last executing test programs:

1m23.530369055s ago: executing program 1 (id=361):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = epoll_create(0xeb)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x20000000})
ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'gre0\x00', <r2=>0x0, 0x7, 0x700, 0x5, 0x0, {{0xa, 0x4, 0x1, 0x2, 0x28, 0x65, 0x0, 0x4, 0x29, 0x0, @multicast1, @rand_addr=0x64010101, {[@rr={0x7, 0x13, 0xd8, [@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @broadcast, @dev={0xac, 0x14, 0x14, 0x2a}]}]}}}}})
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x8, 0x4, 0x4, 0x4, 0x0, 0x1, 0x0, '\x00', r2}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x1c}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}], {0x95, 0x0, 0x74}}, &(0x7f0000000400)='syzkaller\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff024}, {0x20, 0x0, 0x0, 0xfffff038}, {0x6}]}, 0x10)
sendmmsg(r5, &(0x7f0000000180), 0x4000190, 0x0)
ioctl$BTRFS_IOC_LOGICAL_INO_V2(r0, 0xc038943b, &(0x7f00000001c0)={0xffff, 0x40, '\x00', 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000200)='sys_enter\x00', r4, 0x0, 0x5}, 0x18)
ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f00000004c0))
connect$inet(0xffffffffffffffff, 0x0, 0x0)
r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000480)={0x4, &(0x7f0000000440)=[{0x1, 0xff, 0x3, 0xdf6}, {0x6, 0x8, 0x1, 0x81}, {0x7, 0x48, 0x9, 0xc9d}, {0x1ff, 0x8, 0x8c, 0x7}]}, 0x10)
ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000000340)={r0, r0, 0xb, 0x0, 0x0, 0xc2, 0xfd, 0x15c2, 0x1, 0x801, 0x3, 0x8, 'syz0\x00'})
shutdown(r0, 0x1)
r8 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$inet_pktinfo(r8, 0x0, 0x8, &(0x7f0000000280)={r2, @multicast2, @broadcast}, 0xc)

1m23.40052233s ago: executing program 1 (id=363):
r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
sendmmsg(r0, &(0x7f0000001040)=[{{&(0x7f0000000140)=@caif=@util={0x25, "0648da2408299af0d155fdd1db4a434d"}, 0x80, 0x0}}], 0x1, 0x4000) (async)
r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
ppoll(0xfffffffffffffffc, 0x0, &(0x7f0000000000)={0x0, 0x3938700}, 0x0, 0x0) (async)
ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000280)={r2, r2, 0x1, 0xd, &(0x7f0000000040)="0f114def84b22dde27e442f1a7", 0x9, 0x1, 0x16bf, 0x5505, 0xc3b8, 0x1, 0x0, 'syz0\x00'}) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='freezer.state\x00', 0x0, 0x0)
setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x2, 0x3}, 0x10) (async)
socket$tipc(0x1e, 0x2, 0x0)

1m23.327981386s ago: executing program 1 (id=365):
r0 = socket$netlink(0x10, 0x3, 0xf)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000080)=0x100, 0x4)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0)
r2 = gettid()
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r2, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30)
write$cgroup_pid(r1, &(0x7f00000000c0)=r2, 0x12)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0)
getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_GET(r7, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40002000}, 0xc, &(0x7f0000000240)={&(0x7f0000000500)={0xa4, 0x1, 0x2, 0x101, 0x0, 0x0, {0x3, 0x0, 0x7}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x2}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x1}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0xe2}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x2}, @CTA_EXPECT_MASTER={0x54, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x11}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x7ea9}, @CTA_EXPECT_FN={0x8, 0xb, 'sip\x00'}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4008801}, 0x8000)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r6, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r8 = socket$nl_route(0x10, 0x3, 0x0)
r9 = socket(0x1, 0x803, 0x0)
getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r10], 0x54}}, 0x0)
r11 = socket$igmp6(0xa, 0x3, 0x2)
setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @ipv4={'\x00', '\xff\xff', @loopback}, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff, 0x20, 0xf8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x401, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488)
r12 = socket$netlink(0x10, 0x3, 0x0)
r13 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, <r14=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r12, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000001000250800170000000000000a000000", @ANYRES32=r14, @ANYBLOB="0174dfdb0ddad488bc"], 0x20}}, 0x0)
r15 = socket(0x1a, 0x803, 0x0)
getsockname$packet(r15, &(0x7f0000000100)={0x11, 0x0, <r16=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="500000001000110f00"/20, @ANYRES32=0x0, @ANYBLOB="040100000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="00000008001a00", @ANYRES32=r16, @ANYBLOB], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0)

1m22.931154754s ago: executing program 1 (id=367):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), 0xffffffffffffffff)
r1 = socket(0x2a, 0x2, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000100)={r1, r3, 0x8, 0x0, 0x0, 0xa, 0x3, 0x15be, 0x5886, 0x801, 0x1, 0x9, 'syz0\x00'})
shutdown(r3, 0x0)
write(r3, 0x0, 0x0)
r5 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', <r6=>0x0})
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000440)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB="000000000000400400000000", @ANYRES32=r5, @ANYBLOB="b8fc6e698f1e479a02895b6df0d6baa4595b22708e0f24c42306c0369909e113a5fabdf2e0856cdee326f31500a38511781fde7f3588890bb6488d47969d8edf455bb5861501d79a83461ae9cbdfed4b6a63d2966cd1e9eb5a78f0c6eb5bf272e7f7e5c6800cc003a2fc0859df95460f24d9876c9e34b9343184024446a00f06804f05464ff570af607df35bc7658c26bf199d80abd6a37e05", @ANYRESHEX=r0], 0x20)
write$cgroup_int(r5, &(0x7f0000000200)=0x80000002, 0x12)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=@deltaction={0x14, 0x31, 0x300, 0x70bd2c, 0x25dfdbfb}, 0x14}}, 0x8004)
getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14)
r8 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r8, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0)
ioctl$int_in(r5, 0x5452, &(0x7f0000000080)=0x8)
sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xf0b, 0x6, 0x3, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x0, 0x7}}}, 0x24}}, 0x4004)
unshare(0x20000400)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001500)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x2}, {}, {0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x40, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0xfff1, 0xfff3}}, @TCA_U32_SEL={0x34, 0x5, {0xb, 0x0, 0x2, 0xffff, 0xfffc, 0x8, 0x1, 0x6, [{0xff, 0x40, 0x6, 0x6}, {0x6, 0x6, 0x1, 0xfffffff7}]}}]}}]}, 0x6c}}, 0x40000)
r9 = socket$netlink(0x10, 0x3, 0x0)
sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0)
r10 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(r10, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
socket(0x10, 0x3, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)

1m22.051358823s ago: executing program 1 (id=369):
r0 = socket$netlink(0x10, 0x3, 0x14) (async)
sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0)
r1 = accept(r0, &(0x7f00000002c0)=@xdp, &(0x7f00000000c0)=0x80) (async)
socket$nl_route(0x10, 0x3, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00', r2}, 0x10) (async)
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
shutdown(r3, 0x0) (async)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x3c, r4, 0x1, 0x70bd26, 0x0, {{}, {@val={0xfffffeed, 0x3, r6}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x0, 0x119, 0xa}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x99}]}, 0x3c}}, 0x0)
recvmmsg(r3, &(0x7f00000004c0), 0xf02, 0xf0, 0x0)
setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, &(0x7f0000000400)=ANY=[@ANYBLOB="03ede391055e50ac83ab0c5468da41bd9291917af3a8a6628530a3b662bc46e9be23ec41f385828795"], 0x4)
bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async)
r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000001200000024000000080000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={0x0, r7, 0x0, 0x200000002}, 0x18) (async)
r8 = bpf$ITER_CREATE(0xb, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
write$cgroup_int(r8, &(0x7f00000001c0)=0x8200000000000000, 0xfffffdef) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40) (async)
r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
bind$bt_l2cap(r9, &(0x7f00000004c0)={0x1f, 0xfffd, @none}, 0xe)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x2, 0x0, @local, 0x2}]}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4)
socket$kcm(0x10, 0x2, 0x10)

1m21.828863801s ago: executing program 1 (id=370):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x0)
close(r1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$HCIINQUIRY(r2, 0x400448ca, 0x0)

1m6.855548242s ago: executing program 32 (id=370):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x0)
close(r1)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$HCIINQUIRY(r2, 0x400448ca, 0x0)

42.140381734s ago: executing program 2 (id=179):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r2, @ANYBLOB="08000240cd"], 0x40}}, 0x0)
r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x1, &(0x7f0000000180)="e2", 0x8b, 0x1, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'})

35.104368596s ago: executing program 2 (id=179):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r2, @ANYBLOB="08000240cd"], 0x40}}, 0x0)
r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x1, &(0x7f0000000180)="e2", 0x8b, 0x1, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'})

28.07736896s ago: executing program 2 (id=179):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r2, @ANYBLOB="08000240cd"], 0x40}}, 0x0)
r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x1, &(0x7f0000000180)="e2", 0x8b, 0x1, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'})

26.159489271s ago: executing program 3 (id=820):
r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10) (async)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d000000000001000000000000000141"], 0x38}}, 0x0) (async)
connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 32)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (rerun: 32)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90)
r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r5}, 0x18)
r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8)
close(r7)
r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000e40)=ANY=[@ANYRES32=r4, @ANYRES32=r8, @ANYBLOB="0200000002"], 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005345c0f63cdc2e82818254950ee03568b8809a1f04c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab66c1aae9314d7381fcfeb970bea672010000000000000043144648a07a975bd89dc398712376610faa54f12495b4659be8673086f6f3543205d4bc4ce05b8b961103673dff7f158052e62bfbdcddde6985f3f1ac5d9a94cc53207899762a07282a1914452d11858e795a3ca30a101af5574f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5ed44039aab46419496362e54cfad05b4004ac71a003d7b85d07191bed4e5a8908263722d4146f7ed569985439baa355cf3d8731f5e7a237bc06d035a8d601f21746d880819f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c5b9f87d988c9fbd2b9d9b4e2d71753b1549fa734f0b2e5fcf9549804cddad721971637f9c9730a9cc384eed30345979db9c93e1c52f42cad0a4d4f9436d3f39b0ed09c395dc6e970366087a8e4daeeb1b017006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f710c490ecd085d2811a7555c53030000007f00000000bfa6478eb96b079c277e2910b7ccdc3d672ed34aa65278c549e2abb549ad954884289130bc71cee2b7de62bf48129ae1af052a2d46a6165eb0954dac7265f1f425735acf6377793946b3229e861d8ea49806b3b533345d36ecef9df700000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c000000aaae37f044bcadeb0f6846582b7653665aa336db9f0384d3c7ddf79c2e0000000000000000000000000000000000000000000000e154aa0d3e41986a668ee1e5ef93a8ceac75f44aae95e26742f895f287111f8ee86f7e3ffb63cfb0e345cf7fc63dd2b0d30977899c6f03640040af4db71f7452bfc79a05118d8bb42b63b195771e42f9942ec626bd4b5461b74324012164e8"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000280)={r1, r1, 0xff5b, 0x16, &(0x7f00000000c0)="0f114cef8db22dd600e442f1a7a2b051b8e1e250ccdf", 0x9, 0x1, 0x16bf, 0x5505, 0xc3b8, 0x1, 0x0, 'syz0\x00'}) (async, rerun: 32)
r9 = socket$packet(0x11, 0x2, 0x300) (async, rerun: 32)
r10 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00', <r11=>0x0})
setsockopt$packet_int(r10, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) (async, rerun: 32)
sendto$packet(r10, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r11, 0x1, 0x0, 0x6, @multicast}, 0x14) (rerun: 32)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000240)={'syz_tun\x00', <r12=>0x0})
bind$packet(r9, &(0x7f0000000300)={0x11, 0x0, r12, 0x1, 0x0, 0x6, @remote}, 0x14)
r13 = socket$packet(0x11, 0x3, 0x300)
bind$packet(r13, &(0x7f0000000000)={0x11, 0x0, r12, 0x1, 0x10, 0x6, @link_local}, 0x14)
syz_emit_ethernet(0x60, &(0x7f0000000c00)=ANY=[], 0x0) (async)
ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})

25.995857458s ago: executing program 3 (id=823):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000100)={r0, r0, 0xfffe, 0x0, 0x0, 0xc2, 0x85, 0x15c2, 0x5886, 0x6, 0x0, 0x0, 'syz0\x00'})
ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0xcfaa, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x1}, 0x50)
r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0xc0200, 0x0)
ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000100)=0x3)
ioctl$PPPIOCSMRRU(r3, 0x4004743b, &(0x7f0000000540)=0x8fc6)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bridge0\x00', <r6=>0x0})
sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="300000001d00010000000000fddbdf2507000000", @ANYRES32=r6, @ANYBLOB="000078000a000200ffffffffffff000006000500f5ffff"], 0x30}}, 0x0)
r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4c, 0x4c, 0x7, [@fwd={0x1}, @enum={0x10, 0x5, 0x0, 0x6, 0x4, [{0xa}, {0x0, 0x1}, {0x6, 0xed}, {0x6, 0x8f}, {0x0, 0x1}]}, @volatile={0xc, 0x0, 0x0, 0x9, 0x4}]}, {0x0, [0x30, 0x0, 0x7f, 0x30, 0x61]}}, &(0x7f0000000240)=""/240, 0x6b, 0xf0, 0x1, 0x9}, 0x28)
bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1b, 0x6, 0x3, 0x81, 0x2101, r2, 0x200, '\x00', r6, r7, 0x5, 0x3, 0x5}, 0x50)

25.468454427s ago: executing program 3 (id=824):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000001600)={'filter\x00', 0xb001, 0x4, 0x3f8, 0x110, 0x110, 0x0, 0x3f8, 0x310, 0x310, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x7, 0xffffffff}}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010102, @local, 0x2, 0xfffffffe}}}, {{@uncond, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x10b, 0x0, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x448)
socket$inet6_udp(0xa, 0x2, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x48)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x22000, 0x0)
r4 = socket$inet6_sctp(0xa, 0x801, 0x84)
ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f00000003c0))
sendmmsg$inet6(r4, &(0x7f0000001140)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f0000000200)='O', 0x1}], 0x1}}], 0x1, 0x0)
shutdown(r4, 0x1)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000380)=@assoc_value={0x0, 0x8}, 0x8)
socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = socket$inet6(0xa, 0x2, 0x0)
socket$inet6(0xa, 0x3, 0x6)
socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, <r8=>0xffffffffffffffff}, 0x4)
ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000001c0)={'team0\x00', <r9=>0x0})
r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b00)=@bpf_lsm={0x1d, 0xc, &(0x7f00000008c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xdb5, 0x0, 0x0, 0x0, 0x59}, [@map_idx={0x18, 0x7, 0x5, 0x0, 0xd}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x10}]}, &(0x7f0000000940)='GPL\x00', 0x1, 0x24, &(0x7f0000000980)=""/36, 0x40f00, 0x49, '\x00', r9, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x1, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)=[r3, 0xffffffffffffffff, r3, r8], 0x0, 0x10, 0x4}, 0x94)
setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000640)=r10, 0x4)
sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x38, 0x3c, 0x107, 0x0, 0x0, {0x18, 0x7c}, [@nested={0x4, 0xfc}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x6, 0x0, 0x0, @u64=0x8}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x72}]}, @typed={0x8, 0x5, 0x0, 0x0, @fd=r7}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0xc000)
r11 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000000000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x8000)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000000100)={r0, r0, 0xfffe, 0x0, 0x0, 0xc2, 0x85, 0x15c2, 0x5886, 0x6, 0x0, 0x0, 'syz0\x00'})
ioctl$sock_bt_hidp_HIDPCONNDEL(r12, 0x400448c9, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})

20.580805852s ago: executing program 2 (id=179):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r2, @ANYBLOB="08000240cd"], 0x40}}, 0x0)
r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x1, &(0x7f0000000180)="e2", 0x8b, 0x1, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'})

19.179180368s ago: executing program 3 (id=824):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000001600)={'filter\x00', 0xb001, 0x4, 0x3f8, 0x110, 0x110, 0x0, 0x3f8, 0x310, 0x310, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x7, 0xffffffff}}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010102, @local, 0x2, 0xfffffffe}}}, {{@uncond, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x10b, 0x0, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x448)
socket$inet6_udp(0xa, 0x2, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x48)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x22000, 0x0)
r4 = socket$inet6_sctp(0xa, 0x801, 0x84)
ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f00000003c0))
sendmmsg$inet6(r4, &(0x7f0000001140)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f0000000200)='O', 0x1}], 0x1}}], 0x1, 0x0)
shutdown(r4, 0x1)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000380)=@assoc_value={0x0, 0x8}, 0x8)
socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = socket$inet6(0xa, 0x2, 0x0)
socket$inet6(0xa, 0x3, 0x6)
socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, <r8=>0xffffffffffffffff}, 0x4)
ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000001c0)={'team0\x00', <r9=>0x0})
r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b00)=@bpf_lsm={0x1d, 0xc, &(0x7f00000008c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xdb5, 0x0, 0x0, 0x0, 0x59}, [@map_idx={0x18, 0x7, 0x5, 0x0, 0xd}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x10}]}, &(0x7f0000000940)='GPL\x00', 0x1, 0x24, &(0x7f0000000980)=""/36, 0x40f00, 0x49, '\x00', r9, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x1, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)=[r3, 0xffffffffffffffff, r3, r8], 0x0, 0x10, 0x4}, 0x94)
setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000640)=r10, 0x4)
sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x38, 0x3c, 0x107, 0x0, 0x0, {0x18, 0x7c}, [@nested={0x4, 0xfc}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x6, 0x0, 0x0, @u64=0x8}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x72}]}, @typed={0x8, 0x5, 0x0, 0x0, @fd=r7}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0xc000)
r11 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000000000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x8000)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000000100)={r0, r0, 0xfffe, 0x0, 0x0, 0xc2, 0x85, 0x15c2, 0x5886, 0x6, 0x0, 0x0, 'syz0\x00'})
ioctl$sock_bt_hidp_HIDPCONNDEL(r12, 0x400448c9, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})

12.697918395s ago: executing program 3 (id=824):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000001600)={'filter\x00', 0xb001, 0x4, 0x3f8, 0x110, 0x110, 0x0, 0x3f8, 0x310, 0x310, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x7, 0xffffffff}}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010102, @local, 0x2, 0xfffffffe}}}, {{@uncond, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x10b, 0x0, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x448)
socket$inet6_udp(0xa, 0x2, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x48)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x22000, 0x0)
r4 = socket$inet6_sctp(0xa, 0x801, 0x84)
ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f00000003c0))
sendmmsg$inet6(r4, &(0x7f0000001140)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f0000000200)='O', 0x1}], 0x1}}], 0x1, 0x0)
shutdown(r4, 0x1)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000380)=@assoc_value={0x0, 0x8}, 0x8)
socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = socket$inet6(0xa, 0x2, 0x0)
socket$inet6(0xa, 0x3, 0x6)
socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, <r8=>0xffffffffffffffff}, 0x4)
ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000001c0)={'team0\x00', <r9=>0x0})
r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b00)=@bpf_lsm={0x1d, 0xc, &(0x7f00000008c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xdb5, 0x0, 0x0, 0x0, 0x59}, [@map_idx={0x18, 0x7, 0x5, 0x0, 0xd}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x10}]}, &(0x7f0000000940)='GPL\x00', 0x1, 0x24, &(0x7f0000000980)=""/36, 0x40f00, 0x49, '\x00', r9, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x1, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)=[r3, 0xffffffffffffffff, r3, r8], 0x0, 0x10, 0x4}, 0x94)
setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000640)=r10, 0x4)
sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x38, 0x3c, 0x107, 0x0, 0x0, {0x18, 0x7c}, [@nested={0x4, 0xfc}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x6, 0x0, 0x0, @u64=0x8}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x72}]}, @typed={0x8, 0x5, 0x0, 0x0, @fd=r7}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0xc000)
r11 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000000000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x8000)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000000100)={r0, r0, 0xfffe, 0x0, 0x0, 0xc2, 0x85, 0x15c2, 0x5886, 0x6, 0x0, 0x0, 'syz0\x00'})
ioctl$sock_bt_hidp_HIDPCONNDEL(r12, 0x400448c9, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})

12.564013915s ago: executing program 2 (id=179):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r2, @ANYBLOB="08000240cd"], 0x40}}, 0x0)
r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x1, &(0x7f0000000180)="e2", 0x8b, 0x1, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'})

5.642997069s ago: executing program 3 (id=824):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000001600)={'filter\x00', 0xb001, 0x4, 0x3f8, 0x110, 0x110, 0x0, 0x3f8, 0x310, 0x310, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x7, 0xffffffff}}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010102, @local, 0x2, 0xfffffffe}}}, {{@uncond, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x10b, 0x0, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x448)
socket$inet6_udp(0xa, 0x2, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="10000000040000000800000008"], 0x48)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x22000, 0x0)
r4 = socket$inet6_sctp(0xa, 0x801, 0x84)
ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f00000003c0))
sendmmsg$inet6(r4, &(0x7f0000001140)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f0000000200)='O', 0x1}], 0x1}}], 0x1, 0x0)
shutdown(r4, 0x1)
setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000380)=@assoc_value={0x0, 0x8}, 0x8)
socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = socket$inet6(0xa, 0x2, 0x0)
socket$inet6(0xa, 0x3, 0x6)
socket$pppl2tp(0x18, 0x1, 0x1)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, <r8=>0xffffffffffffffff}, 0x4)
ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000001c0)={'team0\x00', <r9=>0x0})
r10 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b00)=@bpf_lsm={0x1d, 0xc, &(0x7f00000008c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xdb5, 0x0, 0x0, 0x0, 0x59}, [@map_idx={0x18, 0x7, 0x5, 0x0, 0xd}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x10}]}, &(0x7f0000000940)='GPL\x00', 0x1, 0x24, &(0x7f0000000980)=""/36, 0x40f00, 0x49, '\x00', r9, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000a00)={0x1, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)=[r3, 0xffffffffffffffff, r3, r8], 0x0, 0x10, 0x4}, 0x94)
setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000640)=r10, 0x4)
sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x38, 0x3c, 0x107, 0x0, 0x0, {0x18, 0x7c}, [@nested={0x4, 0xfc}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0xc, 0x6, 0x0, 0x0, @u64=0x8}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x72}]}, @typed={0x8, 0x5, 0x0, 0x0, @fd=r7}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0xc000)
r11 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000000000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x8000)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000000100)={r0, r0, 0xfffe, 0x0, 0x0, 0xc2, 0x85, 0x15c2, 0x5886, 0x6, 0x0, 0x0, 'syz0\x00'})
ioctl$sock_bt_hidp_HIDPCONNDEL(r12, 0x400448c9, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})

5.229670693s ago: executing program 2 (id=179):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r2, @ANYBLOB="08000240cd"], 0x40}}, 0x0)
r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x1, &(0x7f0000000180)="e2", 0x8b, 0x1, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'})

669.260883ms ago: executing program 0 (id=903):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r0) (async)
syz_genetlink_get_family_id$ieee802154(0x0, r0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10)
r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x1}, 0x28)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={r2, 0x0, 0xfffffffffffffffe}, 0x10) (async)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={r2, 0x0, 0xfffffffffffffffe}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000003"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000070018110000"], 0x0, 0x2}, 0x94)
syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) (async)
syz_open_procfs$namespace(0x0, 0xfffffffffffffffe)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
syz_genetlink_get_family_id$smc(0x0, 0xffffffffffffffff)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async)
r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000340)={r3, r3, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/12], &(0x7f0000000140)='syzkaller\x00'}, 0x94) (async)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/12], &(0x7f0000000140)='syzkaller\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r5}, 0x10)
shutdown(r3, 0x1)
ioctl$sock_bt_hidp_HIDPCONNDEL(r4, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0)

668.579294ms ago: executing program 0 (id=904):
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000600)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
write(r1, &(0x7f0000000000)="0a000000010001", 0x7)
ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000040))
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0)
r2 = socket(0x200000100000011, 0x3, 0x0)
socket$packet(0x11, 0x3, 0x300)
bind$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x7, 0x6, @local}, 0x14)
socket$nl_generic(0x10, 0x3, 0x10)
socket$netlink(0x10, 0x3, 0x0)
r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000080)={0x0, 0x0}, 0x10)
ioctl$sock_bt_hci(r3, 0x400448ca, 0x0)

554.945163ms ago: executing program 0 (id=905):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000150001000000000000000000e000000200000000000000000000001000000000000000000000000000000000ffffffffffffff800a0000002b000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000010000000000000000000000000000000000000000000000a77657b0ffffffff00"/112], 0xb8}}, 0x0)

553.414186ms ago: executing program 0 (id=906):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000800)="ebe3a0e979501a148a0d0b129e6cfd164772219d205e81f4a7f71c1926aae1efd7e005ed863f045cfe6cb55b5bb9fa6935849e6098ed884e7ccb12b672c9f097ca4fe035bbb00400304c09b0294272dfee37fec456574c41ea5cd3860cb2a72de2e1448fdb5f428f5c7fb8f40442d4b9b2bcfb8d5a8dd39ea038222eb4976f868eacd03f282aae735aac5ae16f460275a3f2369b477602669969c3590c7d10e93ebd81cff49585ef40e40b59bfb7a88e32e943f06a05ed228b0d4286d1290000000000000000000000a01e66c50d585ba50e67dd3be3a0a719dcea96541457145e4b4a6c21d882d84cd3934f8ec9f965cdc6f2db0ffe4f8c18948e19560414984363a1436389185e3cec0d7c86cdfb33fe512afd7a96609c0890e6bbe8383515301cf884c580bace7384d9162e5eb71c988c3245e9c2a5fb05aee3b304a1283c32d21ba59c406604b2c1bedef73b2b223ae90803032fe2ffcac3738ae129ec8ecfcfa2c3a6b7c81b810d9d1ed12da342f084ca38eca14b3e04113a39cc4b5e5415ba7ffc3b0732", 0x187}, {&(0x7f0000000b80)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a40000000000000400b3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459ba9dcf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b22eaf0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e20a85060fd22f76c0881d580a3dd605c7141cad1b86efab52a7c54e19d4eaf37a3e197c8d5de653d4c11398fcfd06364a7048a859499dac446fa1b3a0aadaa1877a39820821eb6ff5baee46a123ea09f44bcfaca1b9d418a5213b", 0x123}, {&(0x7f00000009c0)="be7c1cae9fefed7e59316bed37f6eb36ec4ae1d442c67a5ebe9c15b771b531c47f64cab99da329281995ab70d9050519f74cd1e2452bb8cd6db0f53fd7704760879975a8bd737f94242292127be5fe50b61bfa175613e5ddf7e0591978478c7c6fa4657c18e7881159ee6f5707094c9c6deb12b31a2c7282ab105fcdb4c9b99ed9ed061fb4e29befe46a0ae9592863281e3ed4185d4eda3dcf06c92755b659704fc52bdf97fd89353966", 0xaa}, {&(0x7f0000001b40)="4a954034896272f3c1837f69f1370ea70df4f09105932b8cb5076227f09c20d2dc467a17b7339cb7114282b2ddb68d726b6eebf4892029dcc784686f77ddfdbf175bdce89e8e42d0b0ebfe287148448c95a8eaf7e0bed9c8e83d791e26cb40d2ae61ef3a1afbd4a2a331c1370ced667a9183bfd48c820302f65eeae54d48e6f699dfe037d911259b0cea2b9dbc88e20c217b087f90b5953b52a8c9b6ab6d760fcb05cd4fc87e81017c2b2722570cd502e6ebeb7342283d9e273c41ae49ac985dc31a457da73cb5962d71951c6c8cf71fcc1d36662bee1d22757f57a64b2fc693c1211443e854e35b97834309c055a03d6d7f77876a89413935d1b38aa39918b61fb0be3d15b807ef964d154ecef48b34ba5e2e84982ba5d57cdae2bc56ffb495740927efe23090a62315a36bb7d657080a125caa33afb76238cc10f637b6ccbcd0238a8380bc66129f6c7f6d1e5a91016140970fbaba33df1117f0b0ea2f263cc8c0ca25e1e9c1ddf7cb3cf700af96034538431926a9caa34566d879ff286f7418b055ed78cf7387cd2e4b8b308b4df731d2ac2b952e26e01a082533d0145532aad7726a85d292200d43ecb3b3ee4178bb75c4496c771d70effa84598e4443ccee1cd83554166b041886fbdec4011e4d8f879aa94861d959bf558b2bc8dc66fd25e51482370d3448db42ed079c8a0636da22a9aeb9911157da2ba8669bd3d0863bbe36928281df541e12c893e4bd1260439b2062a292d1ee78a7a704bd25fc958056cc1a974b46d148ff85f21b23b47d4e13e314f502e4734213f90e75a12f806c33309a7f4c0c063d769c17bf5f0c831541734fae6053649cd5a6e5e0fd10db97a27521712dadf5629080e2e8f9d73430b951d0b80c7677e45af22c932081724abf50fa4cc361dce6c719b52f8d9adae203a4de0ea2ac3a0c369ec2692d4b65530ebb4ab9d8fed7cb1931977b15a0eada94cf52285f9a7a5e8662137ff3c0efdaaaafde444019c0a2b0329147f4bfd54fadf164b858196163036b4827aaf8b72d70be73ba6efce543ebf348b3aae887782d64a538cc4886f1a4f99875139ad23ca771722c3a938e82024eff7271d5b772273179bbbf20079060c012407c1ad57a8819c79e5828fe600ec41390b544c8b2b7bcf709b46dbb519fa6d122e1b7759f6357cc69d95d7cf7861dba6315de9d00e3ba9a23c08541d7f00140b1d8152b33d37e8808b550e9b2b22374da6c31ca3ac6260d4c17022acf444cd7e29c8e4c3e58a8340049b3998c88c5aa02ea298c84a66983aa04269aa9f6bd506cfc496bfe6c87259b74b54ca78ba3bd1dfa2faca5eb1d7504edb70feebcc91bc7a15169aaa5b9b03cea3d92469a7e62c215f705281ec4d6880fe45e277a2a32b9b669d785a59b6a342ce0e790ae8e9cd474a2298ad99b54a2e14e17ee691fc35c09dc935fea97ea77caed56cade58ac87b68c554800f1dee949ab8288075bdc44b53dc3d34a5d859026c3398d8b3f85145ecaaa5c1431622878b1e854eb3a8cf0f7b26aaec739f4043dfd49fd3ea7425c281891974912105d7a3138a89fecb98d349c1a5b37763c1c0214a454a084e5fdc33858c75435201bd9a4c89159b6e19ad701b22106e0bd5892e84b29553767fb961add5f216d9e37e5bdf5ad86973b4b326b95bfb540e8cfb70a6311460e7caf787f5eac71bc3685efd851224e7184ba2dd5c64e1b0c8fa2b2e319a06f9eb2149fd68222fc7572bdb26122ec39c71183448841c578181099e9ebca26402f5abf54904bdb2983a90ce067ec1d2f70f7c91fdaf5384524552da0b91a311f019ad8fdf3b7272e3dc04a11454bdd2cf1d7a047a66700f7df361e030a4d33ba98a2d1038a8d71c5ae15dda988263cf8d4662f0d16f71a1b88ecd0255df5d44734ee37d97f2b98126c72c14dc4eeedf7d71d56f6fb543909bb3e4bf008b33af69f5e2a62eb0e428cb031fc3d09a50515b3c5611898b2e1e01bd47943d805d6566d4797dfa0b469defde972c64d3aeacf265949b20bba40b7edd6789561b47ccb40fa512acf6b787a4f63a855f9e2541286bf55c5a4b3312bfac4ecd6d88a0345c34cf0ecf70f8c752858a6a5dcb25eec46814fa3eb14dacb3176bc704ceeaab2e3cafcacd10de82efcc315c08495c1e3919c5608c08fb8634f1f1ec12d0e77c1ec8df2f8cc7fe055bb2943e5b0a7d7fb3bc83c29669d5ce0de79aa87a38be65b8eb4ed984ccf85c4ce6745036231c85dec52583bda10320c30e341bd9118d4cb95a9dad136a1d0b6702ace1f3d4b5ff30b90f7136cde152ffde33caea38ecc45a45ed4e34b43552ae7a588f67291ba96d3e3136726be589f124058c0769731449ac7232bc3f5c71342444d2b2c2cf110e35e3e49494e7ba2d202276f0f4b78921283826144a30352c84b51a9cd09546884ce2eed452ba2efb76c66bdfa4d83d9f783838d1e6c07674c159d909e6ae4ba275d23f29e19166d3381eb8ff00508955442176a804b36476a685b7966fa7541ee2ffc674291c22817cc7a1f2395dbcf604115d5666d007499d50ef6134f5de945a7bbc8bf1a9bece45edb26ff511776ad506712ac899ad2539b2c0ca990c4ad6c12f976da12479ed5685131cd8872f7b7aca6e986b63ab6b63cc4a8a9af4745c35ec8b4c76fe7f50b9dcb87396e6b608de38deaca930c53ef47f481fa80bbbe1d45a57a4a4c3b356006a89244a54c5339a5e79ef4988407b5f0eae0e6b39005abcad53a23dd1150ff1369aa20007425ff1a37bd75e161e815934feb5efd434faf68797db67dadbf91133b5a5c0800f4c6ae3019fb87b85221b3a970620063369e599c1c40ff4d223cc559769675c05201be3cc3a607f71456a54838c9dbd52fef9df42324c102231ee2febd2ee2c5b53c3f59ccd2bb0b128cc021740277a7618fb506b9899798fa3985abe781179520363693b3d74c90c3458b04b8d95d3d5ef7fdf353278654cb480f0c78fa5443a87868beca83c2404461ea28d5c68f6b03940eb467783e1989d5d4fef1b7217134d3b5579434a7c4a21e4e827c2f1169a729ca0df4882774ebcd9ace980de0db4a730bddf249cf11099ca60a0ac40c0239a591e0c2af26a4b4eaf7ad7bf8bb7e25ae859b0cdbf493817bce32a6f680f47fb5f62da49c8b115ecb5142f37a2a43e7ad834cc5c00ca895651a0aaeec179fd3d7da1557d85326ca9279731f079345fdfec2845f110812906689f085a38786a3b03f08861222aaca167d145884416de7b271ff39c62814cb6e6f8bcbc7834a49846a2c9ff775aac27ef37d1cc185519fe51343242690fee410d716495166d1bc7e592832cceeb9c345301af5bde1f392a00e67749f5dcebf34a38972736f9531d775d0005b46eb5710dc0a4b6ba15fcc44a9e41ad478b3b25ee3cb1240150bb7dc8e7d17afd094a901fa7581cd468717f791ddb97e22f9c787faa67828d28e485c6c81b804916de671eed7d8933604bae54c7b6678e9dc5bf1af9f572b40014283773a637bc2e99f1e46566c1561e0826343e0f838a8de01a6c0d33c7335e9602c52fd9611fb41099b0ead4e53386bd878be790aef5d5bdbba7c595ad39799f0c7d3fca83c225812a3d033118617ad85bde7fd7d68730abf5e66697255c7911d502beeb6b673e8a6deaac9e8d4c77711f7b5842826afc8cb762863e01c24bceff8812f832473b33baa694dacbf12b8d27bbb1dcf39c40210698d69e4d09310e23095318c35a281eca13261b7543825d1703142a3bc6759781832500cc31302ef814b636db26c73ec3809ca4d29d63641ed6f4255634093da3405b24ede0ba57e14eae40440d3ee41d79373a1cc6b7b06b11b37057a44d5cfd19ac49e67fe3a98c899b3f3a59272b22ff0a057799c75d4f8db0c6f0b3f6508eea0c3867d7f090a4c71386820ac94ac9b7458e11d4f7f5c6c0a4547662205deafa619715b5672116958812831941246d268f8521651bc477563dfd79cd0a3d3e1d6772a917a97637beb8c990879d1d611a059e39d98af3fa09df0aec25f094ec0e958b500739b4feb0d0c5c7c4d7a5a45ea476a746122bab17de1418c37031ac49aeef03446b6681283412ff1e48e198e7de5ee263e7bc3532fcef8b54a6df05c2dfe283a9f81a93c9dd03918662ad86b954e129215b2e802c57089fdb05183c34e531cb3fb92b49b16a10e441d03d90b4ffa702fd19d458d7b5f83620f9222e56005e611629d527c811c934b669ce6acdce6303fc7ca7f41acb4886c5845d195fb02e16d8553516375f3bc3fa0e96603642290cc0596009b292ab68b19741ca642ed81b3ab98dbc9edc249d9d40976cc877eaca85f11585ee4bff9120def03f572c02393179440bfb0c65a998570c21a37438c8c72fdfba65ce4c442e77b7797e4ddcd1887f9dc929e3302aa0368a55c6d38acee6c4c140e6518fbb9d72835d79e441b020d52ea8ead", 0xc5c}], 0x5, &(0x7f0000000380)=[@assoc={0x18, 0x117, 0x4, 0xffffffc0}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000001c0)="9d5ab229d99f6a8e10bb5fd52316e117eee892d86a067b4ae693515c2f15508e4d2d7c3d8a0ca7d2f3469320bce3097147e2e1816fe001f04afec25f5b9aaa55646b232a465b2c0deb426a084a2220ab94ff8be945f2a80ac0b0d740961893e41b80741213be111e59de4d56b3f64fb98fbf7b1153833e89545ca0f5b265", 0x7e)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000c0ff0000ed0061129400000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, r2}, 0x94)
socket$nl_xfrm(0x10, 0x3, 0x6)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56", 0x2)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x98)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00'})
sendmsg$NL802154_CMD_NEW_SEC_KEY(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000000c0)=ANY=[], 0x7c}}, 0x0)
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan1\x00'})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'wpan1\x00', <r6=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'wpan4\x00', <r7=>0x0})
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r8)
ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000300)={'wpan0\x00'})
sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010028bd7000fcdbdf25200000000c00060002000000000000001c002d800800020000e6e7e5b200000008000300040000000501010000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x4000)
sendmsg$NL802154_CMD_GET_SEC_KEY(r3, &(0x7f0000000680)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000640)={&(0x7f0000000a80)={0x54, r5, 0x8, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x54}, 0x1, 0x0, 0x0, 0x20004010}, 0x10)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_rdma(0x10, 0x3, 0x14)

378.744755ms ago: executing program 0 (id=907):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10)
r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x1}, 0x28)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={r2, 0x0, 0xfffffffffffffffe}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000003"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000070018110000"], 0x0, 0x2}, 0x94)
syz_open_procfs$namespace(0x0, 0xfffffffffffffffe)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
syz_genetlink_get_family_id$smc(0x0, 0xffffffffffffffff)
r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x4000002, 0x3032, 0xffffffffffffffff, 0x2a1cf000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0}, 0x94)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f0000000d00)=ANY=[], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000a80)='mm_page_free_batched\x00', r4}, 0x18)
r5 = socket$packet(0x11, 0x2, 0x300)
mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r5, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0)
r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000000340)={r3, r3, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'})
r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/12], &(0x7f0000000140)='syzkaller\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r7}, 0x10)
shutdown(r3, 0x1)
ioctl$sock_bt_hidp_HIDPCONNDEL(r6, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)

0s ago: executing program 0 (id=908):
bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x0, 0x1d64, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x1f, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r0}, 0x10)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff})
recvmmsg(r1, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}, 0xf5ff}], 0xf00, 0x0, 0x0)
shutdown(r1, 0x0)
r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYRES32=r0], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20}, 0x18)
r3 = socket$inet6_sctp(0xa, 0x5, 0x84)
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x58, &(0x7f0000000700)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, '\x00', 0x27}, 0xef96}, @in6={0xa, 0x4e2b, 0x200, @rand_addr=' \x01\x00', 0x9}, @in={0x2, 0x4e20, @multicast1}]}, &(0x7f00000002c0)=0x10)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x33, &(0x7f0000000000)=0x7, 0x4)
getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f00000005c0)=@assoc_value={<r5=>0x0}, &(0x7f0000000600)=0x8)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000000000)={r5, @in={{0x2, 0x4e23, @multicast2}}}, &(0x7f00000000c0)=0x84)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r2, 0x0, 0x3c, 0x72, &(0x7f0000000040)="976d9023d56482cd284a63da539706d7009be646625bd75b025352ebe557df463106baeed6c2d75549b140f143fb8bb67bfe5b308b8d05758115c7ad", &(0x7f0000000180)=""/114, 0x0, 0x0, 0xffffffffffffffa5, 0xa0, &(0x7f0000000400)="cf2240e6919817e49555d221b4e6c6ba11c4d974ddab2318db7b52cee499399a00be4b710e9246d7bca28cc8346eb84414e45f3f4633f4acb77bf8cc38c4c16fe035905db79cdc0be634a915662c4cac58ae94706f86ea320f339c21399b5bb7607044916c63c528ab4149718d6215a9a3749113c268e49b2b9dae91ed804e5ac5d4ec7ac9c5fd67a76f9a2b06f7304f6e81221a751008e786e1edde82cf1ecb76cb4cd71cf781ea3a19b917a1e215b1a6c7ee605b32b91eaae38517fde4303d5f2b1e63e9e52ae4b197fd72de1f71801e1f9f1369d1f530", &(0x7f0000000280)="bf049fd184f7b03c21d9bcddc4eef9ebb6a0da3eb91c56454e873dd7336ccf21a1eeb8da7adf80d6e06ef46c7f36222fadaed2103c286468b3f44adee51445bd1bedf8fcc1c0b9fdc8b3829b1bf0c9d2d409cdecb12ad033e299c029331993ae9760345bf7feb91ee96b0eee19454ad3dbce5019b68c114ff1921a9b4665744c7784ac6736101a70592d83c448a84c31ec60bb901d96ea99471d823ee5233188", 0x0, 0x8000, 0xfffffffe}, 0x50)
r6 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_TX_RING(r6, 0x11b, 0x6, &(0x7f0000000000)=0x40000000, 0x4)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6)
r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r8, 0x400448cb, 0x0)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2})
ioctl$TUNATTACHFILTER(r9, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x60, 0x4, 0xfd}]})
r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r11 = syz_init_net_socket$ax25(0x3, 0x5, 0xcb)
getsockopt$ax25_int(r11, 0x101, 0xc, &(0x7f0000000080), &(0x7f0000000100)=0x4)
bind$bt_hci(r10, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6)
setsockopt$sock_int(r7, 0x1, 0x22, &(0x7f0000000500)=0x1ff, 0x4)
socket$inet(0x2, 0x2, 0x0)
write(r10, &(0x7f0000000040)="05000000010000", 0x7)

kernel console output (not intermixed with test programs):

er parsing attributes in process `syz.0.407'.
[   99.064208][ T7427] netlink: 4 bytes leftover after parsing attributes in process `syz.0.407'.
[   99.066926][ T7427] netlink: 'syz.0.407': attribute type 1 has an invalid length.
[   99.071182][ T7427] netlink: 10 bytes leftover after parsing attributes in process `syz.0.407'.
[   99.323590][ T7438] netlink: 8 bytes leftover after parsing attributes in process `syz.0.410'.
[   99.363628][ T7440] netlink: 104 bytes leftover after parsing attributes in process `syz.0.411'.
[   99.703907][ T7464] netlink: 596 bytes leftover after parsing attributes in process `syz.0.416'.
[   99.766066][ T7468] netlink: 104 bytes leftover after parsing attributes in process `syz.0.418'.
[   99.800149][ T7470] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input49
[   99.855645][ T7474] netlink: 'syz.0.420': attribute type 9 has an invalid length.
[   99.858216][ T7474] netlink: 8 bytes leftover after parsing attributes in process `syz.0.420'.
[   99.864945][ T7474] hsr0: entered promiscuous mode
[   99.867730][ T7474] macvlan2: entered promiscuous mode
[   99.870876][ T7474] macvlan2: entered allmulticast mode
[   99.872673][ T7474] hsr0: entered allmulticast mode
[   99.874321][ T7474] hsr_slave_0: entered allmulticast mode
[   99.876326][ T7474] hsr_slave_1: entered allmulticast mode
[  100.722386][ T7477] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input50
[  100.808442][ T7480] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input51
[  100.855026][ T7483] netlink: 596 bytes leftover after parsing attributes in process `syz.0.423'.
[  100.886704][ T7485] netlink: 12 bytes leftover after parsing attributes in process `syz.0.424'.
[  102.255246][ T7513] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input52
[  102.562603][ T5816] Bluetooth: hci2: link tx timeout
[  102.565463][ T5816] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  102.569911][ T5810] Bluetooth: hci2: link tx timeout
[  102.572161][ T5810] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  102.575494][ T5810] Bluetooth: hci2: link tx timeout
[  102.578836][ T5810] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  102.767921][ T7538] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input53
[  102.821144][ T7541] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input54
[  104.629119][ T5810] Bluetooth: hci2: command 0x0405 tx timeout
[  104.880505][ T5810] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  104.890508][ T5810] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  104.894319][ T5810] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  104.899082][ T5810] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  104.902608][ T5810] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  105.081828][ T7569] chnl_net:caif_netlink_parms(): no params data found
[  105.092267][ T7580] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input55
[  105.131616][ T7435] udevd[7435]: setting owner of /dev/input/event3 to uid=0, gid=104 failed: No such file or directory
[  105.218225][ T7569] bridge0: port 1(bridge_slave_0) entered blocking state
[  105.221520][ T7569] bridge0: port 1(bridge_slave_0) entered disabled state
[  105.226073][ T7569] bridge_slave_0: entered allmulticast mode
[  105.230498][ T7569] bridge_slave_0: entered promiscuous mode
[  105.235186][ T7569] bridge0: port 2(bridge_slave_1) entered blocking state
[  105.240664][ T7569] bridge0: port 2(bridge_slave_1) entered disabled state
[  105.243866][ T7569] bridge_slave_1: entered allmulticast mode
[  105.248077][ T7569] bridge_slave_1: entered promiscuous mode
[  105.276904][ T7591] __nla_validate_parse: 2 callbacks suppressed
[  105.276923][ T7591] netlink: 24 bytes leftover after parsing attributes in process `syz.0.451'.
[  105.288470][ T7569] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  105.296445][ T7569] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  105.331859][ T7569] team0: Port device team_slave_0 added
[  105.336297][ T7569] team0: Port device team_slave_1 added
[  105.358271][ T7569] batman_adv: batadv0: Adding interface: batadv_slave_0
[  105.360731][ T7569] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  105.370319][ T7569] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  105.374745][ T7569] batman_adv: batadv0: Adding interface: batadv_slave_1
[  105.377034][ T7569] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  105.387627][ T7569] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  105.432325][ T7569] hsr_slave_0: entered promiscuous mode
[  105.435140][ T7569] hsr_slave_1: entered promiscuous mode
[  105.569605][ T7569] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  105.575695][ T7569] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  105.584822][ T7569] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  105.590109][ T7569] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  105.627990][ T7569] bridge0: port 2(bridge_slave_1) entered blocking state
[  105.632024][ T7569] bridge0: port 2(bridge_slave_1) entered forwarding state
[  105.635527][ T7569] bridge0: port 1(bridge_slave_0) entered blocking state
[  105.638617][ T7569] bridge0: port 1(bridge_slave_0) entered forwarding state
[  105.700547][ T7569] 8021q: adding VLAN 0 to HW filter on device bond0
[  105.714183][ T7456] bridge0: port 1(bridge_slave_0) entered disabled state
[  105.718444][ T7456] bridge0: port 2(bridge_slave_1) entered disabled state
[  105.745610][ T7569] 8021q: adding VLAN 0 to HW filter on device team0
[  105.766157][ T7456] bridge0: port 1(bridge_slave_0) entered blocking state
[  105.768622][ T7456] bridge0: port 1(bridge_slave_0) entered forwarding state
[  105.772667][ T7456] bridge0: port 2(bridge_slave_1) entered blocking state
[  105.775100][ T7456] bridge0: port 2(bridge_slave_1) entered forwarding state
[  105.807806][ T7616] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input56
[  105.915061][ T7569] 8021q: adding VLAN 0 to HW filter on device batadv0
[  105.950837][ T7569] veth0_vlan: entered promiscuous mode
[  105.956835][ T7569] veth1_vlan: entered promiscuous mode
[  105.980546][ T7569] veth0_macvtap: entered promiscuous mode
[  105.984842][ T7569] veth1_macvtap: entered promiscuous mode
[  106.013720][ T7569] batman_adv: batadv0: Interface activated: batadv_slave_0
[  106.024771][ T7569] batman_adv: batadv0: Interface activated: batadv_slave_1
[  106.034401][ T7569] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  106.038084][ T7569] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  106.043848][ T7569] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  106.047497][ T7569] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  106.183157][ T3546] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  106.189569][ T3546] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  106.271348][ T2982] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  106.275357][ T2982] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  106.435528][ T7640] IPVS: set_ctl: invalid protocol: 50 172.20.20.48:20000
[  106.609511][   T33] audit: type=1800 audit(1751651104.845:7): pid=7637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.445" name="cgroup.controllers" dev="tmpfs" ino=18 res=0 errno=0
[  106.611077][ T7647] netlink: 104 bytes leftover after parsing attributes in process `syz.0.462'.
[  106.648513][ T7649] netlink: 666 bytes leftover after parsing attributes in process `syz.0.463'.
[  106.949051][ T5810] Bluetooth: hci3: command tx timeout
[  107.584874][ T7659] netlink: 36 bytes leftover after parsing attributes in process `syz.0.466'.
[  107.641591][ T7661] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on
[  107.665465][ T7661] bond1: entered promiscuous mode
[  107.667199][ T7661] bond1: entered allmulticast mode
[  107.671232][ T7661] 8021q: adding VLAN 0 to HW filter on device bond1
[  107.691434][ T7666] netlink: 48 bytes leftover after parsing attributes in process `syz.0.468'.
[  107.779210][ T5874] hid-generic 0005:16BF:5505.0016: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  107.915783][ T7690] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input57
[  107.953026][ T7690] netlink: 36 bytes leftover after parsing attributes in process `syz.0.475'.
[  108.110761][ T7700] netlink: 4 bytes leftover after parsing attributes in process `syz.3.479'.
[  108.922507][ T7704] IPVS: set_ctl: invalid protocol: 33 224.0.0.1:20003
[  108.998011][ T5874] hid-generic 0005:16BF:5505.0017: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  109.029829][ T5810] Bluetooth: hci3: command 0x041b tx timeout
[  109.233769][ T5844] hid-generic 0005:16C0:5505.0018: unknown main item tag 0x0
[  109.236950][ T5844] hid-generic 0005:16C0:5505.0018: unknown main item tag 0x0
[  109.240228][ T5844] hid-generic 0005:16C0:5505.0018: unknown main item tag 0x0
[  109.243428][ T5844] hid-generic 0005:16C0:5505.0018: unknown main item tag 0x0
[  109.246549][ T5844] hid-generic 0005:16C0:5505.0018: unknown main item tag 0x0
[  109.250221][ T5844] hid-generic 0005:16C0:5505.0018: unknown main item tag 0x0
[  109.253502][ T5844] hid-generic 0005:16C0:5505.0018: unknown main item tag 0x3
[  109.256882][ T5844] hid-generic 0005:16C0:5505.0018: item fetching failed at offset 17/19
[  109.261154][ T5844] hid-generic 0005:16C0:5505.0018: probe with driver hid-generic failed with error -22
[  109.976084][ T7732] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input58
[  110.431687][ T7753] syz.3.493: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  110.437878][ T7753] CPU: 0 UID: 0 PID: 7753 Comm: syz.3.493 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  110.437898][ T7753] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  110.437905][ T7753] Call Trace:
[  110.437912][ T7753]  <TASK>
[  110.437921][ T7753]  dump_stack_lvl+0x189/0x250
[  110.437948][ T7753]  ? __pfx_dump_stack_lvl+0x10/0x10
[  110.437967][ T7753]  ? __pfx__printk+0x10/0x10
[  110.437981][ T7753]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  110.437995][ T7753]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  110.438009][ T7753]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  110.438023][ T7753]  warn_alloc+0x214/0x310
[  110.438038][ T7753]  ? stack_depot_save_flags+0x40/0x900
[  110.438058][ T7753]  ? __pfx_warn_alloc+0x10/0x10
[  110.438073][ T7753]  ? kasan_save_track+0x4f/0x80
[  110.438091][ T7753]  ? xskq_create+0x56/0x170
[  110.438107][ T7753]  ? xsk_init_queue+0xb0/0x110
[  110.438120][ T7753]  ? xsk_setsockopt+0x43f/0x710
[  110.438133][ T7753]  ? do_sock_setsockopt+0x25a/0x3e0
[  110.438146][ T7753]  ? __x64_sys_setsockopt+0x18b/0x220
[  110.438157][ T7753]  ? do_syscall_64+0xfa/0x3b0
[  110.438167][ T7753]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.438185][ T7753]  __vmalloc_node_range_noprof+0x125/0x12f0
[  110.438250][ T7753]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  110.438266][ T7753]  ? xskq_create+0x56/0x170
[  110.438283][ T7753]  ? __kasan_kmalloc+0x93/0xb0
[  110.438296][ T7753]  vmalloc_user_noprof+0xad/0xf0
[  110.438310][ T7753]  ? xskq_create+0xbf/0x170
[  110.438326][ T7753]  xskq_create+0xbf/0x170
[  110.438343][ T7753]  xsk_init_queue+0xb0/0x110
[  110.438361][ T7753]  xsk_setsockopt+0x43f/0x710
[  110.438378][ T7753]  ? __pfx_xsk_setsockopt+0x10/0x10
[  110.438392][ T7753]  ? __lock_acquire+0xab9/0xd20
[  110.438416][ T7753]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  110.438431][ T7753]  ? __pfx_xsk_setsockopt+0x10/0x10
[  110.438446][ T7753]  do_sock_setsockopt+0x25a/0x3e0
[  110.438463][ T7753]  ? __pfx_do_sock_setsockopt+0x10/0x10
[  110.438479][ T7753]  ? __fget_files+0x2a/0x420
[  110.438499][ T7753]  __x64_sys_setsockopt+0x18b/0x220
[  110.438516][ T7753]  do_syscall_64+0xfa/0x3b0
[  110.438526][ T7753]  ? lockdep_hardirqs_on+0x9c/0x150
[  110.438543][ T7753]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.438553][ T7753]  ? exc_page_fault+0x9f/0xf0
[  110.438569][ T7753]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  110.438581][ T7753] RIP: 0033:0x7f9e5378e929
[  110.438594][ T7753] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  110.438604][ T7753] RSP: 002b:00007f9e5463e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  110.438618][ T7753] RAX: ffffffffffffffda RBX: 00007f9e539b5fa0 RCX: 00007f9e5378e929
[  110.438625][ T7753] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000006
[  110.438632][ T7753] RBP: 00007f9e53810b39 R08: 0000000000000004 R09: 0000000000000000
[  110.438639][ T7753] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  110.438646][ T7753] R13: 0000000000000000 R14: 00007f9e539b5fa0 R15: 00007ffe94d95978
[  110.438666][ T7753]  </TASK>
[  110.438672][ T7753] Mem-Info:
[  110.575031][ T7753] active_anon:6007 inactive_anon:0 isolated_anon:0
[  110.575031][ T7753]  active_file:1025 inactive_file:38232 isolated_file:0
[  110.575031][ T7753]  unevictable:1768 dirty:29 writeback:0
[  110.575031][ T7753]  slab_reclaimable:9563 slab_unreclaimable:57455
[  110.575031][ T7753]  mapped:23345 shmem:2425 pagetables:984
[  110.575031][ T7753]  sec_pagetables:0 bounce:0
[  110.575031][ T7753]  kernel_misc_reclaimable:0
[  110.575031][ T7753]  free:279488 free_pcp:24600 free_cma:0
[  110.593351][ T7753] Node 0 active_anon:12744kB inactive_anon:0kB active_file:2804kB inactive_file:15756kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:59220kB dirty:40kB writeback:0kB shmem:4872kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:7804kB pagetables:2168kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  110.606877][ T7753] Node 1 active_anon:11284kB inactive_anon:0kB active_file:1296kB inactive_file:137172kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:34160kB dirty:76kB writeback:0kB shmem:4828kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4252kB pagetables:1768kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  110.621063][ T7753] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  110.633558][ T7753] lowmem_reserve[]: 0 815 815 815 815
[  110.635864][ T7753] Node 0 DMA32 free:336328kB boost:0kB min:33716kB low:42144kB high:50572kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12744kB inactive_anon:0kB active_file:2804kB inactive_file:15756kB unevictable:3536kB writepending:40kB present:1556484kB managed:834740kB mlocked:0kB bounce:0kB free_pcp:50648kB local_pcp:29724kB free_cma:0kB
[  110.650380][ T7753] lowmem_reserve[]: 0 0 0 0 0
[  110.652478][ T7753] Node 1 DMA32 free:458616kB boost:0kB min:19168kB low:23960kB high:28752kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  110.664791][ T7753] lowmem_reserve[]: 0 0 854 854 854
[  110.667047][ T7753] Node 1 Normal free:307432kB boost:0kB min:36576kB low:45720kB high:54864kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11284kB inactive_anon:0kB active_file:1296kB inactive_file:137172kB unevictable:3536kB writepending:76kB present:1048576kB managed:875016kB mlocked:0kB bounce:0kB free_pcp:47892kB local_pcp:19080kB free_cma:0kB
[  110.679754][ T7753] lowmem_reserve[]: 0 0 0 0 0
[  110.681722][ T7753] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  110.687043][ T7753] Node 0 DMA32: 3*4kB (ME) 3*8kB (UM) 3*16kB (UM) 122*32kB (UM) 33*64kB (UME) 4*128kB (UE) 2*256kB (UE) 1*512kB (U) 3*1024kB (UE) 5*2048kB (UM) 77*4096kB (UM) = 336340kB
[  110.694036][ T7753] Node 1 DMA32: 2*4kB (M) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 1*128kB (M) 2*256kB (M) 2*512kB (M) 2*1024kB (M) 2*2048kB (M) 110*4096kB (M) = 458616kB
[  110.700996][ T7753] Node 1 Normal: 302*4kB (UME) 160*8kB (ME) 57*16kB (UME) 54*32kB (UM) 29*64kB (UM) 25*128kB (UM) 11*256kB (M) 13*512kB (ME) 5*1024kB (UME) 2*2048kB (ME) 68*4096kB (M) = 307400kB
[  110.708421][ T7753] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  110.712356][ T7753] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  110.716032][ T7753] 41682 total pagecache pages
[  110.718014][ T7753] 0 pages in swap cache
[  110.720809][ T7753] Free swap  = 124996kB
[  110.722559][ T7753] Total swap = 124996kB
[  110.724250][ T7753] 786301 pages RAM
[  110.725767][ T7753] 0 pages HighMem/MovableOnly
[  110.727688][ T7753] 240368 pages reserved
[  110.729662][ T7753] 0 pages cma reserved
[  111.077510][ T7774] netlink: 244 bytes leftover after parsing attributes in process `syz.3.498'.
[  111.101697][ T7774] netlink: 156 bytes leftover after parsing attributes in process `syz.3.498'.
[  111.119148][ T5810] Bluetooth: hci3: command 0x041b tx timeout
[  111.287200][ T7782] netlink: 8 bytes leftover after parsing attributes in process `syz.0.501'.
[  111.299698][ T7782] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input59
[  111.413453][ T7786] IPVS: length: 209 != 24
[  111.488912][   T33] audit: type=1800 audit(1751651109.735:8): pid=7783 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.500" name="cgroup.controllers" dev="tmpfs" ino=124 res=0 errno=0
[  112.129615][ T7792] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input60
[  112.286588][ T7802] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input61
[  112.414682][ T7812] netlink: 20 bytes leftover after parsing attributes in process `syz.3.507'.
[  112.421292][ T7812] netlink: 64 bytes leftover after parsing attributes in process `syz.3.507'.
[  112.425310][ T7812] netlink: 64 bytes leftover after parsing attributes in process `syz.3.507'.
[  112.430531][ T7812] netlink: 64 bytes leftover after parsing attributes in process `syz.3.507'.
[  112.449914][ T7817] netlink: 104 bytes leftover after parsing attributes in process `syz.0.508'.
[  112.826284][ T7853] netlink: 104 bytes leftover after parsing attributes in process `syz.3.516'.
[  113.012265][ T5837] syzkaller0: tun_net_xmit 76
[  113.015725][ T5837] syzkaller0: tun_net_xmit 48
[  113.020730][ T7866] syzkaller0: create flow: hash 1496596029 index 1
[  113.039180][ T5858] syzkaller0: tun_net_xmit 76
[  113.049911][ T7865] syzkaller0: delete flow: hash 1496596029 index 1
[  113.095242][   T33] audit: type=1800 audit(1751651111.335:9): pid=7867 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.518" name="cgroup.controllers" dev="tmpfs" ino=162 res=0 errno=0
[  113.189623][ T5816] Bluetooth: hci3: command 0x041b tx timeout
[  113.226185][ T7870] netlink: 8 bytes leftover after parsing attributes in process `syz.3.522'.
[  114.066504][ T7888] openvswitch: netlink: IPv4 tun info is not correct
[  114.166972][ T7899] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input62
[  114.246446][ T7904] Unsupported ieee802154 address type: 0
[  114.255431][ T7904] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input63
[  114.418210][ T7911] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input64
[  114.522896][ T7921] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input65
[  114.623050][ T7924] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input66
[  115.269007][ T5810] Bluetooth: hci3: command 0x041b tx timeout
[  116.606284][ T5844] hid-generic 0005:16C0:5505.0019: unknown main item tag 0x0
[  116.610712][ T5844] hid-generic 0005:16C0:5505.0019: unknown main item tag 0x0
[  116.613632][ T5844] hid-generic 0005:16C0:5505.0019: unknown main item tag 0x0
[  116.615994][ T5844] hid-generic 0005:16C0:5505.0019: unknown main item tag 0x0
[  116.618419][ T5844] hid-generic 0005:16C0:5505.0019: unknown main item tag 0x0
[  116.621790][ T5844] hid-generic 0005:16C0:5505.0019: unknown main item tag 0x0
[  116.624142][ T5844] hid-generic 0005:16C0:5505.0019: unknown main item tag 0x3
[  116.626593][ T5844] hid-generic 0005:16C0:5505.0019: item fetching failed at offset 17/19
[  116.632951][ T5844] hid-generic 0005:16C0:5505.0019: probe with driver hid-generic failed with error -22
[  116.684671][ T7991] __nla_validate_parse: 4 callbacks suppressed
[  116.684686][ T7991] netlink: 4 bytes leftover after parsing attributes in process `syz.0.551'.
[  116.924952][   T33] audit: type=1800 audit(1751651115.165:10): pid=7995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.552" name="cgroup.controllers" dev="tmpfs" ino=1540 res=0 errno=0
[  117.112091][ T5844] hid-generic 0005:16BF:5505.001A: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  117.323593][ T8021] netlink: 104 bytes leftover after parsing attributes in process `syz.3.559'.
[  117.332066][   T33] audit: type=1800 audit(1751651115.575:11): pid=8005 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.554" name="cgroup.controllers" dev="tmpfs" ino=1546 res=0 errno=0
[  117.358963][ T5810] Bluetooth: hci3: command 0x041b tx timeout
[  117.760772][ T8042] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  117.822421][ T8037] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  118.411162][ T8045] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  118.413607][ T8045] IPv6: NLM_F_CREATE should be set when creating new route
[  118.417371][ T8045] xt_l2tp: v2 doesn't support IP mode
[  118.433094][ T8047] netlink: 36 bytes leftover after parsing attributes in process `syz.3.567'.
[  118.508185][ T5844] hid-generic 0005:16BF:5505.001B: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  118.521644][ T8053] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[  118.525350][ T8053] netlink: 'syz.3.569': attribute type 9 has an invalid length.
[  118.533778][ T8053] netlink: 'syz.3.569': attribute type 9 has an invalid length.
[  118.602821][ T5858] hid-generic 0005:16C0:5505.001C: unknown main item tag 0x0
[  118.606000][ T5858] hid-generic 0005:16C0:5505.001C: unknown main item tag 0x0
[  118.614022][ T5858] hid-generic 0005:16C0:5505.001C: unknown main item tag 0x0
[  118.616525][ T5858] hid-generic 0005:16C0:5505.001C: unknown main item tag 0x0
[  118.620946][ T8068] netlink: 'syz.0.573': attribute type 1 has an invalid length.
[  118.621445][ T5858] hid-generic 0005:16C0:5505.001C: unknown main item tag 0x0
[  118.624086][ T8068] netlink: 44 bytes leftover after parsing attributes in process `syz.0.573'.
[  118.626758][ T5858] hid-generic 0005:16C0:5505.001C: unknown main item tag 0x0
[  118.632669][ T8068] netlink: 'syz.0.573': attribute type 1 has an invalid length.
[  118.633855][ T5858] hid-generic 0005:16C0:5505.001C: unknown main item tag 0x3
[  118.638365][ T5858] hid-generic 0005:16C0:5505.001C: item fetching failed at offset 17/19
[  118.643109][ T5858] hid-generic 0005:16C0:5505.001C: probe with driver hid-generic failed with error -22
[  118.754287][ T8072] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input67
[  118.858631][ T8084] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input68
[  118.965025][ T8088] netlink: 80 bytes leftover after parsing attributes in process `syz.0.580'.
[  119.034416][ T8092] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input69
[  119.363265][ T8108] netlink: 24 bytes leftover after parsing attributes in process `syz.3.586'.
[  119.429745][ T5810] Bluetooth: hci3: command 0x041b tx timeout
[  119.471072][ T8107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.585'.
[  119.523518][ T8115] netlink: 248 bytes leftover after parsing attributes in process `syz.0.587'.
[  119.570169][ T8115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.587'.
[  119.574314][ T8116] netlink: 8 bytes leftover after parsing attributes in process `syz.0.587'.
[  119.870970][   T47] hid-generic 0005:16C0:5504.001D: unknown main item tag 0x0
[  119.882904][   T47] hid-generic 0005:16C0:5504.001D: unknown main item tag 0x0
[  119.891504][   T47] hid-generic 0005:16C0:5504.001D: unknown main item tag 0x0
[  119.894587][   T47] hid-generic 0005:16C0:5504.001D: unknown main item tag 0x0
[  119.897597][   T47] hid-generic 0005:16C0:5504.001D: unknown main item tag 0x0
[  119.903599][   T47] hid-generic 0005:16C0:5504.001D: unknown main item tag 0x0
[  119.906162][   T47] hid-generic 0005:16C0:5504.001D: unknown main item tag 0x3
[  119.907647][ T8126] lo speed is unknown, defaulting to 1000
[  119.908567][   T47] hid-generic 0005:16C0:5504.001D: item fetching failed at offset 17/19
[  119.916419][   T47] hid-generic 0005:16C0:5504.001D: probe with driver hid-generic failed with error -22
[  119.929078][ T8126] lo speed is unknown, defaulting to 1000
[  119.932556][ T8126] lo speed is unknown, defaulting to 1000
[  119.953262][ T8126] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  119.984513][ T8126] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  120.035537][ T8126] lo speed is unknown, defaulting to 1000
[  120.041282][ T8126] lo speed is unknown, defaulting to 1000
[  120.043829][ T8126] lo speed is unknown, defaulting to 1000
[  120.046450][ T8126] lo speed is unknown, defaulting to 1000
[  120.063967][ T8126] lo speed is unknown, defaulting to 1000
[  120.342643][ T8159] netlink: 'syz.3.594': attribute type 11 has an invalid length.
[  120.354965][ T8159] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048)
[  121.176428][ T2202] hid-generic 0005:16C0:5505.001E: unknown main item tag 0x0
[  121.180572][ T2202] hid-generic 0005:16C0:5505.001E: unknown main item tag 0x0
[  121.186224][ T2202] hid-generic 0005:16C0:5505.001E: unknown main item tag 0x0
[  121.193321][ T2202] hid-generic 0005:16C0:5505.001E: unknown main item tag 0x0
[  121.195640][ T2202] hid-generic 0005:16C0:5505.001E: unknown main item tag 0x0
[  121.198023][ T2202] hid-generic 0005:16C0:5505.001E: unknown main item tag 0x0
[  121.202260][ T2202] hid-generic 0005:16C0:5505.001E: unknown main item tag 0x3
[  121.204673][ T2202] hid-generic 0005:16C0:5505.001E: item fetching failed at offset 17/19
[  121.207647][ T2202] hid-generic 0005:16C0:5505.001E: probe with driver hid-generic failed with error -22
[  121.278488][ T8203] Cannot find del_set index 4 as target
[  121.509837][ T5810] Bluetooth: hci3: command 0x041b tx timeout
[  121.756004][ T8227] __nla_validate_parse: 7 callbacks suppressed
[  121.756013][ T8227] netlink: 256 bytes leftover after parsing attributes in process `syz.3.610'.
[  121.795571][ T8229] Bluetooth: MGMT ver 1.23
[  121.802218][ T8229] netlink: 36 bytes leftover after parsing attributes in process `syz.3.611'.
[  121.930497][ T2202] hid-generic 0005:16C0:5505.001F: unknown main item tag 0x0
[  121.933505][ T2202] hid-generic 0005:16C0:5505.001F: unknown main item tag 0x0
[  121.936410][ T2202] hid-generic 0005:16C0:5505.001F: unknown main item tag 0x0
[  121.942277][ T2202] hid-generic 0005:16C0:5505.001F: unknown main item tag 0x0
[  121.945257][ T2202] hid-generic 0005:16C0:5505.001F: unknown main item tag 0x0
[  121.948170][ T2202] hid-generic 0005:16C0:5505.001F: unknown main item tag 0x0
[  121.953482][ T2202] hid-generic 0005:16C0:5505.001F: unknown main item tag 0x3
[  121.956431][ T2202] hid-generic 0005:16C0:5505.001F: item fetching failed at offset 17/19
[  121.962751][ T2202] hid-generic 0005:16C0:5505.001F: probe with driver hid-generic failed with error -22
[  122.197084][ T8252] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input70
[  122.209283][ T8254] netlink: 8 bytes leftover after parsing attributes in process `syz.3.619'.
[  122.241619][ T8254] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input71
[  122.367587][ T8264] netlink: 104 bytes leftover after parsing attributes in process `syz.0.622'.
[  122.706367][   T33] audit: type=1800 audit(1751651120.945:12): pid=8279 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.625" name="cgroup.controllers" dev="tmpfs" ino=482 res=0 errno=0
[  122.824262][ T8289] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input72
[  122.835884][ T8291] netlink: 104 bytes leftover after parsing attributes in process `syz.3.629'.
[  122.894808][ T8297] netlink: 'syz.3.631': attribute type 1 has an invalid length.
[  122.956953][ T8301] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input73
[  123.080018][ T8310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.634'.
[  123.216252][ T8317] netlink: 104 bytes leftover after parsing attributes in process `syz.3.637'.
[  123.357853][ T8322] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input74
[  123.437121][ T8325] netlink: 'syz.3.640': attribute type 142 has an invalid length.
[  123.587783][ T5858] hid-generic 0005:16BF:5505.0020: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  123.908371][ T8348] netlink: 104 bytes leftover after parsing attributes in process `syz.3.644'.
[  124.030199][   T47] hid-generic 0005:16C0:5505.0021: unknown main item tag 0x0
[  124.042167][   T47] hid-generic 0005:16C0:5505.0021: unknown main item tag 0x0
[  124.045241][   T47] hid-generic 0005:16C0:5505.0021: unknown main item tag 0x0
[  124.048235][   T47] hid-generic 0005:16C0:5505.0021: unknown main item tag 0x0
[  124.052060][   T47] hid-generic 0005:16C0:5505.0021: unknown main item tag 0x0
[  124.055048][   T47] hid-generic 0005:16C0:5505.0021: unknown main item tag 0x0
[  124.058019][   T47] hid-generic 0005:16C0:5505.0021: unknown main item tag 0x3
[  124.064121][   T47] hid-generic 0005:16C0:5505.0021: item fetching failed at offset 17/19
[  124.067999][   T47] hid-generic 0005:16C0:5505.0021: probe with driver hid-generic failed with error -22
[  124.165373][ T8357] netlink: 8 bytes leftover after parsing attributes in process `syz.3.647'.
[  124.170266][ T8357] netlink: 24 bytes leftover after parsing attributes in process `syz.3.647'.
[  124.411537][ T8372] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input75
[  125.045188][ T8384] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  125.053490][ T8384] netlink: 'syz.0.655': attribute type 3 has an invalid length.
[  125.060163][ T8384] netlink: 'syz.0.655': attribute type 1 has an invalid length.
[  125.644358][ T8417] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input76
[  125.928317][ T8437] x_tables: duplicate underflow at hook 2
[  126.870671][ T5858] hid-generic 0005:0B57:00AA.0022: collection stack underflow
[  126.880613][ T5858] hid-generic 0005:0B57:00AA.0022: item 0 0 0 12 parsing failed
[  126.883920][ T5858] hid-generic 0005:0B57:00AA.0022: probe with driver hid-generic failed with error -22
[  126.908641][ T8456] __nla_validate_parse: 6 callbacks suppressed
[  126.908652][ T8456] netlink: 596 bytes leftover after parsing attributes in process `syz.3.678'.
[  126.912523][ T8457] netlink: 104 bytes leftover after parsing attributes in process `syz.0.679'.
[  126.954585][ T8461] netlink: 'syz.3.680': attribute type 10 has an invalid length.
[  127.534227][ T5874] hid-generic 0005:16BF:5505.0023: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  127.817662][ T8485] netlink: 596 bytes leftover after parsing attributes in process `syz.0.687'.
[  127.862289][ T8487] netlink: 104 bytes leftover after parsing attributes in process `syz.0.688'.
[  128.147441][ T8497] netlink: 8 bytes leftover after parsing attributes in process `syz.0.691'.
[  128.153430][ T8497] netlink: 4 bytes leftover after parsing attributes in process `syz.0.691'.
[  128.157485][ T8497] netlink: 10 bytes leftover after parsing attributes in process `syz.0.691'.
[  128.165357][ T8497] nbd: socks must be embedded in a SOCK_ITEM attr
[  128.503938][ T8511] netlink: 596 bytes leftover after parsing attributes in process `syz.3.695'.
[  128.531729][ T8513] netlink: 104 bytes leftover after parsing attributes in process `syz.3.696'.
[  128.646505][ T5858] hid-generic 0005:046D:FFF9.0024: item fetching failed at offset 0/1
[  128.650476][ T5858] hid-generic 0005:046D:FFF9.0024: probe with driver hid-generic failed with error -22
[  128.838818][ T8524] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input77
[  128.944969][ T5858] hid-generic 0005:16BF:5505.0025: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  128.993557][ T8531] netlink: 596 bytes leftover after parsing attributes in process `syz.3.703'.
[  129.172520][ T8543] netlink: 'syz.3.706': attribute type 8 has an invalid length.
[  129.267146][ T8549] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input78
[  129.465237][ T6855] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  129.563430][ T6855] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  129.636882][ T6855] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  129.713864][ T6855] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  129.849436][ T6855] bridge_slave_1: left allmulticast mode
[  129.853548][ T6855] bridge_slave_1: left promiscuous mode
[  129.856438][ T6855] bridge0: port 2(bridge_slave_1) entered disabled state
[  129.864446][ T6855] bridge_slave_0: left allmulticast mode
[  129.867213][ T6855] bridge_slave_0: left promiscuous mode
[  129.870631][ T6855] bridge0: port 1(bridge_slave_0) entered disabled state
[  130.067449][ T8568] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  130.168274][ T6855] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  130.174181][ T6855] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  130.179196][ T6855] bond0 (unregistering): Released all slaves
[  130.296417][ T5810] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  130.304197][ T5810] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  130.308634][ T5810] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  130.316685][ T5810] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  130.324443][ T5810] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  130.487291][ T6855] hsr_slave_0: left promiscuous mode
[  130.490970][ T6855] hsr_slave_1: left promiscuous mode
[  130.493102][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  130.495518][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_0
[  130.498452][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  130.502115][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_1
[  130.512203][ T6855] veth1_macvtap: left promiscuous mode
[  130.514441][ T6855] veth0_macvtap: left promiscuous mode
[  130.516757][ T6855] veth1_vlan: left promiscuous mode
[  130.520082][ T6855] veth0_vlan: left promiscuous mode
[  130.863174][ T6855] team0 (unregistering): Port device team_slave_1 removed
[  130.890790][ T6855] team0 (unregistering): Port device team_slave_0 removed
[  131.362401][ T8574] chnl_net:caif_netlink_parms(): no params data found
[  131.420893][ T8603] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input79
[  131.487590][ T8608] Bluetooth: MGMT ver 1.23
[  131.510591][ T8574] bridge0: port 1(bridge_slave_0) entered blocking state
[  131.523183][ T8574] bridge0: port 1(bridge_slave_0) entered disabled state
[  131.530565][ T8574] bridge_slave_0: entered allmulticast mode
[  131.534924][ T8574] bridge_slave_0: entered promiscuous mode
[  131.550220][ T8574] bridge0: port 2(bridge_slave_1) entered blocking state
[  131.552541][ T8574] bridge0: port 2(bridge_slave_1) entered disabled state
[  131.554950][ T8574] bridge_slave_1: entered allmulticast mode
[  131.557618][ T8574] bridge_slave_1: entered promiscuous mode
[  131.616296][ T8574] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  131.627947][ T8574] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  131.671522][ T8574] team0: Port device team_slave_0 added
[  131.675727][ T8574] team0: Port device team_slave_1 added
[  131.725665][ T5874] hid-generic 0005:16C0:5505.0026: unknown main item tag 0x0
[  131.731723][ T5874] hid-generic 0005:16C0:5505.0026: unknown main item tag 0x0
[  131.735842][ T8574] batman_adv: batadv0: Adding interface: batadv_slave_0
[  131.738531][ T8574] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  131.741924][ T5874] hid-generic 0005:16C0:5505.0026: unknown main item tag 0x0
[  131.759668][ T5874] hid-generic 0005:16C0:5505.0026: unknown main item tag 0x0
[  131.761118][ T8574] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  131.766790][ T8574] batman_adv: batadv0: Adding interface: batadv_slave_1
[  131.767482][ T5874] hid-generic 0005:16C0:5505.0026: unknown main item tag 0x0
[  131.771336][ T8574] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  131.781798][ T8574] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  131.784586][ T5874] hid-generic 0005:16C0:5505.0026: unknown main item tag 0x0
[  131.798620][ T5874] hid-generic 0005:16C0:5505.0026: unknown main item tag 0x3
[  131.804182][ T5874] hid-generic 0005:16C0:5505.0026: item fetching failed at offset 17/19
[  131.807947][ T5874] hid-generic 0005:16C0:5505.0026: probe with driver hid-generic failed with error -22
[  131.822027][ T8625] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input80
[  131.847735][ T8574] hsr_slave_0: entered promiscuous mode
[  131.853335][ T8574] hsr_slave_1: entered promiscuous mode
[  131.857835][ T8574] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  131.861195][ T8574] Cannot create hsr debugfs directory
[  131.959316][ T6855] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  132.021015][ T6855] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  132.116370][ T6855] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  132.214386][ T6855] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  132.399384][ T5204] Bluetooth: hci0: command tx timeout
[  132.404272][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  132.406825][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[  132.481150][ T6855] bridge_slave_1: left allmulticast mode
[  132.484698][ T6855] bridge_slave_1: left promiscuous mode
[  132.487286][ T6855] bridge0: port 2(bridge_slave_1) entered disabled state
[  132.497592][ T6855] bridge_slave_0: left allmulticast mode
[  132.509524][ T6855] bridge_slave_0: left promiscuous mode
[  132.512230][ T6855] bridge0: port 1(bridge_slave_0) entered disabled state
[  132.528595][ T8656] __nla_validate_parse: 7 callbacks suppressed
[  132.528610][ T8656] netlink: 596 bytes leftover after parsing attributes in process `syz.3.731'.
[  132.596474][ T6855] bond2 (unregistering): (slave ip6gretap1): Removing an active aggregator
[  132.604080][ T6855] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface
[  132.626799][ T8660] netlink: 24 bytes leftover after parsing attributes in process `syz.3.733'.
[  132.658525][ T6855] bond1 (unregistering): (slave vti0): Releasing backup interface
[  132.907519][ T6855] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  132.913512][ T6855] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  132.917206][ T6855] bond0 (unregistering): Released all slaves
[  132.923810][ T6855] bond1 (unregistering): Released all slaves
[  132.990722][ T6855] bond2 (unregistering): Released all slaves
[  133.086198][ T8574] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  133.107643][ T8574] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  133.123306][ T8574] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  133.142103][ T8664] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input81
[  133.161297][ T7436] udevd[7436]: setting mode of /dev/input/mouse1 to 020660 failed: No such file or directory
[  133.164767][ T7436] udevd[7436]: setting owner of /dev/input/mouse1 to uid=0, gid=104 failed: No such file or directory
[  133.193091][ T8574] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  133.361247][ T8684] netlink: 104 bytes leftover after parsing attributes in process `syz.3.736'.
[  133.393423][ T6855] hsr_slave_0: left promiscuous mode
[  133.399637][ T6855] hsr_slave_1: left promiscuous mode
[  133.402178][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  133.405650][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_0
[  133.412834][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  133.415240][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_1
[  133.420780][ T8687] netlink: 'syz.3.737': attribute type 11 has an invalid length.
[  133.422638][ T6855] veth1_macvtap: left promiscuous mode
[  133.425329][ T6855] veth0_macvtap: left promiscuous mode
[  133.427380][ T6855] veth1_vlan: left promiscuous mode
[  133.431297][ T6855] veth0_vlan: left promiscuous mode
[  133.511776][ T5810] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[  134.042037][ T8574] 8021q: adding VLAN 0 to HW filter on device bond0
[  134.081920][ T8574] 8021q: adding VLAN 0 to HW filter on device team0
[  134.092754][ T7456] bridge0: port 1(bridge_slave_0) entered blocking state
[  134.095772][ T7456] bridge0: port 1(bridge_slave_0) entered forwarding state
[  134.107829][ T7456] bridge0: port 2(bridge_slave_1) entered blocking state
[  134.110889][ T7456] bridge0: port 2(bridge_slave_1) entered forwarding state
[  134.234600][ T8696] netlink: 8 bytes leftover after parsing attributes in process `syz.3.740'.
[  134.962582][ T8702] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input82
[  135.325608][ T8715] netlink: 104 bytes leftover after parsing attributes in process `syz.3.743'.
[  135.330978][ T8574] 8021q: adding VLAN 0 to HW filter on device batadv0
[  135.371224][ T8574] veth0_vlan: entered promiscuous mode
[  135.384682][ T8574] veth1_vlan: entered promiscuous mode
[  135.402150][ T8574] veth0_macvtap: entered promiscuous mode
[  135.406379][ T8574] veth1_macvtap: entered promiscuous mode
[  135.417301][ T8574] batman_adv: batadv0: Interface activated: batadv_slave_0
[  135.431447][ T8719] netlink: 16 bytes leftover after parsing attributes in process `syz.3.744'.
[  135.437878][ T8574] batman_adv: batadv0: Interface activated: batadv_slave_1
[  135.443754][ T8574] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  135.447123][ T8574] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  135.451820][ T8574] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  135.454876][ T8574] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  135.491402][ T8720] netlink: 8 bytes leftover after parsing attributes in process `syz.3.744'.
[  135.527928][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  135.532763][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  135.559399][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  135.568553][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  136.011682][   T10] hid-generic 0005:16BF:5505.0027: item fetching failed at offset 23/148
[  136.015463][   T10] hid-generic 0005:16BF:5505.0027: probe with driver hid-generic failed with error -22
[  136.366679][ T8771] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input83
[  136.683956][   T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.287352][   T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.694259][ T8818] netlink: 28 bytes leftover after parsing attributes in process `syz.0.755'.
[  137.901389][   T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.976786][ T8842] netlink: 596 bytes leftover after parsing attributes in process `syz.3.759'.
[  137.981777][ T5204] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  137.988122][ T5204] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  137.991435][ T5204] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  137.995482][ T5204] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  138.004415][ T5204] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  138.186532][ T8841] chnl_net:caif_netlink_parms(): no params data found
[  138.255385][   T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  138.296482][ T8856] x_tables: ip6_tables: icmp6 match: only valid for protocol 58
[  138.450154][ T8841] bridge0: port 1(bridge_slave_0) entered blocking state
[  138.452961][ T8841] bridge0: port 1(bridge_slave_0) entered disabled state
[  138.455360][ T8841] bridge_slave_0: entered allmulticast mode
[  138.458504][ T8841] bridge_slave_0: entered promiscuous mode
[  138.465034][ T8841] bridge0: port 2(bridge_slave_1) entered blocking state
[  138.467733][ T8841] bridge0: port 2(bridge_slave_1) entered disabled state
[  138.473217][ T8841] bridge_slave_1: entered allmulticast mode
[  138.476195][ T8841] bridge_slave_1: entered promiscuous mode
[  138.526449][ T8856] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  138.536719][ T8855] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  138.550825][ T8841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  138.554644][   T12] bridge_slave_1: left allmulticast mode
[  138.556799][   T12] bridge_slave_1: left promiscuous mode
[  138.561217][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  138.561303][ T5858] hid-generic 0005:16BF:5505.0028: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  138.573748][   T12] bridge_slave_0: left allmulticast mode
[  138.577496][   T12] bridge_slave_0: left promiscuous mode
[  138.582995][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  138.825830][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  138.831618][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  138.835249][   T12] bond0 (unregistering): Released all slaves
[  138.843965][ T8841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  138.898594][ T8841] team0: Port device team_slave_0 added
[  138.911221][ T8841] team0: Port device team_slave_1 added
[  138.983134][ T8841] batman_adv: batadv0: Adding interface: batadv_slave_0
[  138.993277][ T8841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  139.005005][ T8841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  139.024972][ T8841] batman_adv: batadv0: Adding interface: batadv_slave_1
[  139.028203][ T8841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  139.039656][ T8841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  139.105022][ T8879] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input84
[  139.265581][   T12] hsr_slave_0: left promiscuous mode
[  139.270112][   T12] hsr_slave_1: left promiscuous mode
[  139.276125][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  139.279549][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[  139.283593][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  139.286772][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[  139.304490][   T12] veth1_macvtap: left promiscuous mode
[  139.306952][   T12] veth0_macvtap: left promiscuous mode
[  139.307589][ T8887] netlink: 596 bytes leftover after parsing attributes in process `syz.3.766'.
[  139.314766][   T12] veth1_vlan: left promiscuous mode
[  139.317166][   T12] veth0_vlan: left promiscuous mode
[  139.471497][ T8890] warn_alloc: 1 callbacks suppressed
[  139.471512][ T8890] syz.3.767: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  139.491038][ T8890] CPU: 0 UID: 0 PID: 8890 Comm: syz.3.767 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  139.491062][ T8890] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  139.491071][ T8890] Call Trace:
[  139.491077][ T8890]  <TASK>
[  139.491083][ T8890]  dump_stack_lvl+0x189/0x250
[  139.491113][ T8890]  ? __pfx_dump_stack_lvl+0x10/0x10
[  139.491128][ T8890]  ? __pfx__printk+0x10/0x10
[  139.491175][ T8890]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  139.491188][ T8890]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  139.491203][ T8890]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  139.491215][ T8890]  warn_alloc+0x214/0x310
[  139.491228][ T8890]  ? stack_depot_save_flags+0x40/0x900
[  139.491246][ T8890]  ? __pfx_warn_alloc+0x10/0x10
[  139.491260][ T8890]  ? kasan_save_track+0x4f/0x80
[  139.491276][ T8890]  ? xskq_create+0x56/0x170
[  139.491291][ T8890]  ? xsk_init_queue+0xb0/0x110
[  139.491304][ T8890]  ? xsk_setsockopt+0x43f/0x710
[  139.491315][ T8890]  ? do_sock_setsockopt+0x25a/0x3e0
[  139.491326][ T8890]  ? __x64_sys_setsockopt+0x18b/0x220
[  139.491337][ T8890]  ? do_syscall_64+0xfa/0x3b0
[  139.491346][ T8890]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  139.491364][ T8890]  __vmalloc_node_range_noprof+0x125/0x12f0
[  139.491398][ T8890]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  139.491410][ T8890]  ? xskq_create+0x56/0x170
[  139.491426][ T8890]  ? __kasan_kmalloc+0x93/0xb0
[  139.491438][ T8890]  vmalloc_user_noprof+0xad/0xf0
[  139.491450][ T8890]  ? xskq_create+0xbf/0x170
[  139.491465][ T8890]  xskq_create+0xbf/0x170
[  139.491483][ T8890]  xsk_init_queue+0xb0/0x110
[  139.491499][ T8890]  xsk_setsockopt+0x43f/0x710
[  139.491515][ T8890]  ? __pfx_xsk_setsockopt+0x10/0x10
[  139.491528][ T8890]  ? __lock_acquire+0xab9/0xd20
[  139.491550][ T8890]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  139.491563][ T8890]  ? __pfx_xsk_setsockopt+0x10/0x10
[  139.491577][ T8890]  do_sock_setsockopt+0x25a/0x3e0
[  139.491591][ T8890]  ? __pfx_do_sock_setsockopt+0x10/0x10
[  139.491606][ T8890]  ? __fget_files+0x2a/0x420
[  139.491624][ T8890]  __x64_sys_setsockopt+0x18b/0x220
[  139.491641][ T8890]  do_syscall_64+0xfa/0x3b0
[  139.491649][ T8890]  ? lockdep_hardirqs_on+0x9c/0x150
[  139.491665][ T8890]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  139.491676][ T8890]  ? exc_page_fault+0x9f/0xf0
[  139.491693][ T8890]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  139.491703][ T8890] RIP: 0033:0x7f9e5378e929
[  139.491715][ T8890] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  139.491727][ T8890] RSP: 002b:00007f9e5461d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  139.491741][ T8890] RAX: ffffffffffffffda RBX: 00007f9e539b6080 RCX: 00007f9e5378e929
[  139.491749][ T8890] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009
[  139.491758][ T8890] RBP: 00007f9e53810b39 R08: 0000000000000004 R09: 0000000000000000
[  139.491765][ T8890] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  139.491772][ T8890] R13: 0000000000000000 R14: 00007f9e539b6080 R15: 00007ffe94d95978
[  139.491802][ T8890]  </TASK>
[  139.491812][ T8890] Mem-Info:
[  139.623770][ T8890] active_anon:5971 inactive_anon:0 isolated_anon:0
[  139.623770][ T8890]  active_file:1025 inactive_file:38247 isolated_file:0
[  139.623770][ T8890]  unevictable:1768 dirty:32 writeback:0
[  139.623770][ T8890]  slab_reclaimable:9516 slab_unreclaimable:56644
[  139.623770][ T8890]  mapped:19325 shmem:2461 pagetables:996
[  139.623770][ T8890]  sec_pagetables:0 bounce:0
[  139.623770][ T8890]  kernel_misc_reclaimable:0
[  139.623770][ T8890]  free:296983 free_pcp:18890 free_cma:0
[  139.641621][ T8890] Node 0 active_anon:12232kB inactive_anon:0kB active_file:2804kB inactive_file:15760kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:48976kB dirty:48kB writeback:0kB shmem:4900kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:7904kB pagetables:2220kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  139.654945][ T8890] Node 1 active_anon:11652kB inactive_anon:0kB active_file:1296kB inactive_file:137228kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:28324kB dirty:80kB writeback:0kB shmem:4944kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4112kB pagetables:1764kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  139.668646][ T8890] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  139.681796][ T8890] lowmem_reserve[]: 0 815 815 815 815
[  139.684048][ T8890] Node 0 DMA32 free:382620kB boost:0kB min:33716kB low:42144kB high:50572kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12232kB inactive_anon:0kB active_file:2804kB inactive_file:15760kB unevictable:3536kB writepending:48kB present:1556484kB managed:834740kB mlocked:0kB bounce:0kB free_pcp:37968kB local_pcp:19544kB free_cma:0kB
[  139.696880][ T8890] lowmem_reserve[]: 0 0 0 0 0
[  139.699140][ T8890] Node 1 DMA32 free:458616kB boost:0kB min:19168kB low:23960kB high:28752kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  139.712373][ T8890] lowmem_reserve[]: 0 0 854 854 854
[  139.714615][ T8890] Node 1 Normal free:331336kB boost:0kB min:36576kB low:45720kB high:54864kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11652kB inactive_anon:0kB active_file:1296kB inactive_file:137228kB unevictable:3536kB writepending:80kB present:1048576kB managed:875016kB mlocked:0kB bounce:0kB free_pcp:37756kB local_pcp:17508kB free_cma:0kB
[  139.728220][ T8890] lowmem_reserve[]: 0 0 0 0 0
[  139.730310][ T8890] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  139.735495][ T8890] Node 0 DMA32: 827*4kB (UME) 334*8kB (UM) 154*16kB (UM) 163*32kB (UME) 149*64kB (UME) 78*128kB (UME) 57*256kB (UME) 32*512kB (UM) 15*1024kB (UME) 6*2048kB (UM) 71*4096kB (UM) = 382620kB
[  139.744267][ T8890] Node 1 DMA32: 2*4kB (M) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 1*128kB (M) 2*256kB (M) 2*512kB (M) 2*1024kB (M) 2*2048kB (M) 110*4096kB (M) = 458616kB
[  139.751217][ T8890] Node 1 Normal: 4*4kB (UM) 127*8kB (U) 46*16kB (ME) 261*32kB (UME) 167*64kB (UME) 114*128kB (UME) 30*256kB (UME) 15*512kB (UME) 6*1024kB (UM) 4*2048kB (UME) 65*4096kB (UM) = 331336kB
[  139.763951][ T8890] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  139.767972][ T8890] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  139.772036][ T8890] 41733 total pagecache pages
[  139.774329][ T8890] 0 pages in swap cache
[  139.777066][ T8890] Free swap  = 124996kB
[  139.779588][ T8890] Total swap = 124996kB
[  139.781507][ T8890] 786301 pages RAM
[  139.783068][ T8890] 0 pages HighMem/MovableOnly
[  139.784992][ T8890] 240368 pages reserved
[  139.786593][ T8890] 0 pages cma reserved
[  139.963862][   T12] team0 (unregistering): Port device team_slave_1 removed
[  139.996828][   T12] team0 (unregistering): Port device team_slave_0 removed
[  140.188793][ T8891] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[  140.285000][ T8841] hsr_slave_0: entered promiscuous mode
[  140.287528][ T8841] hsr_slave_1: entered promiscuous mode
[  140.290280][ T8841] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  140.292930][ T8841] Cannot create hsr debugfs directory
[  140.537022][ T8908] xt_addrtype: both incoming and outgoing interface limitation cannot be selected
[  140.654720][ T8918] netlink: 596 bytes leftover after parsing attributes in process `syz.3.773'.
[  140.848157][ T8928] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input85
[  141.010522][ T8942] netlink: 20 bytes leftover after parsing attributes in process `syz.0.778'.
[  141.050228][ T8841] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  141.058306][ T8841] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  141.076392][ T8841] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  141.086714][ T8841] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  141.092189][ T8948] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input86
[  141.272273][ T8966] netlink: 596 bytes leftover after parsing attributes in process `syz.3.780'.
[  141.281907][ T8841] 8021q: adding VLAN 0 to HW filter on device bond0
[  141.307381][ T8841] 8021q: adding VLAN 0 to HW filter on device team0
[  141.324818][ T7806] bridge0: port 1(bridge_slave_0) entered blocking state
[  141.327344][ T7806] bridge0: port 1(bridge_slave_0) entered forwarding state
[  141.339701][ T7806] bridge0: port 2(bridge_slave_1) entered blocking state
[  141.342119][ T7806] bridge0: port 2(bridge_slave_1) entered forwarding state
[  141.522637][ T8984] netlink: 224 bytes leftover after parsing attributes in process `syz.3.783'.
[  141.526717][ T8985] netlink: 224 bytes leftover after parsing attributes in process `syz.3.783'.
[  141.565928][ T8841] 8021q: adding VLAN 0 to HW filter on device batadv0
[  141.615531][ T8841] veth0_vlan: entered promiscuous mode
[  141.631109][ T8841] veth1_vlan: entered promiscuous mode
[  141.672974][ T8841] veth0_macvtap: entered promiscuous mode
[  141.677250][ T8841] veth1_macvtap: entered promiscuous mode
[  141.694363][ T8841] batman_adv: batadv0: Interface activated: batadv_slave_0
[  141.709756][ T8841] batman_adv: batadv0: Interface activated: batadv_slave_1
[  141.723937][ T8841] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  141.727636][ T8841] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  141.738913][ T8841] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  141.743424][ T8841] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  141.802660][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  141.808407][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  141.834142][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  141.837137][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  141.914650][ T9011] netlink: 596 bytes leftover after parsing attributes in process `syz.3.787'.
[  141.973532][ T5874] hid-generic 0005:04F3:000E.0029: collection stack underflow
[  141.976389][ T5874] hid-generic 0005:04F3:000E.0029: item 0 0 0 12 parsing failed
[  141.990133][ T5874] hid-generic 0005:04F3:000E.0029: probe with driver hid-generic failed with error -22
[  142.997441][ T9037] netlink: 596 bytes leftover after parsing attributes in process `syz.0.794'.
[  143.157484][ T9050] netlink: 104 bytes leftover after parsing attributes in process `syz.0.799'.
[  143.234359][ T9058] netlink: 'syz.3.801': attribute type 1 has an invalid length.
[  143.236882][ T9058] netlink: 'syz.3.801': attribute type 1 has an invalid length.
[  143.285688][ T9064] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input87
[  143.326012][ T9063] netlink: 8 bytes leftover after parsing attributes in process `syz.0.802'.
[  143.336804][ T9063] netlink: 8 bytes leftover after parsing attributes in process `syz.0.802'.
[  143.340466][ T9063] netlink: 5 bytes leftover after parsing attributes in process `syz.0.802'.
[  143.343357][ T9063] netlink: 8 bytes leftover after parsing attributes in process `syz.0.802'.
[  143.382313][ T9071] netlink: 56 bytes leftover after parsing attributes in process `syz.0.805'.
[  143.512724][   T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  144.350191][ T9079] netlink: 72 bytes leftover after parsing attributes in process `syz.3.808'.
[  144.376166][ T9081] netlink: 104 bytes leftover after parsing attributes in process `syz.0.807'.
[  144.435285][ T9084] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input88
[  144.566140][ T9095] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input89
[  144.618331][ T5204] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  144.622564][ T5204] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  144.627051][ T5204] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  144.634558][ T5204] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  144.638077][ T5204] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  144.727407][ T9104] netlink: 28 bytes leftover after parsing attributes in process `syz.3.811'.
[  144.845648][ T9098] chnl_net:caif_netlink_parms(): no params data found
[  144.916440][ T9098] bridge0: port 1(bridge_slave_0) entered blocking state
[  144.919593][ T9098] bridge0: port 1(bridge_slave_0) entered disabled state
[  144.921939][ T9098] bridge_slave_0: entered allmulticast mode
[  144.924760][ T9098] bridge_slave_0: entered promiscuous mode
[  144.928109][ T9098] bridge0: port 2(bridge_slave_1) entered blocking state
[  144.931057][ T9098] bridge0: port 2(bridge_slave_1) entered disabled state
[  144.933606][ T9098] bridge_slave_1: entered allmulticast mode
[  144.936432][ T9098] bridge_slave_1: entered promiscuous mode
[  144.958936][ T9098] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  144.963376][ T9098] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  144.982757][ T9098] team0: Port device team_slave_0 added
[  144.987101][ T9098] team0: Port device team_slave_1 added
[  145.004802][ T9098] batman_adv: batadv0: Adding interface: batadv_slave_0
[  145.007078][ T9098] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  145.015984][ T9098] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  145.021073][ T9098] batman_adv: batadv0: Adding interface: batadv_slave_1
[  145.023281][ T9098] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  145.031568][ T9098] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  145.058501][ T9098] hsr_slave_0: entered promiscuous mode
[  145.060982][ T9098] hsr_slave_1: entered promiscuous mode
[  145.063230][ T9098] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  145.065640][ T9098] Cannot create hsr debugfs directory
[  145.094262][   T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  145.150910][   T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  145.157757][   T33] audit: type=1800 audit(1751651143.395:13): pid=9120 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.817" name="cgroup.controllers" dev="tmpfs" ino=2057 res=0 errno=0
[  145.200593][   T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  145.304665][   T47] hid-generic 0005:16C0:5505.002A: unknown main item tag 0x0
[  145.307393][   T47] hid-generic 0005:16C0:5505.002A: unknown main item tag 0x0
[  145.312261][   T47] hid-generic 0005:16C0:5505.002A: unknown main item tag 0x0
[  145.315345][   T47] hid-generic 0005:16C0:5505.002A: unknown main item tag 0x0
[  145.318556][   T47] hid-generic 0005:16C0:5505.002A: unknown main item tag 0x0
[  145.322564][   T47] hid-generic 0005:16C0:5505.002A: unknown main item tag 0x0
[  145.326871][   T47] hid-generic 0005:16C0:5505.002A: unknown main item tag 0x3
[  145.333173][   T47] hid-generic 0005:16C0:5505.002A: item fetching failed at offset 17/19
[  145.336480][   T47] hid-generic 0005:16C0:5505.002A: probe with driver hid-generic failed with error -22
[  145.392000][   T12] bridge_slave_1: left allmulticast mode
[  145.394331][   T12] bridge_slave_1: left promiscuous mode
[  145.396727][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  145.412487][   T12] bridge_slave_0: left allmulticast mode
[  145.415827][   T12] bridge_slave_0: left promiscuous mode
[  145.418002][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  145.810015][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  145.814136][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  145.819603][   T12] bond0 (unregistering): Released all slaves
[  146.185945][   T12] hsr_slave_0: left promiscuous mode
[  146.188080][   T12] hsr_slave_1: left promiscuous mode
[  146.193569][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  146.196239][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[  146.227196][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  146.231805][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[  146.251778][   T12] veth1_macvtap: left promiscuous mode
[  146.256494][   T12] veth0_macvtap: left promiscuous mode
[  146.260335][   T12] veth1_vlan: left promiscuous mode
[  146.262543][   T12] veth0_vlan: left promiscuous mode
[  146.463418][ T5810] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  146.467865][ T5810] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  146.475231][ T5810] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  146.480077][ T5810] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  146.491432][ T5810] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  146.646951][   T12] team0 (unregistering): Port device team_slave_1 removed
[  146.670883][   T12] team0 (unregistering): Port device team_slave_0 removed
[  146.709685][ T5810] Bluetooth: hci0: command tx timeout
[  147.083709][ T9098] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  147.103380][ T9098] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  147.136250][ T9098] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  147.163460][ T9098] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  147.164504][ T9166] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input90
[  147.218651][ T9159] chnl_net:caif_netlink_parms(): no params data found
[  147.374182][ T9159] bridge0: port 1(bridge_slave_0) entered blocking state
[  147.376959][ T9159] bridge0: port 1(bridge_slave_0) entered disabled state
[  147.380096][ T9159] bridge_slave_0: entered allmulticast mode
[  147.383146][ T9159] bridge_slave_0: entered promiscuous mode
[  147.387410][ T9159] bridge0: port 2(bridge_slave_1) entered blocking state
[  147.391331][ T9159] bridge0: port 2(bridge_slave_1) entered disabled state
[  147.393957][ T9159] bridge_slave_1: entered allmulticast mode
[  147.397362][ T9159] bridge_slave_1: entered promiscuous mode
[  147.410740][ T9098] 8021q: adding VLAN 0 to HW filter on device bond0
[  147.462924][ T9159] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  147.497425][   T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  147.509235][ T9159] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  147.542863][ T9159] team0: Port device team_slave_0 added
[  147.559083][ T9159] team0: Port device team_slave_1 added
[  147.587595][ T9159] batman_adv: batadv0: Adding interface: batadv_slave_0
[  147.590290][ T9159] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  147.600049][ T9159] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  147.614364][   T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  147.626016][ T9098] 8021q: adding VLAN 0 to HW filter on device team0
[  147.632372][ T9159] batman_adv: batadv0: Adding interface: batadv_slave_1
[  147.635237][ T9159] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  147.647537][ T9159] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  147.673952][   T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  147.695509][ T3546] bridge0: port 1(bridge_slave_0) entered blocking state
[  147.698183][ T3546] bridge0: port 1(bridge_slave_0) entered forwarding state
[  147.724876][ T3546] bridge0: port 2(bridge_slave_1) entered blocking state
[  147.727470][ T3546] bridge0: port 2(bridge_slave_1) entered forwarding state
[  147.763515][   T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  147.783696][ T9159] hsr_slave_0: entered promiscuous mode
[  147.786795][ T9159] hsr_slave_1: entered promiscuous mode
[  147.791856][ T9159] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  147.794267][ T9159] Cannot create hsr debugfs directory
[  148.094775][   T12] bridge_slave_1: left allmulticast mode
[  148.097398][   T12] bridge_slave_1: left promiscuous mode
[  148.102791][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  148.108043][   T12] bridge_slave_0: left allmulticast mode
[  148.111540][   T12] bridge_slave_0: left promiscuous mode
[  148.113983][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  148.412085][   T33] audit: type=1800 audit(1751651146.655:14): pid=9216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.833" name="cgroup.controllers" dev="tmpfs" ino=2125 res=0 errno=0
[  148.542952][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  148.549094][ T5810] Bluetooth: hci2: command tx timeout
[  148.549320][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  148.556394][   T12] bond0 (unregistering): Released all slaves
[  148.641829][   T12] bond1 (unregistering): Released all slaves
[  148.767934][ T9098] 8021q: adding VLAN 0 to HW filter on device batadv0
[  148.915666][ T9231] __nla_validate_parse: 4 callbacks suppressed
[  148.915683][ T9231] netlink: 596 bytes leftover after parsing attributes in process `syz.0.834'.
[  148.917125][ T9098] veth0_vlan: entered promiscuous mode
[  148.932515][ T9098] veth1_vlan: entered promiscuous mode
[  148.981588][ T9237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.835'.
[  149.008352][   T12] hsr_slave_0: left promiscuous mode
[  149.011578][   T12] hsr_slave_1: left promiscuous mode
[  149.013870][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  149.016503][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[  149.020724][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  149.023232][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[  149.042975][   T12] veth1_macvtap: left promiscuous mode
[  149.045164][   T12] veth0_macvtap: left promiscuous mode
[  149.047231][   T12] veth1_vlan: left promiscuous mode
[  149.051338][   T12] veth0_vlan: left promiscuous mode
[  149.210497][ T9244] Bluetooth: MGMT ver 1.23
[  149.354735][   T12] team0 (unregistering): Port device team_slave_1 removed
[  149.375262][   T12] team0 (unregistering): Port device team_slave_0 removed
[  149.701647][ T9098] veth0_macvtap: entered promiscuous mode
[  149.722246][ T9098] veth1_macvtap: entered promiscuous mode
[  149.766225][ T9159] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  149.780592][ T9159] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  149.794762][ T9159] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  149.806944][ T9159] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  149.829687][ T9098] batman_adv: batadv0: Interface activated: batadv_slave_0
[  149.840394][ T9248] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input91
[  149.846401][ T9098] batman_adv: batadv0: Interface activated: batadv_slave_1
[  149.872598][ T9098] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  149.876026][ T9098] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  149.883162][ T9098] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  149.886516][ T9098] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  149.978217][ T9262] netlink: 'syz.0.839': attribute type 1 has an invalid length.
[  149.994388][ T7806] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  149.996890][ T7806] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  150.044416][ T7806] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  150.050728][ T9159] 8021q: adding VLAN 0 to HW filter on device bond0
[  150.054894][ T7806] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  150.082224][ T9159] 8021q: adding VLAN 0 to HW filter on device team0
[  150.098148][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[  150.100536][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[  150.109833][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[  150.112094][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[  150.164353][ T9269] netlink: 596 bytes leftover after parsing attributes in process `syz.0.841'.
[  150.246552][ T9159] 8021q: adding VLAN 0 to HW filter on device batadv0
[  150.270802][ T9159] veth0_vlan: entered promiscuous mode
[  150.275847][ T9159] veth1_vlan: entered promiscuous mode
[  150.292672][ T9159] veth0_macvtap: entered promiscuous mode
[  150.296688][ T9159] veth1_macvtap: entered promiscuous mode
[  150.306572][ T9159] batman_adv: batadv0: Interface activated: batadv_slave_0
[  150.317173][ T9159] batman_adv: batadv0: Interface activated: batadv_slave_1
[  150.326568][ T9159] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  150.339053][ T9159] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  150.343021][ T9159] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  150.348654][ T9159] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  150.406071][ T3546] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  150.411417][ T3546] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  150.445662][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  150.449627][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  150.712896][   T33] audit: type=1800 audit(1751651148.955:15): pid=9282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.844" name="cgroup.controllers" dev="tmpfs" ino=2183 res=0 errno=0
[  151.009925][ T8665] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  151.169080][ T8665] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  151.233183][ T8665] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  151.302481][ T8665] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  151.424920][ T8665] bridge_slave_1: left allmulticast mode
[  151.429455][ T8665] bridge_slave_1: left promiscuous mode
[  151.431847][ T8665] bridge0: port 2(bridge_slave_1) entered disabled state
[  151.437512][ T8665] bridge_slave_0: left allmulticast mode
[  151.441356][ T8665] bridge_slave_0: left promiscuous mode
[  151.443560][ T8665] bridge0: port 1(bridge_slave_0) entered disabled state
[  151.665265][ T8665] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  151.670710][ T8665] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  151.675078][ T8665] bond0 (unregistering): Released all slaves
[  151.912906][ T8665] hsr_slave_0: left promiscuous mode
[  151.916067][ T8665] hsr_slave_1: left promiscuous mode
[  151.920382][ T8665] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  151.923388][ T8665] batman_adv: batadv0: Removing interface: batadv_slave_0
[  151.927084][ T8665] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  151.932884][ T8665] batman_adv: batadv0: Removing interface: batadv_slave_1
[  151.969723][ T8665] veth1_macvtap: left promiscuous mode
[  151.971623][ T8665] veth0_macvtap: left promiscuous mode
[  151.973476][ T8665] veth1_vlan: left promiscuous mode
[  151.975184][ T8665] veth0_vlan: left promiscuous mode
[  152.143788][ T5204] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  152.154507][ T5204] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  152.157950][ T5204] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  152.170083][ T5204] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  152.175885][ T5204] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  152.181599][ T9304] warn_alloc: 1 callbacks suppressed
[  152.181608][ T9304] syz.0.846: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  152.189951][ T9304] CPU: 0 UID: 0 PID: 9304 Comm: syz.0.846 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  152.189971][ T9304] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  152.189977][ T9304] Call Trace:
[  152.189980][ T9304]  <TASK>
[  152.189985][ T9304]  dump_stack_lvl+0x189/0x250
[  152.190002][ T9304]  ? __pfx_dump_stack_lvl+0x10/0x10
[  152.190013][ T9304]  ? __pfx__printk+0x10/0x10
[  152.190022][ T9304]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  152.190031][ T9304]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  152.190041][ T9304]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  152.190050][ T9304]  warn_alloc+0x214/0x310
[  152.190059][ T9304]  ? stack_depot_save_flags+0x40/0x900
[  152.190071][ T9304]  ? __pfx_warn_alloc+0x10/0x10
[  152.190079][ T9304]  ? kasan_save_track+0x4f/0x80
[  152.190090][ T9304]  ? xskq_create+0x56/0x170
[  152.190101][ T9304]  ? xsk_init_queue+0xb0/0x110
[  152.190110][ T9304]  ? xsk_setsockopt+0x43f/0x710
[  152.190118][ T9304]  ? do_sock_setsockopt+0x25a/0x3e0
[  152.190126][ T9304]  ? __x64_sys_setsockopt+0x18b/0x220
[  152.190133][ T9304]  ? do_syscall_64+0xfa/0x3b0
[  152.190139][ T9304]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  152.190150][ T9304]  __vmalloc_node_range_noprof+0x125/0x12f0
[  152.190169][ T9304]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  152.190179][ T9304]  ? __kasan_kmalloc+0x93/0xb0
[  152.190187][ T9304]  vmalloc_user_noprof+0xad/0xf0
[  152.190195][ T9304]  ? xskq_create+0xbf/0x170
[  152.190205][ T9304]  xskq_create+0xbf/0x170
[  152.190218][ T9304]  xsk_init_queue+0xb0/0x110
[  152.190229][ T9304]  xsk_setsockopt+0x43f/0x710
[  152.190239][ T9304]  ? __pfx_xsk_setsockopt+0x10/0x10
[  152.190248][ T9304]  ? __lock_acquire+0xab9/0xd20
[  152.190262][ T9304]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  152.190271][ T9304]  ? __pfx_xsk_setsockopt+0x10/0x10
[  152.190280][ T9304]  do_sock_setsockopt+0x25a/0x3e0
[  152.190290][ T9304]  ? __pfx_do_sock_setsockopt+0x10/0x10
[  152.190300][ T9304]  ? __fget_files+0x2a/0x420
[  152.190311][ T9304]  __x64_sys_setsockopt+0x18b/0x220
[  152.190322][ T9304]  do_syscall_64+0xfa/0x3b0
[  152.190328][ T9304]  ? lockdep_hardirqs_on+0x9c/0x150
[  152.190338][ T9304]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  152.190344][ T9304]  ? exc_page_fault+0x9f/0xf0
[  152.190355][ T9304]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  152.190362][ T9304] RIP: 0033:0x7f7e7418e929
[  152.190370][ T9304] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  152.190376][ T9304] RSP: 002b:00007f7e71fd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  152.190385][ T9304] RAX: ffffffffffffffda RBX: 00007f7e743b6080 RCX: 00007f7e7418e929
[  152.190390][ T9304] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000008
[  152.190395][ T9304] RBP: 00007f7e74210b39 R08: 0000000000000004 R09: 0000000000000000
[  152.190400][ T9304] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  152.190404][ T9304] R13: 0000000000000000 R14: 00007f7e743b6080 R15: 00007fffc7c0d9f8
[  152.190415][ T9304]  </TASK>
[  152.190418][ T9304] Mem-Info:
[  152.302445][ T9304] active_anon:6441 inactive_anon:0 isolated_anon:0
[  152.302445][ T9304]  active_file:1042 inactive_file:38256 isolated_file:0
[  152.302445][ T9304]  unevictable:1768 dirty:56 writeback:0
[  152.302445][ T9304]  slab_reclaimable:9663 slab_unreclaimable:54769
[  152.302445][ T9304]  mapped:18294 shmem:2472 pagetables:1059
[  152.302445][ T9304]  sec_pagetables:0 bounce:0
[  152.302445][ T9304]  kernel_misc_reclaimable:0
[  152.302445][ T9304]  free:295987 free_pcp:20905 free_cma:0
[  152.319472][ T9304] Node 0 active_anon:14416kB inactive_anon:0kB active_file:2804kB inactive_file:15768kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:59180kB dirty:60kB writeback:0kB shmem:4904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:7848kB pagetables:2564kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  152.330510][ T9304] Node 1 active_anon:11348kB inactive_anon:0kB active_file:1364kB inactive_file:137256kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:13996kB dirty:164kB writeback:0kB shmem:4984kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4048kB pagetables:1672kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  152.342265][ T9304] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  152.352322][ T9304] lowmem_reserve[]: 0 815 815 815 815
[  152.357983][ T9304] Node 0 DMA32 free:351836kB boost:0kB min:33716kB low:42144kB high:50572kB reserved_highatomic:0KB free_highatomic:0KB active_anon:14416kB inactive_anon:0kB active_file:2804kB inactive_file:15768kB unevictable:3536kB writepending:60kB present:1556484kB managed:834740kB mlocked:0kB bounce:0kB free_pcp:23512kB local_pcp:9028kB free_cma:0kB
[  152.369338][ T9304] lowmem_reserve[]: 0 0 0 0 0
[  152.371316][ T9304] Node 1 DMA32 free:458616kB boost:0kB min:19168kB low:23960kB high:28752kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  152.386919][ T9305] netlink: 8 bytes leftover after parsing attributes in process `syz.0.846'.
[  152.405216][ T9305] netlink: 8 bytes leftover after parsing attributes in process `syz.0.846'.
[  152.405230][ T9304] lowmem_reserve[]: 0 0 854 854 854
[  152.429980][ T9304] Node 1 Normal free:360720kB boost:0kB min:36576kB low:45720kB high:54864kB reserved_highatomic:0KB free_highatomic:0KB active_anon:11408kB inactive_anon:0kB active_file:1364kB inactive_file:137256kB unevictable:3536kB writepending:164kB present:1048576kB managed:875016kB mlocked:0kB bounce:0kB free_pcp:57048kB local_pcp:15176kB free_cma:0kB
[  152.482844][ T9304] lowmem_reserve[]: 0 0 0 0 0
[  152.485352][ T9304] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  152.490495][ T9306] Bluetooth: MGMT ver 1.23
[  152.495738][ T9301] Bluetooth: hci0: Opcode 0x0c03 failed: -112
[  152.499273][ T9304] Node 0 DMA32: 67*4kB (ME) 37*8kB (UME) 77*16kB (UME) 69*32kB (UME) 14*64kB (UME) 18*128kB (UME) 16*256kB (UME) 31*512kB (UM) 15*1024kB (UME) 9*2048kB (UM) 71*4096kB (UM) = 351780kB
[  152.524004][ T9304] Node 1 DMA32: 2*4kB (M) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 1*128kB (M) 2*256kB (M) 2*512kB (M) 2*1024kB (M) 2*2048kB (M) 110*4096kB (M) = 458616kB
[  152.531232][ T9304] Node 1 Normal: 2568*4kB (UM) 1185*8kB (UME) 698*16kB (UM) 252*32kB (UME) 275*64kB (UM) 135*128kB (UME) 33*256kB (UME) 14*512kB (UME) 7*1024kB (UM) 3*2048kB (UE) 63*4096kB (UM) = 360840kB
[  152.548845][ T9304] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  152.552035][ T9304] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  152.555079][ T9304] 41776 total pagecache pages
[  152.556776][ T9304] 0 pages in swap cache
[  152.558261][ T9304] Free swap  = 124996kB
[  152.560278][ T9304] Total swap = 124996kB
[  152.562323][ T9304] 786301 pages RAM
[  152.563721][ T9304] 0 pages HighMem/MovableOnly
[  152.565356][ T9304] 240368 pages reserved
[  152.566787][ T9304] 0 pages cma reserved
[  152.648143][ T8665] team0 (unregistering): Port device team_slave_1 removed
[  152.677195][ T8665] team0 (unregistering): Port device team_slave_0 removed
[  152.842066][ T5816] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  152.846413][ T5816] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  152.852791][ T5816] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  152.857196][ T5816] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  152.860822][ T5816] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  153.284288][ T9308] chnl_net:caif_netlink_parms(): no params data found
[  153.343512][ T9302] chnl_net:caif_netlink_parms(): no params data found
[  153.414738][ T9308] bridge0: port 1(bridge_slave_0) entered blocking state
[  153.418042][ T9308] bridge0: port 1(bridge_slave_0) entered disabled state
[  153.425692][ T9308] bridge_slave_0: entered allmulticast mode
[  153.430481][ T9308] bridge_slave_0: entered promiscuous mode
[  153.458820][ T9308] bridge0: port 2(bridge_slave_1) entered blocking state
[  153.461718][ T9308] bridge0: port 2(bridge_slave_1) entered disabled state
[  153.464249][ T9308] bridge_slave_1: entered allmulticast mode
[  153.467410][ T9308] bridge_slave_1: entered promiscuous mode
[  153.552276][ T8665] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  153.563569][ T9308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  153.594790][ T9308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  153.598488][ T9302] bridge0: port 1(bridge_slave_0) entered blocking state
[  153.602244][ T9302] bridge0: port 1(bridge_slave_0) entered disabled state
[  153.605401][ T9302] bridge_slave_0: entered allmulticast mode
[  153.609911][ T9302] bridge_slave_0: entered promiscuous mode
[  153.654072][ T9302] bridge0: port 2(bridge_slave_1) entered blocking state
[  153.657138][ T9302] bridge0: port 2(bridge_slave_1) entered disabled state
[  153.660063][ T9302] bridge_slave_1: entered allmulticast mode
[  153.664003][ T9302] bridge_slave_1: entered promiscuous mode
[  153.683808][ T9308] team0: Port device team_slave_0 added
[  153.701713][ T9302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  153.706534][ T9308] team0: Port device team_slave_1 added
[  153.713044][ T9302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  153.781330][ T9302] team0: Port device team_slave_0 added
[  153.785613][ T9308] batman_adv: batadv0: Adding interface: batadv_slave_0
[  153.788060][ T9308] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  153.799670][ T9308] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  153.811304][ T9302] team0: Port device team_slave_1 added
[  153.819060][ T9308] batman_adv: batadv0: Adding interface: batadv_slave_1
[  153.821300][ T9308] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  153.832542][ T9308] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  153.872553][ T9302] batman_adv: batadv0: Adding interface: batadv_slave_0
[  153.875500][ T9302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  153.888114][ T9302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  153.895443][ T9302] batman_adv: batadv0: Adding interface: batadv_slave_1
[  153.898424][ T9302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  153.909125][ T9302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  153.974263][ T9308] hsr_slave_0: entered promiscuous mode
[  153.977527][ T9308] hsr_slave_1: entered promiscuous mode
[  154.034826][ T9302] hsr_slave_0: entered promiscuous mode
[  154.037660][ T9302] hsr_slave_1: entered promiscuous mode
[  154.044595][ T9302] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  154.047444][ T9302] Cannot create hsr debugfs directory
[  154.344580][ T8665] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  154.441151][ T8665] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  154.511486][ T8665] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  154.549094][ T5204] Bluetooth: hci0: Opcode 0x0c1a failed: -110
[  154.643868][ T8665] bridge_slave_1: left allmulticast mode
[  154.647966][ T8665] bridge_slave_1: left promiscuous mode
[  154.652790][ T8665] bridge0: port 2(bridge_slave_1) entered disabled state
[  154.658312][ T8665] bridge_slave_0: left allmulticast mode
[  154.661572][ T8665] bridge_slave_0: left promiscuous mode
[  154.664080][ T8665] bridge0: port 1(bridge_slave_0) entered disabled state
[  154.949052][ T5204] Bluetooth: hci2: command tx timeout
[  154.954433][ T9379] netlink: 104 bytes leftover after parsing attributes in process `syz.0.850'.
[  154.963904][ T8665] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  154.971869][ T8665] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  154.976895][ T8665] bond0 (unregistering): Released all slaves
[  154.981813][ T9381] netlink: 8 bytes leftover after parsing attributes in process `syz.0.851'.
[  155.117517][ T9391] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input92
[  155.298476][ T8665] hsr_slave_0: left promiscuous mode
[  155.304062][ T8665] hsr_slave_1: left promiscuous mode
[  155.306562][ T8665] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  155.311001][ T8665] batman_adv: batadv0: Removing interface: batadv_slave_0
[  155.314185][ T8665] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  155.316554][ T8665] batman_adv: batadv0: Removing interface: batadv_slave_1
[  155.335607][ T8665] veth1_macvtap: left promiscuous mode
[  155.337744][ T8665] veth0_macvtap: left promiscuous mode
[  155.341797][ T8665] veth1_vlan: left promiscuous mode
[  155.345981][ T8665] veth0_vlan: left promiscuous mode
[  155.391605][ T9412] netlink: 'syz.0.855': attribute type 10 has an invalid length.
[  155.682209][ T8665] team0 (unregistering): Port device team_slave_1 removed
[  155.706330][ T8665] team0 (unregistering): Port device team_slave_0 removed
[  155.992517][ T9412] macvlan0: entered promiscuous mode
[  155.994683][ T9412] macvlan0: entered allmulticast mode
[  156.000773][ T9412] veth1_vlan: entered allmulticast mode
[  156.004847][ T9412] bond0: (slave macvlan0): Enslaving as an active interface with an up link
[  156.478396][ T9308] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  156.500586][ T9308] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  156.507603][ T9308] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  156.517801][ T9308] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  156.611411][ T9302] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  156.622369][ T9302] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  156.636332][ T9302] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  156.657412][ T9302] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  156.681765][ T2202] hid-generic 0005:16C0:5505.002B: unknown main item tag 0x0
[  156.684465][ T2202] hid-generic 0005:16C0:5505.002B: unknown main item tag 0x0
[  156.690472][ T2202] hid-generic 0005:16C0:5505.002B: unknown main item tag 0x0
[  156.695459][ T2202] hid-generic 0005:16C0:5505.002B: unknown main item tag 0x0
[  156.699905][ T2202] hid-generic 0005:16C0:5505.002B: unknown main item tag 0x0
[  156.702423][ T2202] hid-generic 0005:16C0:5505.002B: unknown main item tag 0x0
[  156.704816][ T2202] hid-generic 0005:16C0:5505.002B: unknown main item tag 0x3
[  156.709235][ T2202] hid-generic 0005:16C0:5505.002B: item fetching failed at offset 17/19
[  156.714048][ T2202] hid-generic 0005:16C0:5505.002B: probe with driver hid-generic failed with error -22
[  156.752284][ T9308] 8021q: adding VLAN 0 to HW filter on device bond0
[  156.782207][ T9308] 8021q: adding VLAN 0 to HW filter on device team0
[  156.799603][ T7456] bridge0: port 1(bridge_slave_0) entered blocking state
[  156.802504][ T7456] bridge0: port 1(bridge_slave_0) entered forwarding state
[  156.818569][ T7456] bridge0: port 2(bridge_slave_1) entered blocking state
[  156.821572][ T7456] bridge0: port 2(bridge_slave_1) entered forwarding state
[  156.859974][ T9302] 8021q: adding VLAN 0 to HW filter on device bond0
[  156.894923][ T9302] 8021q: adding VLAN 0 to HW filter on device team0
[  156.908237][ T7806] bridge0: port 1(bridge_slave_0) entered blocking state
[  156.911173][ T7806] bridge0: port 1(bridge_slave_0) entered forwarding state
[  156.923144][ T7806] bridge0: port 2(bridge_slave_1) entered blocking state
[  156.926065][ T7806] bridge0: port 2(bridge_slave_1) entered forwarding state
[  157.029420][ T5204] Bluetooth: hci2: command tx timeout
[  157.065392][ T9308] 8021q: adding VLAN 0 to HW filter on device batadv0
[  157.138628][ T9308] veth0_vlan: entered promiscuous mode
[  157.161560][ T9308] veth1_vlan: entered promiscuous mode
[  157.213953][ T9308] veth0_macvtap: entered promiscuous mode
[  157.224471][ T9308] veth1_macvtap: entered promiscuous mode
[  157.257210][ T9302] 8021q: adding VLAN 0 to HW filter on device batadv0
[  157.266497][ T9308] batman_adv: batadv0: Interface activated: batadv_slave_0
[  157.279261][ T9308] batman_adv: batadv0: Interface activated: batadv_slave_1
[  157.288115][ T9308] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  157.292447][ T9308] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  157.296013][ T9308] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  157.300159][ T9308] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  157.345743][ T9302] veth0_vlan: entered promiscuous mode
[  157.373657][ T9302] veth1_vlan: entered promiscuous mode
[  157.395487][ T7806] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  157.398064][ T7806] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  157.443957][ T9302] veth0_macvtap: entered promiscuous mode
[  157.448609][ T9302] veth1_macvtap: entered promiscuous mode
[  157.454608][ T7456] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  157.457171][ T7456] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  157.491520][ T9302] batman_adv: batadv0: Interface activated: batadv_slave_0
[  157.503841][ T9302] batman_adv: batadv0: Interface activated: batadv_slave_1
[  157.544687][ T9302] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  157.547450][ T9302] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  157.552132][ T9479] netlink: 104 bytes leftover after parsing attributes in process `syz.0.861'.
[  157.552141][ T9302] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  157.557909][ T9302] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  157.602973][ T3568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  157.605588][ T3568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  157.625541][ T3568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  157.628117][ T3568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  157.761005][ T9487] netlink: 24 bytes leftover after parsing attributes in process `syz.0.863'.
[  157.855999][ T9486] infiniband syz0: set down
[  157.859271][ T9486] infiniband syz0: added ipvlan1
[  157.863604][ T9486] syz0: rxe_create_cq: returned err = -12
[  157.866158][ T9486] infiniband syz0: Couldn't create ib_mad CQ
[  157.869033][ T9486] infiniband syz0: Couldn't open port 1
[  157.891341][ T9486] RDS/IB: syz0: added
[  157.893435][ T9486] smc: adding ib device syz0 with port count 1
[  157.896107][ T9486] smc:    ib device syz0 port 1 has pnetid 
[  158.452153][   T24] hid-generic 0005:16BF:5505.002C: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  158.895456][   T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  159.105372][ T5810] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  159.109240][ T5810] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  159.111989][ T5810] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  159.114807][ T5810] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  159.117645][ T5810] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  159.320445][ T9500] chnl_net:caif_netlink_parms(): no params data found
[  159.373440][ T9500] bridge0: port 1(bridge_slave_0) entered blocking state
[  159.375846][ T9500] bridge0: port 1(bridge_slave_0) entered disabled state
[  159.378133][ T9500] bridge_slave_0: entered allmulticast mode
[  159.381976][ T9500] bridge_slave_0: entered promiscuous mode
[  159.385564][ T9500] bridge0: port 2(bridge_slave_1) entered blocking state
[  159.387811][ T9500] bridge0: port 2(bridge_slave_1) entered disabled state
[  159.391306][ T9500] bridge_slave_1: entered allmulticast mode
[  159.393988][ T9500] bridge_slave_1: entered promiscuous mode
[  159.411386][ T9500] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  159.415932][ T9500] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  159.437963][ T9500] team0: Port device team_slave_0 added
[  159.442343][ T9500] team0: Port device team_slave_1 added
[  159.460973][ T9500] batman_adv: batadv0: Adding interface: batadv_slave_0
[  159.463876][ T9500] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  159.472432][ T9500] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  159.477302][ T9500] batman_adv: batadv0: Adding interface: batadv_slave_1
[  159.479762][ T9500] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  159.487969][ T9500] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  159.518087][ T9500] hsr_slave_0: entered promiscuous mode
[  159.520850][ T9500] hsr_slave_1: entered promiscuous mode
[  159.523447][ T9500] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  159.526263][ T9500] Cannot create hsr debugfs directory
[  160.124616][ T9512] netlink: 104 bytes leftover after parsing attributes in process `syz.0.868'.
[  160.185627][   T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  160.235035][ T5204] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  160.238529][ T5204] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  160.246531][ T5204] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  160.254568][ T5204] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  160.259535][ T5204] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  160.295861][ T9518] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input93
[  160.591743][ T9515] chnl_net:caif_netlink_parms(): no params data found
[  160.628659][   T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  160.677380][   T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  160.697552][ T9515] bridge0: port 1(bridge_slave_0) entered blocking state
[  160.701008][ T9515] bridge0: port 1(bridge_slave_0) entered disabled state
[  160.704044][ T9515] bridge_slave_0: entered allmulticast mode
[  160.708014][ T9515] bridge_slave_0: entered promiscuous mode
[  160.714007][ T9515] bridge0: port 2(bridge_slave_1) entered blocking state
[  160.717014][ T9515] bridge0: port 2(bridge_slave_1) entered disabled state
[  160.720451][ T9515] bridge_slave_1: entered allmulticast mode
[  160.724202][ T9515] bridge_slave_1: entered promiscuous mode
[  160.758291][ T9515] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  160.766170][ T9515] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  160.829179][ T9515] team0: Port device team_slave_0 added
[  160.834155][ T9515] team0: Port device team_slave_1 added
[  160.900495][   T12] bridge_slave_1: left allmulticast mode
[  160.903118][   T12] bridge_slave_1: left promiscuous mode
[  160.905756][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  160.914126][   T12] bridge_slave_0: left allmulticast mode
[  160.916478][   T12] bridge_slave_0: left promiscuous mode
[  160.923910][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  161.175000][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  161.180983][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  161.185276][   T12] bond0 (unregistering): Released all slaves
[  161.195859][ T9515] batman_adv: batadv0: Adding interface: batadv_slave_0
[  161.198846][ T9515] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  161.210997][ T9515] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  161.217058][ T9515] batman_adv: batadv0: Adding interface: batadv_slave_1
[  161.220213][ T9515] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  161.231138][ T9515] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  161.361520][ T9515] hsr_slave_0: entered promiscuous mode
[  161.364554][ T9515] hsr_slave_1: entered promiscuous mode
[  161.367364][ T9515] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  161.373127][ T9515] Cannot create hsr debugfs directory
[  161.762688][   T12] hsr_slave_0: left promiscuous mode
[  161.765548][   T12] hsr_slave_1: left promiscuous mode
[  161.768191][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  161.771896][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[  161.779840][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  161.782841][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[  161.800968][   T12] veth1_macvtap: left promiscuous mode
[  161.803322][   T12] veth0_macvtap: left promiscuous mode
[  161.805635][   T12] veth1_vlan: left promiscuous mode
[  161.807839][   T12] veth0_vlan: left promiscuous mode
[  161.887037][ T9546] netlink: 104 bytes leftover after parsing attributes in process `syz.0.875'.
[  162.170445][   T12] team0 (unregistering): Port device team_slave_1 removed
[  162.196615][   T12] team0 (unregistering): Port device team_slave_0 removed
[  162.319109][ T5810] Bluetooth: hci2: command tx timeout
[  162.494404][ T9515] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  162.503849][ T9500] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  162.508544][ T9500] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  162.521520][ T9500] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  162.528371][ T9500] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  162.537017][ T9551] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input94
[  162.611047][ T9515] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  162.676602][ T9560] netlink: 8 bytes leftover after parsing attributes in process `syz.0.878'.
[  162.677849][ T9515] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  162.681435][ T9560] netlink: 'syz.0.878': attribute type 20 has an invalid length.
[  162.688847][ T9560] netlink: 'syz.0.878': attribute type 21 has an invalid length.
[  162.740558][ T9500] 8021q: adding VLAN 0 to HW filter on device bond0
[  162.755607][ T9515] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  162.776209][ T9500] 8021q: adding VLAN 0 to HW filter on device team0
[  162.785250][   T47] hid-generic 0005:16BF:5505.002D: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  162.788071][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state
[  162.792553][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state
[  162.816582][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state
[  162.819630][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state
[  162.929620][ T9515] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  162.936568][ T9515] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  162.945015][ T9515] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  162.951887][ T9515] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  162.958351][ T9573] netlink: 12 bytes leftover after parsing attributes in process `syz.0.881'.
[  162.966366][ T9572] netlink: 12 bytes leftover after parsing attributes in process `syz.0.881'.
[  162.974229][ T9572] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input95
[  162.992142][   T12] bridge_slave_1: left allmulticast mode
[  162.993993][   T12] bridge_slave_1: left promiscuous mode
[  163.005917][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  163.018215][   T12] bridge_slave_0: left allmulticast mode
[  163.027561][   T12] bridge_slave_0: left promiscuous mode
[  163.030107][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  163.262215][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  163.266631][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  163.270996][   T12] bond0 (unregistering): Released all slaves
[  163.295170][ T9500] 8021q: adding VLAN 0 to HW filter on device batadv0
[  163.357824][ T9585] netlink: 104 bytes leftover after parsing attributes in process `syz.0.882'.
[  163.462256][ T9500] veth0_vlan: entered promiscuous mode
[  163.484158][ T9500] veth1_vlan: entered promiscuous mode
[  163.560457][ T9515] 8021q: adding VLAN 0 to HW filter on device bond0
[  163.583350][ T9515] 8021q: adding VLAN 0 to HW filter on device team0
[  163.586828][ T9500] veth0_macvtap: entered promiscuous mode
[  163.616897][ T3568] bridge0: port 1(bridge_slave_0) entered blocking state
[  163.619946][ T3568] bridge0: port 1(bridge_slave_0) entered forwarding state
[  163.644148][ T3568] bridge0: port 2(bridge_slave_1) entered blocking state
[  163.647162][ T3568] bridge0: port 2(bridge_slave_1) entered forwarding state
[  163.666098][ T9500] veth1_macvtap: entered promiscuous mode
[  163.757124][ T9500] batman_adv: batadv0: Interface activated: batadv_slave_0
[  163.764954][ T9500] batman_adv: batadv0: Interface activated: batadv_slave_1
[  163.796092][ T9500] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  163.800349][ T9598] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input96
[  163.806065][ T9500] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  163.813397][ T9500] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  163.816918][ T9500] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  163.938408][   T12] hsr_slave_0: left promiscuous mode
[  163.943376][   T12] hsr_slave_1: left promiscuous mode
[  163.954203][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  163.957252][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[  163.965517][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  163.977805][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[  163.997802][   T12] veth1_macvtap: left promiscuous mode
[  164.000596][   T12] veth0_macvtap: left promiscuous mode
[  164.003072][   T12] veth1_vlan: left promiscuous mode
[  164.005357][   T12] veth0_vlan: left promiscuous mode
[  164.389237][ T5810] Bluetooth: hci2: command 0x041b tx timeout
[  164.428216][   T12] team0 (unregistering): Port device team_slave_1 removed
[  164.465793][   T12] team0 (unregistering): Port device team_slave_0 removed
[  164.845824][ T9598] netlink: 256 bytes leftover after parsing attributes in process `syz.0.885'.
[  164.881542][ T3568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  164.884662][ T9515] 8021q: adding VLAN 0 to HW filter on device batadv0
[  164.884800][ T3568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  164.964041][ T9607] netlink: 132 bytes leftover after parsing attributes in process `syz.0.886'.
[  164.968945][ T3568] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  164.979117][ T3568] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  165.012855][ T9515] veth0_vlan: entered promiscuous mode
[  165.042156][ T9515] veth1_vlan: entered promiscuous mode
[  165.102149][ T9515] veth0_macvtap: entered promiscuous mode
[  165.152017][ T9515] veth1_macvtap: entered promiscuous mode
[  165.164681][ T9515] batman_adv: batadv0: Interface activated: batadv_slave_0
[  165.176408][ T9515] batman_adv: batadv0: Interface activated: batadv_slave_1
[  165.200163][ T9515] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  165.203488][ T9515] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  165.206600][ T9515] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  165.211202][ T9515] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  165.289386][ T1092] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  165.296347][ T1092] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  165.318039][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  165.322554][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  165.322691][ T9621] netlink: 104 bytes leftover after parsing attributes in process `syz.0.889'.
[  165.964102][ T6855] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  166.243801][ T6855] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  166.490933][ T5810] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  166.494290][ T5810] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  166.497147][ T5810] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  166.502376][ T5810] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  166.505556][ T5810] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  166.583218][ T6855] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  166.665290][ T6855] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  166.738494][ T9632] chnl_net:caif_netlink_parms(): no params data found
[  166.867422][ T6855] bridge_slave_1: left allmulticast mode
[  166.876001][ T6855] bridge_slave_1: left promiscuous mode
[  166.878548][ T6855] bridge0: port 2(bridge_slave_1) entered disabled state
[  166.884634][ T6855] bridge_slave_0: left allmulticast mode
[  166.887022][ T6855] bridge_slave_0: left promiscuous mode
[  166.890409][ T6855] bridge0: port 1(bridge_slave_0) entered disabled state
[  167.138262][ T6855] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  167.142883][ T6855] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  167.146659][ T6855] bond0 (unregistering): Released all slaves
[  167.153071][ T9632] bridge0: port 1(bridge_slave_0) entered blocking state
[  167.155418][ T9632] bridge0: port 1(bridge_slave_0) entered disabled state
[  167.157914][ T9632] bridge_slave_0: entered allmulticast mode
[  167.161133][ T9632] bridge_slave_0: entered promiscuous mode
[  167.166903][ T9632] bridge0: port 2(bridge_slave_1) entered blocking state
[  167.172066][ T9632] bridge0: port 2(bridge_slave_1) entered disabled state
[  167.174413][ T9632] bridge_slave_1: entered allmulticast mode
[  167.177479][ T9632] bridge_slave_1: entered promiscuous mode
[  167.223064][ T9632] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  167.232639][ T9632] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  167.275992][ T9632] team0: Port device team_slave_0 added
[  167.286002][ T9632] team0: Port device team_slave_1 added
[  167.368133][ T9632] batman_adv: batadv0: Adding interface: batadv_slave_0
[  167.376213][ T9632] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  167.391534][ T9632] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  167.410949][ T9632] batman_adv: batadv0: Adding interface: batadv_slave_1
[  167.413997][ T9632] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  167.431210][ T9632] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  167.509761][ T5204] Bluetooth: hci1: command tx timeout
[  167.534932][ T9632] hsr_slave_0: entered promiscuous mode
[  167.549418][ T5816] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  167.554018][ T5816] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  167.554194][ T9632] hsr_slave_1: entered promiscuous mode
[  167.557128][ T5816] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  167.562822][ T5816] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  167.565443][ T5816] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  167.695435][ T6855] hsr_slave_0: left promiscuous mode
[  167.705160][ T6855] hsr_slave_1: left promiscuous mode
[  167.708039][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  167.712785][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_0
[  167.718320][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  167.735327][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_1
[  167.755388][ T6855] veth1_macvtap: left promiscuous mode
[  167.769498][ T6855] veth0_macvtap: left promiscuous mode
[  167.771988][ T6855] veth1_vlan: left promiscuous mode
[  167.774203][ T6855] veth0_vlan: left promiscuous mode
[  168.163313][ T6855] team0 (unregistering): Port device team_slave_1 removed
[  168.197937][ T6855] team0 (unregistering): Port device team_slave_0 removed
[  168.368167][ T5874] hid-generic 0005:16BF:5505.002E: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  168.559429][ T5816] Bluetooth: hci0: command tx timeout
[  168.640042][ T9672] netlink: 104 bytes leftover after parsing attributes in process `syz.0.896'.
[  168.667564][ T9674] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input97
[  168.833069][ T9650] chnl_net:caif_netlink_parms(): no params data found
[  168.925200][ T6855] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  168.945672][ T9650] bridge0: port 1(bridge_slave_0) entered blocking state
[  168.947998][ T9650] bridge0: port 1(bridge_slave_0) entered disabled state
[  168.954631][ T9650] bridge_slave_0: entered allmulticast mode
[  168.957408][ T9650] bridge_slave_0: entered promiscuous mode
[  168.960889][ T9650] bridge0: port 2(bridge_slave_1) entered blocking state
[  168.963329][ T9650] bridge0: port 2(bridge_slave_1) entered disabled state
[  168.965734][ T9650] bridge_slave_1: entered allmulticast mode
[  168.968470][ T9650] bridge_slave_1: entered promiscuous mode
[  169.019907][ T9650] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  169.036222][ T6855] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  169.046212][ T9650] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  169.106161][ T6855] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  169.116044][ T9650] team0: Port device team_slave_0 added
[  169.122111][ T9650] team0: Port device team_slave_1 added
[  169.157889][ T6855] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  169.168613][ T9650] batman_adv: batadv0: Adding interface: batadv_slave_0
[  169.178365][ T9650] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  169.201503][ T9650] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  169.219660][ T9650] batman_adv: batadv0: Adding interface: batadv_slave_1
[  169.222344][ T9650] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  169.235544][ T9650] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  169.305128][ T9650] hsr_slave_0: entered promiscuous mode
[  169.307673][ T9650] hsr_slave_1: entered promiscuous mode
[  169.310388][ T9650] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  169.313981][ T9650] Cannot create hsr debugfs directory
[  169.395344][ T9632] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  169.416152][ T9632] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  169.438270][ T9632] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  169.445902][ T6855] bridge_slave_1: left allmulticast mode
[  169.448238][ T6855] bridge_slave_1: left promiscuous mode
[  169.453223][ T6855] bridge0: port 2(bridge_slave_1) entered disabled state
[  169.458472][ T6855] bridge_slave_0: left allmulticast mode
[  169.461503][ T6855] bridge_slave_0: left promiscuous mode
[  169.464083][ T6855] bridge0: port 1(bridge_slave_0) entered disabled state
[  169.599686][ T5816] Bluetooth: hci2: command tx timeout
[  169.765163][ T9695] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input98
[  169.791917][ T6855] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  169.801534][ T6855] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  169.806867][ T6855] bond0 (unregistering): Released all slaves
[  169.821865][ T9632] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  170.116538][ T9632] 8021q: adding VLAN 0 to HW filter on device bond0
[  170.152258][ T9632] 8021q: adding VLAN 0 to HW filter on device team0
[  170.163093][ T7806] bridge0: port 1(bridge_slave_0) entered blocking state
[  170.165536][ T7806] bridge0: port 1(bridge_slave_0) entered forwarding state
[  170.195135][ T7806] bridge0: port 2(bridge_slave_1) entered blocking state
[  170.198314][ T7806] bridge0: port 2(bridge_slave_1) entered forwarding state
[  170.260667][ T6855] hsr_slave_0: left promiscuous mode
[  170.263912][ T6855] hsr_slave_1: left promiscuous mode
[  170.266195][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  170.269141][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_0
[  170.272176][ T6855] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  170.274658][ T6855] batman_adv: batadv0: Removing interface: batadv_slave_1
[  170.284460][ T6855] veth1_macvtap: left promiscuous mode
[  170.287681][ T6855] veth0_macvtap: left promiscuous mode
[  170.291679][ T6855] veth1_vlan: left promiscuous mode
[  170.293513][ T6855] veth0_vlan: left promiscuous mode
[  170.583154][ T6855] team0 (unregistering): Port device team_slave_1 removed
[  170.617682][ T6855] team0 (unregistering): Port device team_slave_0 removed
[  170.631465][ T5816] Bluetooth: hci0: command 0x041b tx timeout
[  170.924251][ T9712] Bluetooth: MGMT ver 1.23
[  170.983976][ T9716] netlink: 104 bytes leftover after parsing attributes in process `syz.0.905'.
[  171.005737][ T9632] 8021q: adding VLAN 0 to HW filter on device batadv0
[  171.122713][ T9650] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  171.149162][ T9650] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  171.155378][ T9650] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  171.170947][ T9632] veth0_vlan: entered promiscuous mode
[  171.175135][ T9650] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  171.191907][ T9632] veth1_vlan: entered promiscuous mode
[  171.228343][ T9632] veth0_macvtap: entered promiscuous mode
[  171.238070][ T9632] veth1_macvtap: entered promiscuous mode
[  171.257800][ T9632] batman_adv: batadv0: Interface activated: batadv_slave_0
[  171.282910][ T9632] batman_adv: batadv0: Interface activated: batadv_slave_1
[  171.292668][ T9650] 8021q: adding VLAN 0 to HW filter on device bond0
[  171.296901][ T9632] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  171.301815][ T9632] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  171.305323][ T9632] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  171.308598][ T9632] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  171.327787][ T9650] 8021q: adding VLAN 0 to HW filter on device team0
[  171.347525][ T7806] bridge0: port 1(bridge_slave_0) entered blocking state
[  171.350673][ T7806] bridge0: port 1(bridge_slave_0) entered forwarding state
[  171.380304][ T7806] bridge0: port 2(bridge_slave_1) entered blocking state
[  171.383453][ T7806] bridge0: port 2(bridge_slave_1) entered forwarding state
[  171.464843][ T3568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  171.471501][ T3568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  171.517860][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  171.521427][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  171.590143][    T9] Oops: general protection fault, probably for non-canonical address 0xdffffc000000004b: 0000 [#1] SMP KASAN PTI
[  171.594865][    T9] KASAN: null-ptr-deref in range [0x0000000000000258-0x000000000000025f]
[  171.598876][    T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  171.604057][    T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  171.608074][    T9] Workqueue: events l2cap_info_timeout
[  171.610277][    T9] RIP: 0010:kasan_byte_accessible+0x12/0x30
[  171.612647][    T9] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 10 d6 45 09 cc 66 66 66 66 66 66 2e
[  171.620357][    T9] RSP: 0018:ffffc900000c77a8 EFLAGS: 00010206
[  171.622901][    T9] RAX: dffffc0000000000 RBX: ffffffff8945af28 RCX: 53589ea7ac053000
[  171.625925][    T9] RDX: 0000000000000000 RSI: ffffffff8945af28 RDI: 000000000000004b
[  171.629158][    T9] RBP: ffffffff8a71f325 R08: 0000000000000001 R09: 0000000000000000
[  171.632471][    T9] R10: dffffc0000000000 R11: ffffffff8a71f2e0 R12: 0000000000000000
[  171.635755][    T9] R13: 0000000000000258 R14: 0000000000000258 R15: 0000000000000001
[  171.638997][    T9] FS:  0000000000000000(0000) GS:ffff8880b8650000(0000) knlGS:0000000000000000
[  171.642706][    T9] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  171.645350][    T9] CR2: 00007fff7b12e5e0 CR3: 000000000df38000 CR4: 00000000000006f0
[  171.648523][    T9] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  171.651686][    T9] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  171.654716][    T9] Call Trace:
[  171.655811][    T9]  <TASK>
[  171.656778][    T9]  __kasan_check_byte+0x12/0x40
[  171.658335][    T9]  lock_acquire+0x8d/0x360
[  171.659827][    T9]  ? lockdep_hardirqs_on+0x9c/0x150
[  171.661503][    T9]  ? __cancel_work+0x254/0x2e0
[  171.663315][    T9]  lock_sock_nested+0x48/0x100
[  171.665196][    T9]  ? l2cap_sock_ready_cb+0x45/0x140
[  171.666928][    T9]  l2cap_sock_ready_cb+0x45/0x140
[  171.668600][    T9]  l2cap_conn_start+0x76d/0xe50
[  171.670138][    T9]  ? __pfx_l2cap_conn_start+0x10/0x10
[  171.671855][    T9]  ? l2cap_info_timeout+0x60/0xa0
[  171.673788][    T9]  ? __lock_acquire+0xab9/0xd20
[  171.675482][    T9]  ? __pfx___mutex_lock+0x10/0x10
[  171.677155][    T9]  ? process_scheduled_works+0x9ef/0x17b0
[  171.678986][    T9]  l2cap_info_timeout+0x68/0xa0
[  171.680540][    T9]  ? process_scheduled_works+0x9ef/0x17b0
[  171.682539][    T9]  process_scheduled_works+0xae1/0x17b0
[  171.684837][    T9]  ? __pfx_process_scheduled_works+0x10/0x10
[  171.686836][    T9]  worker_thread+0x8a0/0xda0
[  171.688287][    T9]  kthread+0x711/0x8a0
[  171.689578][    T9]  ? __pfx_worker_thread+0x10/0x10
[  171.691183][    T9]  ? __pfx_kthread+0x10/0x10
[  171.692864][    T9]  ? _raw_spin_unlock_irq+0x23/0x50
[  171.694761][    T9]  ? lockdep_hardirqs_on+0x9c/0x150
[  171.696458][    T9]  ? __pfx_kthread+0x10/0x10
[  171.697946][    T9]  ret_from_fork+0x3fc/0x770
[  171.699452][    T9]  ? __pfx_ret_from_fork+0x10/0x10
[  171.701532][    T9]  ? __switch_to_asm+0x39/0x70
[  171.703431][    T9]  ? __switch_to_asm+0x33/0x70
[  171.705252][    T9]  ? __pfx_kthread+0x10/0x10
[  171.706970][    T9]  ret_from_fork_asm+0x1a/0x30
[  171.708748][    T9]  </TASK>
[  171.709935][    T9] Modules linked in:
[  171.712237][    T9] ---[ end trace 0000000000000000 ]---
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  171.717317][ T5810] Bluetooth: hci2: command tx timeout
[  171.720234][ T9732] syz.0.908: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  171.721138][    T9] RIP: 0010:kasan_byte_accessible+0x12/0x30
[  171.726521][ T9732] CPU: 1 UID: 0 PID: 9732 Comm: syz.0.908 Tainted: G      D             6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  171.726577][ T9732] Tainted: [D]=DIE
[  171.726584][ T9732] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  171.726593][ T9732] Call Trace:
[  171.726599][ T9732]  <TASK>
[  171.726605][ T9732]  dump_stack_lvl+0x189/0x250
[  171.726634][ T9732]  ? __pfx_dump_stack_lvl+0x10/0x10
[  171.726654][ T9732]  ? __pfx__printk+0x10/0x10
[  171.726669][ T9732]  ? lock_release+0x4b/0x3e0
[  171.726686][ T9732]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  171.726700][ T9732]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  171.726714][ T9732]  warn_alloc+0x214/0x310
[  171.726728][ T9732]  ? stack_depot_save_flags+0x40/0x900
[  171.726746][ T9732]  ? __pfx_warn_alloc+0x10/0x10
[  171.726760][ T9732]  ? kasan_save_track+0x4f/0x80
[  171.726779][ T9732]  ? xskq_create+0x56/0x170
[  171.726797][ T9732]  ? xsk_init_queue+0xb0/0x110
[  171.726811][ T9732]  ? xsk_setsockopt+0x43f/0x710
[  171.726826][ T9732]  ? do_sock_setsockopt+0x25a/0x3e0
[  171.726840][ T9732]  ? __x64_sys_setsockopt+0x18b/0x220
[  171.726853][ T9732]  ? do_syscall_64+0xfa/0x3b0
[  171.726871][ T9732]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  171.726887][ T9732]  __vmalloc_node_range_noprof+0x125/0x12f0
[  171.726911][ T9732]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  171.726928][ T9732]  ? __kasan_kmalloc+0x93/0xb0
[  171.726941][ T9732]  vmalloc_user_noprof+0xad/0xf0
[  171.726956][ T9732]  ? xskq_create+0xbf/0x170
[  171.726974][ T9732]  xskq_create+0xbf/0x170
[  171.726994][ T9732]  xsk_init_queue+0xb0/0x110
[  171.727011][ T9732]  xsk_setsockopt+0x43f/0x710
[  171.727028][ T9732]  ? __pfx_xsk_setsockopt+0x10/0x10
[  171.727043][ T9732]  ? do_futex+0x395/0x420
[  171.727056][ T9732]  ? file_init_path+0x434/0x590
[  171.727072][ T9732]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[  171.727088][ T9732]  ? __pfx_xsk_setsockopt+0x10/0x10
[  171.727104][ T9732]  do_sock_setsockopt+0x25a/0x3e0
[  171.727117][ T9732]  ? __pfx_do_sock_setsockopt+0x10/0x10
[  171.727130][ T9732]  ? __fget_files+0x2a/0x420
[  171.727143][ T9732]  __x64_sys_setsockopt+0x18b/0x220
[  171.727157][ T9732]  do_syscall_64+0xfa/0x3b0
[  171.727166][ T9732]  ? lockdep_hardirqs_on+0x9c/0x150
[  171.727181][ T9732]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  171.727193][ T9732]  ? exc_page_fault+0x9f/0xf0
[  171.727208][ T9732]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  171.727220][ T9732] RIP: 0033:0x7f7e7418e929
[  171.727233][ T9732] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  171.727244][ T9732] RSP: 002b:00007f7e71ff6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  171.727260][ T9732] RAX: ffffffffffffffda RBX: 00007f7e743b5fa0 RCX: 00007f7e7418e929
[  171.727270][ T9732] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007
[  171.727278][ T9732] RBP: 00007f7e74210b39 R08: 0000000000000004 R09: 0000000000000000
[  171.727287][ T9732] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
[  171.727295][ T9732] R13: 0000000000000000 R14: 00007f7e743b5fa0 R15: 00007fffc7c0d9f8
[  171.727309][ T9732]  </TASK>
[  171.727314][ T9732] Mem-Info:
[  171.728004][    T9] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 e9 10 d6 45 09 cc 66 66 66 66 66 66 2e
[  171.745249][ T9732] active_anon:5169 inactive_anon:0 isolated_anon:0
[  171.745249][ T9732]  active_file:1042 inactive_file:38276 isolated_file:0
[  171.745249][ T9732]  unevictable:1771 dirty:28 writeback:0
[  171.745249][ T9732]  slab_reclaimable:9685 slab_unreclaimable:56152
[  171.745249][ T9732]  mapped:17911 shmem:2443 pagetables:912
[  171.745249][ T9732]  sec_pagetables:0 bounce:0
[  171.745249][ T9732]  kernel_misc_reclaimable:0
[  171.745249][ T9732]  free:302108 free_pcp:16249 free_cma:0
[  171.747059][    T9] RSP: 0018:ffffc900000c77a8 EFLAGS: 00010206
[  171.750127][ T9732] Node 0 active_anon:13304kB inactive_anon:0kB active_file:2804kB inactive_file:15788kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:51932kB dirty:36kB writeback:0kB shmem:4796kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:7428kB pagetables:2212kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  171.752716][    T9] 
[  171.755391][ T9732] Node 1 active_anon:7372kB inactive_anon:0kB active_file:1364kB inactive_file:137316kB unevictable:3548kB isolated(anon):0kB isolated(file):0kB mapped:19712kB dirty:76kB writeback:0kB shmem:4976kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4272kB pagetables:1436kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  171.755811][    T9] RAX: dffffc0000000000 RBX: ffffffff8945af28 RCX: 53589ea7ac053000
[  171.757778][ T9732] Node 0 
[  171.760073][    T9] RDX: 0000000000000000 RSI: ffffffff8945af28 RDI: 000000000000004b
[  171.768923][ T9732] DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  171.770387][    T9] RBP: ffffffff8a71f325 R08: 0000000000000001 R09: 0000000000000000
[  171.775751][ T9732] lowmem_reserve[]:
[  171.776799][    T9] R10: dffffc0000000000 R11: ffffffff8a71f2e0 R12: 0000000000000000
[  171.784975][ T9732]  0
[  171.787740][    T9] R13: 0000000000000258 R14: 0000000000000258 R15: 0000000000000001
[  171.788663][ T9732]  815
[  171.790347][    T9] FS:  0000000000000000(0000) GS:ffff8880b8650000(0000) knlGS:0000000000000000
[  171.795144][ T9732]  815
[  171.796626][    T9] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  171.816067][ T9732]  815
[  171.828486][    T9] CR2: 00007ffd559ddbd8 CR3: 00000000359ce000 CR4: 00000000000006f0
[  171.889642][ T9732]  815
[  171.904002][    T9] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  171.940081][ T9732] 
[  171.941420][    T9] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  171.943895][ T9732] Node 0 
[  171.945757][    T9] Kernel panic - not syncing: Fatal exception
[  171.948823][    T9] Kernel Offset: disabled

VM DIAGNOSIS:
17:46:09  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900000c6fd0
R8 =ffff888108a90237 R9 =1ffff11021152046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac4918 R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fff7b12e5e0 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007f40839846a3 00007f40839846a3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=0000000000000000 00007f4083811b1f
XMM06=0000000000000000 00007f4083811b19 XMM07=0000000000000000 00007f4083811b2d
XMM08=0000000000000000 00007f4083811bb3 XMM09=0000000000000000 00007f4083811c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000000 RBX=ffff88813663b1c0 RCX=ffff88801fd0b980 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc90002f0f700 RSP=ffffc90002f0f5a0
R8 =ffffffff8fa10df7 R9 =1ffffffff1f421be R10=dffffc0000000000 R11=fffffbfff1f421bf
R12=1ffff11009608385 R13=dffffc0000000000 R14=0000000000000000 R15=ffff88804b041c28
RIP=ffffffff81b4d919 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f8fb10e7d60 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007f8fb05846a3 00007f8fb05846a3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=0a37362073757461 7473206874697720
XMM06=6465746978652070 6f6f6c0a29646574 XMM07=74696d7265702074 6f6e206e6f697461
XMM08=7265704f203a3120 6f6e72726528200a XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
