last executing test programs:

1.529497332s ago: executing program 2 (id=641):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000), 0x31)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000000400007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70400000000000085000000a700000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0x0, 0xfffffffffffffdf3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

1.466266107s ago: executing program 2 (id=645):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000300)="cd", 0x1)
setsockopt$inet6_tcp_int(r0, 0x6, 0x10, &(0x7f0000000040)=0x4, 0x4)

1.358870297s ago: executing program 2 (id=647):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000200)=0x10)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x90)

1.190125635s ago: executing program 0 (id=653):
socket$key(0xf, 0x3, 0x2)
r0 = socket$netlink(0x10, 0x3, 0x0)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket(0x400000000010, 0x3, 0x0)
r3 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r4, {0x0, 0xfff2}, {}, {0xa, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_UDP_DST_PORT={0x6}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0)

1.189896723s ago: executing program 1 (id=654):
r0 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000e40)=@filter={'filter\x00', 0x42, 0x4, 0x418, 0xffffffff, 0x98, 0x0, 0x98, 0xffffffff, 0xffffffff, 0x380, 0x380, 0x380, 0xffffffff, 0x5, 0x0, {[{{@uncond, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0x158, 0x180, 0x0, {}, [@common=@unspec=@string={{0x20}, {0x2, 0x4, 'bm\x00', "17fe85b2e7794dbf95fa4bbcb6a91c1f280c1999b9e9c91aec32acf40242838b14641ee58ffb2807b1455049d59591426d860cbcf1d58ab1ffbb5187b72db33268933cac58623e417fbdbd0b8753f88cb456e7cd9ef85fd6861f486fb7bab7930c4e57def2f1e72aede0b46c35ed67a0549781a3d3fe2b88393de1719bea5584", 0x7e, 0x2, {0xf}}}, @common=@unspec=@connlabel={{0x28}, {0x7fff}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x138, 0x168, 0x0, {}, [@common=@unspec=@conntrack3={{0xc8}, {{@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xff000000, 0xffffff, 0xffffff00], @ipv4=@rand_addr=0x64010101, [0x0, 0xffffff00, 0xffffffff, 0xffffffff], @ipv6=@local, [0xff, 0x0, 0xffffffff, 0xff000000], @ipv6=@remote, [0xff000000, 0xffffff00, 0xffffff00], 0x2, 0x10001, 0x3c, 0x4e20, 0x4e24, 0x4e21, 0x4e24, 0x300, 0x2001}, 0x80, 0x1000, 0x4e29, 0x4e22, 0x4e23, 0x4e24}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x4, 0x6}, {}, 0x360, 0xa}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x478)

1.189783513s ago: executing program 1 (id=655):
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x2, 0x3, 0x1, 0x0, 0x40}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94)

1.115015517s ago: executing program 1 (id=656):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000000)='GPL\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb702000008"], 0x0, 0x9, 0x0, 0x0, 0x0, 0xa}, 0x94)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'wlan0\x00'})
ioctl(r1, 0x8b22, &(0x7f0000000040))

1.113347351s ago: executing program 0 (id=657):
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_DETACH(0x8, &(0x7f00000006c0)=ANY=[@ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="04"], 0x10)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@map=r0, 0x4, 0x0, 0x8, &(0x7f0000000540)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40)

1.11312375s ago: executing program 1 (id=658):
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @sock_ops}, 0x94)
r0 = socket$kcm(0x2d, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={<r1=>r0})
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x10, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000580)="d8001c00180081064e81f782db44fd56170d12a0b9b545c7", 0x18}], 0x1}, 0x0)
ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r1})
ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e3, &(0x7f0000000180)={r0, r2})

1.059172167s ago: executing program 0 (id=659):
r0 = socket$inet6(0xa, 0x80002, 0x88)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @empty, 0x6}, 0x1c)
setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f00000003c0)=0x3, 0x4)
syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000000000000000000104004e200023b0"], 0x0)

1.058995572s ago: executing program 1 (id=660):
r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=<r1=>0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2)
sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r1], 0x1c}}, 0x0)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
pwritev(r0, &(0x7f0000001a00)=[{&(0x7f0000000600)="24ba8d4416efcb4768e949522f47331d4548861502149843b0606505ad3255eb63568e3c6147e90cc21f78d2323128c8d375102a2bcdb5cd78e7f3d6ff64da1b49a467badc8e4f6d699c789929cf02ca9c7165d13c7f7b8be98dcf5a0eb01a3df3e9bdfde437d11f4f599ad8bb03bf63efc4183d44de47eaf11ec43172db7ef524be9203ad39a624829527f8c30773b6", 0x90}], 0x1, 0x5e, 0xdc)

1.009810675s ago: executing program 0 (id=661):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000001500)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10)
socket$kcm(0x2, 0x1, 0x84)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r1)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c)
listen(r2, 0x0)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
r4 = socket$inet6(0xa, 0x5, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r4, 0x84, 0x65, 0x0, 0x0)
r5 = accept(r2, 0x0, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048054}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xd0}, 0x0)
sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000012c0)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0)
sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0)
connect$unix(r5, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e)
r8 = socket(0x2, 0x5, 0x0)
sendmmsg$inet_sctp(r8, &(0x7f00000032c0)=[{&(0x7f0000002e40)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000200)="f9", 0x1}], 0x1, 0x0, 0x0, 0x80020}], 0x1, 0x40c0)
sendmmsg$inet_sctp(r8, &(0x7f0000000bc0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000001c0)=[{0x0, 0x2}], 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c0000000000000000002b0388edb6556900"/51, @ANYRES32=0x0], 0x30}], 0x1, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
socket$kcm(0x2, 0xa, 0x2)
write$tun(r9, &(0x7f0000000340)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0xb4, 0x0, 0x0, 0x7, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xa, 0x0, 0x4, 0x0, 0x1c, {[@timestamp={0x5, 0xa}, @generic={0x0, 0x8, "d58838068b91"}]}}, {"a706faed3cf692307e75e50699d58873e1883515da389cb8158eb176c8e349aea6af78336582d0590e25ec269b2d3680332426aafd97cbf9f2a7ba9e6b90669957d639f5cd9c2e3aa1588665236be66b018ebf74d1ea99a30dc58e38ec0fcf72759302a257550bd8f2c42bf4a9768bef2ca76144bd2900fc"}}}}}, 0xc2)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

498.367398ms ago: executing program 2 (id=662):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000cc0), r0)
sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000001180)={0x18, r1, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x40004)

179.955537ms ago: executing program 1 (id=663):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000e00)={&(0x7f0000000980)='sys_exit\x00', r0}, 0x10)
r1 = socket$kcm(0x2, 0x1, 0x84)
sendmsg$inet(r1, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc)
sendmsg$inet(r1, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x4000080)
sendmsg$inet(r1, 0x0, 0x240448c4)

179.673091ms ago: executing program 2 (id=664):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', <r1=>0x0})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x25dfdbfb, {0x60, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x10, 0x2, [@TCA_RED_FLAGS={0xc, 0x4, {0xf, 0x8}}]}}]}, 0x3c}}, 0x0)

97.742264ms ago: executing program 0 (id=665):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000c40, 0x0, 0x0, 0x200000000c70, 0x200000000ca0], 0x0, 0x0, &(0x7f0000000c40)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}]}, 0x108)

97.501883ms ago: executing program 2 (id=666):
socketpair(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r2}, 0x10)
r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000005140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000000c00020000000000000000001c0007800c00018008000100", @ANYRES32=r0], 0x3c}}, 0x0)

0s ago: executing program 0 (id=667):
unshare(0x20000400)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94)
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)={@ifindex, r0, 0x2e, 0x2010}, 0x20)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:28311' (ED25519) to the list of known hosts.
syzkaller login: [   55.567613][ T5815] cgroup: Unknown subsys name 'net'
[   55.754475][ T5815] cgroup: Unknown subsys name 'cpuset'
[   55.760368][ T5815] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   57.270328][ T5815] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.953007][ T5831] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.957425][ T5831] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.961771][ T5831] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.965608][ T5831] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.969240][ T5831] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   64.044554][ T5831] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   64.048403][ T5831] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   64.051990][ T5831] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   64.056246][ T5831] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   64.061806][ T5220] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   64.066272][ T5220] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   64.069465][ T5220] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   64.073110][ T5220] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   64.080276][ T5220] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   64.083768][ T5220] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   64.399252][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   64.465538][ T5835] chnl_net:caif_netlink_parms(): no params data found
[   64.497289][ T5833] chnl_net:caif_netlink_parms(): no params data found
[   64.559793][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.563348][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.566567][ T5829] bridge_slave_0: entered allmulticast mode
[   64.570462][ T5829] bridge_slave_0: entered promiscuous mode
[   64.594595][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.597533][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.600633][ T5829] bridge_slave_1: entered allmulticast mode
[   64.604599][ T5829] bridge_slave_1: entered promiscuous mode
[   64.673399][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.683133][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.686064][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.689514][ T5835] bridge_slave_0: entered allmulticast mode
[   64.693362][ T5835] bridge_slave_0: entered promiscuous mode
[   64.699009][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.742505][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.745275][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.747862][ T5835] bridge_slave_1: entered allmulticast mode
[   64.751495][ T5835] bridge_slave_1: entered promiscuous mode
[   64.768766][ T5829] team0: Port device team_slave_0 added
[   64.772025][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.774842][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.777779][ T5833] bridge_slave_0: entered allmulticast mode
[   64.782683][ T5833] bridge_slave_0: entered promiscuous mode
[   64.799426][ T5829] team0: Port device team_slave_1 added
[   64.802277][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.805289][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.808262][ T5833] bridge_slave_1: entered allmulticast mode
[   64.812560][ T5833] bridge_slave_1: entered promiscuous mode
[   64.832612][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.840260][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.896776][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.901531][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.912863][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.931977][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.937007][ T5835] team0: Port device team_slave_0 added
[   64.939829][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.942457][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.951517][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.957377][ T5835] team0: Port device team_slave_1 added
[   64.974739][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.015985][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.018636][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.028040][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.034621][ T5833] team0: Port device team_slave_0 added
[   65.038587][ T5833] team0: Port device team_slave_1 added
[   65.055486][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.057966][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.066643][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.129785][ T5835] hsr_slave_0: entered promiscuous mode
[   65.133370][ T5835] hsr_slave_1: entered promiscuous mode
[   65.153027][ T5829] hsr_slave_0: entered promiscuous mode
[   65.155677][ T5829] hsr_slave_1: entered promiscuous mode
[   65.158197][ T5829] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   65.162142][ T5829] Cannot create hsr debugfs directory
[   65.177796][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.180711][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.191312][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.197322][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.200526][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.210753][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.336902][ T5833] hsr_slave_0: entered promiscuous mode
[   65.339958][ T5833] hsr_slave_1: entered promiscuous mode
[   65.342531][ T5833] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   65.345765][ T5833] Cannot create hsr debugfs directory
[   65.530369][ T5835] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   65.560068][ T5835] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   65.582049][ T5835] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.597694][ T5835] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.652107][ T5829] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   65.680053][ T5829] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   65.685853][ T5829] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   65.708297][ T5829] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   65.718510][ T5833] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   65.731919][ T5833] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   65.738362][ T5833] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   65.752364][ T5833] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.827596][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.876005][ T5835] 8021q: adding VLAN 0 to HW filter on device team0
[   65.895249][  T999] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.898267][  T999] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.920619][  T999] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.924212][  T999] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.965509][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.985826][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.004693][ T5833] 8021q: adding VLAN 0 to HW filter on device team0
[   66.018609][   T66] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.020093][ T5838] Bluetooth: hci0: command tx timeout
[   66.022013][   T66] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.054295][   T66] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.057372][   T66] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.068139][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   66.100250][   T66] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.103391][   T66] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.127244][   T66] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.130418][   T66] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.169286][ T5838] Bluetooth: hci2: command tx timeout
[   66.172185][ T5838] Bluetooth: hci1: command tx timeout
[   66.285894][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.360997][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.374129][ T5835] veth0_vlan: entered promiscuous mode
[   66.387189][ T5835] veth1_vlan: entered promiscuous mode
[   66.437408][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.460441][ T5833] veth0_vlan: entered promiscuous mode
[   66.481318][ T5835] veth0_macvtap: entered promiscuous mode
[   66.484996][ T5833] veth1_vlan: entered promiscuous mode
[   66.504648][ T5835] veth1_macvtap: entered promiscuous mode
[   66.541056][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.546199][ T5833] veth0_macvtap: entered promiscuous mode
[   66.555997][ T5829] veth0_vlan: entered promiscuous mode
[   66.562359][ T5833] veth1_macvtap: entered promiscuous mode
[   66.568720][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.583659][ T5835] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.586704][ T5835] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.590486][ T5835] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.593752][ T5835] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.600441][ T5829] veth1_vlan: entered promiscuous mode
[   66.628109][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.646759][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.666712][ T5833] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.670889][ T5833] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.677216][ T5833] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.681837][ T5833] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.692576][ T5829] veth0_macvtap: entered promiscuous mode
[   66.728426][ T5829] veth1_macvtap: entered promiscuous mode
[   66.765063][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.772559][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.787843][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.820369][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.842787][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.846267][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.847527][ T5829] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.853260][ T5829] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.856247][ T5829] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.860151][ T5829] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.871709][ T1100] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.875083][ T1100] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.922870][ T1100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.925840][ T1100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.937371][ T5835] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   66.988298][   T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.998531][   T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.081199][   T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.096140][   T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.421896][ T5916] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11'.
[   67.749005][ T5943] Zero length message leads to an empty skb
[   67.808058][ T5947] tun0: tun_chr_ioctl cmd 1074025673
[   67.895178][ T5955] warning: `syz.1.28' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   68.048588][ T5957] xt_CT: No such helper "syz1"
[   68.051581][ T5964] netlink: 96 bytes leftover after parsing attributes in process `syz.2.33'.
[   68.062228][ T5964] vlan2: entered allmulticast mode
[   68.064382][ T5964] gretap0: entered allmulticast mode
[   68.089265][   T55] Bluetooth: hci0: command tx timeout
[   68.251849][   T55] Bluetooth: hci1: command tx timeout
[   68.254275][   T55] Bluetooth: hci2: command tx timeout
[   68.435729][ T5990] netlink: 4 bytes leftover after parsing attributes in process `syz.0.41'.
[   68.724650][ T6011] Bluetooth: MGMT ver 1.23
[   69.492526][ T6055] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   69.497680][ T6057] netlink: 8 bytes leftover after parsing attributes in process `syz.1.67'.
[   69.551583][ T6060] netlink: 288 bytes leftover after parsing attributes in process `syz.2.68'.
[   69.892070][ T6084] netlink: 24 bytes leftover after parsing attributes in process `syz.2.75'.
[   70.145329][ T6099] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   70.166754][ T6099] xt_connbytes: Forcing CT accounting to be enabled
[   70.170853][   T55] Bluetooth: hci0: command tx timeout
[   70.173642][ T6099] x_tables: ip6_tables: SNPT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING
[   70.338346][   T55] Bluetooth: hci2: command tx timeout
[   70.338384][ T5220] Bluetooth: hci1: command tx timeout
[   70.797583][ T6145] ieee802154 phy0 wpan0: encryption failed: -90
[   70.823947][ T5838] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[   71.135178][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   71.137895][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.622717][ T6191] netlink: 16 bytes leftover after parsing attributes in process `syz.2.120'.
[   71.835752][ T6205] netlink: 'syz.0.127': attribute type 4 has an invalid length.
[   71.868411][ T6205] netlink: 'syz.0.127': attribute type 4 has an invalid length.
[   72.071169][ T6222] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.133'.
[   72.250544][ T5838] Bluetooth: hci0: command 0x0419 tx timeout
[   72.417430][ T5838] Bluetooth: hci1: command tx timeout
[   72.417482][ T5220] Bluetooth: hci2: command tx timeout
[   72.503997][ T6253] netlink: 12 bytes leftover after parsing attributes in process `syz.2.148'.
[   72.646842][ T6259] netlink: 4 bytes leftover after parsing attributes in process `syz.2.152'.
[   72.815438][ T6269] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   72.853763][ T6265] netlink: 8 bytes leftover after parsing attributes in process `syz.1.153'.
[   72.913149][ T6265] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   72.922650][ T6265] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
[   73.287663][ T6294] ipt_REJECT: ECHOREPLY no longer supported.
[   73.453472][ T6308] IPv6: Can't replace route, no match found
[   73.489687][ T6310] netlink: 8 bytes leftover after parsing attributes in process `syz.0.176'.
[   73.502765][ T6312] netlink: 4 bytes leftover after parsing attributes in process `syz.2.177'.
[   73.747027][ T6325] tipc: Started in network mode
[   73.756457][ T6325] tipc: Node identity de1cbb8b127c, cluster identity 4711
[   73.761592][ T6325] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   73.774294][ T6325] syzkaller0: entered promiscuous mode
[   73.776557][ T6325] syzkaller0: entered allmulticast mode
[   73.821598][ T6325] tipc: Resetting bearer <eth:syzkaller0>
[   73.834384][ T6324] tipc: Resetting bearer <eth:syzkaller0>
[   73.860976][ T6324] tipc: Disabling bearer <eth:syzkaller0>
[   74.339299][ T5220] Bluetooth: hci0: command 0x0419 tx timeout
[   74.693336][ T6366] openvswitch: netlink: Missing valid actions attribute.
[   74.696159][ T6366] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   75.673602][ T6394] netlink: 'syz.0.214': attribute type 282 has an invalid length.
[   75.735566][ T6396] netlink: 'syz.0.215': attribute type 39 has an invalid length.
[   75.745077][ T6396] veth0_macvtap: left promiscuous mode
[   75.951652][ T6406] netlink: 72 bytes leftover after parsing attributes in process `syz.0.221'.
[   75.955618][ T6406] netlink: 12 bytes leftover after parsing attributes in process `syz.0.221'.
[   75.976786][ T6406] netlink: 16 bytes leftover after parsing attributes in process `syz.0.221'.
[   75.980425][ T6410] netlink: 28 bytes leftover after parsing attributes in process `syz.1.220'.
[   76.263994][ T6423] netlink: 40 bytes leftover after parsing attributes in process `syz.0.228'.
[   76.927949][ T6416] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[   77.030122][ T6429] netlink: 'syz.2.230': attribute type 15 has an invalid length.
[   77.232167][ T6447] xt_policy: neither incoming nor outgoing policy selected
[   77.232427][ T6443] xt_CT: You must specify a L4 protocol and not use inversions on it
[   77.416881][ T6464] netlink: 'syz.2.248': attribute type 5 has an invalid length.
[   77.436201][ T6468] netlink: 'syz.0.247': attribute type 1 has an invalid length.
[   78.933802][ T6513] vcan0: tx drop: invalid da for name 0x0000000000000003
[   79.288366][ T6525] __nla_validate_parse: 4 callbacks suppressed
[   79.288380][ T6525] netlink: 392 bytes leftover after parsing attributes in process `syz.0.272'.
[   80.041423][ T6556] netlink: 8 bytes leftover after parsing attributes in process `syz.0.285'.
[   80.083650][ T6560] netlink: 4 bytes leftover after parsing attributes in process `syz.0.288'.
[   80.406545][ T6582] syzkaller0: entered promiscuous mode
[   80.409246][ T6582] syzkaller0: entered allmulticast mode
[   80.441150][ T6584] set match dimension is over the limit!
[   80.483764][ T6586] Illegal XDP return value 4294967294 on prog  (id 39) dev N/A, expect packet loss!
[   80.866320][ T6596] netlink: 28 bytes leftover after parsing attributes in process `syz.0.305'.
[   81.813052][ T6632] netlink: 'syz.2.318': attribute type 10 has an invalid length.
[   81.836075][ T6632] batman_adv: batadv0: Adding interface: netdevsim0
[   81.842455][ T6632] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   81.855166][ T6632] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active
[   81.876873][ T6636] syz.0.321 uses obsolete (PF_INET,SOCK_PACKET)
[   81.937980][ T6640] netlink: 8 bytes leftover after parsing attributes in process `syz.2.323'.
[   82.323261][ T6663] IPVS: lblc: UDP 224.0.0.2:0 - no destination available
[   82.328803][ T5868] IPVS: starting estimator thread 0...
[   82.337164][ T6671] netlink: 8 bytes leftover after parsing attributes in process `syz.0.336'.
[   82.341834][ T6671] netlink: 8 bytes leftover after parsing attributes in process `syz.0.336'.
[   82.419456][ T6669] IPVS: using max 79 ests per chain, 189600 per kthread
[   82.433428][ T6679] netlink: 8 bytes leftover after parsing attributes in process `syz.0.340'.
[   82.436315][ T6679] netlink: 4 bytes leftover after parsing attributes in process `syz.0.340'.
[   82.502569][ T6686] netlink: 'syz.0.343': attribute type 1 has an invalid length.
[   82.771453][ T6708] netlink: 180 bytes leftover after parsing attributes in process `syz.2.354'.
[   82.964990][ T6729] netlink: 'syz.2.363': attribute type 4 has an invalid length.
[   83.214258][ T6757] TCP: tcp_parse_options: Illegal window scaling value 236 > 14 received
[   83.477303][ T6773] netlink: 'syz.1.382': attribute type 7 has an invalid length.
[   83.482548][ T6773] netlink: 'syz.1.382': attribute type 8 has an invalid length.
[   83.485397][ T6773] netlink: 'syz.1.382': attribute type 4 has an invalid length.
[   83.666748][ T6785] netlink: 'syz.1.388': attribute type 5 has an invalid length.
[   83.691303][ T6786] TCP: tcp_parse_options: Illegal window scaling value 94 > 14 received
[   84.518940][ T6811] tipc: Started in network mode
[   84.522143][ T6811] tipc: Node identity ca131b574bf4, cluster identity 4711
[   84.525299][ T6811] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   84.530699][ T6811] syzkaller0: entered promiscuous mode
[   84.533040][ T6811] syzkaller0: entered allmulticast mode
[   84.553481][ T6814] __nla_validate_parse: 11 callbacks suppressed
[   84.553497][ T6814] netlink: 4 bytes leftover after parsing attributes in process `syz.2.401'.
[   84.564721][ T6811] tipc: Resetting bearer <eth:syzkaller0>
[   84.572259][ T6809] tipc: Resetting bearer <eth:syzkaller0>
[   84.583011][ T6809] tipc: Disabling bearer <eth:syzkaller0>
[   84.729514][ T6819] netlink: 16 bytes leftover after parsing attributes in process `syz.1.404'.
[   84.773065][ T6824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.405'.
[   85.023056][ T6841] netlink: 'syz.1.415': attribute type 3 has an invalid length.
[   86.387626][ T6933] netlink: 'syz.2.451': attribute type 1 has an invalid length.
[   86.391492][ T6933] netlink: 'syz.2.451': attribute type 4 has an invalid length.
[   86.395539][ T6933] netlink: 188 bytes leftover after parsing attributes in process `syz.2.451'.
[   86.502247][   T24] cfg80211: failed to load regulatory.db
[   86.855140][ T6965] IPVS: lc: UDP 224.0.0.2:0 - no destination available
[   86.858532][ T5861] IPVS: starting estimator thread 0...
[   86.951488][ T6971] IPVS: using max 37 ests per chain, 88800 per kthread
[   86.982322][ T6979] sctp: [Deprecated]: syz.1.471 (pid 6979) Use of struct sctp_assoc_value in delayed_ack socket option.
[   86.982322][ T6979] Use struct sctp_sack_info instead
[   87.057653][ T6987] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   87.192844][ T6992] netlink: 24 bytes leftover after parsing attributes in process `syz.1.474'.
[   87.291091][ T7001] netlink: 4696 bytes leftover after parsing attributes in process `syz.2.481'.
[   87.295282][ T7001] netlink: 4696 bytes leftover after parsing attributes in process `syz.2.481'.
[   87.309197][ T7001] netlink: 508 bytes leftover after parsing attributes in process `syz.2.481'.
[   87.732368][ T7037] ip6gre1: entered allmulticast mode
[   87.961131][ T7060] netlink: 'syz.2.509': attribute type 2 has an invalid length.
[   87.964514][ T7060] netlink: 119 bytes leftover after parsing attributes in process `syz.2.509'.
[   88.055267][ T7070] netlink: 5 bytes leftover after parsing attributes in process `syz.0.514'.
[   88.114437][ T7074] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   88.678889][ T7098] netlink: 'syz.0.526': attribute type 20 has an invalid length.
[   88.975260][ T7118] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   88.980122][ T7122] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   89.004917][ T7124] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   89.008352][ T7124] syzkaller0: entered promiscuous mode
[   89.012131][ T7124] syzkaller0: entered allmulticast mode
[   89.030932][ T7124] tipc: Resetting bearer <eth:syzkaller0>
[   89.037516][ T7123] tipc: Resetting bearer <eth:syzkaller0>
[   89.061548][ T7123] tipc: Disabling bearer <eth:syzkaller0>
[   89.603445][ T7171] netlink: 'syz.2.556': attribute type 13 has an invalid length.
[   89.606761][ T7171] netlink: 'syz.2.556': attribute type 17 has an invalid length.
[   89.717677][ T7171] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   89.825123][ T7164] __nla_validate_parse: 6 callbacks suppressed
[   89.825132][ T7164] netlink: 16 bytes leftover after parsing attributes in process `syz.2.556'.
[   89.853381][ T7164] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   89.898670][ T7192] netlink: 8 bytes leftover after parsing attributes in process `syz.1.566'.
[   89.936690][ T7196] netlink: 88 bytes leftover after parsing attributes in process `syz.1.568'.
[   89.955621][ T7164] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   89.992971][   T33] audit: type=1800 audit(1752372007.382:2): pid=7200 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.570" name="memory.events" dev="tmpfs" ino=1108 res=0 errno=0
[   90.005286][   T33] audit: type=1804 audit(1752372007.392:3): pid=7200 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.570" name="/newroot/216/memory.events" dev="tmpfs" ino=1108 res=1 errno=0
[   90.024404][ T7164] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   90.057527][ T7202] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   90.061518][ T7204] netlink: 40 bytes leftover after parsing attributes in process `syz.0.572'.
[   90.655593][ T7239] netlink: 28 bytes leftover after parsing attributes in process `syz.2.589'.
[   90.985578][ T7276] netlink: 'syz.0.606': attribute type 4 has an invalid length.
[   91.222163][ T7306] batadv1: entered allmulticast mode
[   91.225081][ T7306] 8021q: adding VLAN 0 to HW filter on device batadv1
[   91.228272][ T7305] netlink: 8 bytes leftover after parsing attributes in process `syz.0.618'.
[   91.231959][ T7305] tipc: Enabled bearer <eth:vlan0>, priority 18
[   91.516425][ T7344] netlink: 'syz.1.637': attribute type 4 has an invalid length.
[   91.527564][ T7343] tipc: Failed to remove unknown binding: 66,1,1/0:3277281745/3277281747
[   91.541964][ T7343] tipc: Failed to remove unknown binding: 66,1,1/0:3277281745/3277281747
[   91.628988][ T7355] netlink: 'syz.0.643': attribute type 3 has an invalid length.
[   91.633849][ T7355] netlink: 224 bytes leftover after parsing attributes in process `syz.0.643'.
[   91.809307][ T7373] netlink: 60 bytes leftover after parsing attributes in process `syz.0.649'.
[   91.813458][ T7370] netlink: 60 bytes leftover after parsing attributes in process `syz.0.649'.
[   91.832238][ T7375] netlink: 40 bytes leftover after parsing attributes in process `syz.1.650'.
[   92.137700][   T13] nci: nci_rx_work: unknown MT 0x1
[   92.218691][ T7403] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   92.349921][    T9] tipc: Node number set to 2179406679
[   93.117503][ T5279] udevd[5279]: worker [5832] terminated by signal 33 (Unknown signal 33)
Connection to localhost closed by remote host.
[   93.722063][   T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   93.789518][   T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   93.846389][   T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   93.926344][   T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   94.017521][   T12] bridge_slave_1: left allmulticast mode
[   94.020637][   T12] bridge_slave_1: left promiscuous mode
[   94.023418][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   94.029771][   T12] bridge_slave_0: left allmulticast mode
[   94.032008][   T12] bridge_slave_0: left promiscuous mode
[   94.034022][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   94.369775][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   94.376065][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   94.381981][   T12] bond0 (unregistering): Released all slaves
[   94.652016][   T12] hsr_slave_0: left promiscuous mode
[   94.654328][   T12] hsr_slave_1: left promiscuous mode
[   94.656456][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   94.659162][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[   94.663602][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   94.665886][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[   94.676246][   T12] veth1_macvtap: left promiscuous mode
[   94.678290][   T12] veth0_macvtap: left promiscuous mode
[   94.682902][   T12] veth1_vlan: left promiscuous mode
[   94.684812][   T12] veth0_vlan: left promiscuous mode
[   95.003624][   T12] team0 (unregistering): Port device team_slave_1 removed
[   95.032165][   T12] team0 (unregistering): Port device team_slave_0 removed
[   95.601449][   T12] IPVS: stop unused estimator thread 0...

VM DIAGNOSIS:
02:00:20  Registers:
info registers vcpu 0

CPU#0
RAX=7be01a961ae5ee00 RBX=ffffffff81976c78 RCX=7be01a961ae5ee00 RDX=0000000000000001
RSI=ffffffff8d998b42 RDI=ffffffff8be29dc0 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1f3f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6f24d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055d6e9aba638 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 000000000000ffff XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000ff0000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000071 0000000000000000
XMM06=ff00000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffffffff XMM09=00316e6170772f74 656e2f317968702f
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=3fa352a2930fb800 RBX=ffffffff81976c78 RCX=3fa352a2930fb800 RDX=0000000000000001
RSI=ffffffff8d998b42 RDI=ffffffff8be29dc0 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f5b R9 =1ffff11026cc65eb R10=dffffc0000000000 R11=ffffed1026cc65ec
R12=ffffffff8fa1f3f0 R13=0000000000000001 R14=0000000000000001 R15=1ffff1102001d000
RIP=ffffffff8b6f24d3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055d6e6217680 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000ff0000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
