852] __nla_validate_parse: 10 callbacks suppressed
[  199.236932][T12852] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1934'.
[  199.261682][T12854] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1935'.
[  199.339726][T12858] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1937'.
[  199.391266][T12864] netlink: 'syz.3.1940': attribute type 2 has an invalid length.
[  199.408523][T12864] : entered promiscuous mode
[  199.419418][T12865] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  199.423112][T12865] syzkaller0: entered promiscuous mode
[  199.428476][T12864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1940'.
[  199.432259][T12865] syzkaller0: entered allmulticast mode
[  199.459286][T12865] tipc: Resetting bearer <eth:syzkaller0>
[  199.486713][T12867] ip6erspan0: entered allmulticast mode
[  199.495985][T12863] tipc: Resetting bearer <eth:syzkaller0>
[  199.499786][T12867] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1941'.
[  199.522054][T12863] tipc: Disabling bearer <eth:syzkaller0>
[  199.528070][T12867] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1941'.
[  199.534185][T12867] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1941'.
[  199.727641][T12886] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  199.748188][T12886] veth0_to_bridge: left allmulticast mode
[  199.750572][T12886] veth0_to_bridge: left promiscuous mode
[  199.757915][T12886] bridge0: port 1(veth0_to_bridge) entered disabled state
[  199.835007][T12886] team0: Port device bridge5 removed
[  199.836867][ T5893] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  199.840007][ T5880] wg1 speed is unknown, defaulting to 1000
[  199.846702][ T5893] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  199.850032][ T5893] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  199.868236][T12894] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1949'.
[  199.874292][T12894] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1949'.
[  199.878657][T12894] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1949'.
[  199.901903][T12892] xt_socket: unknown flags 0xfc
[  199.963686][ T5893] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  200.264987][ T5893] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  200.463543][ T5893] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  200.587962][T12940] openvswitch: netlink: Flow actions attr not present in new flow.
[  200.700669][T12947] C speed is unknown, defaulting to 1000
[  200.709211][T12947] wg1 speed is unknown, defaulting to 1000
[  201.335737][T12963] netlink: 'syz.1.1970': attribute type 4 has an invalid length.
[  201.370133][T12963] : renamed from bond0 (while UP)
[  201.558697][T12979] netlink: 'syz.3.1974': attribute type 1 has an invalid length.
[  201.579538][T12979] 8021q: adding VLAN 0 to HW filter on device bond2
[  201.595956][T12979] 8021q: adding VLAN 0 to HW filter on device bond2
[  201.598297][T12979] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address
[  201.602316][T12979] bond2: (slave vxcan3): Error -95 calling set_mac_address
[  201.647322][T12981] veth15: entered promiscuous mode
[  201.650837][T12981] bond2: (slave veth15): Enslaving as an active interface with a down link
[  201.659055][T12979] 8021q: adding VLAN 0 to HW filter on device bond2
[  202.067238][T12986] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  202.070436][T12986] syzkaller0: entered promiscuous mode
[  202.072179][T12986] syzkaller0: entered allmulticast mode
[  202.156761][T12985] tipc: Resetting bearer <eth:syzkaller0>
[  202.175764][T12985] tipc: Disabling bearer <eth:syzkaller0>
[  202.264223][    C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  202.336991][T12990] netlink: 'syz.1.1978': attribute type 32 has an invalid length.
[  202.340081][T12990] (unnamed net_device) (uninitialized): Setting coupled_control to off (0)
[  202.500168][T13002] netlink: 'syz.1.1981': attribute type 30 has an invalid length.
[  202.515601][T13002] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0
[  202.518907][T13002] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0
[  202.521952][T13002] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0
[  202.525162][T13002] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0
[  202.531160][T13002] netlink: 'syz.1.1981': attribute type 30 has an invalid length.
[  202.872487][T13030] tc_dump_action: action bad kind
[  202.875703][T13030] netlink: 'syz.3.1987': attribute type 5 has an invalid length.
[  203.296419][T13060] bpq0: entered promiscuous mode
[  203.298149][T13060] bpq0: entered allmulticast mode
[  203.301283][T13060] netlink: 'syz.1.1996': attribute type 1 has an invalid length.
[  203.361537][T13060] bond10: entered promiscuous mode
[  203.364056][T13060] 8021q: adding VLAN 0 to HW filter on device bond10
[  203.429761][T13053] "syz.1.1996" (13053) uses obsolete ecb(arc4) skcipher
[  203.727770][T13084] nftables ruleset with unbound set
[  203.729726][T13081] netlink: 'syz.3.2001': attribute type 25 has an invalid length.
[  203.814646][T13089] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  203.826120][T13089] syzkaller0: entered promiscuous mode
[  203.828455][T13089] syzkaller0: entered allmulticast mode
[  203.842336][T13091] ip6_vti0: entered promiscuous mode
[  203.859180][T13091] ip6_vti0: entered allmulticast mode
[  203.936038][T13087] tipc: Resetting bearer <eth:gre0>
[  203.957042][T13087] ip6_vti0: left promiscuous mode
[  204.035287][T13087] bond6: left promiscuous mode
[  204.040293][T13087] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0
[  204.044443][T13087] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0
[  204.047578][T13087] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0
[  204.051141][T13087] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0
[  204.098973][T13087] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  204.102309][T13087] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  204.108966][T13087] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  204.112620][T13087] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  204.120710][T13087] geneve4: left promiscuous mode
[  204.131056][ T5880] C speed is unknown, defaulting to 1000
[  204.137031][ T5880] syz1: Port: 1 Link DOWN
[  204.245346][T13099] __nla_validate_parse: 21 callbacks suppressed
[  204.245362][T13099] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2006'.
[  204.343441][T13101] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.2007'.
[  204.500128][ T5280] udevd[5280]: worker [5839] /devices/virtual/block/nbd7 is taking a long time
[  204.541183][T13079] tipc: Resetting bearer <eth:syzkaller0>
[  204.591650][T13079] tipc: Disabling bearer <eth:syzkaller0>
[  204.601396][T13126] netlink: 'syz.0.2012': attribute type 1 has an invalid length.
[  204.603560][T13123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2011'.
[  204.622251][T13126] bond9: entered promiscuous mode
[  204.624284][T13126] 8021q: adding VLAN 0 to HW filter on device bond9
[  204.696978][T13132] syzkaller0: entered promiscuous mode
[  204.700020][T13132] syzkaller0: entered allmulticast mode
[  204.726002][T13135] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  204.769353][T13136] netlink: 'syz.3.2015': attribute type 5 has an invalid length.
[  205.142546][T13168] netlink: 27 bytes leftover after parsing attributes in process `syz.1.2021'.
[  205.471772][T13186] IPv6: NLM_F_CREATE should be specified when creating new route
[  205.617837][T13193] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2029'.
[  205.692520][T13197] pimreg3: entered allmulticast mode
[  205.744242][T13200] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2032'.
[  205.784898][T13201] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2030'.
[  205.798270][T13201] netlink: 'syz.3.2030': attribute type 2 has an invalid length.
[  206.166789][T13200] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[  206.170765][T13200] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[  206.291491][T13207] netdevsim netdevsim3 netdevsim0: entered promiscuous mode
[  206.294606][T13207] netdevsim netdevsim3 netdevsim0: entered allmulticast mode
[  206.303610][T13207] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  206.618496][ T9479] syzkaller0: tun_net_xmit 76
[  206.620835][ T9479] syzkaller0: tun_net_xmit 48
[  206.643551][   T10] syzkaller0: tun_net_xmit 76
[  207.008674][T13231] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2039'.
[  207.011945][T13231] openvswitch: netlink: Flow actions attr not present in new flow.
[  208.558767][T13232] pimreg: entered allmulticast mode
[  208.782532][T13251] netlink: 'syz.0.2043': attribute type 21 has an invalid length.
[  208.787504][T13251] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2043'.
[  208.791123][T13251] netlink: 'syz.0.2043': attribute type 4 has an invalid length.
[  208.794813][T13251] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2043'.
[  208.803861][T13251] batman_adv: batadv0: Adding interface: dummy0
[  208.806378][T13251] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  208.820077][T13251] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active
[  209.369958][T13279] __nla_validate_parse: 1 callbacks suppressed
[  209.369977][T13279] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2051'.
[  209.951836][T13299] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  210.060734][T13306] netlink: 'syz.0.2064': attribute type 1 has an invalid length.
[  210.096751][T13304] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  210.148350][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2057'.
[  210.174958][T13309] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2058'.
[  210.176821][T13304] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  210.241679][T13304] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  210.302280][T13304] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  210.377010][T13304] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  210.387564][T13304] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  210.396487][T13304] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  210.407330][T13304] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  210.503194][T13316] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2060'.
[  210.507154][T13316] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2060'.
[  210.513987][T13316] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2060'.
[  210.556217][T13316] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2060'.
[  210.637863][T13320] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2061'.
[  210.641543][T13320] hsr_slave_0: left promiscuous mode
[  210.647719][T13320] hsr_slave_1: left promiscuous mode
[  211.015725][T13336] xt_TCPMSS: Only works on TCP SYN packets
[  211.113065][T13341] netlink: 'syz.0.2069': attribute type 32 has an invalid length.
[  211.120364][T13341] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2069'.
[  211.129909][T13341] (unnamed net_device) (uninitialized): Setting coupled_control to off (0)
[  211.287159][T13346] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  211.364453][T13350] syzkaller0: entered promiscuous mode
[  211.366759][T13350] syzkaller0: entered allmulticast mode
[  211.386928][T13350] macsec1: entered promiscuous mode
[  211.388728][T13350] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[  211.391008][T13350] macsec1: entered allmulticast mode
[  211.392753][T13350] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode
[  211.959520][T13356] netlink: 4696 bytes leftover after parsing attributes in process `syz.1.2074'.
[  213.175542][T13364] openvswitch: netlink: Flow actions attr not present in new flow.
[  213.456016][T13383] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms
[  213.460849][T13383] (unnamed net_device) (uninitialized): option use_carrier: invalid value (5)
[  213.590550][T13391] C speed is unknown, defaulting to 1000
[  213.597760][T13391] wg1 speed is unknown, defaulting to 1000
[  213.653932][T13393] xt_CT: You must specify a L4 protocol and not use inversions on it
[  214.478111][T13405] __nla_validate_parse: 4 callbacks suppressed
[  214.478153][T13405] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2091'.
[  214.633173][T13411] bpq0: left promiscuous mode
[  214.635190][T13411] bpq0: left allmulticast mode
[  214.641890][T13411] netlink: 'syz.0.2094': attribute type 1 has an invalid length.
[  214.673742][T13411] bond11: entered promiscuous mode
[  214.677870][T13411] 8021q: adding VLAN 0 to HW filter on device bond11
[  214.704024][T13411] bond11: (slave bridge7): making interface the new active one
[  214.706816][T13411] bridge7: entered promiscuous mode
[  214.709030][T13411] bond11: (slave bridge7): Enslaving as an active interface with an up link
[  214.782950][T13418] Cannot find set identified by id 0 to match
[  214.860257][T13421] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2096'.
[  214.868994][T13421] netlink: 'syz.3.2096': attribute type 3 has an invalid length.
[  214.871929][T13421] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2096'.
[  214.962908][T13424] openvswitch: netlink: IPv4 tun info is not correct
[  215.531733][T13453] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  215.553213][T13454] netlink: 'syz.0.2104': attribute type 2 has an invalid length.
[  215.558496][T13454] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2104'.
[  215.564979][T13453] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.2106'.
[  215.656870][T13458] netlink: 'syz.3.2107': attribute type 1 has an invalid length.
[  215.777049][T13467] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2109'.
[  216.089341][T13488] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2114'.
[  216.140613][T13490] trusted_key: syz.3.2115 sent an empty control message without MSG_MORE.
[  216.452277][T13495] tipc: Cannot configure node identity twice
[  216.561914][T13500] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[  216.825308][T13513] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2124'.
[  216.830117][T13514] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2125'.
[  216.836527][T13513] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2124'.
[  217.453958][T13560] batman_adv: batadv0: Removing interface: dummy0
[  217.458567][T13560] bond7: (slave bridge0): Releasing active interface
[  217.461902][T13560] bond8: (slave bridge4): Releasing active interface
[  217.466472][T13560] bond11: (slave bridge7): Releasing backup interface
[  217.469284][T13560] bridge7: left promiscuous mode
[  217.501380][   T12] nci: nci_ntf_packet: unknown ntf opcode 0x206
[  218.366499][T13578] netlink: 'syz.3.2145': attribute type 1 has an invalid length.
[  218.390368][T13578] 8021q: adding VLAN 0 to HW filter on device bond3
[  218.402279][T13578] 8021q: adding VLAN 0 to HW filter on device batadv1
[  218.407967][T13578] bond3: (slave batadv1): making interface the new active one
[  218.412129][T13578] bond3: (slave batadv1): Enslaving as an active interface with an up link
[  218.717226][T13606] xt_CT: You must specify a L4 protocol and not use inversions on it
[  219.338907][T13643] netlink: 'syz.0.2165': attribute type 2 has an invalid length.
[  219.341864][T13643] nbd: must specify a device to reconfigure
[  219.997153][T13650] __nla_validate_parse: 16 callbacks suppressed
[  219.997178][T13650] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2168'.
[  220.102781][T13652] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2169'.
[  220.194532][  T128] block nbd7: Possible stuck request ffff888020900000: control (read@0,1024B). Runtime 90 seconds
[  220.199574][  T128] block nbd7: Possible stuck request ffff888020900200: control (read@1024,1024B). Runtime 90 seconds
[  220.204488][  T128] block nbd7: Possible stuck request ffff888020900400: control (read@2048,1024B). Runtime 90 seconds
[  220.208854][  T128] block nbd7: Possible stuck request ffff888020900600: control (read@3072,1024B). Runtime 90 seconds
[  220.237376][T13661] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2171'.
[  220.249552][T13661] tipc: Enabling of bearer <5dp:s> rejected, media not registered
[  220.451012][T13645] Bluetooth: hci1: Opcode 0x080f failed: -4
[  220.486364][T13667] ipvlan2: entered promiscuous mode
[  220.490673][T13667] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[  220.529354][T13669] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2175'.
[  220.567801][T13671] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2176'.
[  220.571154][T13671] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2176'.
[  220.576686][T13671] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2176'.
[  220.645984][T13673] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  220.650166][T13673] syzkaller0: entered promiscuous mode
[  220.651892][T13673] syzkaller0: entered allmulticast mode
[  220.686794][T13673] C speed is unknown, defaulting to 1000
[  220.690192][T13673] wg1 speed is unknown, defaulting to 1000
[  220.726150][T13677] tipc: Resetting bearer <eth:syzkaller0>
[  220.922804][T13673] tipc: Resetting bearer <eth:syzkaller0>
[  220.944122][T13673] tipc: Disabling bearer <eth:syzkaller0>
[  221.069957][T13680] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  221.076585][T13680] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2179'.
[  221.076617][T13681] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2179'.
[  221.109891][T13680] tipc: Resetting bearer <eth:syzkaller0>
[  221.123183][T13679] tipc: Disabling bearer <eth:syzkaller0>
[  221.214103][T13688] pimreg: left allmulticast mode
[  221.350262][T13696] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2186'.
[  221.559318][T13705] netlink: 'syz.0.2188': attribute type 4 has an invalid length.
[  221.569440][T13705] netlink: 'syz.0.2188': attribute type 4 has an invalid length.
[  221.581512][   T10] C speed is unknown, defaulting to 1000
[  221.584379][   T10] syz1: Port: 1 Link ACTIVE
[  221.590145][T13705] IPVS: set_ctl: invalid protocol: 49 172.20.20.23:20004
[  221.713828][ T6061] Bluetooth: hci1: command 0x0406 tx timeout
[  221.904781][T13728] netlink: 'syz.1.2197': attribute type 1 has an invalid length.
[  221.914010][T13728] sctp: [Deprecated]: syz.1.2197 (pid 13728) Use of struct sctp_assoc_value in delayed_ack socket option.
[  221.914010][T13728] Use struct sctp_sack_info instead
[  222.322065][T13748] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) !
[  222.466614][T13752] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  222.469866][T13752] syzkaller0: entered promiscuous mode
[  222.471791][T13752] syzkaller0: entered allmulticast mode
[  222.500253][T13752] sch_fq: defrate 8 ignored.
[  222.511240][T13752] tipc: Resetting bearer <eth:syzkaller0>
[  222.520431][T13751] tipc: Resetting bearer <eth:syzkaller0>
[  222.559219][T13751] tipc: Disabling bearer <eth:syzkaller0>
[  222.660815][T13758] openvswitch: netlink: nsh attribute has 124 unknown bytes.
[  222.664484][T13758] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  222.670340][T13758] netlink: 'syz.1.2211': attribute type 16 has an invalid length.
[  222.862285][T13771] veth0: entered promiscuous mode
[  222.908229][T13770] veth0: left promiscuous mode
[  222.966267][T13776] x_tables: arp_tables: .0 target: invalid size 8 (kernel) != (user) 0
[  222.969198][T13777] netlink: 'syz.1.2219': attribute type 10 has an invalid length.
[  222.978086][T13777] 8021q: adding VLAN 0 to HW filter on device 
[  222.980997][T13777] team0: Device  failed to register rx_handler
[  223.166169][T13787] IPv6: NLM_F_REPLACE set, but no existing node found!
[  223.279021][T13792] dvmrp8: left allmulticast mode
[  223.281099][T13792] pimreg: left allmulticast mode
[  223.939781][T13824] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  224.023602][    C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  224.382287][T13833] netlink: 'syz.1.2238': attribute type 11 has an invalid length.
[  224.387140][T13833] netlink: 'syz.1.2238': attribute type 11 has an invalid length.
[  224.440523][T13833] syzkaller0: entered promiscuous mode
[  224.442876][T13833] syzkaller0: entered allmulticast mode
[  226.131015][T13851] vxcan1: entered allmulticast mode
[  226.132773][T13851] vxcan1: left allmulticast mode
[  226.238939][T13862] netlink: 'syz.3.2246': attribute type 1 has an invalid length.
[  226.252300][T13862] __nla_validate_parse: 14 callbacks suppressed
[  226.252316][T13862] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2246'.
[  226.497418][T13880] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2251'.
[  226.544424][T13886] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2253'.
[  226.548459][T13884] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2252'.
[  226.581714][T13890] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2255'.
[  226.641722][T13895] netlink: 416 bytes leftover after parsing attributes in process `syz.1.2257'.
[  226.859984][T13909] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2260'.
[  226.976489][T13915] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  227.032664][T13921] ipt_REJECT: ECHOREPLY no longer supported.
[  227.040198][T13921] x_tables: duplicate underflow at hook 1
[  227.043692][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.047071][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.050507][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.054132][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.057502][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.061995][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.067097][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.070426][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.074007][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.077349][T13922] netlink: 'syz.1.2263': attribute type 3 has an invalid length.
[  227.286297][   T33] audit: type=1800 audit(1752882348.626:6): pid=13928 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2266" name="blkio.bfq.time_recursive" dev="tmpfs" ino=3629 res=0 errno=0
[  227.287468][T13928] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2266'.
[  227.608362][T13949] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2269'.
[  227.778666][T13954] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2271'.
[  228.470413][T13986] veth0: entered promiscuous mode
[  228.480558][T13981] veth0: left promiscuous mode
[  229.356319][ T5880] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  229.361663][T14036] xt_l2tp: v2 doesn't support IP mode
[  229.380355][ T5880] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  229.394838][T14028] team0: Mode changed to "broadcast"
[  229.398132][ T5880] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  229.542182][ T5880] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!
[  229.765332][ T5880] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!
[  229.826516][T14065] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  229.874403][ T5880] ip6_tunnel: ip6gre3 xmit: Local address not yet configured!
[  230.071934][T14068] veth1_vlan: left allmulticast mode
[  230.095940][T14068] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  230.098868][T14068] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  230.101904][T14068] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  230.105905][T14068] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  230.190006][T14068] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0
[  230.193830][T14068] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0
[  230.196987][T14068] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0
[  230.200506][T14068] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0
[  230.230920][ T5893] wg1 speed is unknown, defaulting to 1000
[  230.233000][ T5893] syz0: Port: 1 Link DOWN
[  230.844332][T14098] bridge0: port 1(batadv2) entered blocking state
[  230.846461][T14098] bridge0: port 1(batadv2) entered disabled state
[  230.848675][T14098] batadv2: entered allmulticast mode
[  230.851276][T14098] batadv2: entered promiscuous mode
[  230.913723][    C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  230.975827][T14108] @: renamed from bond_slave_0
[  231.347885][ T5700] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled
[  231.351124][ T5700] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled
[  231.527312][T14155] __nla_validate_parse: 22 callbacks suppressed
[  231.527325][T14155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2323'.
[  231.527735][T14153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2324'.
[  231.544204][T14153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2324'.
[  231.561697][T14155] bond15: entered promiscuous mode
[  231.563623][T14155] bond15: entered allmulticast mode
[  231.565468][T14155] 8021q: adding VLAN 0 to HW filter on device bond15
[  231.568209][T14154] (unnamed net_device) (uninitialized): option min_links: invalid value (18446744073709551604)
[  231.572206][T14154] (unnamed net_device) (uninitialized): option min_links: allowed values 0 - 2147483647
[  231.626316][T14161] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2325'.
[  231.629313][T14161] openvswitch: netlink: Unknown nsh attribute 0
[  231.631568][T14161] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  231.689469][T14163] netlink: 119 bytes leftover after parsing attributes in process `syz.0.2326'.
[  231.953446][    C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  232.483987][T14176] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2329'.
[  232.484167][ T9479] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0xea
[  232.679790][T14183] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2332'.
[  232.749882][T14187] xt_l2tp: v2 sid > 0xffff: 4294901760
[  232.752013][T14187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2334'.
[  232.757137][T14187] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2334'.
[  232.761524][T14187] validate_nla: 57 callbacks suppressed
[  232.761535][T14187] netlink: 'syz.1.2334': attribute type 5 has an invalid length.
[  232.768382][T14187] netlink: 'syz.1.2334': attribute type 6 has an invalid length.
[  232.936440][T14168] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  233.022733][T14208] syzkaller0: entered promiscuous mode
[  233.032341][T14208] syzkaller0: entered allmulticast mode
[  233.162165][T14214] netlink: 'syz.3.2344': attribute type 1 has an invalid length.
[  233.177937][T14214] 8021q: adding VLAN 0 to HW filter on device bond4
[  233.191569][T14214] bond4: (slave bridge3): making interface the new active one
[  233.194677][T14216] netlink: 'syz.0.2343': attribute type 10 has an invalid length.
[  233.194999][T14214] bond4: (slave bridge3): Enslaving as an active interface with an up link
[  233.203037][T14214] gretap1: entered promiscuous mode
[  233.207294][T14214] bond4: (slave gretap1): Enslaving as an active interface with an up link
[  233.217501][T14214] macvlan2: entered promiscuous mode
[  233.219401][T14214] macvlan2: entered allmulticast mode
[  233.221844][T14214] bond4: entered promiscuous mode
[  233.223948][T14214] bridge3: entered promiscuous mode
[  233.226178][T14214] 8021q: adding VLAN 0 to HW filter on device macvlan2
[  233.229139][T14214] bond4: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)
[  233.235491][T14214] bond4: left promiscuous mode
[  233.237527][T14214] bridge3: left promiscuous mode
[  233.270510][T14216] 8021q: adding VLAN 0 to HW filter on device batadv0
[  233.497913][T14221] unknown channel width for channel at 909000KHz?
[  233.734876][T14227] netlink: 'syz.1.2347': attribute type 1 has an invalid length.
[  233.739146][T14226] netlink: 'syz.1.2347': attribute type 1 has an invalid length.
[  233.767057][T14226] 8021q: adding VLAN 0 to HW filter on device bond11
[  233.778184][T14230] netlink: 'syz.0.2348': attribute type 21 has an invalid length.
[  233.789751][T14226] veth65: entered promiscuous mode
[  233.794390][T14226] bond11: (slave veth65): Enslaving as an active interface with a down link
[  233.843048][T14235] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2350'.
[  234.021866][T14248] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  234.246814][T14253] syzkaller1: entered promiscuous mode
[  234.249087][T14253] syzkaller1: entered allmulticast mode
[  234.254588][T14253] openvswitch: netlink: ERSPAN option length err (len 256, max 255).
[  234.409691][T14261] openvswitch: netlink: IPv4 tun info is not correct
[  234.837849][T14277] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  234.937896][ T6061] Bluetooth: hci2: command 0x0419 tx timeout
[  235.314971][T14295] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0
[  235.394489][T14299] openvswitch: netlink: IP tunnel TTL not specified.
[  236.000013][T14343] netlink: 'syz.1.2383': attribute type 5 has an invalid length.
[  236.010616][T14343] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0
[  236.013141][T14343] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0
[  236.027243][T14343] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0
[  236.030409][T14343] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0
[  236.043862][T14343] geneve2: entered promiscuous mode
[  236.045637][T14343] geneve2: entered allmulticast mode
[  236.182576][T14352] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (2878)
[  236.186819][T14352] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255
[  237.360035][T14398] __nla_validate_parse: 10 callbacks suppressed
[  237.360048][T14398] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2400'.
[  237.595863][T14420] netlink: 'syz.3.2404': attribute type 39 has an invalid length.
[  237.660991][T14431] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2407'.
[  238.100478][T14449] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  238.634230][T14460] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2416'.
[  238.805653][T14473] team0: Port device ip6gretap1 added
[  239.131690][T14501] netlink: 'syz.0.2426': attribute type 13 has an invalid length.
[  239.150388][T14502] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add()
[  239.160143][T14503] netlink: 'syz.0.2426': attribute type 13 has an invalid length.
[  239.330394][T14517] netlink: 'syz.0.2430': attribute type 3 has an invalid length.
[  239.337639][T14517] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2430'.
[  239.449922][T14522] C speed is unknown, defaulting to 1000
[  239.453637][T14522] wg1 speed is unknown, defaulting to 1000
[  239.903072][T14532] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2433'.
[  239.940105][T14534] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2434'.
[  240.088490][T14539] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2435'.
[  240.125974][T14534] team0 (unregistering): Port device ip6gretap1 removed
[  240.154841][T14543] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2435'.
[  240.158558][T14543] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2435'.
[  240.178934][T14537] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2435'.
[  240.510250][T14574] netlink: 'syz.3.2444': attribute type 1 has an invalid length.
[  240.582538][T14582] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  240.594221][T14582] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  240.612324][T14579] bpq0: entered promiscuous mode
[  240.620793][T14579] netlink: 'syz.1.2448': attribute type 1 has an invalid length.
[  241.099241][T14547] ==================================================================
[  241.102537][T14547] BUG: KASAN: slab-use-after-free in rose_transmit_link+0x5c3/0x740
[  241.105639][T14547] Read of size 1 at addr ffff888118c89c32 by task syz.0.2439/14547
[  241.109411][T14547] 
[  241.110708][T14547] CPU: 1 UID: 0 PID: 14547 Comm: syz.0.2439 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  241.110738][T14547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  241.110750][T14547] Call Trace:
[  241.110759][T14547]  <TASK>
[  241.110769][T14547]  dump_stack_lvl+0x189/0x250
[  241.110795][T14547]  ? __kasan_check_byte+0x12/0x40
[  241.110819][T14547]  ? __pfx_dump_stack_lvl+0x10/0x10
[  241.110836][T14547]  ? lock_release+0x4b/0x3e0
[  241.110853][T14547]  ? __virt_addr_valid+0x4a5/0x5c0
[  241.110876][T14547]  print_report+0xd2/0x2b0
[  241.110890][T14547]  ? rose_transmit_link+0x5c3/0x740
[  241.110906][T14547]  kasan_report+0x118/0x150
[  241.110927][T14547]  ? kmem_cache_alloc_node_noprof+0x217/0x3c0
[  241.110950][T14547]  ? rose_transmit_link+0x5c3/0x740
[  241.110965][T14547]  rose_transmit_link+0x5c3/0x740
[  241.110978][T14547]  ? skb_put+0x11b/0x210
[  241.111000][T14547]  rose_write_internal+0x11dc/0x1ac0
[  241.111022][T14547]  ? __pfx_rose_write_internal+0x10/0x10
[  241.111039][T14547]  ? __timer_delete+0x5d/0x390
[  241.111063][T14547]  rose_release+0x24e/0x520
[  241.111082][T14547]  sock_close+0xc3/0x240
[  241.111095][T14547]  ? __pfx_sock_close+0x10/0x10
[  241.111109][T14547]  __fput+0x44c/0xa70
[  241.111130][T14547]  task_work_run+0x1d4/0x260
[  241.111154][T14547]  ? __pfx_task_work_run+0x10/0x10
[  241.111173][T14547]  ? task_work_add+0x377/0x420
[  241.111193][T14547]  ? __pfx_task_work_add+0x10/0x10
[  241.111213][T14547]  get_signal+0x11ed/0x1340
[  241.111233][T14547]  arch_do_signal_or_restart+0x9a/0x750
[  241.111256][T14547]  ? __pfx___sys_connect+0x10/0x10
[  241.111275][T14547]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  241.111299][T14547]  ? exit_to_user_mode_loop+0x40/0x110
[  241.111317][T14547]  exit_to_user_mode_loop+0x75/0x110
[  241.111333][T14547]  do_syscall_64+0x2bd/0x3b0
[  241.111347][T14547]  ? lockdep_hardirqs_on+0x9c/0x150
[  241.111361][T14547]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  241.111377][T14547]  ? exc_page_fault+0x9f/0xf0
[  241.111392][T14547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  241.111407][T14547] RIP: 0033:0x7fa9b5d8e9a9
[  241.111423][T14547] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  241.111440][T14547] RSP: 002b:00007fa9b6cbd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[  241.111460][T14547] RAX: fffffffffffffe00 RBX: 00007fa9b5fb5fa0 RCX: 00007fa9b5d8e9a9
[  241.111474][T14547] RDX: 0000000000000040 RSI: 0000200000000240 RDI: 000000000000000d
[  241.111484][T14547] RBP: 00007fa9b5e10d69 R08: 0000000000000000 R09: 0000000000000000
[  241.111494][T14547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  241.111504][T14547] R13: 0000000000000000 R14: 00007fa9b5fb5fa0 R15: 00007fff62b40d78
[  241.111522][T14547]  </TASK>
[  241.111529][T14547] 
[  241.217667][T14547] Allocated by task 14374:
[  241.219168][T14547]  kasan_save_track+0x3e/0x80
[  241.220831][T14547]  __kasan_kmalloc+0x93/0xb0
[  241.222632][T14547]  __kmalloc_cache_noprof+0x230/0x3d0
[  241.224782][T14547]  rose_add_node+0x23a/0xde0
[  241.226542][T14547]  rose_rt_ioctl+0xa48/0xfb0
[  241.228415][T14547]  rose_ioctl+0x3ce/0x8b0
[  241.230175][T14547]  sock_do_ioctl+0xdc/0x300
[  241.231910][T14547]  sock_ioctl+0x576/0x790
[  241.233649][T14547]  __se_sys_ioctl+0xfc/0x170
[  241.235424][T14547]  do_syscall_64+0xfa/0x3b0
[  241.237182][T14547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  241.239438][T14547] 
[  241.240372][T14547] Freed by task 14579:
[  241.241940][T14547]  kasan_save_track+0x3e/0x80
[  241.243739][T14547]  kasan_save_free_info+0x46/0x50
[  241.245662][T14547]  __kasan_slab_free+0x62/0x70
[  241.247496][T14547]  kfree+0x18e/0x440
[  241.249064][T14547]  rose_rt_device_down+0x473/0x4c0
[  241.250998][T14547]  rose_device_event+0x603/0x6a0
[  241.252849][T14547]  notifier_call_chain+0x1b6/0x3e0
[  241.254783][T14547]  __dev_notify_flags+0x18d/0x2e0
[  241.256869][T14547]  netif_change_flags+0xe8/0x1a0
[  241.258868][T14547]  dev_change_flags+0x130/0x260
[  241.260769][T14547]  dev_ioctl+0x7b4/0x1150
[  241.262432][T14547]  sock_do_ioctl+0x22c/0x300
[  241.264193][T14547]  sock_ioctl+0x576/0x790
[  241.265929][T14547]  __se_sys_ioctl+0xfc/0x170
[  241.267833][T14547]  do_syscall_64+0xfa/0x3b0
[  241.269617][T14547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  241.271905][T14547] 
[  241.272918][T14547] The buggy address belongs to the object at ffff888118c89c00
[  241.272918][T14547]  which belongs to the cache kmalloc-512 of size 512
[  241.278148][T14547] The buggy address is located 50 bytes inside of
[  241.278148][T14547]  freed 512-byte region [ffff888118c89c00, ffff888118c89e00)
[  241.283359][T14547] 
[  241.284320][T14547] The buggy address belongs to the physical page:
[  241.286764][T14547] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x118c88
[  241.289782][T14547] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  241.292443][T14547] ksm flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  241.295374][T14547] page_type: f5(slab)
[  241.296647][T14547] raw: 057ff00000000040 ffff88801a441c80 ffffea0004429900 0000000000000003
[  241.299900][T14547] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[  241.303039][T14547] head: 057ff00000000040 ffff88801a441c80 ffffea0004429900 0000000000000003
[  241.306282][T14547] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
[  241.309560][T14547] head: 057ff00000000002 ffffea0004632201 00000000ffffffff 00000000ffffffff
[  241.312792][T14547] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  241.316042][T14547] page dumped because: kasan: bad access detected
[  241.318412][T14547] page_owner tracks the page as allocated
[  241.320520][T14547] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 14165, tgid 14164 (syz.0.2327), ts 231884383334, free_ts 195859522514
[  241.328340][T14547]  post_alloc_hook+0x240/0x2a0
[  241.330180][T14547]  get_page_from_freelist+0x21e4/0x22c0
[  241.332349][T14547]  __alloc_frozen_pages_noprof+0x181/0x370
[  241.334722][T14547]  alloc_pages_mpol+0x232/0x4a0
[  241.336691][T14547]  allocate_slab+0x8a/0x3b0
[  241.338428][T14547]  ___slab_alloc+0xbfc/0x1480
[  241.340304][T14547]  __kmalloc_cache_noprof+0x296/0x3d0
[  241.342129][T14547]  __genradix_ptr_alloc+0x352/0x4a0
[  241.343749][T14547]  __genradix_prealloc+0x44/0x90
[  241.345283][T14547]  sctp_stream_init+0x14b/0x440
[  241.346934][T14547]  sctp_association_new+0x10dd/0x25f0
[  241.349076][T14547]  sctp_connect_new_asoc+0x2c5/0x690
[  241.351155][T14547]  sctp_sendmsg+0x155c/0x2810
[  241.352911][T14547]  __sock_sendmsg+0x19c/0x270
[  241.354704][T14547]  __sys_sendto+0x3bd/0x520
[  241.356525][T14547]  __x64_sys_sendto+0xde/0x100
[  241.358442][T14547] page last free pid 12698 tgid 12697 stack trace:
[  241.361006][T14547]  __free_frozen_pages+0xc71/0xe70
[  241.363013][T14547]  __put_partials+0x161/0x1c0
[  241.364892][T14547]  put_cpu_partial+0x17c/0x250
[  241.366749][T14547]  __slab_free+0x2f7/0x400
[  241.368565][T14547]  qlist_free_all+0x97/0x140
[  241.370415][T14547]  kasan_quarantine_reduce+0x148/0x160
[  241.372424][T14547]  __kasan_slab_alloc+0x22/0x80
[  241.374267][T14547]  __kmalloc_cache_noprof+0x1be/0x3d0
[  241.376262][T14547]  push_stack+0x84/0x3c0
[  241.377868][T14547]  check_cond_jmp_op+0x1069/0x2340
[  241.379816][T14547]  do_check+0x6d3a/0xd450
[  241.381449][T14547]  do_check_common+0x168d/0x20b0
[  241.383332][T14547]  bpf_check+0x13664/0x19c60
[  241.385124][T14547]  bpf_prog_load+0x1318/0x1930
[  241.387021][T14547]  __sys_bpf+0x5f1/0x860
[  241.388795][T14547]  __x64_sys_bpf+0x7c/0x90
[  241.390709][T14547] 
[  241.391695][T14547] Memory state around the buggy address:
[  241.393914][T14547]  ffff888118c89b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  241.396920][T14547]  ffff888118c89b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  241.400034][T14547] >ffff888118c89c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  241.403031][T14547]                                      ^
[  241.405169][T14547]  ffff888118c89c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  241.408271][T14547]  ffff888118c89d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  241.411346][T14547] ==================================================================
[  241.437067][T14547] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  241.440073][T14547] CPU: 1 UID: 0 PID: 14547 Comm: syz.0.2439 Not tainted 6.16.0-rc5-syzkaller-00212-g9f735b6f8a77-dirty #0 PREEMPT(full) 
[  241.444950][T14547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  241.448769][T14547] Call Trace:
[  241.449952][T14547]  <TASK>
[  241.451088][T14547]  dump_stack_lvl+0x99/0x250
[  241.452892][T14547]  ? __asan_memcpy+0x40/0x70
[  241.454690][T14547]  ? __pfx_dump_stack_lvl+0x10/0x10
[  241.456536][T14547]  ? __pfx__printk+0x10/0x10
[  241.458409][T14547]  panic+0x2db/0x790
[  241.459971][T14547]  ? __pfx_preempt_schedule+0x10/0x10
[  241.461977][T14547]  ? __pfx_panic+0x10/0x10
[  241.463667][T14547]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[  241.465990][T14547]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  241.468420][T14547]  ? rose_transmit_link+0x5c3/0x740
[  241.470396][T14547]  check_panic_on_warn+0x89/0xb0
[  241.472169][T14547]  ? rose_transmit_link+0x5c3/0x740
[  241.473704][T14547]  end_report+0x78/0x160
[  241.474944][T14547]  kasan_report+0x129/0x150
[  241.476269][T14547]  ? kmem_cache_alloc_node_noprof+0x217/0x3c0
[  241.478064][T14547]  ? rose_transmit_link+0x5c3/0x740
[  241.479613][T14547]  rose_transmit_link+0x5c3/0x740
[  241.481520][T14547]  ? skb_put+0x11b/0x210
[  241.482933][T14547]  rose_write_internal+0x11dc/0x1ac0
[  241.484689][T14547]  ? __pfx_rose_write_internal+0x10/0x10
[  241.486317][T14547]  ? __timer_delete+0x5d/0x390
[  241.487793][T14547]  rose_release+0x24e/0x520
[  241.489156][T14547]  sock_close+0xc3/0x240
[  241.490688][T14547]  ? __pfx_sock_close+0x10/0x10
[  241.492511][T14547]  __fput+0x44c/0xa70
[  241.494064][T14547]  task_work_run+0x1d4/0x260
[  241.495865][T14547]  ? __pfx_task_work_run+0x10/0x10
[  241.497825][T14547]  ? task_work_add+0x377/0x420
[  241.499689][T14547]  ? __pfx_task_work_add+0x10/0x10
[  241.501648][T14547]  get_signal+0x11ed/0x1340
[  241.503378][T14547]  arch_do_signal_or_restart+0x9a/0x750
[  241.505518][T14547]  ? __pfx___sys_connect+0x10/0x10
[  241.507303][T14547]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  241.509611][T14547]  ? exit_to_user_mode_loop+0x40/0x110
[  241.511667][T14547]  exit_to_user_mode_loop+0x75/0x110
[  241.513689][T14547]  do_syscall_64+0x2bd/0x3b0
[  241.515475][T14547]  ? lockdep_hardirqs_on+0x9c/0x150
[  241.517443][T14547]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  241.519790][T14547]  ? exc_page_fault+0x9f/0xf0
[  241.521604][T14547]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  241.523885][T14547] RIP: 0033:0x7fa9b5d8e9a9
[  241.525607][T14547] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  241.532699][T14547] RSP: 002b:00007fa9b6cbd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[  241.535953][T14547] RAX: fffffffffffffe00 RBX: 00007fa9b5fb5fa0 RCX: 00007fa9b5d8e9a9
[  241.539015][T14547] RDX: 0000000000000040 RSI: 0000200000000240 RDI: 000000000000000d
[  241.541437][T14547] RBP: 00007fa9b5e10d69 R08: 0000000000000000 R09: 0000000000000000
[  241.544226][T14547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  241.546843][T14547] R13: 0000000000000000 R14: 00007fa9b5fb5fa0 R15: 00007fff62b40d78
[  241.549513][T14547]  </TASK>
[  241.551226][T14547] Kernel Offset: disabled
[  241.552919][T14547] Rebooting in 86400 seconds..

VM DIAGNOSIS:
23:46:02  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000000 RBX=ffff8880fc480000 RCX=ffff888107345640 RDX=0000000000000000
RSI=0000000000001000 RDI=0000000000000000 RBP=0000000000000001 RSP=ffffc90002b2f300
R8 =0000000000000000 R9 =ffffffff822d5eb7 R10=dffffc0000000000 R11=fffff940008cf2e9
R12=0000000000119e5d R13=dffffc0000000000 R14=ffff88805fffa870 R15=0000000000001000
RIP=ffffffff8b6d5fe3 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8626000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2d41eff8 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=3263666e2f63666e 2f6c617574726976 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000557e3b2fd850 00007f4d0063666e XMM03=ffffffffffffff00 ffff0000000000ff
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000228 000000000000302d
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffff0000 ffffffffffff0000 XMM09=0000000000000251 000000000000302d
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=1ffffffff33be605 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9
RSI=000000000000155d RDI=000000000000155e RBP=ffffc90004aa73f0 RSP=ffffc90004aa7218
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff85460ce0
R12=dffffc0000000000 R13=dffffc0000000000 R14=ffffffff99df32e0 R15=0000000000000000
RIP=ffffffff85460d57 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007fa9b6cbd6c0 ffffffff 00c00000
GS =0000 ffff8881a3c26000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fe48824e341 CR3=0000000124c3a000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000ffff00000000 000000000000ffff XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=000000ff00000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007fe488211ec1
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
