last executing test programs:

1.798734831s ago: executing program 2 (id=9304):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
r2 = socket$qrtr(0x2a, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'wlan1\x00'})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)={0x38, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x38}}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050003000000000000000600000008000300", @ANYRES32=r7, @ANYBLOB="0ab2a2f8730075143a7d11e0824ab516b6366d9cc9db7d3ae166d510fb42a158ee27c2830d9dc9f5115521a510274d683ec0e76b52df4496b9ab29320b0fd973237c18430a41c1c6d939094e71be62abf2008000007dd8d69f0b3a0c6b56619a969af3cac05e9db1d8920bd7de8fa2e45eb4f1694bd0f7bfeba59cb36d58f023fc30aa6960161feaf108b57a388448c565d3173000e6b9ea9e776c2f2fd5e3a96c2b6957b64eb9080f1fa7814d3c59aa053f26469561ace4dbeffe870ede40d315dad9ff48f81f6d87fe8e1d69b7804bf5440d025fbe8f271bf7c58c6d0c184fc7afe445a0a66782df257ebed1f64a7e2d70f5b5d0171eac20dc5c8989b61875449cb1dded69383793"], 0x28}}, 0x0)
r8 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0)
r9 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r9, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="00ff00", 'bond0\x00'}}, 0x1e)
sendmmsg(r9, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0)
r10 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000020000210d0000aaa8fa017242ba9380d412000000000000002900000003000000", 0xeb0e7a7d4c6f0553)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'bond_slave_0\x00', <r11=>0x0})
r12 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r12, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4)
setsockopt$packet_rx_ring(r12, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0xfffffffd}, 0x1c)
setsockopt$packet_int(r12, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4)
sendto$packet(r12, &(0x7f0000000540)="88edecd4bc53a32712428ed167f8f2557587b53eed307a893aed74d9a65e0603b5fcd174d72ec658a10adc77aea5d5a1f533a3ebea885d2dbaff369ab9c2e642afa53c4ee2278464923969fcebea9edc0a73ec037ac5c7e4b19580edc0c31be1d1171e3167e24c828ed3677fb5559c826692e2b349b56a382fe85d7389e201858feaacb0cb7c3bc4f5dae5152ffd822f1d6081ac1bf54910ea1c63f59d1b943dcf019ef6db90d00c13ddf967779e7d2abb", 0xb1, 0x1, &(0x7f0000000240)={0x11, 0x4, r11, 0x1, 0x40}, 0x14)
sendmsg$nl_route(r10, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=ANY=[@ANYBLOB="2000000010000104040000000000000000480000", @ANYRES32=r11, @ANYBLOB="ae1e0200956d32b864fd573bb48a57dd5500000000"], 0x20}}, 0x0)
r13 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$fou(&(0x7f0000000480), 0xffffffffffffffff)
sendmsg$FOU_CMD_ADD(r13, 0x0, 0x0)

1.483217333s ago: executing program 2 (id=9306):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'})
syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r3 = bpf$MAP_CREATE(0x0, 0x0, 0x17)
r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan1\x00', <r5=>0x0})
sendmsg$NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x44, r4, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x14}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x5}, 0x4880)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r3, &(0x7f0000000140), 0x0}, 0x20)
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000740)={'wlan1\x00', <r6=>0x0})
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000040)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
vmsplice(r8, &(0x7f00000000c0)=[{&(0x7f0000000000)="77690addcfbe1fbb66ec", 0xfd9c}], 0x1, 0x1)
r9 = socket$inet6_sctp(0xa, 0x801, 0x84)
setsockopt(r9, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000000", 0x8)
setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r9, 0x84, 0x5, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
splice(0xffffffffffffffff, 0x0, r8, 0x0, 0x10000008ebc, 0x0)
splice(r7, 0x0, 0xffffffffffffffff, 0x0, 0x80000025a5, 0x0)
close(0x3)
close(0x4)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r12=>0x0})
r13 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r13, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0)
r14 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r14, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYRESOCT=r10, @ANYRES32=r6, @ANYBLOB="05005b"], 0x24}}, 0x0)

1.339922012s ago: executing program 1 (id=9308):
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff)
sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, 0x0, 0x40800)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000000000cc0006"], 0x138}}, 0x4)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$IPCTNL_MSG_TIMEOUT_GET(r1, &(0x7f0000000500)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000600)={0x5c, 0x1, 0x8, 0x801, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_TIMEOUT_DATA={0x24, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_COOKIE_WAIT={0x8, 0x2, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_SCTP_CLOSED={0x8, 0x1, 0x1, 0x0, 0x80}, @CTA_TIMEOUT_SCTP_ESTABLISHED={0x8, 0x4, 0x1, 0x0, 0xa}, @CTA_TIMEOUT_SCTP_COOKIE_ECHOED={0x8, 0x3, 0x1, 0x0, 0x34}]}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_SHUTDOWN_SENT={0x8, 0x5, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_SCTP_SHUTDOWN_RECD={0x8, 0x6, 0x1, 0x0, 0x7}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x888e}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88e7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4008001}, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_PRIORITY={0x8}]}, 0x24}}, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newrule={0x30, 0x20, 0x301, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_OIFNAME={0x14, 0x11, 'xfrm0\x00'}]}, 0x30}}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001940)={0x3c, 0x48, 0x1, 0x0, 0x0, {0xa, 0x0, 0x6e80}, [@typed={0x8, 0x100, 0x0, 0x0, @u32}, @nested={0x14, 0x1, 0x0, 0x1, [@generic="0d2a79075827af5aa534d6815c2e93f1"]}, @nested={0xa, 0x2, 0x0, 0x1, [@generic="b4e27551be74"]}]}, 0x3c}}, 0x20048800)
bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0xe, &(0x7f0000000700)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000001b6504040001001f000404000001007d60b7030000000000006a0a00fe00000102850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9bf0bdf81524f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6cd87cef9000000a39c15a7ef365cc27dfeac7b9b0e9048517354b0ca4f9cf8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19ea2eb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc089a9813c1efa26001b3f486ebfaae85c4d0b96778478ae5355e6f923b11056969f486f80a35f7f2339704fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d0000000000000000000000004e1fa60acabcf0553910ca2e5ea499fd5889dde9261f0848a5b8af657bfc96049308e8953431b269053627a1523551c160c813969925a892d266792352ec0204596a37ce8d6d260b32239bddbce2e79f93cb5a0ad897adb53b397d07c50f84b74f2605a565ee149016aa75ea31c0087dcd821b47c8b36efc6da4fb2ea7f1f36c85856b73ac9872babc62149699b6b8c796a79d833eb4b5ca668d430db5653a2b3c5b87e17ca1e9f90e68d484c726a5db5a1758a08200f667452754e2d53543"], &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4}, 0x8, 0x10, &(0x7f0000000480), 0x10}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r8=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=ANY=[@ANYBLOB="8b05000000bf000000be474c5e67a4f996155ef6c98b0a200800fedb8e2ab60000000000", @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB="0800050003000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)={0x60, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x30, 0xe, {{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @val={0x3c, 0x4, {0x0, 0xd5, 0xb4, 0x6}}, @void, @void, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4007965}, @crypto_settings=[@NL80211_ATTR_SAE_PASSWORD={0x4}]]}, 0x60}}, 0x0)

1.272919558s ago: executing program 2 (id=9309):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan4\x00', <r2=>0x0})
sendmsg$NL802154_CMD_DEL_SEC_KEY(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x42002180}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xfc, r1, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_KEY={0x94, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "2235b66b82c24843f886a6523e66f9c293e9eb8d774e319a5f9c30261dfaf5eb"}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "a3be746886b375d407c52be3a7f6d2b1e8f413c2566383978a04a36302bf2d70"}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "9d3e9d651e15348b8c3c80749eb7769b7da7af7dc3292494e42e1b5de4ad2e59"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "7ca955270e7e327c493e85595faa1e74"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x2}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x6}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_SEC_KEY={0x28, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x24, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x1}]}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000280), r0)
ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=<r4=>0x0)
sendmsg$NFC_CMD_FW_DOWNLOAD(r0, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r3, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000095)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000400)={'wpan3\x00'}) (async)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000400)={'wpan3\x00', <r5=>0x0})
sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r0, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, r1, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x8840}, 0x4040) (async)
sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r0, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, r1, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x8840}, 0x4040)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
r7 = accept4(r6, &(0x7f0000000500)=@pppol2tpv3in6={0x18, 0x1, {0x0, <r8=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, &(0x7f0000000580)=0x80, 0x800)
recvmsg(r8, &(0x7f0000000800)={&(0x7f00000005c0)=@generic, 0x80, &(0x7f0000000740)=[{&(0x7f0000000640)=""/254, 0xfe}], 0x1, &(0x7f0000000780)=""/83, 0x53}, 0x2000)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_TDLS_OPER(r9, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000900)={&(0x7f0000000880)={0x54, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2418fb61, 0x16}}}}, [@NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x2}, @NL80211_ATTR_MAC={0xa}]}, 0x54}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4000000)
socket$l2tp(0x2, 0x2, 0x73)
r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r11 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000009c0), r0)
sendmsg$NLBL_MGMT_C_PROTOCOLS(r10, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x1c, r11, 0x4, 0x70bd2d, 0x25dfdbfb, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4f334eb0e8ece383}, 0x300000d0) (async)
sendmsg$NLBL_MGMT_C_PROTOCOLS(r10, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x1c, r11, 0x4, 0x70bd2d, 0x25dfdbfb, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4f334eb0e8ece383}, 0x300000d0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000ac0)='syz0\x00', 0x200002, 0x0) (async)
r12 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000ac0)='syz0\x00', 0x200002, 0x0)
openat$cgroup_type(r12, &(0x7f0000000b00), 0x2, 0x0) (async)
openat$cgroup_type(r12, &(0x7f0000000b00), 0x2, 0x0)
socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000b40), 0x4)
getsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000b80), &(0x7f0000000bc0)=0x4)
bind$inet6(r7, &(0x7f0000000c00)={0xa, 0x4e20, 0x80, @local, 0x6}, 0x1c) (async)
bind$inet6(r7, &(0x7f0000000c00)={0xa, 0x4e20, 0x80, @local, 0x6}, 0x1c)
r13 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000c80), r0)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r10, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x38, r13, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x8040)
socket$l2tp6(0xa, 0x2, 0x73) (async)
r14 = socket$l2tp6(0xa, 0x2, 0x73)
bind$l2tp6(r14, &(0x7f0000000d80)={0xa, 0x0, 0x4, @mcast2, 0x8, 0x1}, 0x20)
ioctl$VFAT_IOCTL_READDIR_BOTH(r12, 0x82307201, &(0x7f0000000dc0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001180)={@map, 0xffffffffffffffff, 0x15, 0xc}, 0x20) (async)
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001180)={@map, 0xffffffffffffffff, 0x15, 0xc}, 0x20)

1.271159227s ago: executing program 1 (id=9310):
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
listen(r0, 0x400004)
r1 = socket(0xa, 0x3, 0x3a)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4d, 0x0, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x20, 0xfd, [0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x4, 0x2]}})
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
r3 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, @remote, @empty, 0x7800, 0x80, 0xfffffffc, 0xdc67}})
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kfree\x00', r4}, 0x10)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', 0x0})
connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0xfffffffc, @loopback, 0xfffffffa}, 0x1c)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r5, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f000000010000000058000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1)
setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000200)=ANY=[@ANYBLOB="7307000000000000072000000002060f060008000000000000000f000000000000000500000000000000c204000000f1010700000000000000c20400018001c2040000000800000082"], 0x48)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000040)={0x14, 0x4, 0xa, 0x101, 0x70bd28, 0x25dfdbff, {0x1, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x2004d805}, 0x8000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x4, 0xfa, &(0x7f00000007c0)=""/250}, 0x90)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0xe6c, 0x30, 0x25, 0x0, 0x0, {}, [{0xe58, 0x1, [@m_pedit={0xe54, 0x1, 0x0, 0x0, {{0xa}, {0xe28, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x4}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x7}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x0, 0x3}, {0x0, 0x2}, {}, {}, {}, {0xfffffffc}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x100000}, {}, {}, {}, {0x7}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {0x0, 0x800000}, {}, {}, {0x0, 0xea3}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffd}, {0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe6c}}, 0x0)
r8 = socket$nl_route(0x10, 0x3, 0x0)
pselect6(0x40, &(0x7f0000000140)={0x5, 0x6, 0x8, 0x8, 0x0, 0x2, 0x0, 0x8}, &(0x7f0000000180)={0x9, 0x2, 0x7fff, 0x22c, 0x5, 0x0, 0xa9e, 0x7}, &(0x7f00000001c0)={0x7fffffff, 0x9, 0x81, 0xa1, 0x3, 0xff, 0x1, 0xffff}, &(0x7f0000000200)={0x77359400}, &(0x7f00000004c0)={0x0})
sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
socket$inet6_sctp(0xa, 0x1, 0x84)
r9 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r9, &(0x7f0000000000), 0x10)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)

1.179340688s ago: executing program 2 (id=9311):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
pipe(&(0x7f0000000180)={<r4=>0xffffffffffffffff})
ioctl$VHOST_VDPA_SET_GROUP_ASID(r4, 0x4008af7c, &(0x7f00000001c0)={0x1, 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61123400000000006113500000000000bf200000000000001500000008ffffffbd030100000000006f000000000000006916320000000000bf670000000000001706000007ff07006706000002000000070600000ee60000bf050000000000002e650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070500000419311f2d4301000000000095000000000000000500000000000000950000000000000032ed3c5be95e76b67754bb12dc8c27df8ecf264e0f84f9f17d3c30e3c72fe9755ba08554bb4f2278af6d71d79a5e12810a089dc1d4681d295c45a674f888a08034b7dd399703d6c4f633a9a4f16d0a3e1282ee45a010fb94fa9de56c9d8a814261bdb94a6538b89dc6c60bf70d742a81b72bab8395fa64810b5b1bfd3782519518c51231422bb8fab4d4d897db2c544c0ec50b8eac8c63d2b1cd06a39702bd547f5ebaa6954f01cef3c9bacec15e2e3b2bd352e93a2aadfe8efe33ff2f8ee5476d4ef7a6f0c4704403b9bad2b648e90fff24f69a5ef05f5408ea197ed09a9510ee6063229de2984abdd46ea3ec78e3127002ed37c2564b8f8a621483fb2a5ff221e0d831d64759d17b8c59d0f2b0727f6b7958fb5b939af4be5e55a95f8c6d785a91c7c3f0c17ae7f9ac5ff05f5ecddf0cef90d50e763be96496661c749e21ab63a1f50b30a65a9027ba357bf8c614497ee59b68bf6a5d45c81c567e347d54574164bbea3e7b7f8a13cce7014137f250370b8a70ae3eaf736f17759c3886871e97d063b7f26eed3226bb0b9ee6320a2b02fea7a06a0e37182adf4b1be6f29358d4f5dfec405bde000000000000000000000000000000902e647cc5962eccaad64429335f3ce2a10ce72da82875427c1d16db24dca08487ba41a3fb337f8432d8176a515229e32ee11a1dd23dac038f989eafdd67f60b63f7be4d1bf325b57335b9973c73bfa89517a98b1fc15f8a2713718feb01059d8b570a0000e3b2a93bd745a74f9bf7f7abc5d15d56331055cc0820c5c9d676d92557c4e47cfbe27f91f0eb18e21dfdab3c84ec11377fbbfd1e000000000000b542a536559eed87b58edcfee83a50077ee0e8fb6e787cb3076dfeeb79f55927fef9651e176b40e64740a01944577caea4ceb9e907cec36a8429445c833b9d24d53dc91f15af1f4a1db9fa452fa3f0b812355aab5b58659ffd56034fdbb169f3e86660acdc65dc699d3e6364a80f45e54d6efcb99b41a080494f842706f3c1716d2e252bf89663393356296d89fbf95aa7966fa700b710008311d6f25e05f77d68799e671d90cb04131742790941d83ffdfa857e9e085a59a78e7a17f008ce55866fcc4de388f270a1ba675f43481bd2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e40)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x50}, 0x0)
r5 = socket(0x400000000010, 0x3, 0x0)
r6 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@delchain={0x24, 0x66, 0x221, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {}, {0xb, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004800)
syz_genetlink_get_family_id$fou(&(0x7f0000002bc0), r5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r8, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="020000000400"})

1.072036395s ago: executing program 1 (id=9312):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000080)={0x7, {{0xa, 0x4e20, 0xe0, @mcast2, 0x138e}}, {{0xa, 0x4e21, 0x9, @private2, 0x4}}}, 0x108) (async)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f00000005c0)={0x8, {{0xa, 0x4e24, 0x5, @mcast2, 0x6d00}}, {{0xa, 0x4620, 0xfffffff8, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8000}}}, 0x108) (async, rerun: 64)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) (async, rerun: 64)
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) (async)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
listen(r2, 0x2) (async)
r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$sock_buf(r4, 0x1, 0x39, 0xffffffffffffffff, &(0x7f0000000100))
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26}, 0x28) (async)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000240)='syzkaller\x00', 0xd, 0x0, 0x0, 0xc1000, 0x5c, '\x00', 0x0, 0x0, r5, 0xc, &(0x7f00000000c0)={0x0, 0xffffffff}, 0x8}, 0x94) (async)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) (async)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000005c0)={@cgroup, 0xffffffffffffffff, 0x2a, 0x2010}, 0x20) (async)
r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x18) (async)
ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) (async)
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x80, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x8, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) (async)
r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000003c0), 0xffffffffffffffff)
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000400)={0x0, @local, @multicast2}, &(0x7f0000000440)=0xc)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0xd871021}, 0xc, &(0x7f00000004c0)={&(0x7f0000000700)={0x60, r8, 0x4, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x28, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xff}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async)
ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x37, 0x800000, 0x8, 0x9, 0x8000})
write$bt_hci(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x6) (async)
socket$inet_sctp(0x2, 0x5, 0x84) (async)
write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8)
write$rfkill(r1, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8)

1.069348482s ago: executing program 1 (id=9313):
syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="9115463ecc790180c20000030806000108000604"], 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', <r1=>0x0})
sendto$packet(r0, &(0x7f0000000580)="f257a8ea7bc273dfaeab96850806", 0xe, 0xc4, &(0x7f0000000200)={0x11, 0x6, r1}, 0x14)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$unix(0x1, 0x2, 0x0)
r4 = socket(0x5fb31a389fbd9721, 0x80000, 0xfffffffb)
setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x5, 0x0, 0x0, 0x4}, 0x10) (async)
write(r4, &(0x7f00000000c0)="1c0000001e005f0214fffffffffffff8070000001d00000000000340", 0x1c)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async)
r5 = socket$kcm(0x10, 0x3, 0x0)
sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000080)="2e00000010008388e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}, {&(0x7f0000000340)="bca2898d9ef53a2478ad550babb9ec66eadb4f8e6f67ca9bf1a33df6984e7977e787d7d7a0f625f45cada6697ae2d7ee474eb1a16d0fe1918d83068684ebe47beca021deadf1bfd8349cc9f90d3f0cf8f638e176d431c64621b08b6d221abbc815aac96725338136a2a556e9656c0a9f77d576", 0x73}, {&(0x7f00000003c0)="34332e9b419721bf12194e9c446d28a750d1f83b4bfac0dc8840be159f2c2583b53f1da7f579eccbea1eb4e2237983a525ad398d37494e2f2cc4baa3f6cf9441d5a73b9bb1582413ab0cf5745c2abd3f412d4fe797e7af723bb0dcc7afc122ee3f36fc2bba7c80d57cab4460bacf51f615ff2a4bf0849e2186f64c195ffb6fa2e9aa8ea90a0e5ff7eb", 0x89}, {&(0x7f0000000480)="56b99e77575316ddd99ae9588a9353014de06d8c9c3988f74ca39bfb5d96c68dd184ade94d2134e369bdab8b599a8e997853bb57d9ea36b266d8dffc0ee5eb56f9372e98c5ffcfc103fbad04a2dfd5745c8510e66204e192615d9967ab256c882ec490985eb404463f732db9f89770879298a30c1c98317482ff58e96f559bf49c691675a435d6b3b2424ebd5b2076219399d35dc32e2112c92b1b0a3e41dba144bb2c", 0xa3}, {&(0x7f0000000640)="e6c97c4c3d9ac97bfbde8a02a26ec2809ee6648c35dd5ad15b3f12d7ebd912ee59911b009fbf0c41b698b6348525d2b8472b24b9ac978048ba29a0ec7f93a0dc0d701b07382792badcdf350432c463a61c337d41f4bcaff7d72b6356008933a52bb369962ea32319ed08c935086f640ececcd281e57dccafefc2b7b7b6ffb6bc4491495c9b06d90a7590f2", 0x8b}, {&(0x7f0000000700)="f9faab02a046b7ad1ca414fdb98251f435652592fc785e815e02fa7a4b0adbb1379d0d1786ce9500bc179e2c5b345057423cd8c2a630dfed7f08bc9824c851958dac5c35c0370cc485fb057f6823262612a21c1d58fed3f90a4e028db3749eb23e9e4215bfaa38869fd1f5a7e7d9ba84e830503ccd9141c5d4a6670e227b5dd107cdf053d41cc312107b0a8413bd313daf5aa15ef97edad121c7f90290e3cf26240dae361a5bbfb55f39663a4ef6522d1a4ba41315426d8fbbfacb604e4e250ccbe92b3c9de0c1dc1d614e1db5dd40ce75bbca30df89366819dab5166c91a5e7211b549def1973f552e43cdb48ff", 0xee}, {&(0x7f00000002c0)="e08fa4487dc545389c00e5d8b6e202ef3b5a651840a8b466d57a18799c22b0f80859a3eea0106d03d5", 0x29}, {&(0x7f0000000a00)="0c992ecdcf4f7d1d8fcb60cf3e7087178493d2fdeb3809741d9523d240c487797d6833c1ffe8641c41bf7966d3c314710fff03fc658c5844a52362bebc2a9e4568f2e7290e4f21bf37d34855905ee9efb8563014aaf3cb698ecd22b3be7856", 0x5f}, {&(0x7f0000000800)="c0e417c1b564628e059cde00c45c5e0a34333971e175a43c040a62a0b25ab539184af01eaa80039d1cb6ca4dd6e1ce244551674a26bcbb966ca759745cfbc0617868181bd6d55afad32253155b3c5d6d3f304dacd0969b101b7aff0897b1b3a788db7a8b571940d91f584b034f14a12fbc15669139751ac7ed576ab8d67aad709d8fd97f37097df30fce2504eb710cb35df515468ef2c5a1d1574a82dffcab756d50673b6f42b5b01cab", 0xaa}, {&(0x7f00000008c0)="153cd6e5e25dc065da01a7e25496cdd4f883b8144b33ee7abc4739bd1ff4f8e0ccb70a8a599a61d2c1037c3f307c1eef059131c0b7479883dc63b6a878fdf9fda7682d9efb523f07d2b9e321965c284d4ea14c991db9", 0x56}], 0xa}, 0x0) (async)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan1\x00'})
bind$802154_raw(r4, &(0x7f0000000100)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0202}}}, 0x14)
sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x4048045) (async)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
sendfile(0xffffffffffffffff, r5, &(0x7f0000000240), 0x4b) (async)
r7 = socket$netlink(0x10, 0x3, 0x0) (async)
r8 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'bridge0\x00', <r9=>0x0})
sendmsg$nl_route(r7, &(0x7f0000002c80)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="300000001c000100000000000000000007000000", @ANYRES32=r9, @ANYBLOB="40003a000a000200ffffffffffff000008000f"], 0x30}}, 0x0) (async)
sendmmsg$inet(r2, &(0x7f0000001640), 0x400026d, 0x20040000) (async)
socket$rds(0x15, 0x5, 0x0) (async)
r10 = socket(0x15, 0x5, 0x0)
getsockopt(r10, 0x200000000114, 0x271f, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) (async)
setsockopt$sock_int(r6, 0x1, 0x200000010, &(0x7f0000000000)=0xb, 0x4)
recvfrom$unix(r6, 0x0, 0x0, 0x10102, 0x0, 0x0)
getsockopt$XDP_MMAP_OFFSETS(r4, 0x11b, 0x1, &(0x7f0000000180), &(0x7f0000000200)=0x80)
close(0xffffffffffffffff) (async)
socket$nl_netfilter(0x10, 0x3, 0xc)

1.012999656s ago: executing program 2 (id=9314):
r0 = socket$netlink(0x10, 0x3, 0x10)
bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4)
syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0)
bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000b00)=@base={0x6, 0x4, 0x70be, 0x2005c, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50)
connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4001, 0x0, @loopback}, 0x1c)
r1 = socket$netlink(0x10, 0x3, 0x10)
setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
write$tun(r2, &(0x7f0000000180)={@void, @void, @mpls={[{0x9, 0x0, 0x1}, {0x4}, {0x7d7}, {0x1, 0x0, 0x1}, {0x86}, {0xe, 0x0, 0x1}, {0x4}], @generic="ec545d9a8127bba050fb74d7ff3227090f4379c897bda0cad19d1edc0339e25ebb48789bd3027f197748d9932bd3f17eb1dd6f124a4802c9009a3800a90137899b297af07bf5e8d44c7fd3d6369f2fed14482d234e19d527cd99d40824490cf05da5d90e843e0693feb871ba6656d4dc983e8db366f706c9bbe07be3f759f825ba1b1e37fc9c09dc6ecee67d2bdf3a7d243d3f38da08623d089335d59fc4b9b7b09ff0ec74113ab0d1cf4822e1df91abe4b0abc8e1baedbf26d9b6e3b2cd508924b1bdf9d37bc525508a779a29423bdbd9fedbe727ba7caceac0fb7a48cc4368"}}, 0xfc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, 0x0, 0x0)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x2, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$L2TP_CMD_SESSION_GET(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000006000000140008"], 0x28}}, 0x8000)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
socket(0xa, 0x3, 0x3a)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002d00010026bd7000fcdbdf25040000fc0b000c00"], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4000804)

1.009836958s ago: executing program 1 (id=9315):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="20000000100001040000000000000000004800ae", @ANYRES32=r1, @ANYBLOB="ae1e020000008000a3a515817b3a61f7ff341de2517b68782d08c545bd755508fa75a55d810000007cdb5b5892b9b969013ac891abbd934147ef04b60bdeda2abafe1861a79f224dfbb398eab96146c87528fea055f06d3506ee55856779244155d3dcae7c6705171aa94264060680bdc56243b7e66267c88c1fc07ec5065c701c71e6babc413f1728f9c1bbfeee782e1d834d7fcc3b50"], 0x20}}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.events\x00', 0x26e1, 0x0)
close(r3)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0))
sendmsg$NFT_MSG_GETCHAIN(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="34000000040a010200000000000000000700000908000540010000000900030073037a32000000008000050073797a300000000011b0b48ba53cca657b1eef4fd39485105d6710d6248327344d86366cc3f29bf831bc27a58f1ab66f1cb399c2ac2f243d15c6c8caacec5ed879de7f542414665cf0a0fb8ad0035645cc50a3381583a3dae04015fdeda811d09a56b59ee6df866151b38b1ece382c00dea6b63ee3b2823e01df02a1e909eb14c5a597c99bacbb55ace9f63879c08ac9da13b2f1a9a46d6f539a7d19c827ca707725e7a419bfc3b5fa03858d804dada5dc"], 0x34}, 0x1, 0x0, 0x0, 0x2}, 0x4040001)
ioctl$SIOCSIFHWADDR(r3, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"})
sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="300000001000010000003a194618d96d6d2e8553", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x0)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x12}]}}]}, 0x38}}, 0x40)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r6=>0xffffffffffffffff})
recvmsg(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x2)
recvmsg$unix(r6, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x20000121)
setsockopt$sock_void(r6, 0x1, 0x3f, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00'})
sendmsg$kcm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0)

663.002034ms ago: executing program 0 (id=9317):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r2)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x3c, 0x8, 0x0, 0xff80}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), r1)
sendmsg$FOU_CMD_DEL(r5, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x2c, r6, 0x13c, 0x70bd26, 0x25dfdbfe, {}, [@FOU_ATTR_AF={0x5}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c0)
syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000000340)=@default_ap_ssid, 0x6, 0x2)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r8, 0x800442d4, &(0x7f0000002600)=0x2)
ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000400)={'wlan0\x00', <r9=>0x0})
syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
r10 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IP_VS_SO_SET_FLUSH(r10, 0x0, 0x485, 0x0, 0x0)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r7, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRESDEC=r3, @ANYBLOB="01002bbd7000fbdbdf252100000008000300", @ANYRES32=r9, @ANYBLOB="a29e73ad41643e104c916fc966749fbe53227e574a2747cd768dd00ea0f4bf493714345f419df629886bf0a13a97f5e34c109ae7c649a050ea4d3ea43961a6007c1674e79a267dc5be7897c84a89a72097bc2cf211a7ea330c86604e"], 0x1c}, 0x1, 0x0, 0x0, 0x24004084}, 0x40000)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', <r11=>0x0})
ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000280)={r1})
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="600000001000ffff27bd7000ebdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="137c0300231a0500400012800e0001006970366772657461700000002c0002801400060000000000000000000000ffff7f000001140007000000000000000041fffffffffffffffe"], 0x60}, 0x1, 0x0, 0x0, 0x1}, 0x20040000)

573.05018ms ago: executing program 0 (id=9318):
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000080)={'ip6gre0\x00', <r1=>0x0, 0x2f, 0xe8, 0xa8, 0x6, 0x53, @mcast1, @private2, 0x20, 0x8000, 0x0, 0x4}})
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-160\x00'}, 0x58)
r3 = accept4(r2, 0x0, 0x0, 0x0)
r4 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$inet(r4, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x34004811)
r5 = socket$inet6_mptcp(0xa, 0x1, 0x106)
connect$inet6(r5, 0x0, 0x0)
r6 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08061cdc030ec080fffffffe0000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f2130809d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff000000000000000000", 0x89}], 0x1}, 0x0)
recvmsg(r3, &(0x7f0000000c00)={0x0, 0x0, 0x0}, 0x2000)
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'lo\x00', <r8=>0x0})
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xffe0, 0x10}, {0xd}, {0xe, 0x10}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0)
sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0xd0f, 0x0, 0x25dfdbfb, {0x60, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}}]}, 0x30}}, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="060034c37f438b59fbf107d82edd000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=r1, @ANYRES32, @ANYBLOB="04000000010000000100"/28], 0x50)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=ANY=[@ANYBLOB="3c0000001800ef0100000000000000000a00000000000000000000000c00090008000000", @ANYRES32=r8, @ANYBLOB="1400050000000000000000000000e3"], 0x3c}, 0x1, 0x11}, 0x0)

452.911084ms ago: executing program 0 (id=9319):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', <r2=>0x0})
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000040)=ANY=[@ANYBLOB="8b0e25c38abfbde20e76cbb6577aa8c9ebf84f38c8619942aa93ba7c2b7b044ac324315fc7c6606d6ba543b8d7e89343cbdb046e34c7", @ANYRES16=r1, @ANYBLOB="01002cbd7000fbdbdf250f00000008000300", @ANYRES32=r2, @ANYBLOB="08003c00018000000500370000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)

371.204195ms ago: executing program 0 (id=9320):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000019", @ANYRES16=r1, @ANYBLOB="01000000000000000000300000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030001000000"], 0x3c}}, 0x48800)
syz_genetlink_get_family_id$tipc(&(0x7f0000000340), r0)
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f00000000c0)={0x2, 0x7ff})
r3 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', <r4=>0x0})
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
r7 = socket(0x10, 0x803, 0x0)
getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r9 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r8, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0)
r10 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r10, 0x0, 0x0)
sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000)
r11 = socket(0x1, 0x803, 0x0)
getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, <r12=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@delneigh={0x1c, 0x1d, 0x20, 0x70bd26, 0x25dfdbfc, {0x1c, 0x0, 0x0, r12, 0x49, 0x4, 0xb}}, 0x1c}, 0x1, 0x0, 0x0, 0x600}, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x2c}}, 0x0)
setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f0000001740)={0xd92, {{0xa, 0x4e20, 0x7fff, @private1, 0x10}}, {{0xa, 0x4e21, 0x5, @mcast1, 0x449a}}}, 0x108)
r13 = socket$netlink(0x10, 0x3, 0x0)
r14 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="58000000020601020000000000000000000000000900020073797a32000000000c000780050014003200000005000100070000000500040000000000110004da06afba1ae1cf3f5e625fd9e085350300686173683a69702c706f7274000000000500050002000000"], 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x0)
r15 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r15, 0x1, 0x27, &(0x7f0000000240)=0x5, 0x4)
sendmsg$nl_route_sched(r13, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r4, {}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4, 0x0, 0x1], 0x24, [0x5, 0x4, 0x2, 0x9, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x3], [0xffff, 0x8, 0x0, 0x0, 0x1, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}]}}]}, 0x8c}}, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002c00)={&(0x7f0000002a80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x4, [{0x0, 0x1, 0xe3}]}]}}, 0x0, 0x32, 0x0, 0x1, 0xffffffff}, 0x28)

232.577803ms ago: executing program 0 (id=9321):
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
listen(r0, 0x400004)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async)
sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xe}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) (async)
r2 = socket(0xa, 0x3, 0x3a)
ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4d, 0x0, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x20, 0xfd, [0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x4, 0x2]}}) (async)
r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async)
r4 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, @remote, @empty, 0x7800, 0x80, 0xfffffffc, 0xdc67}}) (async)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kfree\x00', r5}, 0x10)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', 0x0})
connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4001, 0xfffffffc, @loopback, 0xfffffffa}, 0x1c) (async)
r6 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r6, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f000000010000000058000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1)
setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f0000000200)=ANY=[@ANYBLOB="7307000000000000072000000002060f060008000000000000000f000000000000000500000000000000c204000000f1010700000000000000c20400018001c2040000000800000082"], 0x48)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000040)={0x14, 0x4, 0xa, 0x101, 0x70bd28, 0x25dfdbff, {0x1, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x2004d805}, 0x8000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x4, 0xfa, &(0x7f00000007c0)=""/250}, 0x90) (async)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0xe6c, 0x30, 0x25, 0x0, 0x0, {}, [{0xe58, 0x1, [@m_pedit={0xe54, 0x1, 0x0, 0x0, {{0xa}, {0xe28, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x4}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {}, {0x0, 0x0, 0x2}, {}, {}, {}, {0x4}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x1}, {}, {}, {0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, {0x0, 0x7}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x2}, {}, {}, {}, {0xfffffffc}, {}, {}, {}, {0x0, 0xfffffffd}, {}, {}, {0x0, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x100000}, {}, {}, {0x0, 0x0, 0x0, 0x7}, {0x7}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x4, 0x0, 0x500}, {}, {}, {0x0, 0x800000}, {}, {}, {0x0, 0xea3}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {}, {}, {}, {0x0, 0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x800}, {}, {}, {}, {0xfffffffd}, {0x0, 0x0, 0x1}, {}, {0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x200}, {}, {}, {0x0, 0x0, 0x10001}, {}, {}, {}, {0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {0x4}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe6c}}, 0x0) (async)
r9 = socket$nl_route(0x10, 0x3, 0x0)
pselect6(0x40, &(0x7f0000000140)={0x5, 0x6, 0x8, 0x8, 0x0, 0x2, 0x0, 0x8}, &(0x7f0000000180)={0x9, 0x2, 0x7fff, 0x22c, 0x5, 0x0, 0xa9e, 0x7}, &(0x7f00000001c0)={0x7fffffff, 0x9, 0x81, 0xa1, 0x3, 0xff, 0x1, 0xffff}, &(0x7f0000000200)={0x77359400}, &(0x7f00000004c0)={0x0}) (async)
sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) (async)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
socket$inet6_sctp(0xa, 0x1, 0x84) (async)
socket$can_bcm(0x1d, 0x2, 0x2)

117.025369ms ago: executing program 0 (id=9322):
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
listen(r0, 0x400004)
r1 = socket(0xa, 0x4, 0x3a)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4d, 0x0, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x20, 0xfd, [0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x4, 0x2]}})
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
r3 = socket(0x10, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', <r4=>0x0, 0x0, 0xb, 0x0, 0x0, 0x0, @remote, @empty, 0x7800, 0x80, 0xfffffffc, 0xdc67}})
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kfree\x00', r5}, 0x10)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', 0x0})
connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4001, 0xfffffffc, @loopback, 0xfffffffa}, 0x1c)
r6 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r6, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f000000010000000058000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1)
setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, &(0x7f0000000140)=ANY=[@ANYRES32=r4], 0x48)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000400)=ANY=[@ANYBLOB="14000000040a010128bd70000008b718d09fc8d56d2d305cf963d7ff0532e911802426ef0400000000000000fd75e96eb9aa0b8644085e1c51a3a662527d56902b2177dfccdf26c0a8d6927256b5d16ae3ef82fe4d366db4c424fb113987147a2a762eeaff607687e1c480047fabc58c6be643b57ceec20645a1eff5ad1d3efd4105f5a74c89720db88b06537598ca5c6362f8e44ab5d40b356a49b836147bcd5687a6440ae8deef80695dbbfe6ef972b63fead87b6b46f23326e0b2e798922848f34333b2882d11aa685600d1c8fc3eeb38559393673642f100"/230], 0x14}, 0x1, 0x0, 0x0, 0x2004d805}, 0x8000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x4, 0xfa, &(0x7f00000007c0)=""/250}, 0x90)
bind$tipc(0xffffffffffffffff, 0x0, 0x0)
unshare(0x6a040000)
socket$can_raw(0x1d, 0x3, 0x1)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000100)='nv\x00', 0xfff2)
r9 = syz_init_net_socket$ax25(0x3, 0x5, 0xc5)
ioctl$sock_SIOCINQ(r9, 0x541b, 0x0)
bind$inet6(r8, &(0x7f0000d84000)={0xa, 0x2, 0x3, @loopback, 0x8}, 0x1c)
setsockopt$inet6_tcp_int(r8, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
sendto$inet6(r8, &(0x7f00000000c0)="b2", 0x1, 0x24008844, &(0x7f0000000040)={0xa, 0x2, 0x80398, @empty, 0xfffffffe}, 0x1c)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0)
shutdown(r8, 0x1)

110.545149ms ago: executing program 1 (id=9323):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x0, 0x0, 0x0, 0x2}, 0x94) (async)
r1 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) (async)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), r2) (async)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@dellink={0x34, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) (async)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'ipvlan1\x00', <r6=>0x0})
sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000b80)={0x24, r3, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x802}, 0x8080) (async)
setsockopt$inet6_int(r1, 0x29, 0x38, &(0x7f0000000040)=0x8, 0x4) (async)
recvmmsg(r1, &(0x7f0000004940)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x2, 0x0) (async)
sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) (async)
getsockopt$inet6_buf(r1, 0x29, 0xd2, 0x0, 0x0) (async)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004000000130317"], 0x328}}, 0x84)

0s ago: executing program 2 (id=9324):
r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r1)
sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)={0x28, r2, 0x101, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x84)
sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002d00010000000000fcdbdf250401f280080018000bac0f"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0)

kernel console output (not intermixed with test programs):

4 bytes leftover after parsing attributes in process `syz.0.7749'.
[  725.509841][ T6326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7749'.
[  725.514504][ T6326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7749'.
[  725.517490][ T6326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7749'.
[  725.522830][ T6326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7749'.
[  725.526936][ T6326] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7749'.
[  725.733640][ T6351] tipc: Resetting bearer <eth:syzkaller0>
[  726.048636][ T6390] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  726.052555][ T6390] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  726.154692][ T6401] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  726.404477][ T6412] validate_nla: 10 callbacks suppressed
[  726.404488][ T6412] netlink: 'syz.1.7765': attribute type 10 has an invalid length.
[  726.837271][ T6439] netlink: 'syz.0.7770': attribute type 9 has an invalid length.
[  727.003108][ T6446] netlink: 'syz.2.7773': attribute type 10 has an invalid length.
[  727.101640][ T6454] netlink: 'syz.2.7774': attribute type 10 has an invalid length.
[  727.173773][ T6459] netlink: 'syz.2.7777': attribute type 5 has an invalid length.
[  727.176757][ T6459] netlink: 'syz.2.7777': attribute type 12 has an invalid length.
[  727.181075][ T6458] netlink: 'syz.1.7776': attribute type 16 has an invalid length.
[  727.183848][ T6458] netlink: 'syz.1.7776': attribute type 17 has an invalid length.
[  727.313593][ T6464] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  727.317045][ T6464] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  727.320806][ T6464] tipc: Resetting bearer <eth:syzkaller0>
[  727.490871][ T6480] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check.
[  727.875762][ T6517] tipc: Resetting bearer <eth:syzkaller0>
[  727.891964][ T6517] tipc: Resetting bearer <eth:syzkaller0>
[  728.032588][ T6523] netlink: 'syz.2.7791': attribute type 1 has an invalid length.
[  728.037964][ T6523] netlink: 'syz.2.7791': attribute type 1 has an invalid length.
[  728.776771][ T6559] batadv1: entered promiscuous mode
[  728.778871][ T6559] batadv1: entered allmulticast mode
[  729.287574][ T6595] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  729.296003][ T6595] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  730.268621][ T6636] batadv1: entered promiscuous mode
[  730.271122][ T6636] batadv1: entered allmulticast mode
[  730.358210][ T6637] syzkaller1: entered promiscuous mode
[  730.362340][ T6637] syzkaller1: entered allmulticast mode
[  731.279376][ T6704] tipc: Resetting bearer <eth:syzkaller0>
[  731.466521][ T6706] validate_nla: 2 callbacks suppressed
[  731.466539][ T6706] netlink: 'syz.0.7834': attribute type 16 has an invalid length.
[  731.473552][ T6706] netlink: 'syz.0.7834': attribute type 17 has an invalid length.
[  731.691093][ T6721] syzkaller1: entered promiscuous mode
[  731.693280][ T6721] syzkaller1: entered allmulticast mode
[  731.709018][ T6721] syzkaller1: left promiscuous mode
[  731.711718][ T6721] syzkaller1: left allmulticast mode
[  731.836441][ T6726] __nla_validate_parse: 98 callbacks suppressed
[  731.836456][ T6726] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7839'.
[  731.992273][ T6730] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7840'.
[  732.128551][ T6744] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7844'.
[  732.200593][ T6756] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7844'.
[  732.219740][ T6744] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7844'.
[  732.313518][ T6763] syzkaller1: entered promiscuous mode
[  732.315381][ T6763] syzkaller1: entered allmulticast mode
[  732.913797][ T6785] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7852'.
[  732.973749][ T6788] netlink: 'syz.0.7852': attribute type 10 has an invalid length.
[  732.985651][ T6788] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  732.989064][ T6788] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  733.507304][ T6799] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  733.515451][ T6799] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  733.518307][ T6799] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  733.521809][ T6799] tipc: Resetting bearer <eth:syzkaller0>
[  733.927421][ T6831] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7862'.
[  733.998135][ T6842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7861'.
[  734.006788][ T6843] netlink: 'syz.2.7863': attribute type 10 has an invalid length.
[  734.014234][ T6844] netlink: 'syz.1.7860': attribute type 10 has an invalid length.
[  734.019912][ T6842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7861'.
[  734.049396][ T6836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7861'.
[  734.068936][ T6847] netlink: 'syz.2.7864': attribute type 9 has an invalid length.
[  734.189693][ T6828] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  734.194182][ T6828] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  734.366543][ T6864] netlink: 'syz.2.7869': attribute type 9 has an invalid length.
[  734.973354][ T6883] tipc: Resetting bearer <eth:syzkaller0>
[  735.995062][ T6917] netlink: 'syz.2.7885': attribute type 16 has an invalid length.
[  736.530971][ T6939] netlink: 'syz.2.7892': attribute type 10 has an invalid length.
[  736.813113][ T6949] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[  736.815625][ T6949] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  736.818447][ T6949] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  736.869635][ T6957] pimreg: left allmulticast mode
[  736.895767][ T6955] __nla_validate_parse: 9 callbacks suppressed
[  736.895787][ T6955] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7894'.
[  736.925161][ T6958] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.928672][ T6958] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.932285][ T6958] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.935489][ T6958] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.939249][ T6959] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.942361][ T6959] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.945328][ T6959] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.948290][ T6959] netlink: 68 bytes leftover after parsing attributes in process `syz.1.7896'.
[  736.992989][ T6961] netlink: 'syz.1.7897': attribute type 10 has an invalid length.
[  737.131192][ T6964] mac80211_hwsim hwsim3 wlan0: left promiscuous mode
[  737.133708][ T6964] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode
[  737.136548][ T6964] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode
[  737.148586][ T6970] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  737.152165][ T6970] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode
[  737.154688][ T6970] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode
[  737.227293][ T6977] netlink: 'syz.0.7901': attribute type 10 has an invalid length.
[  737.233779][ T6977] mac80211_hwsim hwsim787 wlan1: entered allmulticast mode
[  737.516172][ T6988] netlink: 200 bytes leftover after parsing attributes in process `syz.2.7903'.
[  738.283268][ T7014] pimreg: entered allmulticast mode
[  738.294225][ T7011] tipc: Resetting bearer <eth:syzkaller0>
[  739.114444][ T7053] mac80211_hwsim hwsim787 wlan1: left allmulticast mode
[  739.316671][ T7057] netlink: 'syz.0.7918': attribute type 10 has an invalid length.
[  739.512705][ T7067] mac80211_hwsim hwsim288 wlan0: entered promiscuous mode
[  739.515583][ T7067] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  739.533279][ T7070] netlink: 'syz.0.7919': attribute type 10 has an invalid length.
[  739.549625][ T7070] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  739.560747][ T7070] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  739.597123][ T7073] netlink: 'syz.2.7921': attribute type 10 has an invalid length.
[  739.748936][ T7084] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  739.753656][ T7084] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  739.994863][ T7089] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode
[  739.997883][ T7089] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode
[  740.002638][ T7089] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  740.208321][ T7105] netlink: 'syz.1.7930': attribute type 10 has an invalid length.
[  740.348584][ T7116] netlink: 'syz.1.7933': attribute type 10 has an invalid length.
[  741.130237][ T7142] tipc: Invalid UDP bearer configuration
[  741.130356][ T7142] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  741.283794][ T7150] netlink: 'syz.2.7942': attribute type 10 has an invalid length.
[  742.085429][ T7190] __nla_validate_parse: 9 callbacks suppressed
[  742.085447][ T7190] netlink: 9 bytes leftover after parsing attributes in process `syz.0.7951'.
[  742.124373][ T7185] netlink: 'syz.0.7951': attribute type 10 has an invalid length.
[  742.136888][ T7185] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  742.140025][ T7185] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  742.156814][ T7196] netlink: 'syz.1.7953': attribute type 83 has an invalid length.
[  742.287392][ T7202] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7954'.
[  742.294353][ T7202] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7954'.
[  742.316596][ T7202] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7954'.
[  742.637347][ T7225] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7959'.
[  742.641894][ T7225] netlink: 'syz.1.7959': attribute type 10 has an invalid length.
[  743.058857][ T7234] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  743.062047][ T7234] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  743.246951][ T7242] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7964'.
[  743.255859][ T7241] netlink: 'syz.0.7962': attribute type 10 has an invalid length.
[  743.283255][ T7241] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode
[  743.288776][ T7241] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode
[  743.359811][ T7248] netlink: 'syz.2.7965': attribute type 16 has an invalid length.
[  743.363092][ T7248] netlink: 'syz.2.7965': attribute type 17 has an invalid length.
[  743.366323][ T7247] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7963'.
[  743.367386][ T7248] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7965'.
[  743.378228][ T7248] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7965'.
[  743.396481][ T7248] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7965'.
[  744.209393][ T7271] syzkaller1: entered promiscuous mode
[  744.212055][ T7271] syzkaller1: entered allmulticast mode
[  744.283858][ T7279] netlink: 'syz.2.7971': attribute type 66 has an invalid length.
[  744.348450][ T7281] netlink: 'syz.2.7972': attribute type 10 has an invalid length.
[  744.890580][ T7302] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  745.106325][ T7314] netlink: 'syz.1.7980': attribute type 16 has an invalid length.
[  745.109171][ T7314] netlink: 'syz.1.7980': attribute type 17 has an invalid length.
[  746.951216][ T7381] pim6reg1: entered promiscuous mode
[  746.953605][ T7381] pim6reg1: entered allmulticast mode
[  747.008519][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[  747.136135][ T7392] __nla_validate_parse: 8 callbacks suppressed
[  747.136155][ T7392] netlink: 14212 bytes leftover after parsing attributes in process `syz.0.7999'.
[  747.507067][ T7415] netlink: 'syz.1.8001': attribute type 11 has an invalid length.
[  747.615497][ T7420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8002'.
[  747.644137][ T7420] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  747.647164][ T7420] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  747.676596][ T7413] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8002'.
[  747.680399][ T7421] validate_nla: 17 callbacks suppressed
[  747.680467][ T7421] netlink: 'syz.0.8004': attribute type 10 has an invalid length.
[  747.703143][ T7421] mac80211_hwsim hwsim787 wlan1: entered allmulticast mode
[  747.724845][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8005'.
[  747.727952][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8005'.
[  747.730979][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8005'.
[  747.733870][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8005'.
[  747.737196][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8005'.
[  747.740048][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8005'.
[  747.743474][ T7424] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8005'.
[  747.925355][ T7436] netlink: 'syz.0.8009': attribute type 12 has an invalid length.
[  747.925753][ T7430] netlink: 'syz.1.8007': attribute type 10 has an invalid length.
[  747.933214][ T7430] bond0: (slave 0!): Enslaving as an active interface with an up link
[  748.153625][ T7455] netlink: 'syz.1.8012': attribute type 10 has an invalid length.
[  748.158797][ T7455] 8021q: adding VLAN 0 to HW filter on device batadv0
[  748.166280][ T7455] bond0: (slave batadv0): Enslaving as an active interface with an up link
[  748.183096][ T7457] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  748.186025][ T7457] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  748.256534][ T7462] bond0: (slave 0!): Releasing backup interface
[  748.258557][ T7462] bond0: (slave 0!): the permanent HWaddr of slave - aa:aa:aa:aa:aa:24 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[  748.284742][ T7462] bond0: (slave batadv0): Releasing backup interface
[  748.298064][ T7462] netlink: 'syz.1.8013': attribute type 10 has an invalid length.
[  749.203757][ T7489] netlink: 'syz.2.8020': attribute type 16 has an invalid length.
[  749.206864][ T7489] netlink: 'syz.2.8020': attribute type 17 has an invalid length.
[  749.258292][ T7495] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  749.263457][ T7495] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  749.266465][ T7494] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  749.565777][ T7516] netlink: 'syz.0.8025': attribute type 16 has an invalid length.
[  749.568683][ T7516] netlink: 'syz.0.8025': attribute type 17 has an invalid length.
[  749.651286][ T7522] netlink: 'syz.0.8029': attribute type 23 has an invalid length.
[  750.091076][ T7545] mac80211_hwsim hwsim819 wlan1: entered allmulticast mode
[  750.763476][ T7560] IPVS: set_ctl: invalid protocol: 115 255.255.255.255:20001
[  750.780666][ T7560] IPVS: set_ctl: invalid protocol: 47 224.0.0.1:20002
[  750.943080][ T7568] tipc: Invalid UDP bearer configuration
[  750.943117][ T7568] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  751.408993][ T7589] mac80211_hwsim hwsim787 wlan1: left allmulticast mode
[  751.545876][ T7595] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  751.551424][ T7595] CPU: 1 UID: 0 PID: 7595 Comm: syz.1.8047 Not tainted syzkaller #0 PREEMPT(full) 
[  751.551449][ T7595] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  751.551462][ T7595] Call Trace:
[  751.551470][ T7595]  <TASK>
[  751.551480][ T7595]  dump_stack_lvl+0x189/0x250
[  751.551512][ T7595]  ? __pfx_dump_stack_lvl+0x10/0x10
[  751.551533][ T7595]  ? __pfx__printk+0x10/0x10
[  751.551559][ T7595]  ? kernfs_path_from_node+0x2f/0x290
[  751.551582][ T7595]  ? kernfs_path_from_node+0x250/0x290
[  751.551600][ T7595]  ? kernfs_path_from_node+0x2f/0x290
[  751.551622][ T7595]  sysfs_warn_dup+0x8e/0xa0
[  751.551644][ T7595]  sysfs_do_create_link_sd+0xc0/0x110
[  751.551665][ T7595]  device_add_class_symlinks+0x1cf/0x240
[  751.551692][ T7595]  device_add+0x475/0xb50
[  751.551716][ T7595]  wiphy_register+0x1c81/0x2aa0
[  751.551754][ T7595]  ? __pfx_wiphy_register+0x10/0x10
[  751.551778][ T7595]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  751.551802][ T7595]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  751.551842][ T7595]  ieee80211_register_hw+0x3442/0x40a0
[  751.551876][ T7595]  ? ieee80211_register_hw+0x1411/0x40a0
[  751.551904][ T7595]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  751.551933][ T7595]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  751.551965][ T7595]  ? __hrtimer_setup+0x187/0x210
[  751.551988][ T7595]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  751.552011][ T7595]  mac80211_hwsim_new_radio+0x2f0e/0x5350
[  751.552063][ T7595]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  751.552086][ T7595]  ? trace_kmalloc+0x1f/0xd0
[  751.552106][ T7595]  ? __kmalloc_node_track_caller_noprof+0x587/0x800
[  751.552126][ T7595]  ? __x64_sys_sendmsg+0x19b/0x260
[  751.552141][ T7595]  ? kstrndup+0xbf/0x160
[  751.552167][ T7595]  hwsim_new_radio_nl+0xea4/0x1b10
[  751.552193][ T7595]  ? __pfx___nla_validate_parse+0x10/0x10
[  751.552229][ T7595]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  751.552258][ T7595]  ? rcu_is_watching+0x15/0xb0
[  751.552287][ T7595]  ? __nla_parse+0x40/0x60
[  751.552340][ T7595]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  751.552388][ T7595]  genl_family_rcv_msg_doit+0x215/0x300
[  751.552414][ T7595]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  751.552446][ T7595]  ? bpf_lsm_capable+0x9/0x20
[  751.552467][ T7595]  ? security_capable+0x7e/0x2e0
[  751.552492][ T7595]  genl_rcv_msg+0x60e/0x790
[  751.552515][ T7595]  ? __pfx_genl_rcv_msg+0x10/0x10
[  751.552530][ T7595]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  751.552566][ T7595]  netlink_rcv_skb+0x208/0x470
[  751.552585][ T7595]  ? __lock_acquire+0xab9/0xd20
[  751.552605][ T7595]  ? __pfx_genl_rcv_msg+0x10/0x10
[  751.552624][ T7595]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  751.552662][ T7595]  ? down_read+0x1ad/0x2e0
[  751.552676][ T7595]  genl_rcv+0x28/0x40
[  751.552687][ T7595]  netlink_unicast+0x82f/0x9e0
[  751.552715][ T7595]  ? __pfx_netlink_unicast+0x10/0x10
[  751.552739][ T7595]  ? netlink_sendmsg+0x642/0xb30
[  751.552759][ T7595]  ? skb_put+0x11b/0x210
[  751.552787][ T7595]  netlink_sendmsg+0x805/0xb30
[  751.552816][ T7595]  ? __pfx_netlink_sendmsg+0x10/0x10
[  751.552841][ T7595]  ? aa_sock_msg_perm+0xf1/0x1d0
[  751.552862][ T7595]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  751.552899][ T7595]  ? __pfx_netlink_sendmsg+0x10/0x10
[  751.552936][ T7595]  __sock_sendmsg+0x21c/0x270
[  751.552960][ T7595]  ____sys_sendmsg+0x505/0x830
[  751.552983][ T7595]  ? __pfx_____sys_sendmsg+0x10/0x10
[  751.553007][ T7595]  ? import_iovec+0x74/0xa0
[  751.553026][ T7595]  ___sys_sendmsg+0x21f/0x2a0
[  751.553043][ T7595]  ? __pfx____sys_sendmsg+0x10/0x10
[  751.553091][ T7595]  ? __fget_files+0x2a/0x420
[  751.553107][ T7595]  ? __fget_files+0x3a0/0x420
[  751.553132][ T7595]  __x64_sys_sendmsg+0x19b/0x260
[  751.553150][ T7595]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  751.553183][ T7595]  ? do_syscall_64+0xbe/0xfa0
[  751.553209][ T7595]  do_syscall_64+0xfa/0xfa0
[  751.553229][ T7595]  ? lockdep_hardirqs_on+0x9c/0x150
[  751.553251][ T7595]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  751.553266][ T7595]  ? exc_page_fault+0xab/0x100
[  751.553289][ T7595]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  751.553332][ T7595] RIP: 0033:0x7f91dbf8eba9
[  751.553349][ T7595] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  751.553364][ T7595] RSP: 002b:00007f91dceb6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  751.553383][ T7595] RAX: ffffffffffffffda RBX: 00007f91dc1d5fa0 RCX: 00007f91dbf8eba9
[  751.553396][ T7595] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000005
[  751.553406][ T7595] RBP: 00007f91dc011e19 R08: 0000000000000000 R09: 0000000000000000
[  751.553417][ T7595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  751.553427][ T7595] R13: 00007f91dc1d6038 R14: 00007f91dc1d5fa0 R15: 00007ffe16b33ff8
[  751.553458][ T7595]  </TASK>
[  751.839863][ T7602] nbd: socks must be embedded in a SOCK_ITEM attr
[  752.495772][ T7634] __nla_validate_parse: 42 callbacks suppressed
[  752.495796][ T7634] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8058'.
[  753.148234][ T7652] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8061'.
[  753.155570][ T7652] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8061'.
[  753.431778][ T7664] validate_nla: 9 callbacks suppressed
[  753.431796][ T7664] netlink: 'syz.2.8063': attribute type 10 has an invalid length.
[  753.447131][ T7664] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  753.452169][ T7664] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  753.866735][ T7678] netlink: 'syz.1.8064': attribute type 10 has an invalid length.
[  754.111395][ T7681] netlink: 'syz.0.8065': attribute type 16 has an invalid length.
[  754.114495][ T7681] netlink: 'syz.0.8065': attribute type 17 has an invalid length.
[  754.156120][ T7685] netlink: 'syz.0.8066': attribute type 1 has an invalid length.
[  754.159513][ T7685] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8066'.
[  754.324807][ T7685] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode
[  754.327588][ T7685] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode
[  754.328911][ T7691] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8068'.
[  754.375773][ T7690] netlink: 'syz.2.8067': attribute type 1 has an invalid length.
[  754.418847][ T7697] netlink: 'syz.1.8068': attribute type 7 has an invalid length.
[  754.424923][ T7697] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8068'.
[  754.487434][ T7704] 8021q: adding VLAN 0 to HW filter on device bond0
[  754.729696][ T7718] netlink: 'syz.0.8074': attribute type 10 has an invalid length.
[  754.738382][ T7718] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8074'.
[  754.743863][ T7717] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8075'.
[  754.757140][ T7720] netlink: 'syz.2.8076': attribute type 10 has an invalid length.
[  754.832412][ T7726] mac80211_hwsim hwsim790 wlan1: entered allmulticast mode
[  754.858480][ T7722] netlink: 'syz.0.8077': attribute type 1 has an invalid length.
[  754.862086][ T7722] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8077'.
[  754.884082][ T7724] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8078'.
[  754.926896][ T7724] tipc: Resetting bearer <eth:syzkaller0>
[  755.525410][ T7778] mac80211_hwsim hwsim819 wlan1: left allmulticast mode
[  755.625991][   T33] audit: type=1107 audit(1758175984.311:12): pid=7786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='^58A8`˼mom!#cvN.qp~B:|fb>[S@rIP*ftL¢'
[  755.689926][ T7791] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  755.696394][ T7791] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  757.461042][ T7875] bond0 (unregistering): Released all slaves
[  757.538497][ T7884] __nla_validate_parse: 7 callbacks suppressed
[  757.538519][ T7884] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8116'.
[  757.594292][ T7887] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8116'.
[  757.602401][ T7887] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8116'.
[  757.606058][ T7887] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8116'.
[  757.609590][ T7887] netlink: 540 bytes leftover after parsing attributes in process `syz.0.8116'.
[  757.645406][ T7890] netlink: 3 bytes leftover after parsing attributes in process `syz.2.8117'.
[  757.709440][ T7890] batadv1: entered promiscuous mode
[  757.716504][ T7890] batadv1: entered allmulticast mode
[  758.024744][ T7907] netlink: 20824 bytes leftover after parsing attributes in process `syz.1.8121'.
[  758.119781][ T7911] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8122'.
[  758.126739][ T7903] bond0: (slave 0!): Enslaving as an active interface with an up link
[  758.458665][ T7931] validate_nla: 9 callbacks suppressed
[  758.458687][ T7931] netlink: 'syz.2.8129': attribute type 10 has an invalid length.
[  758.467678][ T7931] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  758.521619][ T7935] netlink: 200 bytes leftover after parsing attributes in process `syz.0.8130'.
[  758.556600][ T7935] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8130'.
[  758.611541][ T7938] netlink: 'syz.0.8131': attribute type 1 has an invalid length.
[  758.614553][ T7938] netlink: 'syz.0.8131': attribute type 1 has an invalid length.
[  759.192598][ T7963] netlink: 'syz.2.8136': attribute type 12 has an invalid length.
[  759.534431][ T8000] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  759.560285][ T8002] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  759.563262][ T8002] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  759.566782][ T8002] mac80211_hwsim hwsim790 wlan1: left allmulticast mode
[  759.708355][ T8015] netlink: 'syz.0.8145': attribute type 16 has an invalid length.
[  759.713128][ T8015] netlink: 'syz.0.8145': attribute type 17 has an invalid length.
[  759.821059][ T8017] netlink: 'syz.0.8146': attribute type 23 has an invalid length.
[  759.914226][ T8020] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  760.223421][ T8042] netlink: 'syz.1.8150': attribute type 4 has an invalid length.
[  760.226682][ T8042] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  760.255559][ T8044] netlink: 'syz.2.8151': attribute type 10 has an invalid length.
[  760.413404][ T8056] tipc: Invalid UDP bearer configuration
[  760.413442][ T8056] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  760.435190][ T8053] netlink: 'syz.2.8152': attribute type 21 has an invalid length.
[  760.691129][ T8076] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  760.694237][ T8076] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  760.936490][ T8089] mac80211_hwsim hwsim288 wlan0: entered promiscuous mode
[  760.939821][ T8089] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  761.016834][ T8095] tipc: Enabling of bearer <udp:syz2> rejected, already enabled
[  761.264797][ T8110] batadv2: entered promiscuous mode
[  761.267154][ T8110] batadv2: entered allmulticast mode
[  761.723673][ T8143] bond0: (slave 0!): Releasing backup interface
[  761.782329][ T8158] sctp: [Deprecated]: syz.2.8176 (pid 8158) Use of struct sctp_assoc_value in delayed_ack socket option.
[  761.782329][ T8158] Use struct sctp_sack_info instead
[  761.798829][ T8143] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  761.802356][ T8143] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  762.593227][ T8182] __nla_validate_parse: 22 callbacks suppressed
[  762.593251][ T8182] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8180'.
[  763.033505][ T8204] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8186'.
[  763.046669][ T8204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8186'.
[  763.244440][ T8212] 8021q: adding VLAN 0 to HW filter on device bond0
[  763.458878][ T8216] bond0: (slave geneve0): making interface the new active one
[  763.464140][ T8216] bond0: (slave geneve0): Enslaving as an active interface with an up link
[  763.476733][ T5695] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  763.508775][ T5695] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  763.513852][ T5695] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  763.517359][ T5695] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  764.055235][ T8241] validate_nla: 13 callbacks suppressed
[  764.055254][ T8241] netlink: 'syz.2.8191': attribute type 2 has an invalid length.
[  764.061372][ T8241] netlink: 'syz.2.8191': attribute type 2 has an invalid length.
[  764.278816][ T8256] netlink: 'syz.0.8193': attribute type 10 has an invalid length.
[  764.691350][ T8273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8196'.
[  764.755489][ T8290] netlink: 'syz.0.8198': attribute type 16 has an invalid length.
[  764.765410][ T8290] netlink: 'syz.0.8198': attribute type 17 has an invalid length.
[  764.769237][ T8284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8198'.
[  764.836320][ T8293] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8200'.
[  764.976928][ T8297] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8202'.
[  764.983694][ T8297] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8202'.
[  765.233220][ T8309] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8206'.
[  765.305663][ T8319] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8205'.
[  765.443182][ T8321] IPVS: set_ctl: invalid protocol: 44 172.30.1.1:20002
[  765.523990][ T8335] netlink: 'syz.1.8211': attribute type 2 has an invalid length.
[  765.542821][ T8336] netlink: 'syz.1.8211': attribute type 23 has an invalid length.
[  765.887802][ T8353] netlink: 'syz.1.8214': attribute type 11 has an invalid length.
[  766.178027][ T8363] netlink: 'syz.0.8216': attribute type 10 has an invalid length.
[  766.746349][ T8397] netlink: 'syz.0.8221': attribute type 10 has an invalid length.
[  767.147232][ T8410] netlink: 'syz.2.8224': attribute type 16 has an invalid length.
[  767.203890][ T5695] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  767.220942][ T5695] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  767.223934][ T5695] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  767.227119][ T5695] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  767.911778][ T8429] __nla_validate_parse: 5 callbacks suppressed
[  767.911799][ T8429] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8229'.
[  768.121786][ T8439] bond0: (slave geneve0): Releasing active interface
[  768.129826][ T8439] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  768.133579][ T8439] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  768.405026][ T8463] IPVS: stopping backup sync thread 10907 ...
[  768.547762][ T8471] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8238'.
[  769.038048][ T8503] netlink: 277 bytes leftover after parsing attributes in process `syz.2.8245'.
[  769.042820][ T8505] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8244'.
[  769.056200][ T8498] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8244'.
[  769.098107][ T8507] validate_nla: 5 callbacks suppressed
[  769.098121][ T8507] netlink: 'syz.2.8246': attribute type 16 has an invalid length.
[  769.106042][ T8507] netlink: 'syz.2.8246': attribute type 17 has an invalid length.
[  769.111646][ T8507] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8246'.
[  769.741782][ T8537] netlink: 200 bytes leftover after parsing attributes in process `syz.2.8253'.
[  769.748738][ T8538] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8253'.
[  769.878624][ T8534] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8252'.
[  770.158374][ T8571] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8260'.
[  770.189226][ T8571] netlink: 'syz.1.8260': attribute type 21 has an invalid length.
[  770.193714][ T8571] netlink: 'syz.1.8260': attribute type 9 has an invalid length.
[  770.387372][ T8576] netlink: 'syz.2.8261': attribute type 10 has an invalid length.
[  770.401351][ T8576] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  770.405370][ T8576] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  771.066786][ T8586] netlink: 'syz.0.8264': attribute type 1 has an invalid length.
[  771.184551][ T8594] netlink: 'syz.0.8267': attribute type 1 has an invalid length.
[  771.547923][ T8618] netlink: 'syz.0.8274': attribute type 10 has an invalid length.
[  771.637905][ T8623] netlink: 'syz.2.8273': attribute type 16 has an invalid length.
[  771.641952][ T8623] netlink: 'syz.2.8273': attribute type 17 has an invalid length.
[  771.715738][ T8626] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  771.718528][ T8626] IPv6: NLM_F_CREATE should be set when creating new route
[  771.721153][ T8626] IPv6: NLM_F_CREATE should be set when creating new route
[  771.725914][ T8626] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  772.151739][ T8641] syzkaller1: entered promiscuous mode
[  772.154052][ T8641] syzkaller1: entered allmulticast mode
[  772.948830][ T8684] __nla_validate_parse: 18 callbacks suppressed
[  772.948852][ T8684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8290'.
[  772.977142][ T8680] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8290'.
[  773.062256][ T8690] netlink: 236 bytes leftover after parsing attributes in process `syz.2.8293'.
[  773.065928][ T8690] netlink: 1 bytes leftover after parsing attributes in process `syz.2.8293'.
[  773.152320][ T8692] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8294'.
[  773.157162][ T8692] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8294'.
[  773.246938][ T8690] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check.
[  773.334753][ T8698] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8295'.
[  773.741642][ T8711] netlink: 'syz.1.8299': attribute type 11 has an invalid length.
[  773.895085][ T8715] netlink: 14212 bytes leftover after parsing attributes in process `syz.2.8300'.
[  774.138153][ T8729] validate_nla: 8 callbacks suppressed
[  774.138172][ T8729] netlink: 'syz.0.8302': attribute type 10 has an invalid length.
[  774.158320][ T8731] dvmrp1: entered allmulticast mode
[  774.249247][ T8738] mac80211_hwsim hwsim3 wlan0: entered promiscuous mode
[  774.402344][ T8751] netlink: 200 bytes leftover after parsing attributes in process `syz.1.8310'.
[  774.414921][ T8751] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8310'.
[  774.434529][ T8755] netlink: 'syz.2.8311': attribute type 12 has an invalid length.
[  774.710823][ T8787] ip6_vti0: entered promiscuous mode
[  774.719938][ T8787] ip6_vti0: entered allmulticast mode
[  774.914326][ T8798] netlink: 'syz.1.8322': attribute type 10 has an invalid length.
[  775.139806][ T8806] netlink: 'syz.0.8324': attribute type 10 has an invalid length.
[  775.152696][ T8806] mac80211_hwsim hwsim840 wlan1: entered allmulticast mode
[  775.285018][ T8818] netlink: 'syz.1.8326': attribute type 9 has an invalid length.
[  775.545383][ T8835] netlink: 'syz.0.8332': attribute type 10 has an invalid length.
[  775.645670][ T8845] netlink: 'syz.1.8337': attribute type 10 has an invalid length.
[  775.652793][ T8845] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  775.655966][ T8845] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  776.658390][ T8863] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  776.661938][ T8863] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  776.758134][ T8866] tipc: Resetting bearer <eth:syzkaller0>
[  776.786658][ T8866] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  776.946831][ T8879] tipc: Resetting bearer <eth:syzkaller0>
[  777.555027][ T8882] tipc: Invalid UDP bearer configuration
[  777.555075][ T8882] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  778.007821][ T8900] netlink: 'syz.1.8351': attribute type 10 has an invalid length.
[  778.067076][ T8903] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  778.073261][ T8903] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  778.338619][ T8915] __nla_validate_parse: 17 callbacks suppressed
[  778.338631][ T8915] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8353'.
[  778.346564][ T8915] netlink: 'syz.2.8353': attribute type 10 has an invalid length.
[  778.443284][ T8920] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8355'.
[  778.602601][ T8924] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8357'.
[  778.690336][ T8933] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8360'.
[  778.703309][ T8933] netlink: 'syz.0.8360': attribute type 10 has an invalid length.
[  778.707215][ T8933] netlink: 60 bytes leftover after parsing attributes in process `syz.0.8360'.
[  778.751012][ T8935] mac80211_hwsim hwsim844 wlan1: entered allmulticast mode
[  778.806208][ T8941] syzkaller1: entered promiscuous mode
[  778.811808][ T8941] syzkaller1: entered allmulticast mode
[  778.817123][ T8941] mac80211_hwsim hwsim288 wlan0: entered promiscuous mode
[  778.819883][ T8941] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  778.828949][ T8940] mac80211_hwsim hwsim840 wlan1: left allmulticast mode
[  778.867883][ T8940] mac80211_hwsim hwsim840 wlan1: entered allmulticast mode
[  778.926612][ T8943] ip6_vti0: left promiscuous mode
[  778.928750][ T8943] ip6_vti0: left allmulticast mode
[  778.942707][ T8943] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check.
[  779.061968][ T8961] mac80211_hwsim hwsim840 wlan1: left allmulticast mode
[  779.169842][ T8970] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR
[  779.599303][ T9004] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR
[  779.783163][ T9014] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8380'.
[  779.973439][ T9023] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8381'.
[  779.978344][ T9023] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8381'.
[  779.992683][ T9023] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8381'.
[  780.137732][ T9031] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8382'.
[  780.369578][ T9046] validate_nla: 4 callbacks suppressed
[  780.369601][ T9046] netlink: 'syz.2.8386': attribute type 10 has an invalid length.
[  780.418464][ T9050] mac80211_hwsim hwsim844 wlan1: left allmulticast mode
[  780.463119][ T9057] netlink: 'syz.2.8389': attribute type 16 has an invalid length.
[  780.465993][ T9057] netlink: 'syz.2.8389': attribute type 17 has an invalid length.
[  780.556736][ T9059] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check.
[  783.229112][ T9140] netlink: 'syz.1.8403': attribute type 10 has an invalid length.
[  783.562386][ T9149] netlink: 'syz.1.8404': attribute type 10 has an invalid length.
[  783.622584][ T9149] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  783.626459][ T9149] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  783.688455][ T9160] netlink: 'syz.0.8406': attribute type 9 has an invalid length.
[  783.692264][ T9160] __nla_validate_parse: 9 callbacks suppressed
[  783.692282][ T9160] netlink: 184 bytes leftover after parsing attributes in process `syz.0.8406'.
[  783.806087][ T9167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8408'.
[  783.825059][ T9167] vlan0: entered promiscuous mode
[  783.827232][ T9167] gretap0: entered promiscuous mode
[  783.859170][ T9172] netlink: 104 bytes leftover after parsing attributes in process `syz.2.8408'.
[  783.867205][ T9167] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode
[  783.869753][ T9167] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  784.017292][ T9171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8410'.
[  784.021577][ T9177] netlink: 8560 bytes leftover after parsing attributes in process `syz.2.8411'.
[  784.041082][ T9176] netlink: 'syz.2.8411': attribute type 10 has an invalid length.
[  784.080649][ T9179] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  784.084186][ T9179] CPU: 1 UID: 0 PID: 9179 Comm: syz.0.8412 Not tainted syzkaller #0 PREEMPT(full) 
[  784.084211][ T9179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  784.084222][ T9179] Call Trace:
[  784.084229][ T9179]  <TASK>
[  784.084238][ T9179]  dump_stack_lvl+0x189/0x250
[  784.084270][ T9179]  ? __pfx_dump_stack_lvl+0x10/0x10
[  784.084289][ T9179]  ? __pfx__printk+0x10/0x10
[  784.084315][ T9179]  ? kernfs_path_from_node+0x2f/0x290
[  784.084336][ T9179]  ? kernfs_path_from_node+0x250/0x290
[  784.084352][ T9179]  ? kernfs_path_from_node+0x2f/0x290
[  784.084374][ T9179]  sysfs_warn_dup+0x8e/0xa0
[  784.084393][ T9179]  sysfs_do_create_link_sd+0xc0/0x110
[  784.084412][ T9179]  device_add_class_symlinks+0x1cf/0x240
[  784.084449][ T9179]  device_add+0x475/0xb50
[  784.084470][ T9179]  wiphy_register+0x1c81/0x2aa0
[  784.084509][ T9179]  ? __pfx_wiphy_register+0x10/0x10
[  784.084535][ T9179]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  784.084559][ T9179]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  784.084578][ T9179]  ieee80211_register_hw+0x3442/0x40a0
[  784.084636][ T9179]  ? ieee80211_register_hw+0x1411/0x40a0
[  784.084661][ T9179]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  784.084677][ T9179]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  784.084704][ T9179]  ? __hrtimer_setup+0x187/0x210
[  784.084727][ T9179]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  784.084750][ T9179]  mac80211_hwsim_new_radio+0x2f0e/0x5350
[  784.084806][ T9179]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  784.084826][ T9179]  ? trace_kmalloc+0x1f/0xd0
[  784.084847][ T9179]  ? __kmalloc_node_track_caller_noprof+0x587/0x800
[  784.084865][ T9179]  ? __x64_sys_sendmsg+0x19b/0x260
[  784.084880][ T9179]  ? kstrndup+0xbf/0x160
[  784.084907][ T9179]  hwsim_new_radio_nl+0xea4/0x1b10
[  784.084931][ T9179]  ? __pfx___nla_validate_parse+0x10/0x10
[  784.084994][ T9179]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  784.085023][ T9179]  ? rcu_is_watching+0x15/0xb0
[  784.085046][ T9179]  ? __nla_parse+0x40/0x60
[  784.085065][ T9179]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  784.085090][ T9179]  genl_family_rcv_msg_doit+0x215/0x300
[  784.085114][ T9179]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  784.085144][ T9179]  ? bpf_lsm_capable+0x9/0x20
[  784.085162][ T9179]  ? security_capable+0x7e/0x2e0
[  784.085186][ T9179]  genl_rcv_msg+0x60e/0x790
[  784.085209][ T9179]  ? __pfx_genl_rcv_msg+0x10/0x10
[  784.085227][ T9179]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  784.085262][ T9179]  netlink_rcv_skb+0x208/0x470
[  784.085282][ T9179]  ? __lock_acquire+0xab9/0xd20
[  784.085302][ T9179]  ? __pfx_genl_rcv_msg+0x10/0x10
[  784.085320][ T9179]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  784.085358][ T9179]  ? down_read+0x1ad/0x2e0
[  784.085376][ T9179]  genl_rcv+0x28/0x40
[  784.085391][ T9179]  netlink_unicast+0x82f/0x9e0
[  784.085419][ T9179]  ? __pfx_netlink_unicast+0x10/0x10
[  784.085440][ T9179]  ? netlink_sendmsg+0x642/0xb30
[  784.085458][ T9179]  ? skb_put+0x11b/0x210
[  784.085482][ T9179]  netlink_sendmsg+0x805/0xb30
[  784.085511][ T9179]  ? __pfx_netlink_sendmsg+0x10/0x10
[  784.085534][ T9179]  ? aa_sock_msg_perm+0xf1/0x1d0
[  784.085553][ T9179]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  784.085568][ T9179]  ? __pfx_netlink_sendmsg+0x10/0x10
[  784.085588][ T9179]  __sock_sendmsg+0x21c/0x270
[  784.085672][ T9179]  ____sys_sendmsg+0x505/0x830
[  784.085695][ T9179]  ? __pfx_____sys_sendmsg+0x10/0x10
[  784.085721][ T9179]  ? import_iovec+0x74/0xa0
[  784.085744][ T9179]  ___sys_sendmsg+0x21f/0x2a0
[  784.085761][ T9179]  ? __pfx____sys_sendmsg+0x10/0x10
[  784.085804][ T9179]  ? __fget_files+0x2a/0x420
[  784.085820][ T9179]  ? __fget_files+0x3a0/0x420
[  784.085846][ T9179]  __x64_sys_sendmsg+0x19b/0x260
[  784.085866][ T9179]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  784.085896][ T9179]  ? do_syscall_64+0xbe/0xfa0
[  784.085920][ T9179]  do_syscall_64+0xfa/0xfa0
[  784.085939][ T9179]  ? lockdep_hardirqs_on+0x9c/0x150
[  784.085959][ T9179]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  784.085992][ T9179]  ? exc_page_fault+0xab/0x100
[  784.086015][ T9179]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  784.086030][ T9179] RIP: 0033:0x7f4b69d8eba9
[  784.086049][ T9179] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  784.086064][ T9179] RSP: 002b:00007f4b6acf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  784.086084][ T9179] RAX: ffffffffffffffda RBX: 00007f4b69fd5fa0 RCX: 00007f4b69d8eba9
[  784.086096][ T9179] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  784.086105][ T9179] RBP: 00007f4b69e11e19 R08: 0000000000000000 R09: 0000000000000000
[  784.086115][ T9179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  784.086123][ T9179] R13: 00007f4b69fd6038 R14: 00007f4b69fd5fa0 R15: 00007ffc628c20a8
[  784.086146][ T9179]  </TASK>
[  784.333112][ T9181] netlink: 'syz.0.8413': attribute type 10 has an invalid length.
[  784.411660][ T9185] netlink: 156 bytes leftover after parsing attributes in process `syz.0.8413'.
[  784.699504][ T9201] IPVS: set_ctl: invalid protocol: 113 224.0.0.1:20000
[  784.712347][ T9201] netlink: 'syz.1.8418': attribute type 16 has an invalid length.
[  784.715621][ T9201] netlink: 'syz.1.8418': attribute type 17 has an invalid length.
[  784.720861][ T9201] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8418'.
[  784.756265][ T9203] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8419'.
[  784.930298][ T9203] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8419'.
[  785.082136][ T9209] can: request_module (can-proto-4) failed.
[  785.591466][ T9234] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8424'.
[  785.908507][ T9245] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  786.256095][ T9261] validate_nla: 1 callbacks suppressed
[  786.256113][ T9261] netlink: 'syz.2.8432': attribute type 10 has an invalid length.
[  786.262940][ T9261] mac80211_hwsim hwsim844 wlan1: entered allmulticast mode
[  786.678043][ T9277] netlink: 'syz.0.8437': attribute type 10 has an invalid length.
[  786.726092][ T9277] (unnamed net_device) (uninitialized): option ad_user_port_key: mode dependency failed, not supported in mode balance-xor(2)
[  787.206478][ T9309] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  787.209705][ T9309] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  787.214883][ T9309] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  787.281092][ T9316] mac80211_hwsim hwsim844 wlan1: left allmulticast mode
[  787.298989][ T9316] netlink: 'syz.2.8443': attribute type 10 has an invalid length.
[  787.303466][ T9316] mac80211_hwsim hwsim844 wlan1: entered allmulticast mode
[  787.803763][ T9337] netlink: 'syz.1.8445': attribute type 10 has an invalid length.
[  788.798003][ T9362] netlink: 'syz.1.8451': attribute type 10 has an invalid length.
[  788.874059][ T9367] netlink: 'syz.1.8452': attribute type 2 has an invalid length.
[  788.878449][ T9367] netlink: 'syz.1.8452': attribute type 1 has an invalid length.
[  788.883191][ T9367] netlink: 'syz.1.8452': attribute type 1 has an invalid length.
[  788.888101][ T9367] netlink: 'syz.1.8452': attribute type 2 has an invalid length.
[  788.891514][ T9367] netlink: 'syz.1.8452': attribute type 2 has an invalid length.
[  789.004631][ T9369] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  789.158879][ T9375] __nla_validate_parse: 13 callbacks suppressed
[  789.158895][ T9375] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8455'.
[  789.204672][ T9371] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8454'.
[  789.292717][ T9384] tipc: Resetting bearer <eth:syzkaller0>
[  789.323727][ T9384] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8458'.
[  789.417053][ T9392] netlink: 5770 bytes leftover after parsing attributes in process `syz.2.8459'.
[  789.420533][ T9392] netlink: 5770 bytes leftover after parsing attributes in process `syz.2.8459'.
[  789.713960][ T9405] netlink: 200 bytes leftover after parsing attributes in process `syz.2.8462'.
[  789.728166][ T9405] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8462'.
[  790.004986][ T9424] tipc: Resetting bearer <eth:syzkaller0>
[  790.373400][ T9439] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8469'.
[  790.376418][ T9440] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8469'.
[  790.478216][ T9448] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  790.483656][ T9448] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  790.486841][ T9448] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  790.491252][ T9448] tipc: Resetting bearer <eth:syzkaller0>
[  790.873749][ T9460] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8473'.
[  790.949797][ T9465] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  791.056610][ T9467] tipc: Resetting bearer <eth:syzkaller0>
[  791.077780][ T9467] tipc: Resetting bearer <eth:syzkaller0>
[  792.097156][ T9536] validate_nla: 10 callbacks suppressed
[  792.097169][ T9536] netlink: 'syz.1.8488': attribute type 10 has an invalid length.
[  792.117505][ T9536] pim6reg1: entered promiscuous mode
[  792.123810][ T9536] pim6reg1: entered allmulticast mode
[  792.653569][ T9553] tipc: Resetting bearer <eth:syzkaller0>
[  792.680226][ T9553] pim6reg1: left promiscuous mode
[  792.682173][ T9553] pim6reg1: left allmulticast mode
[  792.875153][ T9555] netlink: 'syz.2.8491': attribute type 10 has an invalid length.
[  792.999372][ T9568] netlink: 'syz.0.8494': attribute type 10 has an invalid length.
[  793.098488][ T9578] tap0: tun_chr_ioctl cmd 1074025676
[  793.101915][ T9578] tap0: owner set to 0
[  793.205761][ T9583] netlink: 'syz.2.8497': attribute type 10 has an invalid length.
[  793.220369][ T9583] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  793.223738][ T9583] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  794.234581][ T9607] mac80211_hwsim hwsim844 wlan1: left allmulticast mode
[  794.553273][ T9630] netlink: 'syz.1.8508': attribute type 16 has an invalid length.
[  794.555936][ T9630] netlink: 'syz.1.8508': attribute type 17 has an invalid length.
[  794.559492][ T9630] __nla_validate_parse: 13 callbacks suppressed
[  794.559509][ T9630] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8508'.
[  794.685067][ T9640] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8511'.
[  794.703622][ T9640] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8511'.
[  794.716159][ T9641] netlink: 20824 bytes leftover after parsing attributes in process `syz.2.8510'.
[  795.349145][ T9658] netlink: 'syz.2.8514': attribute type 10 has an invalid length.
[  795.363700][ T9658] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  795.366680][ T9658] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  795.372958][ T9658] tipc: Resetting bearer <eth:syzkaller0>
[  795.574455][ T9662] netlink: 'syz.1.8515': attribute type 5 has an invalid length.
[  795.589622][ T9662] netlink: 'syz.1.8515': attribute type 10 has an invalid length.
[  795.618552][ T9664] netlink: 'syz.2.8516': attribute type 16 has an invalid length.
[  795.622882][ T9664] tipc: Resetting bearer <eth:syzkaller0>
[  795.688327][ T9665] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8516'.
[  795.717963][ T9667] tipc: Resetting bearer <eth:syzkaller0>
[  795.856132][ T9682] netlink: 'syz.1.8520': attribute type 11 has an invalid length.
[  795.999316][ T9684] tipc: Resetting bearer <eth:syzkaller0>
[  796.133231][ T9699] netlink: 144 bytes leftover after parsing attributes in process `syz.1.8524'.
[  796.395704][ T9727] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8530'.
[  796.417160][ T9716] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8528'.
[  796.445243][ T9716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8528'.
[  796.497827][ T9732] netlink: 224 bytes leftover after parsing attributes in process `syz.1.8533'.
[  796.585587][ T9734] bond0: entered promiscuous mode
[  797.404601][ T9769] validate_nla: 5 callbacks suppressed
[  797.404625][ T9769] netlink: 'syz.0.8541': attribute type 10 has an invalid length.
[  797.703764][ T9794] netlink: 'syz.1.8548': attribute type 10 has an invalid length.
[  797.875822][ T9820] bond0: left promiscuous mode
[  797.983740][ T9829] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  797.987617][ T9829] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode
[  797.990921][ T9829] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode
[  798.187636][ T9840] netlink: 'syz.1.8555': attribute type 11 has an invalid length.
[  798.396183][ T9854] netlink: 'syz.0.8557': attribute type 10 has an invalid length.
[  798.729759][ T9895] netlink: 'syz.1.8564': attribute type 12 has an invalid length.
[  798.844599][ T9896] netlink: 'syz.1.8564': attribute type 12 has an invalid length.
[  799.536818][ T9914] netlink: 'syz.0.8568': attribute type 16 has an invalid length.
[  799.539772][ T9914] netlink: 'syz.0.8568': attribute type 17 has an invalid length.
[  799.758066][ T9930] netlink: 'syz.0.8571': attribute type 10 has an invalid length.
[  799.799979][ T9930] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  799.803420][ T9930] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  799.987407][ T9952] __nla_validate_parse: 12 callbacks suppressed
[  799.987420][ T9952] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8575'.
[  799.993665][ T9952] netlink: 'syz.1.8575': attribute type 10 has an invalid length.
[  800.134839][ T9967] netlink: 200 bytes leftover after parsing attributes in process `syz.2.8579'.
[  800.139475][ T9967] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8579'.
[  800.297180][ T9981] bridge22: the hash_elasticity option has been deprecated and is always 16
[  800.301646][ T9981] bridge22: entered allmulticast mode
[  800.339186][ T9977] netlink: 'syz.2.8581': attribute type 10 has an invalid length.
[  800.414817][ T9987] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8582'.
[  800.830041][T10007] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  801.032904][T10010] warn_alloc: 1 callbacks suppressed
[  801.050894][T10010] syz.0.8586: vmalloc error: size 4194304, failed to allocated page array size 8192, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[  801.059058][T10010] CPU: 1 UID: 0 PID: 10010 Comm: syz.0.8586 Not tainted syzkaller #0 PREEMPT(full) 
[  801.059072][T10010] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  801.059078][T10010] Call Trace:
[  801.059083][T10010]  <TASK>
[  801.059089][T10010]  dump_stack_lvl+0x189/0x250
[  801.059107][T10010]  ? __pfx_dump_stack_lvl+0x10/0x10
[  801.059117][T10010]  ? __pfx__printk+0x10/0x10
[  801.059129][T10010]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  801.059139][T10010]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  801.059148][T10010]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[  801.059157][T10010]  warn_alloc+0x214/0x310
[  801.059169][T10010]  ? __pfx_warn_alloc+0x10/0x10
[  801.059208][T10010]  ? __get_vm_area_node+0x28f/0x300
[  801.059220][T10010]  ? pfifo_fast_change_tx_queue_len+0x115/0xa40
[  801.059235][T10010]  __vmalloc_node_range_noprof+0x67e/0x12f0
[  801.059246][T10010]  ? do_syscall_64+0xfa/0xfa0
[  801.059269][T10010]  ? alloc_pages_mpol+0x3cd/0x4a0
[  801.059279][T10010]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  801.059292][T10010]  ? rcu_is_watching+0x15/0xb0
[  801.059305][T10010]  ? pfifo_fast_change_tx_queue_len+0x115/0xa40
[  801.059316][T10010]  __kvmalloc_node_noprof+0x674/0x910
[  801.059325][T10010]  ? pfifo_fast_change_tx_queue_len+0x115/0xa40
[  801.059335][T10010]  ? __kmalloc_cache_noprof+0x3d5/0x6f0
[  801.059347][T10010]  ? pfifo_fast_change_tx_queue_len+0xa2/0xa40
[  801.059360][T10010]  ? __local_bh_enable_ip+0x12d/0x1c0
[  801.059382][T10010]  pfifo_fast_change_tx_queue_len+0x115/0xa40
[  801.059397][T10010]  ? __pfx___local_bh_enable_ip+0x10/0x10
[  801.059417][T10010]  ? do_raw_spin_unlock+0x4d/0x240
[  801.059433][T10010]  ? dev_deactivate_many+0xb82/0xd40
[  801.059450][T10010]  ? dev_deactivate_many+0xd03/0xd40
[  801.059473][T10010]  ? __pfx_pfifo_fast_change_tx_queue_len+0x10/0x10
[  801.059492][T10010]  dev_qdisc_change_tx_queue_len+0x3a6/0x510
[  801.059509][T10010]  ? __pfx_dev_qdisc_change_tx_queue_len+0x10/0x10
[  801.059520][T10010]  ? notifier_call_chain+0x3bf/0x3e0
[  801.059532][T10010]  netif_change_tx_queue_len+0x162/0x270
[  801.059543][T10010]  ? __pfx_netif_change_tx_queue_len+0x10/0x10
[  801.059552][T10010]  ? netif_change_flags+0xe8/0x1a0
[  801.059562][T10010]  do_setlink+0xdfb/0x41c0
[  801.059577][T10010]  ? ___ratelimit+0x7c3/0xab0
[  801.059588][T10010]  ? __pfx_do_setlink+0x10/0x10
[  801.059597][T10010]  ? __pfx____ratelimit+0x10/0x10
[  801.059610][T10010]  ? __lock_acquire+0xab9/0xd20
[  801.059627][T10010]  ? __mutex_trylock_common+0x153/0x260
[  801.059637][T10010]  ? __pfx___mutex_trylock_common+0x10/0x10
[  801.059647][T10010]  ? rcu_is_watching+0x15/0xb0
[  801.059668][T10010]  ? trace_contention_end+0x39/0x120
[  801.059675][T10010]  ? __mutex_lock+0x335/0x1350
[  801.059690][T10010]  ? rtnl_newlink+0x8db/0x1c70
[  801.059703][T10010]  ? __pfx___mutex_lock+0x10/0x10
[  801.059715][T10010]  ? ns_capable+0x8a/0xf0
[  801.059729][T10010]  ? rtnl_link_get_net_capable+0x16a/0x350
[  801.059738][T10010]  rtnl_newlink+0x149f/0x1c70
[  801.059754][T10010]  ? __pfx_rtnl_newlink+0x10/0x10
[  801.059765][T10010]  ? ring_buffer_unlock_commit+0x476/0x5f0
[  801.059778][T10010]  ? trace_buffer_unlock_commit_regs+0x14f/0x550
[  801.059789][T10010]  ? __lock_acquire+0xab9/0xd20
[  801.059804][T10010]  ? __lock_acquire+0xab9/0xd20
[  801.059823][T10010]  ? is_bpf_text_address+0x26/0x2b0
[  801.059837][T10010]  ? is_bpf_text_address+0x292/0x2b0
[  801.059846][T10010]  ? is_bpf_text_address+0x26/0x2b0
[  801.059860][T10010]  ? __lock_acquire+0xab9/0xd20
[  801.059881][T10010]  ? __pfx_rtnl_newlink+0x10/0x10
[  801.059890][T10010]  rtnetlink_rcv_msg+0x7cf/0xb70
[  801.059901][T10010]  ? __lock_acquire+0xab9/0xd20
[  801.059913][T10010]  ? rtnetlink_rcv_msg+0x1ab/0xb70
[  801.059923][T10010]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  801.059941][T10010]  netlink_rcv_skb+0x208/0x470
[  801.059953][T10010]  ? __lock_acquire+0xab9/0xd20
[  801.059962][T10010]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  801.059973][T10010]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  801.059989][T10010]  ? netlink_deliver_tap+0x2e/0x1b0
[  801.060003][T10010]  netlink_unicast+0x82f/0x9e0
[  801.060018][T10010]  ? __pfx_netlink_unicast+0x10/0x10
[  801.060045][T10010]  ? netlink_sendmsg+0x642/0xb30
[  801.060055][T10010]  ? skb_put+0x11b/0x210
[  801.060068][T10010]  netlink_sendmsg+0x805/0xb30
[  801.060087][T10010]  ? __pfx_netlink_sendmsg+0x10/0x10
[  801.060106][T10010]  ? aa_sock_msg_perm+0xf1/0x1d0
[  801.060123][T10010]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  801.060135][T10010]  ? __pfx_netlink_sendmsg+0x10/0x10
[  801.060154][T10010]  __sock_sendmsg+0x21c/0x270
[  801.060201][T10010]  ____sys_sendmsg+0x505/0x830
[  801.060218][T10010]  ? __pfx_____sys_sendmsg+0x10/0x10
[  801.060237][T10010]  ? import_iovec+0x74/0xa0
[  801.060253][T10010]  ___sys_sendmsg+0x21f/0x2a0
[  801.060268][T10010]  ? __pfx____sys_sendmsg+0x10/0x10
[  801.060310][T10010]  ? __fget_files+0x2a/0x420
[  801.060323][T10010]  ? __fget_files+0x3a0/0x420
[  801.060342][T10010]  __x64_sys_sendmsg+0x19b/0x260
[  801.060356][T10010]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  801.060380][T10010]  ? do_syscall_64+0xbe/0xfa0
[  801.060401][T10010]  do_syscall_64+0xfa/0xfa0
[  801.060417][T10010]  ? lockdep_hardirqs_on+0x9c/0x150
[  801.060435][T10010]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  801.060449][T10010]  ? exc_page_fault+0xab/0x100
[  801.060469][T10010]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  801.060482][T10010] RIP: 0033:0x7f4b69d8eba9
[  801.060496][T10010] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  801.060508][T10010] RSP: 002b:00007f4b6acd5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  801.060525][T10010] RAX: ffffffffffffffda RBX: 00007f4b69fd6090 RCX: 00007f4b69d8eba9
[  801.060535][T10010] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 000000000000000c
[  801.060543][T10010] RBP: 00007f4b69e11e19 R08: 0000000000000000 R09: 0000000000000000
[  801.060551][T10010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  801.060559][T10010] R13: 00007f4b69fd6128 R14: 00007f4b69fd6090 R15: 00007ffc628c20a8
[  801.060584][T10010]  </TASK>
[  801.440661][T10010] Mem-Info:
[  801.442012][T10010] active_anon:6322 inactive_anon:30 isolated_anon:0
[  801.442012][T10010]  active_file:816 inactive_file:32924 isolated_file:0
[  801.442012][T10010]  unevictable:1768 dirty:72 writeback:0
[  801.442012][T10010]  slab_reclaimable:28996 slab_unreclaimable:210389
[  801.442012][T10010]  mapped:18175 shmem:2555 pagetables:1158
[  801.442012][T10010]  sec_pagetables:0 bounce:0
[  801.442012][T10010]  kernel_misc_reclaimable:0
[  801.442012][T10010]  free:138868 free_pcp:5358 free_cma:0
[  801.464474][T10010] Node 0 active_anon:12704kB inactive_anon:84kB active_file:2912kB inactive_file:59524kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:43364kB dirty:216kB writeback:0kB shmem:5136kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:3924kB pagetables:2028kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  801.524397][T10010] Node 1 active_anon:12584kB inactive_anon:36kB active_file:352kB inactive_file:72172kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:29336kB dirty:72kB writeback:0kB shmem:5084kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7836kB pagetables:2604kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  801.571660][T10010] Node 0 DMA free:4608kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:64kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:252kB local_pcp:88kB free_cma:0kB
[  801.600592][T10010] lowmem_reserve[]: 0 810 810 810 810
[  801.603990][T10010] Node 0 DMA32 free:79148kB boost:0kB min:33600kB low:42000kB high:50400kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12828kB inactive_anon:84kB active_file:2912kB inactive_file:59524kB unevictable:3536kB writepending:216kB zspages:0kB present:1556484kB managed:830088kB mlocked:0kB bounce:0kB free_pcp:1232kB local_pcp:32kB free_cma:0kB
[  801.674520][T10010] lowmem_reserve[]: 0 0 0 0 0
[  801.680906][T10010] Node 1 DMA32 free:402412kB boost:0kB min:19212kB low:24012kB high:28812kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:40kB unevictable:0kB writepending:0kB zspages:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:17548kB local_pcp:7148kB free_cma:0kB
[  801.692533][T10010] lowmem_reserve[]: 0 0 854 854 854
[  801.694287][T10010] Node 1 Normal free:78320kB boost:0kB min:36652kB low:45812kB high:54972kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12564kB inactive_anon:36kB active_file:328kB inactive_file:66960kB unevictable:3536kB writepending:72kB zspages:0kB present:1048576kB managed:874952kB mlocked:0kB bounce:0kB free_pcp:1092kB local_pcp:740kB free_cma:0kB
[  801.704804][T10010] lowmem_reserve[]: 0 0 0 0 0
[  801.706403][T10010] Node 0 DMA: 46*4kB (UM) 29*8kB (UM) 41*16kB (UM) 7*32kB (UM) 11*64kB (UM) 5*128kB (UM) 8*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4688kB
[  801.711689][T10010] Node 0 DMA32: 867*4kB (UME) 634*8kB (UME) 412*16kB (UME) 549*32kB (UME) 170*64kB (UME) 22*128kB (UME) 44*256kB (UME) 6*512kB (UM) 4*1024kB (UM) 7*2048kB (UM) 0*4096kB = 79164kB
[  801.717505][T10010] Node 1 DMA32: 437*4kB (UM) 218*8kB (UME) 244*16kB (UME) 235*32kB (UME) 107*64kB (UME) 170*128kB (UME) 208*256kB (UM) 165*512kB (UME) 204*1024kB (UME) 6*2048kB (M) 0*4096kB = 402436kB
[  801.725522][T10010] Node 1 Normal: 1681*4kB (UME) 1000*8kB (UME) 299*16kB (UME) 222*32kB (UME) 167*64kB (UME) 19*128kB (ME) 67*256kB (UME) 12*512kB (UME) 5*1024kB (ME) 5*2048kB (M) 0*4096kB = 78388kB
[  801.731967][T10010] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  801.734888][T10010] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  801.737895][T10010] 34997 total pagecache pages
[  801.739584][T10010] 0 pages in swap cache
[  801.741194][T10010] Free swap  = 124996kB
[  801.742800][T10010] Total swap = 124996kB
[  801.744196][T10010] 786301 pages RAM
[  801.745662][T10010] 0 pages HighMem/MovableOnly
[  801.747205][T10010] 241547 pages reserved
[  801.748519][T10010] 0 pages cma reserved
[  801.755825][T10010] erspan0: refused to change device tx_queue_len
[  801.758543][T10010] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check.
[  801.786082][T10011] erspan0: refused to change device tx_queue_len
[  801.788914][T10011] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check.
[  801.964160][T10028] netlink: 248 bytes leftover after parsing attributes in process `syz.0.8589'.
[  802.166300][T10047] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8592'.
[  802.666124][T10070] validate_nla: 5 callbacks suppressed
[  802.666145][T10070] netlink: 'syz.2.8596': attribute type 10 has an invalid length.
[  802.715146][T10076] netlink: 'syz.2.8597': attribute type 10 has an invalid length.
[  803.055809][T10118] tipc: Resetting bearer <eth:syzkaller0>
[  803.079517][T10118] tipc: Resetting bearer <eth:syzkaller0>
[  803.136581][T10132] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8607'.
[  803.159511][T10132] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8607'.
[  803.199601][T10137] netlink: 'syz.0.8609': attribute type 12 has an invalid length.
[  803.305452][T10141] netlink: 'syz.0.8609': attribute type 1 has an invalid length.
[  803.353765][T10138] netlink: 'syz.1.8610': attribute type 12 has an invalid length.
[  803.530937][T10144] mac80211_hwsim hwsim3 wlan0: left promiscuous mode
[  803.533236][T10144] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode
[  803.535564][T10144] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode
[  803.658352][T10152] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8612'.
[  803.670862][T10152] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode
[  803.673840][T10152] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode
[  803.704547][T10152] bridge22: left allmulticast mode
[  803.720643][T10152] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8612'.
[  804.090986][T10174] netlink: 'syz.1.8617': attribute type 10 has an invalid length.
[  804.095216][T10174] mac80211_hwsim hwsim868 wlan1: entered allmulticast mode
[  804.150553][T10170] netlink: 'syz.2.8616': attribute type 12 has an invalid length.
[  804.373140][T10183] mac80211_hwsim hwsim868 wlan1: left allmulticast mode
[  804.447187][T10187] netlink: 'syz.1.8620': attribute type 1 has an invalid length.
[  804.478835][T10190] netlink: 'syz.0.8621': attribute type 10 has an invalid length.
[  804.491660][T10187] 8021q: adding VLAN 0 to HW filter on device bond7
[  804.543719][T10187] bond7: (slave geneve7): making interface the new active one
[  804.549106][T10187] bond7: (slave geneve7): Enslaving as an active interface with an up link
[  804.552993][ T8222] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[  804.559518][ T8222] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[  804.571216][ T8222] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[  804.573908][ T8222] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[  804.629610][T10195] tun1: tun_chr_ioctl cmd 1074025672
[  804.634108][T10195] tun1: ignored: set checksum disabled
[  804.678086][T10193] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  804.681488][T10193] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  804.975601][T10204] IPVS: set_ctl: invalid protocol: 135 0.0.0.0:20001
[  804.982697][T10204] IPVS: set_ctl: invalid protocol: 41 172.20.20.170:20003
[  805.041101][T10208] __nla_validate_parse: 4 callbacks suppressed
[  805.041122][T10208] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8627'.
[  805.049930][T10208] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8627'.
[  805.054366][T10208] netlink: 'syz.1.8627': attribute type 16 has an invalid length.
[  805.803071][T10249] netlink: 80 bytes leftover after parsing attributes in process `syz.0.8635'.
[  805.807958][T10249] x_tables: ip_tables: udp match: only valid for protocol 17
[  806.154829][T10259] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8638'.
[  806.818613][T10284] netlink: 200 bytes leftover after parsing attributes in process `syz.0.8644'.
[  806.995856][T10296] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8647'.
[  807.337336][T10317] bond7: (slave geneve7): Releasing active interface
[  807.347644][ T5695] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  807.354909][ T5695] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  807.358688][ T5695] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  807.362971][ T5695] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  807.371835][T10317] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  807.374992][T10317] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  807.453877][T10321] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8654'.
[  807.957822][T10335] validate_nla: 4 callbacks suppressed
[  807.957839][T10335] netlink: 'syz.0.8656': attribute type 12 has an invalid length.
[  807.969416][T10335] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.8656'.
[  808.809574][T10353] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8660'.
[  808.960736][T10367] netlink: 'syz.0.8663': attribute type 9 has an invalid length.
[  808.963843][T10367] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8663'.
[  809.196779][T10382] netlink: 'syz.2.8667': attribute type 11 has an invalid length.
[  809.443769][T10395] macvlan0: entered promiscuous mode
[  809.449204][T10395] batadv0: entered promiscuous mode
[  809.454074][T10395] hsr0: Slave A (macvlan0) is not up; please bring it up to get a fully working HSR network
[  809.457491][T10395] hsr0: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network
[  809.462879][T10395] hsr0: entered allmulticast mode
[  809.470442][T10395] macvlan0: entered allmulticast mode
[  809.472814][T10395] batadv0: entered allmulticast mode
[  809.477976][T10395] macvlan0: left promiscuous mode
[  809.481415][T10395] batadv0: left promiscuous mode
[  809.526121][T10403] netlink: 'syz.1.8670': attribute type 10 has an invalid length.
[  809.788548][T10427] netlink: 'syz.1.8682': attribute type 10 has an invalid length.
[  809.877633][T10436] netlink: 'syz.1.8685': attribute type 12 has an invalid length.
[  810.025062][T10440] sch_tbf: burst 2097152 is lower than device lo mtu (11337746) !
[  810.206111][T10448] netlink: 'syz.1.8688': attribute type 10 has an invalid length.
[  810.746457][T10489] netlink: 'syz.0.8698': attribute type 12 has an invalid length.
[  810.847247][T10494] mac80211_hwsim hwsim288 wlan0: entered promiscuous mode
[  810.850021][T10494] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  810.948490][T10499] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  811.002843][T10503] __nla_validate_parse: 1 callbacks suppressed
[  811.002856][T10503] netlink: 200 bytes leftover after parsing attributes in process `syz.1.8702'.
[  811.015240][T10503] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8702'.
[  811.053896][T10506] mac80211_hwsim hwsim288 wlan0: entered promiscuous mode
[  811.056370][T10506] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  811.241525][T10512] netlink: 6 bytes leftover after parsing attributes in process `syz.2.8706'.
[  811.244643][T10512] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  811.399782][T10519] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8707'.
[  811.604442][T10530] netlink: 'syz.2.8709': attribute type 10 has an invalid length.
[  811.607933][T10530] mac80211_hwsim hwsim874 wlan1: entered allmulticast mode
[  811.833777][T10543] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma?
[  811.854662][T10546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'.
[  811.863940][T10546] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[  811.866176][T10546] mac80211_hwsim hwsim4 wlan0: left allmulticast mode
[  811.871166][T10546] mac80211_hwsim hwsim874 wlan1: left allmulticast mode
[  811.890700][T10540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8712'.
[  812.043646][T10559] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8718'.
[  812.124631][T10562] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8719'.
[  812.237513][T10567] netlink: 200 bytes leftover after parsing attributes in process `syz.1.8721'.
[  812.243616][T10567] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8721'.
[  812.341951][T10569] netlink: 'syz.1.8722': attribute type 10 has an invalid length.
[  812.345914][T10569] mac80211_hwsim hwsim868 wlan1: entered allmulticast mode
[  812.582379][T10576] netlink: 'syz.2.8725': attribute type 10 has an invalid length.
[  812.588496][T10576] tipc: Resetting bearer <eth:syzkaller0>
[  812.653676][T10578] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  812.657696][T10578] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  813.093292][T10601] IPVS: set_ctl: invalid protocol: 29 0.0.0.51:20000
[  813.551863][T10622] validate_nla: 3 callbacks suppressed
[  813.551879][T10622] netlink: 'syz.1.8736': attribute type 1 has an invalid length.
[  813.565969][T10626] netlink: 'syz.2.8738': attribute type 10 has an invalid length.
[  813.572806][T10622] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  813.596713][T10622] mac80211_hwsim hwsim868 wlan1: left allmulticast mode
[  813.627017][T10629] netlink: 'syz.0.8739': attribute type 23 has an invalid length.
[  813.774861][T10636] netlink: 'syz.0.8741': attribute type 23 has an invalid length.
[  813.993216][T10641] mac80211_hwsim hwsim3 wlan0: entered promiscuous mode
[  813.996210][T10641] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  814.069431][T10653] netlink: 'syz.0.8745': attribute type 12 has an invalid length.
[  814.286506][T10666] netlink: 'syz.2.8749': attribute type 3 has an invalid length.
[  814.289617][T10666] netlink: 'syz.2.8749': attribute type 3 has an invalid length.
[  814.612646][T10692] netlink: 'syz.1.8757': attribute type 10 has an invalid length.
[  814.642255][T10701] netlink: 'syz.0.8759': attribute type 23 has an invalid length.
[  814.916191][T10716] netlink: 'syz.2.8763': attribute type 11 has an invalid length.
[  814.977576][T10713] tipc: Resetting bearer <eth:syzkaller0>
[  815.455065][T10733] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  815.468427][T10733] CPU: 0 UID: 0 PID: 10733 Comm: syz.2.8767 Not tainted syzkaller #0 PREEMPT(full) 
[  815.468445][T10733] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  815.468451][T10733] Call Trace:
[  815.468457][T10733]  <TASK>
[  815.468463][T10733]  dump_stack_lvl+0x189/0x250
[  815.468483][T10733]  ? __pfx_dump_stack_lvl+0x10/0x10
[  815.468493][T10733]  ? __pfx__printk+0x10/0x10
[  815.468508][T10733]  ? kernfs_path_from_node+0x2f/0x290
[  815.468521][T10733]  ? kernfs_path_from_node+0x250/0x290
[  815.468530][T10733]  ? kernfs_path_from_node+0x2f/0x290
[  815.468542][T10733]  sysfs_warn_dup+0x8e/0xa0
[  815.468553][T10733]  sysfs_do_create_link_sd+0xc0/0x110
[  815.468564][T10733]  device_add_class_symlinks+0x1cf/0x240
[  815.468579][T10733]  device_add+0x475/0xb50
[  815.468591][T10733]  wiphy_register+0x1c81/0x2aa0
[  815.468615][T10733]  ? __pfx_wiphy_register+0x10/0x10
[  815.468628][T10733]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  815.468642][T10733]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  815.468654][T10733]  ieee80211_register_hw+0x3442/0x40a0
[  815.468672][T10733]  ? ieee80211_register_hw+0x1411/0x40a0
[  815.468685][T10733]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  815.468695][T10733]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  815.468713][T10733]  ? __hrtimer_setup+0x187/0x210
[  815.468726][T10733]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  815.468739][T10733]  mac80211_hwsim_new_radio+0x2f0e/0x5350
[  815.468825][T10733]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  815.468853][T10733]  ? trace_kmalloc+0x1f/0xd0
[  815.468871][T10733]  ? __kmalloc_node_track_caller_noprof+0x587/0x800
[  815.468887][T10733]  ? __x64_sys_sendmsg+0x19b/0x260
[  815.468902][T10733]  ? kstrndup+0xbf/0x160
[  815.468924][T10733]  hwsim_new_radio_nl+0xea4/0x1b10
[  815.468948][T10733]  ? __pfx___nla_validate_parse+0x10/0x10
[  815.469012][T10733]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  815.469035][T10733]  ? rcu_is_watching+0x15/0xb0
[  815.469058][T10733]  ? __nla_parse+0x40/0x60
[  815.469080][T10733]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  815.469102][T10733]  genl_family_rcv_msg_doit+0x215/0x300
[  815.469117][T10733]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  815.469132][T10733]  ? bpf_lsm_capable+0x9/0x20
[  815.469144][T10733]  ? security_capable+0x7e/0x2e0
[  815.469160][T10733]  genl_rcv_msg+0x60e/0x790
[  815.469172][T10733]  ? __pfx_genl_rcv_msg+0x10/0x10
[  815.469181][T10733]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  815.469200][T10733]  netlink_rcv_skb+0x208/0x470
[  815.469212][T10733]  ? __lock_acquire+0xab9/0xd20
[  815.469227][T10733]  ? __pfx_genl_rcv_msg+0x10/0x10
[  815.469236][T10733]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  815.469257][T10733]  ? down_read+0x1ad/0x2e0
[  815.469267][T10733]  genl_rcv+0x28/0x40
[  815.469275][T10733]  netlink_unicast+0x82f/0x9e0
[  815.469290][T10733]  ? __pfx_netlink_unicast+0x10/0x10
[  815.469304][T10733]  ? netlink_sendmsg+0x642/0xb30
[  815.469315][T10733]  ? skb_put+0x11b/0x210
[  815.469331][T10733]  netlink_sendmsg+0x805/0xb30
[  815.469347][T10733]  ? __pfx_netlink_sendmsg+0x10/0x10
[  815.469360][T10733]  ? aa_sock_msg_perm+0xf1/0x1d0
[  815.469374][T10733]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  815.469384][T10733]  ? __pfx_netlink_sendmsg+0x10/0x10
[  815.469397][T10733]  __sock_sendmsg+0x21c/0x270
[  815.469411][T10733]  ____sys_sendmsg+0x505/0x830
[  815.469423][T10733]  ? __pfx_____sys_sendmsg+0x10/0x10
[  815.469436][T10733]  ? import_iovec+0x74/0xa0
[  815.469447][T10733]  ___sys_sendmsg+0x21f/0x2a0
[  815.469457][T10733]  ? __pfx____sys_sendmsg+0x10/0x10
[  815.469483][T10733]  ? __fget_files+0x2a/0x420
[  815.469494][T10733]  ? __fget_files+0x3a0/0x420
[  815.469507][T10733]  __x64_sys_sendmsg+0x19b/0x260
[  815.469517][T10733]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  815.469534][T10733]  ? do_syscall_64+0xbe/0xfa0
[  815.469558][T10733]  do_syscall_64+0xfa/0xfa0
[  815.469569][T10733]  ? lockdep_hardirqs_on+0x9c/0x150
[  815.469581][T10733]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  815.469590][T10733]  ? exc_page_fault+0xab/0x100
[  815.469601][T10733]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  815.469609][T10733] RIP: 0033:0x7f5651f8eba9
[  815.469619][T10733] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  815.469627][T10733] RSP: 002b:00007f5652e82038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  815.469638][T10733] RAX: ffffffffffffffda RBX: 00007f56521d5fa0 RCX: 00007f5651f8eba9
[  815.469644][T10733] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007
[  815.469649][T10733] RBP: 00007f5652011e19 R08: 0000000000000000 R09: 0000000000000000
[  815.469654][T10733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  815.469659][T10733] R13: 00007f56521d6038 R14: 00007f56521d5fa0 R15: 00007ffe13a03ec8
[  815.469674][T10733]  </TASK>
[  815.705289][T10741] pimreg: left allmulticast mode
[  816.062129][T10764] __nla_validate_parse: 13 callbacks suppressed
[  816.062146][T10764] netlink: 76 bytes leftover after parsing attributes in process `syz.2.8774'.
[  816.105403][T10768] mac80211_hwsim hwsim882 wlan1: entered allmulticast mode
[  816.307276][T10793] mac80211_hwsim hwsim288 wlan0: entered promiscuous mode
[  816.309764][T10793] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  816.352415][T10780] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8779'.
[  816.387493][T10799] netlink: 192 bytes leftover after parsing attributes in process `syz.0.8783'.
[  816.461520][T10803] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8782'.
[  816.465419][T10803] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  816.475848][T10803] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8782'.
[  817.096227][T10814] sctp: [Deprecated]: syz.2.8787 (pid 10814) Use of struct sctp_assoc_value in delayed_ack socket option.
[  817.096227][T10814] Use struct sctp_sack_info instead
[  817.304306][T10831] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8791'.
[  817.347772][T10826] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  817.356685][T10827] syzkaller0: mtu less than device minimum
[  817.622878][T10845] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  817.625847][T10845] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  817.669999][T10849] bond5: entered promiscuous mode
[  818.107930][T10874] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  818.112213][T10874] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  818.114840][T10874] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  818.122589][T10874] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8802'.
[  818.126371][T10874] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8802'.
[  818.293274][T10886] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8807'.
[  818.356564][T10880] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check.
[  818.375427][T10892] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8808'.
[  818.894655][T10920] validate_nla: 6 callbacks suppressed
[  818.894670][T10920] netlink: 'syz.2.8815': attribute type 11 has an invalid length.
[  818.920207][T10919] netlink: 'syz.2.8815': attribute type 23 has an invalid length.
[  819.263997][T10924] netlink: 'syz.2.8816': attribute type 10 has an invalid length.
[  819.271986][T10925] pimreg: entered allmulticast mode
[  819.406924][T10936] IPVS: Scheduler module ip_vs_ not found
[  819.534073][T10948] netlink: 'syz.0.8821': attribute type 12 has an invalid length.
[  820.320688][T10961] netlink: 'syz.1.8825': attribute type 16 has an invalid length.
[  820.323117][T10961] netlink: 'syz.1.8825': attribute type 17 has an invalid length.
[  820.587075][T10989] netlink: 'syz.1.8833': attribute type 10 has an invalid length.
[  820.663554][T10998] mac80211_hwsim hwsim288 wlan0: entered promiscuous mode
[  820.775154][T11008] netlink: 'syz.1.8837': attribute type 23 has an invalid length.
[  820.917608][T11010] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode
[  820.921597][T11010] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode
[  820.934148][T11010] netlink: 'syz.1.8838': attribute type 9 has an invalid length.
[  821.224602][T11019] __nla_validate_parse: 10 callbacks suppressed
[  821.224618][T11019] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.8841'.
[  821.233056][T11019] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8841'.
[  821.598328][T11050] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8848'.
[  821.657889][T11050] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8848'.
[  821.674356][T11050] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8848'.
[  821.685977][T11050] mac80211_hwsim hwsim3 wlan0: left promiscuous mode
[  821.689149][T11050] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode
[  821.692251][T11050] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode
[  821.715867][T11050] mac80211_hwsim hwsim882 wlan1: left allmulticast mode
[  821.724622][T11050] bond5: left promiscuous mode
[  821.735323][T11050] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8848'.
[  822.027300][T11068] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8852'.
[  822.032396][T11068] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8852'.
[  822.386832][T11081] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode
[  822.389148][T11081] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode
[  822.395681][T11081] mac80211_hwsim hwsim288 wlan0: left promiscuous mode
[  822.519373][T11086] netlink: 'syz.1.8856': attribute type 1 has an invalid length.
[  823.029109][T11114] netlink: 104 bytes leftover after parsing attributes in process `syz.0.8862'.
[  823.187266][T11123] mac80211_hwsim hwsim902 wlan1: entered allmulticast mode
[  823.477454][T11133] mac80211_hwsim hwsim3 wlan0: entered promiscuous mode
[  823.480421][T11133] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  823.486579][T11128] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8866'.
[  824.088973][T11154] validate_nla: 12 callbacks suppressed
[  824.088988][T11154] netlink: 'syz.2.8871': attribute type 10 has an invalid length.
[  824.584908][T11173] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  824.590746][T11173] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  824.597592][T11173] tipc: Resetting bearer <eth:syzkaller0>
[  825.026941][T11202] tipc: Resetting bearer <eth:syzkaller0>
[  825.062248][T11202] tipc: Resetting bearer <eth:syzkaller0>
[  825.767026][T11222] mac80211_hwsim hwsim902 wlan1: left allmulticast mode
[  825.917344][T11230] netlink: 'syz.1.8893': attribute type 10 has an invalid length.
[  826.062176][T11241] netlink: 'syz.2.8897': attribute type 10 has an invalid length.
[  826.126061][T11247] tipc: Resetting bearer <eth:syzkaller0>
[  826.272775][T11256] __nla_validate_parse: 8 callbacks suppressed
[  826.272791][T11256] netlink: 48 bytes leftover after parsing attributes in process `syz.1.8900'.
[  826.333348][T11258] netlink: 'syz.2.8901': attribute type 10 has an invalid length.
[  826.486440][T11270] netlink: 'syz.0.8905': attribute type 10 has an invalid length.
[  826.492523][T11270] mac80211_hwsim hwsim882 wlan1: entered allmulticast mode
[  826.596860][T11279] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8907'.
[  826.706437][T11274] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8906'.
[  827.014842][T11307] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8910'.
[  827.087706][T11312] netlink: 'syz.2.8913': attribute type 10 has an invalid length.
[  827.106395][T11307] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  827.110468][T11307] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  827.502171][T11329] netlink: 'syz.2.8918': attribute type 178 has an invalid length.
[  827.505567][T11329] tipc: Can't bind to reserved service type 1
[  827.615384][T11333] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check.
[  827.682299][T11335] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8920'.
[  827.689511][T11335] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8920'.
[  827.692513][T11335] tipc: Invalid UDP bearer configuration
[  827.692546][T11335] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  827.756206][T11337] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8921'.
[  827.807961][T11337] netlink: 'syz.2.8921': attribute type 10 has an invalid length.
[  827.813085][T11337] mac80211_hwsim hwsim904 wlan1: entered allmulticast mode
[  827.878991][T11340] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8922'.
[  827.886060][T11341] netlink: 11188 bytes leftover after parsing attributes in process `syz.0.8923'.
[  828.052472][T11349] netlink: 'syz.2.8924': attribute type 10 has an invalid length.
[  828.065713][T11349] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  828.069531][T11349] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  828.097599][T11353] netlink: 'syz.0.8926': attribute type 9 has an invalid length.
[  828.100710][T11353] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8926'.
[  828.358164][T11363] tipc: Resetting bearer <eth:syzkaller0>
[  828.586946][T11388] mac80211_hwsim hwsim882 wlan1: left allmulticast mode
[  828.609120][T11388] mac80211_hwsim hwsim882 wlan1: entered allmulticast mode
[  828.858567][T11407] pimreg3: entered allmulticast mode
[  829.106005][T11428] validate_nla: 9 callbacks suppressed
[  829.106025][T11428] netlink: 'syz.0.8949': attribute type 10 has an invalid length.
[  829.126238][T11427] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  829.131519][T11427] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  829.186946][T11435] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[  829.196729][T11435] mac80211_hwsim hwsim904 wlan1: left allmulticast mode
[  829.253106][T11438] tipc: Resetting bearer <eth:syzkaller0>
[  829.907015][T11463] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  829.913986][T11463] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode
[  829.916488][T11463] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode
[  829.920934][T11463] tipc: Resetting bearer <eth:syzkaller0>
[  829.975080][T11463] netlink: 'syz.1.8957': attribute type 10 has an invalid length.
[  830.004604][T11473] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  830.181829][T11478] netlink: 'syz.1.8960': attribute type 10 has an invalid length.
[  830.367543][T11488] sysfs: cannot create duplicate filename '/class/ieee80211/^>>Mv^侦Kc'A_xDpj8TT!'
[  830.371841][T11488] CPU: 0 UID: 0 PID: 11488 Comm: syz.2.8963 Not tainted syzkaller #0 PREEMPT(full) 
[  830.371857][T11488] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  830.371863][T11488] Call Trace:
[  830.371868][T11488]  <TASK>
[  830.371874][T11488]  dump_stack_lvl+0x189/0x250
[  830.371894][T11488]  ? __pfx_dump_stack_lvl+0x10/0x10
[  830.371904][T11488]  ? __pfx__printk+0x10/0x10
[  830.371921][T11488]  ? kernfs_path_from_node+0x2f/0x290
[  830.371934][T11488]  ? kernfs_path_from_node+0x250/0x290
[  830.371943][T11488]  ? kernfs_path_from_node+0x2f/0x290
[  830.371954][T11488]  sysfs_warn_dup+0x8e/0xa0
[  830.371965][T11488]  sysfs_do_create_link_sd+0xc0/0x110
[  830.371977][T11488]  device_add_class_symlinks+0x1cf/0x240
[  830.371990][T11488]  device_add+0x475/0xb50
[  830.372002][T11488]  wiphy_register+0x1c81/0x2aa0
[  830.372024][T11488]  ? __pfx_wiphy_register+0x10/0x10
[  830.372035][T11488]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  830.372050][T11488]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  830.372061][T11488]  ieee80211_register_hw+0x3442/0x40a0
[  830.372079][T11488]  ? ieee80211_register_hw+0x1411/0x40a0
[  830.372091][T11488]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  830.372102][T11488]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  830.372118][T11488]  ? __hrtimer_setup+0x187/0x210
[  830.372130][T11488]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  830.372140][T11488]  mac80211_hwsim_new_radio+0x2f0e/0x5350
[  830.372167][T11488]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  830.372179][T11488]  ? trace_kmalloc+0x1f/0xd0
[  830.372190][T11488]  ? __kmalloc_node_track_caller_noprof+0x587/0x800
[  830.372200][T11488]  ? __x64_sys_sendmsg+0x19b/0x260
[  830.372209][T11488]  ? kstrndup+0xbf/0x160
[  830.372223][T11488]  hwsim_new_radio_nl+0xea4/0x1b10
[  830.372236][T11488]  ? __pfx___nla_validate_parse+0x10/0x10
[  830.372255][T11488]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  830.372271][T11488]  ? rcu_is_watching+0x15/0xb0
[  830.372287][T11488]  ? __nla_parse+0x40/0x60
[  830.372299][T11488]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  830.372313][T11488]  genl_family_rcv_msg_doit+0x215/0x300
[  830.372326][T11488]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  830.372341][T11488]  ? bpf_lsm_capable+0x9/0x20
[  830.372351][T11488]  ? security_capable+0x7e/0x2e0
[  830.372364][T11488]  genl_rcv_msg+0x60e/0x790
[  830.372376][T11488]  ? __pfx_genl_rcv_msg+0x10/0x10
[  830.372384][T11488]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  830.372403][T11488]  netlink_rcv_skb+0x208/0x470
[  830.372414][T11488]  ? __lock_acquire+0xab9/0xd20
[  830.372425][T11488]  ? __pfx_genl_rcv_msg+0x10/0x10
[  830.372441][T11488]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  830.372464][T11488]  ? down_read+0x1ad/0x2e0
[  830.372474][T11488]  genl_rcv+0x28/0x40
[  830.372483][T11488]  netlink_unicast+0x82f/0x9e0
[  830.372500][T11488]  ? __pfx_netlink_unicast+0x10/0x10
[  830.372511][T11488]  ? netlink_sendmsg+0x642/0xb30
[  830.372523][T11488]  ? skb_put+0x11b/0x210
[  830.372537][T11488]  netlink_sendmsg+0x805/0xb30
[  830.372553][T11488]  ? __pfx_netlink_sendmsg+0x10/0x10
[  830.372566][T11488]  ? aa_sock_msg_perm+0xf1/0x1d0
[  830.372577][T11488]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  830.372585][T11488]  ? __pfx_netlink_sendmsg+0x10/0x10
[  830.372596][T11488]  __sock_sendmsg+0x21c/0x270
[  830.372608][T11488]  ____sys_sendmsg+0x505/0x830
[  830.372619][T11488]  ? __pfx_____sys_sendmsg+0x10/0x10
[  830.372632][T11488]  ? import_iovec+0x74/0xa0
[  830.372643][T11488]  ___sys_sendmsg+0x21f/0x2a0
[  830.372652][T11488]  ? __pfx____sys_sendmsg+0x10/0x10
[  830.372680][T11488]  ? __fget_files+0x2a/0x420
[  830.372689][T11488]  ? __fget_files+0x3a0/0x420
[  830.372702][T11488]  __x64_sys_sendmsg+0x19b/0x260
[  830.372711][T11488]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  830.372756][T11488]  ? do_syscall_64+0xbe/0xfa0
[  830.372774][T11488]  do_syscall_64+0xfa/0xfa0
[  830.372785][T11488]  ? lockdep_hardirqs_on+0x9c/0x150
[  830.372798][T11488]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  830.372807][T11488]  ? exc_page_fault+0xab/0x100
[  830.372819][T11488]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  830.372826][T11488] RIP: 0033:0x7f5651f8eba9
[  830.372836][T11488] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  830.372843][T11488] RSP: 002b:00007f5652e82038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  830.372854][T11488] RAX: ffffffffffffffda RBX: 00007f56521d5fa0 RCX: 00007f5651f8eba9
[  830.372860][T11488] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 0000000000000006
[  830.372866][T11488] RBP: 00007f5652011e19 R08: 0000000000000000 R09: 0000000000000000
[  830.372871][T11488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  830.372876][T11488] R13: 00007f56521d6038 R14: 00007f56521d5fa0 R15: 00007ffe13a03ec8
[  830.372893][T11488]  </TASK>
[  830.720870][T11495] netlink: 'syz.1.8964': attribute type 10 has an invalid length.
[  830.756600][T11495] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  830.772119][T11495] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  831.154785][T11515] tipc: Resetting bearer <eth:syzkaller0>
[  831.397455][T11519] netlink: 'syz.2.8969': attribute type 10 has an invalid length.
[  831.558328][T11526] netlink: 'syz.1.8971': attribute type 10 has an invalid length.
[  831.566328][T11526] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode
[  831.569083][T11526] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode
[  831.576326][T11526] tipc: Resetting bearer <eth:syzkaller0>
[  831.623316][T11525] tipc: Resetting bearer <eth:syzkaller0>
[  831.662014][T11528] netlink: 'syz.1.8972': attribute type 16 has an invalid length.
[  831.665430][T11528] netlink: 'syz.1.8972': attribute type 17 has an invalid length.
[  831.671170][T11528] __nla_validate_parse: 20 callbacks suppressed
[  831.671187][T11528] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8972'.
[  831.682546][T11528] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8972'.
[  831.881673][T11536] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8973'.
[  831.899111][T11536] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8973'.
[  831.907948][T11536] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8973'.
[  832.135918][T11543] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8975'.
[  832.175659][T11559] netlink: 'syz.0.8978': attribute type 10 has an invalid length.
[  832.186648][T11559] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode
[  832.188935][T11561] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8979'.
[  832.188958][T11559] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode
[  832.431515][T11570] netlink: 'syz.0.8981': attribute type 10 has an invalid length.
[  832.435485][T11570] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8981'.
[  832.777941][T11586] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8986'.
[  833.126668][T11599] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8989'.
[  833.229822][T11601] IPVS: set_ctl: invalid protocol: 47 0.0.0.0:20001
[  833.944672][T11647] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  833.948454][T11647] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  834.161730][T11655] validate_nla: 8 callbacks suppressed
[  834.161742][T11655] netlink: 'syz.1.9003': attribute type 16 has an invalid length.
[  834.167000][T11655] netlink: 'syz.1.9003': attribute type 17 has an invalid length.
[  834.401448][T11658] IPVS: Unknown mcast interface: vcan0
[  834.666261][T11665] mac80211_hwsim hwsim882 wlan1: left allmulticast mode
[  834.692456][T11665] netlink: 'syz.0.9005': attribute type 10 has an invalid length.
[  834.698547][T11665] mac80211_hwsim hwsim882 wlan1: entered allmulticast mode
[  834.817635][T11670] netlink: 'syz.0.9006': attribute type 10 has an invalid length.
[  834.845919][T11667] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  834.849729][T11667] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  834.927812][T11675] netlink: 'syz.2.9007': attribute type 12 has an invalid length.
[  836.043945][T11709] netlink: 'syz.0.9016': attribute type 12 has an invalid length.
[  836.804654][T11735] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  836.808594][T11726] __nla_validate_parse: 14 callbacks suppressed
[  836.808612][T11726] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9018'.
[  836.815721][T11735] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode
[  836.818030][T11735] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode
[  836.823941][T11735] tipc: Resetting bearer <eth:syzkaller0>
[  836.921093][T11743] netlink: 200 bytes leftover after parsing attributes in process `syz.1.9022'.
[  836.927026][T11744] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9022'.
[  836.977327][T11740] tipc: Resetting bearer <eth:syzkaller0>
[  836.994774][T11749] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  836.997884][T11749] CPU: 0 UID: 0 PID: 11749 Comm: syz.1.9023 Not tainted syzkaller #0 PREEMPT(full) 
[  836.997904][T11749] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  836.997914][T11749] Call Trace:
[  836.997922][T11749]  <TASK>
[  836.997929][T11749]  dump_stack_lvl+0x189/0x250
[  836.997957][T11749]  ? __pfx_dump_stack_lvl+0x10/0x10
[  836.997974][T11749]  ? __pfx__printk+0x10/0x10
[  836.997998][T11749]  ? kernfs_path_from_node+0x2f/0x290
[  836.998018][T11749]  ? kernfs_path_from_node+0x250/0x290
[  836.998033][T11749]  ? kernfs_path_from_node+0x2f/0x290
[  836.998050][T11749]  sysfs_warn_dup+0x8e/0xa0
[  836.998066][T11749]  sysfs_do_create_link_sd+0xc0/0x110
[  836.998082][T11749]  device_add_class_symlinks+0x1cf/0x240
[  836.998101][T11749]  device_add+0x475/0xb50
[  836.998117][T11749]  wiphy_register+0x1c81/0x2aa0
[  836.998151][T11749]  ? __pfx_wiphy_register+0x10/0x10
[  836.998199][T11749]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  836.998222][T11749]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  836.998241][T11749]  ieee80211_register_hw+0x3442/0x40a0
[  836.998266][T11749]  ? ieee80211_register_hw+0x1411/0x40a0
[  836.998283][T11749]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  836.998300][T11749]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  836.998326][T11749]  ? __hrtimer_setup+0x187/0x210
[  836.998346][T11749]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  836.998364][T11749]  mac80211_hwsim_new_radio+0x2f0e/0x5350
[  836.998409][T11749]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  836.998427][T11749]  ? trace_kmalloc+0x1f/0xd0
[  836.998445][T11749]  ? __kmalloc_node_track_caller_noprof+0x587/0x800
[  836.998463][T11749]  ? __x64_sys_sendmsg+0x19b/0x260
[  836.998478][T11749]  ? kstrndup+0xbf/0x160
[  836.998502][T11749]  hwsim_new_radio_nl+0xea4/0x1b10
[  836.998524][T11749]  ? __pfx___nla_validate_parse+0x10/0x10
[  836.998557][T11749]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  836.998582][T11749]  ? rcu_is_watching+0x15/0xb0
[  836.998606][T11749]  ? __nla_parse+0x40/0x60
[  836.998627][T11749]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  836.998652][T11749]  genl_family_rcv_msg_doit+0x215/0x300
[  836.998674][T11749]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  836.998700][T11749]  ? bpf_lsm_capable+0x9/0x20
[  836.998717][T11749]  ? security_capable+0x7e/0x2e0
[  836.998741][T11749]  genl_rcv_msg+0x60e/0x790
[  836.998768][T11749]  ? __pfx_genl_rcv_msg+0x10/0x10
[  836.998781][T11749]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  836.998812][T11749]  netlink_rcv_skb+0x208/0x470
[  836.998830][T11749]  ? __lock_acquire+0xab9/0xd20
[  836.998851][T11749]  ? __pfx_genl_rcv_msg+0x10/0x10
[  836.998867][T11749]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  836.998899][T11749]  ? down_read+0x1ad/0x2e0
[  836.998916][T11749]  genl_rcv+0x28/0x40
[  836.998929][T11749]  netlink_unicast+0x82f/0x9e0
[  836.998955][T11749]  ? __pfx_netlink_unicast+0x10/0x10
[  836.998970][T11749]  ? netlink_sendmsg+0x642/0xb30
[  836.998986][T11749]  ? skb_put+0x11b/0x210
[  836.999009][T11749]  netlink_sendmsg+0x805/0xb30
[  836.999035][T11749]  ? __pfx_netlink_sendmsg+0x10/0x10
[  836.999055][T11749]  ? aa_sock_msg_perm+0xf1/0x1d0
[  836.999074][T11749]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  836.999088][T11749]  ? __pfx_netlink_sendmsg+0x10/0x10
[  836.999108][T11749]  __sock_sendmsg+0x21c/0x270
[  836.999129][T11749]  ____sys_sendmsg+0x505/0x830
[  836.999148][T11749]  ? __pfx_____sys_sendmsg+0x10/0x10
[  836.999198][T11749]  ? import_iovec+0x74/0xa0
[  836.999217][T11749]  ___sys_sendmsg+0x21f/0x2a0
[  836.999234][T11749]  ? __pfx____sys_sendmsg+0x10/0x10
[  836.999277][T11749]  ? __fget_files+0x2a/0x420
[  836.999293][T11749]  ? __fget_files+0x3a0/0x420
[  836.999315][T11749]  __x64_sys_sendmsg+0x19b/0x260
[  836.999330][T11749]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  836.999358][T11749]  ? do_syscall_64+0xbe/0xfa0
[  836.999382][T11749]  do_syscall_64+0xfa/0xfa0
[  836.999398][T11749]  ? lockdep_hardirqs_on+0x9c/0x150
[  836.999418][T11749]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  836.999431][T11749]  ? exc_page_fault+0xab/0x100
[  836.999450][T11749]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  836.999462][T11749] RIP: 0033:0x7f91dbf8eba9
[  836.999474][T11749] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  836.999484][T11749] RSP: 002b:00007f91dceb6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  836.999498][T11749] RAX: ffffffffffffffda RBX: 00007f91dc1d5fa0 RCX: 00007f91dbf8eba9
[  836.999505][T11749] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005
[  836.999512][T11749] RBP: 00007f91dc011e19 R08: 0000000000000000 R09: 0000000000000000
[  836.999519][T11749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  836.999525][T11749] R13: 00007f91dc1d6038 R14: 00007f91dc1d5fa0 R15: 00007ffe16b33ff8
[  836.999550][T11749]  </TASK>
[  837.230930][T11751] netlink: 'syz.1.9024': attribute type 16 has an invalid length.
[  837.233778][T11751] netlink: 'syz.1.9024': attribute type 17 has an invalid length.
[  837.237591][T11751] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9024'.
[  837.282079][T11753] netlink: 'syz.1.9025': attribute type 10 has an invalid length.
[  837.285928][T11753] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9025'.
[  837.465118][T11767] netlink: 'syz.2.9029': attribute type 11 has an invalid length.
[  837.503070][T11768] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9028'.
[  837.592191][T11768] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9028'.
[  837.597498][T11768] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9028'.
[  837.619337][T11768] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9028'.
[  837.763178][T11774] netlink: 'syz.2.9030': attribute type 1 has an invalid length.
[  837.775655][T11774] netlink: 224 bytes leftover after parsing attributes in process `syz.2.9030'.
[  838.497504][T11831] mac80211_hwsim hwsim927 wlan1: entered allmulticast mode
[  840.321081][T11922] IPVS: set_ctl: invalid protocol: 103 224.0.0.2:20002
[  840.381028][T11927] validate_nla: 9 callbacks suppressed
[  840.381047][T11927] netlink: 'syz.2.9074': attribute type 10 has an invalid length.
[  840.542760][T11942] netlink: 'syz.0.9071': attribute type 12 has an invalid length.
[  840.722278][T11946] tipc: Resetting bearer <eth:syzkaller0>
[  841.506936][T11971] netlink: 'syz.1.9083': attribute type 10 has an invalid length.
[  842.022501][T11991] netlink: 'syz.0.9090': attribute type 10 has an invalid length.
[  842.095649][T11997] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode
[  842.099961][T11997] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode
[  842.185576][T12003] netlink: 'syz.1.9093': attribute type 12 has an invalid length.
[  842.447130][T12016] IPv6: Can't replace route, no match found
[  842.498221][T12018] __nla_validate_parse: 21 callbacks suppressed
[  842.498234][T12018] netlink: 200 bytes leftover after parsing attributes in process `syz.2.9098'.
[  842.540389][T12018] netlink: 200 bytes leftover after parsing attributes in process `syz.2.9098'.
[  842.543584][T12018] netlink: 200 bytes leftover after parsing attributes in process `syz.2.9098'.
[  842.546946][T12018] netlink: 200 bytes leftover after parsing attributes in process `syz.2.9098'.
[  843.169533][T12030] netlink: 96 bytes leftover after parsing attributes in process `syz.0.9100'.
[  843.255494][T12039] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9104'.
[  843.259210][T12039] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9104'.
[  843.265121][T12039] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9104'.
[  843.465588][T12050] netlink: 'syz.0.9106': attribute type 1 has an invalid length.
[  843.467302][T12053] netlink: 'syz.2.9107': attribute type 39 has an invalid length.
[  843.530660][T12050] bond6: (slave bridge20): making interface the new active one
[  843.534224][T12050] bond6: (slave bridge20): Enslaving as an active interface with an up link
[  844.172688][T12085] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9114'.
[  844.177526][T12085] netlink: 'syz.1.9114': attribute type 10 has an invalid length.
[  844.863368][T12110] (unnamed net_device) (uninitialized): option arp_interval: mode dependency failed, not supported in mode balance-tlb(5)
[  844.869958][T12107] netlink: 'syz.1.9120': attribute type 10 has an invalid length.
[  844.969534][T12115] netlink: 'syz.1.9121': attribute type 1 has an invalid length.
[  845.502372][T12136] netlink: 200 bytes leftover after parsing attributes in process `syz.2.9126'.
[  846.351820][   T33] audit: type=1800 audit(1758176075.041:13): pid=12187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9135" name="memory.events" dev="tmpfs" ino=15501 res=0 errno=0
[  846.787685][T12197] validate_nla: 1 callbacks suppressed
[  846.787697][T12197] netlink: 'syz.1.9137': attribute type 10 has an invalid length.
[  847.196480][T12226] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  847.199673][T12226] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  847.202471][T12226] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  848.124980][T12252] netlink: 'syz.0.9148': attribute type 10 has an invalid length.
[  848.129585][T12252] __nla_validate_parse: 8 callbacks suppressed
[  848.129596][T12252] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9148'.
[  848.313087][T12278] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate.
[  848.573371][T12296] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  848.577124][T12296] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  849.120374][T12301] mac80211_hwsim hwsim882 wlan1: left allmulticast mode
[  849.132380][T12301] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9157'.
[  849.136685][T12301] netlink: 14 bytes leftover after parsing attributes in process `syz.0.9157'.
[  849.294722][T12313] netlink: 'syz.0.9161': attribute type 10 has an invalid length.
[  849.376190][T12320] netlink: 'syz.0.9163': attribute type 9 has an invalid length.
[  849.389485][T12320] netlink: 224 bytes leftover after parsing attributes in process `syz.0.9163'.
[  849.439582][T12305] netlink: 'syz.1.9159': attribute type 10 has an invalid length.
[  849.614794][T12336] netlink: 'syz.0.9164': attribute type 10 has an invalid length.
[  849.712720][T12349] netlink: 'syz.0.9168': attribute type 10 has an invalid length.
[  849.752789][T12353] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  849.755272][T12353] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  849.761431][T12353] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9165'.
[  850.262365][T12379] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9174'.
[  851.182813][T12416] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode
[  851.185174][T12416] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  851.218183][T12413] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9181'.
[  851.319162][T12430] netlink: 'syz.1.9182': attribute type 10 has an invalid length.
[  851.402768][T12430] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  851.416090][T12430] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  851.754823][T12450] netlink: 'syz.0.9186': attribute type 16 has an invalid length.
[  851.757539][T12450] netlink: 'syz.0.9186': attribute type 17 has an invalid length.
[  851.767485][T12450] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9186'.
[  853.173708][T12505] netlink: 'syz.2.9194': attribute type 10 has an invalid length.
[  853.229472][T12511] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9194'.
[  853.319767][T12505] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9194'.
[  853.411515][T12505] tipc: Resetting bearer <eth:syzkaller0>
[  853.498807][T12516] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  854.059587][T12536] netlink: 248 bytes leftover after parsing attributes in process `syz.1.9201'.
[  854.354812][T12543] netlink: 'syz.1.9202': attribute type 12 has an invalid length.
[  854.357947][T12543] netlink: 9472 bytes leftover after parsing attributes in process `syz.1.9202'.
[  854.545301][T12545] netlink: 248 bytes leftover after parsing attributes in process `syz.0.9203'.
[  854.859474][T12547] bond6: (slave bridge20): Releasing active interface
[  855.484112][T12554] netlink: 'syz.2.9205': attribute type 16 has an invalid length.
[  855.493385][T12554] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9205'.
[  855.811417][T12563] tipc: Resetting bearer <eth:syzkaller0>
[  855.814651][T12563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9207'.
[  856.081393][T12571] tipc: Resetting bearer <eth:syzkaller0>
[  856.555457][T12582] netlink: 'syz.2.9210': attribute type 16 has an invalid length.
[  856.558152][T12582] netlink: 'syz.2.9210': attribute type 17 has an invalid length.
[  856.563466][T12582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9210'.
[  856.613289][T12584] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  856.619453][T12584] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode
[  856.625224][T12584] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode
[  856.629594][T12584] tipc: Resetting bearer <eth:syzkaller0>
[  856.655849][T12584] tipc: Resetting bearer <eth:syzkaller0>
[  856.898463][T12586] netlink: 'syz.2.9212': attribute type 10 has an invalid length.
[  857.184954][T12622] sysfs: cannot create duplicate filename '/class/ieee80211/!'
[  857.188559][T12622] CPU: 1 UID: 0 PID: 12622 Comm: syz.2.9220 Not tainted syzkaller #0 PREEMPT(full) 
[  857.188582][T12622] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  857.188593][T12622] Call Trace:
[  857.188601][T12622]  <TASK>
[  857.188611][T12622]  dump_stack_lvl+0x189/0x250
[  857.188638][T12622]  ? __pfx_dump_stack_lvl+0x10/0x10
[  857.188668][T12622]  ? __pfx__printk+0x10/0x10
[  857.188698][T12622]  ? kernfs_path_from_node+0x2f/0x290
[  857.188718][T12622]  ? kernfs_path_from_node+0x250/0x290
[  857.188735][T12622]  ? kernfs_path_from_node+0x2f/0x290
[  857.188757][T12622]  sysfs_warn_dup+0x8e/0xa0
[  857.188776][T12622]  sysfs_do_create_link_sd+0xc0/0x110
[  857.188796][T12622]  device_add_class_symlinks+0x1cf/0x240
[  857.188817][T12622]  device_add+0x475/0xb50
[  857.188839][T12622]  wiphy_register+0x1c81/0x2aa0
[  857.188874][T12622]  ? __pfx_wiphy_register+0x10/0x10
[  857.188895][T12622]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  857.188930][T12622]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  857.188952][T12622]  ieee80211_register_hw+0x3442/0x40a0
[  857.188982][T12622]  ? ieee80211_register_hw+0x1411/0x40a0
[  857.189009][T12622]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  857.189028][T12622]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  857.189053][T12622]  ? __hrtimer_setup+0x187/0x210
[  857.189073][T12622]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  857.189090][T12622]  mac80211_hwsim_new_radio+0x2f0e/0x5350
[  857.189139][T12622]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  857.189158][T12622]  ? trace_kmalloc+0x1f/0xd0
[  857.189175][T12622]  ? __kmalloc_node_track_caller_noprof+0x587/0x800
[  857.189195][T12622]  ? __x64_sys_sendmsg+0x19b/0x260
[  857.189208][T12622]  ? kstrndup+0xbf/0x160
[  857.189233][T12622]  hwsim_new_radio_nl+0xea4/0x1b10
[  857.189258][T12622]  ? __pfx___nla_validate_parse+0x10/0x10
[  857.189290][T12622]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  857.189319][T12622]  ? rcu_is_watching+0x15/0xb0
[  857.189343][T12622]  ? __nla_parse+0x40/0x60
[  857.189366][T12622]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  857.189391][T12622]  genl_family_rcv_msg_doit+0x215/0x300
[  857.189414][T12622]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  857.189440][T12622]  ? bpf_lsm_capable+0x9/0x20
[  857.189457][T12622]  ? security_capable+0x7e/0x2e0
[  857.189517][T12622]  genl_rcv_msg+0x60e/0x790
[  857.189541][T12622]  ? __pfx_genl_rcv_msg+0x10/0x10
[  857.189555][T12622]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  857.189589][T12622]  netlink_rcv_skb+0x208/0x470
[  857.189608][T12622]  ? __lock_acquire+0xab9/0xd20
[  857.189627][T12622]  ? __pfx_genl_rcv_msg+0x10/0x10
[  857.189644][T12622]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  857.189682][T12622]  ? down_read+0x1ad/0x2e0
[  857.189701][T12622]  genl_rcv+0x28/0x40
[  857.189714][T12622]  netlink_unicast+0x82f/0x9e0
[  857.189742][T12622]  ? __pfx_netlink_unicast+0x10/0x10
[  857.189762][T12622]  ? netlink_sendmsg+0x642/0xb30
[  857.189781][T12622]  ? skb_put+0x11b/0x210
[  857.189801][T12622]  netlink_sendmsg+0x805/0xb30
[  857.189830][T12622]  ? __pfx_netlink_sendmsg+0x10/0x10
[  857.189852][T12622]  ? aa_sock_msg_perm+0xf1/0x1d0
[  857.189871][T12622]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  857.189885][T12622]  ? __pfx_netlink_sendmsg+0x10/0x10
[  857.189912][T12622]  __sock_sendmsg+0x21c/0x270
[  857.189936][T12622]  ____sys_sendmsg+0x505/0x830
[  857.189957][T12622]  ? __pfx_____sys_sendmsg+0x10/0x10
[  857.189979][T12622]  ? import_iovec+0x74/0xa0
[  857.189995][T12622]  ___sys_sendmsg+0x21f/0x2a0
[  857.190012][T12622]  ? __pfx____sys_sendmsg+0x10/0x10
[  857.190057][T12622]  ? __fget_files+0x2a/0x420
[  857.190094][T12622]  ? __fget_files+0x3a0/0x420
[  857.190116][T12622]  __x64_sys_sendmsg+0x19b/0x260
[  857.190131][T12622]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  857.190160][T12622]  ? do_syscall_64+0xbe/0xfa0
[  857.190186][T12622]  do_syscall_64+0xfa/0xfa0
[  857.190206][T12622]  ? lockdep_hardirqs_on+0x9c/0x150
[  857.190226][T12622]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  857.190239][T12622]  ? exc_page_fault+0xab/0x100
[  857.190257][T12622]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  857.190268][T12622] RIP: 0033:0x7f5651f8eba9
[  857.190281][T12622] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  857.190292][T12622] RSP: 002b:00007f5652e82038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  857.190306][T12622] RAX: ffffffffffffffda RBX: 00007f56521d5fa0 RCX: 00007f5651f8eba9
[  857.190315][T12622] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000008
[  857.190323][T12622] RBP: 00007f5652011e19 R08: 0000000000000000 R09: 0000000000000000
[  857.190331][T12622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  857.190337][T12622] R13: 00007f56521d6038 R14: 00007f56521d5fa0 R15: 00007ffe13a03ec8
[  857.190362][T12622]  </TASK>
[  857.231245][T12624] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9218'.
[  857.388031][T12625] tipc: Resetting bearer <eth:syzkaller0>
[  857.464481][T12633] netlink: 'syz.2.9221': attribute type 180 has an invalid length.
[  858.007879][T12660] netlink: 'syz.2.9227': attribute type 23 has an invalid length.
[  859.009263][T12696] netlink: 3 bytes leftover after parsing attributes in process `syz.1.9235'.
[  859.042172][T12696] batadv2: entered promiscuous mode
[  859.044396][T12696] batadv2: entered allmulticast mode
[  859.370029][T12702] netlink: 200 bytes leftover after parsing attributes in process `syz.0.9237'.
[  859.381617][T12702] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9237'.
[  859.484850][T12711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9237'.
[  859.743624][T12717] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9240'.
[  859.983478][T12732] IPVS: set_ctl: invalid protocol: 44 10.1.1.1:20000
[  860.049699][T12736] netlink: 'syz.1.9245': attribute type 12 has an invalid length.
[  860.342899][T12743] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9247'.
[  860.406701][T12751] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9247'.
[  860.412618][T12751] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9247'.
[  860.415664][T12751] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9247'.
[  860.419005][T12751] netlink: 540 bytes leftover after parsing attributes in process `syz.1.9247'.
[  860.825114][T12773] netlink: 'syz.0.9254': attribute type 16 has an invalid length.
[  860.831262][T12773] netlink: 'syz.0.9254': attribute type 17 has an invalid length.
[  860.853728][T12783] mac80211_hwsim hwsim4 wlan0: left promiscuous mode
[  860.855931][T12783] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode
[  860.858480][T12783] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode
[  860.962734][T12798] netlink: 'syz.2.9258': attribute type 15 has an invalid length.
[  861.744029][T12845] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  862.474334][T12873] bond0: entered promiscuous mode
[  862.479563][T12873] bond0: left promiscuous mode
[  862.493070][T12879] bond0: entered promiscuous mode
[  862.510218][T12879] bond0: left promiscuous mode
[  863.103146][T12917] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode
[  863.106102][T12917] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode
[  863.112842][T12917] tipc: Resetting bearer <eth:syzkaller0>
[  863.221943][T12927] netlink: 'syz.1.9288': attribute type 10 has an invalid length.
[  863.456116][T12949] netlink: 'syz.1.9293': attribute type 83 has an invalid length.
[  863.477728][T12943] tipc: Resetting bearer <eth:syzkaller0>
[  864.012273][T12977] __nla_validate_parse: 13 callbacks suppressed
[  864.012286][T12977] netlink: 3 bytes leftover after parsing attributes in process `syz.1.9299'.
[  864.045888][T12976] netlink: 20824 bytes leftover after parsing attributes in process `syz.0.9298'.
[  864.052839][T12977] batadv2: entered promiscuous mode
[  864.054581][T12977] batadv2: entered allmulticast mode
[  864.221545][T12980] netlink: 'syz.0.9300': attribute type 10 has an invalid length.
[  864.225869][T12980] mac80211_hwsim hwsim939 wlan1: entered allmulticast mode
[  864.493594][T13000] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9305'.
[  864.562635][T13006] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9305'.
[  864.566714][T13006] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9305'.
[  864.569279][T12994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9304'.
[  864.581334][T12994] netlink: 'syz.2.9304': attribute type 10 has an invalid length.
[  864.623051][T13000] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9305'.
[  864.820391][T13019] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9307'.
[  864.828730][T13019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9307'.
[  864.868034][T13022] netlink: 200 bytes leftover after parsing attributes in process `syz.1.9308'.
[  865.009220][T13030] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode
[  865.014914][T13030] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode
[  865.148030][T13046] netlink: 'syz.1.9313': attribute type 10 has an invalid length.
[  865.229301][T13052] netlink: 'syz.2.9314': attribute type 12 has an invalid length.
[  865.295373][T13053] netlink: 'syz.1.9315': attribute type 10 has an invalid length.
[  865.664003][T13062] netlink: 'syz.0.9318': attribute type 16 has an invalid length.
[  865.667127][T13062] netlink: 'syz.0.9318': attribute type 17 has an invalid length.
[  865.817302][T13068] netlink: 'syz.0.9320': attribute type 1 has an invalid length.
[  866.647426][T14576] smc: removing ib device syz2
[  866.817951][ T5907] ==================================================================
[  866.821129][ T5907] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190
[  866.824505][ T5907] Read of size 8 at addr ffff888100afc2e8 by task kworker/1:4/5907
[  866.828548][ T5907] 
[  866.829597][ T5907] CPU: 1 UID: 0 PID: 5907 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) 
[  866.829610][ T5907] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  866.829619][ T5907] Workqueue: events smc_ib_port_event_work
[  866.829636][ T5907] Call Trace:
[  866.829644][ T5907]  <TASK>
[  866.829650][ T5907]  dump_stack_lvl+0x189/0x250
[  866.829688][ T5907]  ? rcu_is_watching+0x15/0xb0
[  866.829702][ T5907]  ? __kasan_check_byte+0x12/0x40
[  866.829711][ T5907]  ? __pfx_dump_stack_lvl+0x10/0x10
[  866.829719][ T5907]  ? rcu_is_watching+0x15/0xb0
[  866.829730][ T5907]  ? lock_release+0x4b/0x3e0
[  866.829743][ T5907]  ? __virt_addr_valid+0x1c8/0x5c0
[  866.829752][ T5907]  ? __virt_addr_valid+0x4a5/0x5c0
[  866.829761][ T5907]  print_report+0xca/0x240
[  866.829770][ T5907]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  866.829779][ T5907]  kasan_report+0x118/0x150
[  866.829787][ T5907]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  866.829796][ T5907]  __ethtool_get_link_ksettings+0x6e/0x190
[  866.829805][ T5907]  ib_get_eth_speed+0x15e/0x7b0
[  866.829819][ T5907]  ? __pfx_ib_get_eth_speed+0x10/0x10
[  866.829831][ T5907]  ? do_raw_spin_unlock+0x4d/0x240
[  866.829842][ T5907]  rxe_query_port+0x93/0x3b0
[  866.829854][ T5907]  ib_query_port+0x170/0x830
[  866.829863][ T5907]  smc_ib_port_event_work+0x15a/0x940
[  866.829874][ T5907]  ? _raw_spin_unlock_irq+0x23/0x50
[  866.829887][ T5907]  ? process_scheduled_works+0x9ef/0x17b0
[  866.829900][ T5907]  ? process_scheduled_works+0x9ef/0x17b0
[  866.829910][ T5907]  process_scheduled_works+0xae1/0x17b0
[  866.829926][ T5907]  ? __pfx_process_scheduled_works+0x10/0x10
[  866.829939][ T5907]  worker_thread+0x8a0/0xda0
[  866.829951][ T5907]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  866.829962][ T5907]  ? __kthread_parkme+0x7b/0x200
[  866.829971][ T5907]  kthread+0x711/0x8a0
[  866.829980][ T5907]  ? __pfx_worker_thread+0x10/0x10
[  866.829990][ T5907]  ? __pfx_kthread+0x10/0x10
[  866.829998][ T5907]  ? _raw_spin_unlock_irq+0x23/0x50
[  866.830007][ T5907]  ? lockdep_hardirqs_on+0x9c/0x150
[  866.830018][ T5907]  ? __pfx_kthread+0x10/0x10
[  866.830026][ T5907]  ret_from_fork+0x4bc/0x870
[  866.830037][ T5907]  ? __pfx_ret_from_fork+0x10/0x10
[  866.830048][ T5907]  ? __switch_to_asm+0x39/0x70
[  866.830057][ T5907]  ? __switch_to_asm+0x33/0x70
[  866.830066][ T5907]  ? __pfx_kthread+0x10/0x10
[  866.830076][ T5907]  ret_from_fork_asm+0x1a/0x30
[  866.830096][ T5907]  </TASK>
[  866.830101][ T5907] 
[  866.911681][ T5907] Allocated by task 5840:
[  866.913328][ T5907]  kasan_save_track+0x3e/0x80
[  866.914812][ T5907]  __kasan_kmalloc+0x93/0xb0
[  866.916282][ T5907]  __kvmalloc_node_noprof+0x5cd/0x910
[  866.918019][ T5907]  alloc_netdev_mqs+0xa6/0x11b0
[  866.919575][ T5907]  rtnl_create_link+0x31f/0xd10
[  866.921119][ T5907]  rtnl_newlink_create+0x25c/0xb00
[  866.922838][ T5907]  rtnl_newlink+0x16d6/0x1c70
[  866.924450][ T5907]  rtnetlink_rcv_msg+0x7cf/0xb70
[  866.926222][ T5907]  netlink_rcv_skb+0x208/0x470
[  866.927776][ T5907]  netlink_unicast+0x82f/0x9e0
[  866.929298][ T5907]  netlink_sendmsg+0x805/0xb30
[  866.930841][ T5907]  __sock_sendmsg+0x21c/0x270
[  866.932293][ T5907]  __sys_sendto+0x3bd/0x520
[  866.933746][ T5907]  __x64_sys_sendto+0xde/0x100
[  866.935519][ T5907]  do_syscall_64+0xfa/0xfa0
[  866.937028][ T5907]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  866.938875][ T5907] 
[  866.939682][ T5907] Freed by task 13088:
[  866.941098][ T5907]  kasan_save_track+0x3e/0x80
[  866.942722][ T5907]  __kasan_save_free_info+0x46/0x50
[  866.944477][ T5907]  __kasan_slab_free+0x5c/0x80
[  866.946231][ T5907]  kfree+0x19c/0x6e0
[  866.947422][ T5907]  device_release+0x9c/0x1c0
[  866.949089][ T5907]  kobject_put+0x22b/0x480
[  866.950629][ T5907]  netdev_run_todo+0xd2e/0xea0
[  866.952403][ T5907]  rtnl_dellink+0x537/0x710
[  866.954188][ T5907]  rtnetlink_rcv_msg+0x7cf/0xb70
[  866.955860][ T5907]  netlink_rcv_skb+0x208/0x470
[  866.957578][ T5907]  netlink_unicast+0x82f/0x9e0
[  866.959126][ T5907]  netlink_sendmsg+0x805/0xb30
[  866.960905][ T5907]  __sock_sendmsg+0x21c/0x270
[  866.962742][ T5907]  ____sys_sendmsg+0x505/0x830
[  866.964288][ T5907]  ___sys_sendmsg+0x21f/0x2a0
[  866.965751][ T5907]  __x64_sys_sendmsg+0x19b/0x260
[  866.967427][ T5907]  do_syscall_64+0xfa/0xfa0
[  866.968848][ T5907]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  866.970806][ T5907] 
[  866.971719][ T5907] The buggy address belongs to the object at ffff888100afc000
[  866.971719][ T5907]  which belongs to the cache kmalloc-cg-4k of size 4096
[  866.976273][ T5907] The buggy address is located 744 bytes inside of
[  866.976273][ T5907]  freed 4096-byte region [ffff888100afc000, ffff888100afd000)
[  866.981481][ T5907] 
[  866.982440][ T5907] The buggy address belongs to the physical page:
[  866.984925][ T5907] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100af8
[  866.988437][ T5907] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  866.991704][ T5907] memcg:ffff888112c6c3c1
[  866.993398][ T5907] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  866.996361][ T5907] page_type: f5(slab)
[  866.997947][ T5907] raw: 057ff00000000040 ffff88801a84b500 dead000000000100 dead000000000122
[  867.001291][ T5907] raw: 0000000000000000 0000000000040004 00000000f5000000 ffff888112c6c3c1
[  867.004388][ T5907] head: 057ff00000000040 ffff88801a84b500 dead000000000100 dead000000000122
[  867.007090][ T5907] head: 0000000000000000 0000000000040004 00000000f5000000 ffff888112c6c3c1
[  867.009823][ T5907] head: 057ff00000000003 ffffea000402be01 00000000ffffffff 00000000ffffffff
[  867.012824][ T5907] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  867.015721][ T5907] page dumped because: kasan: bad access detected
[  867.017936][ T5907] page_owner tracks the page as allocated
[  867.020151][ T5907] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5840, tgid 5840 (syz-executor), ts 57543141401, free_ts 57542152698
[  867.027759][ T5907]  post_alloc_hook+0x240/0x2a0
[  867.029377][ T5907]  get_page_from_freelist+0x21e4/0x22c0
[  867.031448][ T5907]  __alloc_frozen_pages_noprof+0x181/0x370
[  867.033700][ T5907]  alloc_pages_mpol+0x232/0x4a0
[  867.035611][ T5907]  allocate_slab+0x96/0x3a0
[  867.037394][ T5907]  ___slab_alloc+0xe94/0x1920
[  867.039227][ T5907]  __slab_alloc+0x65/0x100
[  867.040953][ T5907]  __kmalloc_node_track_caller_noprof+0x5c7/0x800
[  867.043346][ T5907]  kmemdup_noprof+0x2b/0x70
[  867.044765][ T5907]  __addrconf_sysctl_register+0x9e/0x4c0
[  867.046487][ T5907]  addrconf_sysctl_register+0x168/0x1c0
[  867.048289][ T5907]  ipv6_add_dev+0xd46/0x1370
[  867.049856][ T5907]  addrconf_notify+0x794/0x1010
[  867.051674][ T5907]  notifier_call_chain+0x1b6/0x3e0
[  867.053431][ T5907]  register_netdevice+0x1608/0x1ae0
[  867.055288][ T5907]  virt_wifi_newlink+0x428/0x860
[  867.057088][ T5907] page last free pid 5840 tgid 5840 stack trace:
[  867.059267][ T5907]  register_dummy_stack+0x89/0xe0
[  867.060839][ T5907]  init_page_owner+0x2e/0x620
[  867.062291][ T5907]  page_ext_init+0x511/0x550
[  867.063741][ T5907]  mm_core_init+0x56/0x70
[  867.065112][ T5907] 
[  867.065983][ T5907] Memory state around the buggy address:
[  867.067740][ T5907]  ffff888100afc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  867.070189][ T5907]  ffff888100afc200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  867.073397][ T5907] >ffff888100afc280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  867.076468][ T5907]                                                           ^
[  867.079319][ T5907]  ffff888100afc300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  867.081914][ T5907]  ffff888100afc380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  867.084540][ T5907] ==================================================================
[  867.094545][ T5907] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  867.097545][ T5907] CPU: 1 UID: 0 PID: 5907 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT(full) 
[  867.101464][ T5907] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  867.105745][ T5907] Workqueue: events smc_ib_port_event_work
[  867.108206][ T5907] Call Trace:
[  867.109725][ T5907]  <TASK>
[  867.111033][ T5907]  dump_stack_lvl+0x99/0x250
[  867.113101][ T5907]  ? __asan_memcpy+0x40/0x70
[  867.115061][ T5907]  ? __pfx_dump_stack_lvl+0x10/0x10
[  867.116900][ T5907]  ? __pfx__printk+0x10/0x10
[  867.118567][ T5907]  vpanic+0x237/0x6d0
[  867.119884][ T5907]  ? __pfx_vpanic+0x10/0x10
[  867.121428][ T5907]  ? preempt_schedule+0xae/0xc0
[  867.123343][ T5907]  ? __pfx_preempt_schedule+0x10/0x10
[  867.125512][ T5907]  panic+0xb9/0xc0
[  867.126948][ T5907]  ? __pfx_panic+0x10/0x10
[  867.128433][ T5907]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[  867.130288][ T5907]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  867.132072][ T5907]  check_panic_on_warn+0x89/0xb0
[  867.133591][ T5907]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  867.135486][ T5907]  end_report+0x78/0x160
[  867.136831][ T5907]  kasan_report+0x129/0x150
[  867.138343][ T5907]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  867.140293][ T5907]  __ethtool_get_link_ksettings+0x6e/0x190
[  867.142209][ T5907]  ib_get_eth_speed+0x15e/0x7b0
[  867.143768][ T5907]  ? __pfx_ib_get_eth_speed+0x10/0x10
[  867.145527][ T5907]  ? do_raw_spin_unlock+0x4d/0x240
[  867.147200][ T5907]  rxe_query_port+0x93/0x3b0
[  867.148777][ T5907]  ib_query_port+0x170/0x830
[  867.150622][ T5907]  smc_ib_port_event_work+0x15a/0x940
[  867.152747][ T5907]  ? _raw_spin_unlock_irq+0x23/0x50
[  867.154833][ T5907]  ? process_scheduled_works+0x9ef/0x17b0
[  867.157054][ T5907]  ? process_scheduled_works+0x9ef/0x17b0
[  867.159253][ T5907]  process_scheduled_works+0xae1/0x17b0
[  867.161425][ T5907]  ? __pfx_process_scheduled_works+0x10/0x10
[  867.163754][ T5907]  worker_thread+0x8a0/0xda0
[  867.165545][ T5907]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  867.167897][ T5907]  ? __kthread_parkme+0x7b/0x200
[  867.169511][ T5907]  kthread+0x711/0x8a0
[  867.170920][ T5907]  ? __pfx_worker_thread+0x10/0x10
[  867.172843][ T5907]  ? __pfx_kthread+0x10/0x10
[  867.174522][ T5907]  ? _raw_spin_unlock_irq+0x23/0x50
[  867.176586][ T5907]  ? lockdep_hardirqs_on+0x9c/0x150
[  867.178587][ T5907]  ? __pfx_kthread+0x10/0x10
[  867.180201][ T5907]  ret_from_fork+0x4bc/0x870
[  867.181616][ T5907]  ? __pfx_ret_from_fork+0x10/0x10
[  867.183226][ T5907]  ? __switch_to_asm+0x39/0x70
[  867.184869][ T5907]  ? __switch_to_asm+0x33/0x70
[  867.186352][ T5907]  ? __pfx_kthread+0x10/0x10
[  867.187798][ T5907]  ret_from_fork_asm+0x1a/0x30
[  867.189250][ T5907]  </TASK>
[  867.190855][ T5907] Kernel Offset: disabled
[  867.192150][ T5907] Rebooting in 86400 seconds..

VM DIAGNOSIS:
06:14:55  Registers:
info registers vcpu 0

CPU#0
RAX=cd3052278d461900 RBX=ffffffff81969548 RCX=cd3052278d461900 RDX=0000000000000001
RSI=ffffffff8dbc0fba RDI=ffffffff8c038200 RBP=ffffffff8e007ea8 RSP=ffffffff8e007d80
R8 =ffff88804b032fdb R9 =1ffff110096065fb R10=dffffc0000000000 R11=ffffed10096065fc
R12=ffffffff8fc43c30 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1c12a38
RIP=ffffffff8b83fde3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b83e0000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000000000000000 CR3=000000006e744000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=9500820000fffe00 7500200008000001 XMM03=07000040fa000000 0000003048000000
XMM04=3efcc8d1005668aa 112d88b23343f348 XMM05=0000000000000000 0000000000f14236
XMM06=6793935538eb3efc c8d1005668aa112d XMM07=88b23343f3482892 98e7b2e02633f246
XMM08=6b7bd8ea3fb672f9 6efebb5d6980efde XMM09=0000000000000000 00007f4b69e12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=000000000000005b RBX=000000000000005b RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900044ef090
R8 =ffff888107210237 R9 =1ffff11020e42046 R10=dffffc0000000000 R11=ffffffff85548780
R12=dffffc0000000000 R13=ffffffff99d358e1 R14=ffffffff9a02a180 R15=0000000000000000
RIP=ffffffff855487fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a39e0000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000d84000 CR3=000000006e744000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f5652012e53
XMM06=0000000000000000 00007f5652012e4d XMM07=0000000000000000 00007f5652012e61
XMM08=0000000000000000 00007f5652012ee7 XMM09=0000000000000000 00007f5652012fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
