last executing test programs:

1.676549105s ago: executing program 1 (id=398):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000104010100000000000000000d000004080004400000000608000340000010000500010001"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x44084)

1.676223541s ago: executing program 1 (id=399):
r0 = socket$kcm(0x1e, 0x4, 0x0)
setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43)
r1 = socket$kcm(0x1e, 0x4, 0x0)
setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43)
write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0x101d0)
sendmsg$kcm(r1, &(0x7f00000001c0)={&(0x7f00000000c0)=@tipc=@name={0x1e, 0x2, 0x3, {{0x41}, 0x5}}, 0x80, 0x0, 0x0, &(0x7f0000000900)=ANY=[], 0x1458}, 0x48800)
close(0x3)

1.530164885s ago: executing program 1 (id=401):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r0, &(0x7f0000000040), 0x0}, 0x20)

1.468746128s ago: executing program 1 (id=402):
socket$kcm(0x2, 0x922000000001, 0x106)
perf_event_open(&(0x7f0000000b80)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000f2dcc6d0e5bfb6ecc27477a80d1fcf4b137d054bd61743b079bac97f2141d9f3fc65776a653c4ec621d3c20287f5605901decf24849b329a36c04e4b9ed84e68605ca797889c2552b819a920c3ea749c4760aa70f09c9c56b6a43f7c5b6d22e5b85ad8359b1ca3ce6562fb42785fa4a7fee635efcaa4ba6fab659971224383e4bf1cf7f3e03373a9750690557a2efd747ce8afce6d4cd5"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r2, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffff97, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)

1.337018218s ago: executing program 1 (id=406):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002a00)={0x30, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@typed={0x4, 0x8e}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x14, 0x0, 0x0, @u32=0x20004}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)

1.336374921s ago: executing program 2 (id=407):
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48)
bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x6)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @link_local})
close(r0)

1.267989272s ago: executing program 1 (id=408):
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = socket$kcm(0xf, 0x3, 0x2)
sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001c40)="0206e7ec02000000ffffffff006d97dc", 0x10}], 0x1}, 0x0)
r2 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x114b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x6, 0x7ff}, 0x19cb8, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x89fa, 0x0)
r4 = socket$kcm(0x2, 0x2, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x240440d1)
r5 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000001500)}, 0x8880)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x4, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, 0x0, 0x0)
r6 = socket$kcm(0x10, 0x2, 0x0)
r7 = socket$kcm(0x15, 0x5, 0x0)
ioctl$sock_kcm_SIOCKCMUNATTACH(r7, 0x89e1, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x1400, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xaffffff7ffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/mnt\x00')
r8 = socket$kcm(0x2b, 0x1, 0x0)
setsockopt$sock_attach_bpf(r8, 0x6, 0x24, 0x0, 0x0)
sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000001000000000000", 0x20}], 0x1}, 0x40000)
bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
setsockopt$sock_attach_bpf(r4, 0x1, 0x44, &(0x7f0000000640), 0x4)

1.20896107s ago: executing program 2 (id=409):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000006900000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r1, 0x5, 0x0, 0xfffffffffffffefe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x50)

1.204382929s ago: executing program 2 (id=411):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000007c0000007c00000002000000000000000000000e0000000000000000000000000600000d000000000000000000000000000000000000000000000000fd000000000000000000000000000000000000000000000000000000000000000000000c00000000000000000000000900000000000000000000000900000000000000000000000a02"], 0x0, 0x96, 0x0, 0x3}, 0x28)
r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1}, 0x28)
r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x5, 0xe2, &(0x7f00000002c0)=""/226, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x2}, 0x80)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a00)={r1, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001000), 0x8, 0x0, 0x8, 0xd, 0x0}}, 0x10)

903.193142ms ago: executing program 2 (id=412):
socket$nl_netfilter(0x10, 0x3, 0xc)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_bp={0x0, 0xb}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0))
socket$kcm(0x2b, 0x1, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0))
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040))
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000041000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100))
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x80)
socketpair(0x9, 0x1, 0x0, &(0x7f0000000000))
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'netdevsim0\x00'})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000080))

895.760041ms ago: executing program 0 (id=413):
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bf16000000000000b7070000010000004070000000000000400000004000e1ff95000000000000002ba76bb33123751c4e3409e62751ee00ba19ce670d25010000020000040000009fc404000000c788b277beee1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac03d046837d907b09ec39e9ef8f6e396ad200e011ea665c4"], 0x0}, 0x94)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000880)=ANY=[@ANYBLOB="4401"], 0x144}, 0x1, 0x0, 0x0, 0x4075}, 0x4800)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000840)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8fff0ff79a4f0ff00000000b7060000ffffffff6d64050000000000650404000100000004"], 0x0}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001f80)=ANY=[@ANYBLOB="b702000009000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2e6405000000000065060400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7956244cef7baf48e6d2885a09a87507ebfc75b5b0f4e4309ebcdac5f7a860c008cbdd3b4c3b7f28754860c9c781f6410457253e89ad528d985636a86ec0f68f59cd1159a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81078545c146a0857153b7b8f00034debae58a4ab415b0d7ff0575cc272cd3d7e8d974927676468ff2d86e0ffac94792ed9cf6b40b3cf252a47c05ae8a70d57cc3e067d1867b54d24e20000000000000020009ebf84d3b042d6e432cd080e3b57239f0127473e6ba922aff649609d40b47ec331ccba3cf96f9483ff19a6471bf5abc742d9cbcfb964b11b31034694a6aad86cf08a6c7b2235dc99de9aa3e6b77c7a2877261ed32da90864987f30926c9013eec3b86836ae50447aa5a79f40c235000000453302712c3d8fc4e2b61adb0695e800000000d4f4e91f0000002c33df424d1bafe5725c8a404724f8a4f1cda7997b65954f74097560b91da309b887af2485c2d9ab09b523000000000000000bf7b2ff4602aec1eea200000064881c5630521a08e051374cf05c921a06fb7818000000009dc8d95e0e5b365d10e1004dae58b3b5b89709b0ff47b200000000004000cbef88811dc8c1b27ac7d9a6bb70f60eb9c01dd2fc79b85e4d961498f3a80131d21d856177a2189f45d011ef1da5c6d57bb8fd387ccea9c3899a914e47e82f040000009d81003f927355408f87264797d3fa970949793b94329d580500d1f91c0d22587e05a61e3d8576ca168e88d7a9af95b04a37c27bfffab9abbb31fa8c0080258cfa6d3f166e695f3c56490aeef464d9965d70a50f1282619344f223548e750339643adac1322c87ca253ff2fb1882760d6feab16bacdf83c11816dbe959ebc5ec479c8319f73e2249eab0486b110702a481d3b51976a52303056e800b4ae5acc2dfae60ab958e9f3ef9b4aaa4e8d6166f636a65eb1d672bf2000000cda8462cc9b16624998be65683321e970000000009b8e20762c1bf4a3eb6769f2b23e842bacd9c685edea0ffa3e975424f8ede49e61a4de808a38ba3512d64dc71867df4eee3f1ff791cf7c9862f98b45852e4b2f78721b978a2df2f2a29a387c6f0576b36038f819286eca99a6a434811cf2a117d775fe986a49fb82cf5f15972d5ab18f1045384501adabb20f7b0e15ff47f1744e2341b59034959a1289ba6e243668e6735305707e3de7652bfc5b60c76deff43a1d6fd6a4180ab723735abbeffe7f2ec3a0bb86f9eddfc0f3d1d503d7a54b49e1ae6c5aa620d27e91aa0aa0ed6fcacfc91fbb4c256409e54daefbb107c381fa729ff5f3907d93430da178d685d7730f5e129438a5214f722096d2986334c2576bef69145d3fbd78a9059e454474f92e65828b018174a9f4738b8c71fbdeac26ab95e02f9a847182766964976b1fccdb9f35721e43e33883cf16ed1343fb7429eb395123b0a4262b7023c22039b9002589a378ed4c6267965af78b861bd025312538cec97966b8973d4e299d9802264d06e40ae118e1d242d1128dcedeb44030df12ef68f78215d65f96eb55db8cbcb060008000d988374f85451a694ffe38a1d03916ff10dc82b31c98d42e1a1bda1290de1a499a5a385b31112a48ba3e6d6849914c1788a7aca37177cc341fff44fec5c5e0abae01c439a1b0311e074e81ae9993b5b3459553e4ece78d4c1501c70f5d81e0725d5b273755c0000000000000000aa4234ff82182952a76233d18e7d49638aeb04e7a9e9e7eafb7c255372795d2d192a0a33cab0f5bf2e93e0544fcdf2df2bc6ce96e5a11993d54f97a23754ac828674dbb93c0ad345715be4a13678b01edf76d8a923655800a2c88cce004505ab45d8f5f88aa887bbce5c18970428516f6099bdbb2cd7a2356397f1a0a23e662e2a6c4834400cbaa41c3c574e6e6aefb7a68da5ec1ae49f968bbe0e0bf9878516f553639f5b4828e92019b61f5874be1c7cdd9482df50bc24b8a1fa10d291390eb84e26a2e8dbeaa45604b05a116c1210a7540bf81005044273f5a8ffc538db289350eb248e483bd8920efcf30a798c2b636243e0a37262ca47dfeefa753ba528f7ba77e825051ce69b4475d7d714ba0c636e6ae9f710411d30ef424aeaabe057c7df6ff8f767bcd9012e1047c686f5ccb76ab3a5df53cbc22ba7ea8f6a8e220bb4d83de1e4dc19d6c1be841503850803bc2c2d5e0e34270a7f1cca0c6c53a8e5f891f7a793a70da62d6d88fbb90d220acc687931b42d6be83ab870da3c0a567f5e65ec0457f4ad2a4ec0b671b36388afd5520a8483a4b11f7d02a409315f0f9e59f47668d68a74838d6976e12fd45200014041dffacbf60892ec8bd7560686f137a806d3dfaba900b47cac62f828342fff009adb5b2251461a1b9d6ba625b8fe04e69a1a4be2696f0000000086e172932e03000000000000005942e1b9d6dc28ab8e19e1111dd893e801015642faf21eef40d6e7de3ef62c4bc5ff17e7aeb2841098f845d1cc9ec4eee79c298fb0ba939b13707044e2e9cc0d350438c1c8c6bb9a38c6ac5ca0d9cf1f3d6915f25cb26edfc28b3079b97df32601240e454db103fb0c4a143673a3f160d3a7b83ecd0509ce9eba0c7bf7843799b1b56a234f9eaab8a3f14f1472bb6aaeb8ac9ee4054605558ab31f339f6a4caf2ee2fd01f34dca3300000000000000000000000000000000f59f8e6e00000000c44130098d833a24000000000095e6f945ba9a941cef5e70b8c152321e24b5b29bcf374dcf5a29a35d76e6e2bf8df95462690a4fc9ec8129e92b6ebb4b40a992a75d3c595426ae40d0bfc87db24d856359079b29b3c374d081c300b2cfaa596d24e800ef8e2201f2fb7a9946f89f9f31f7cbd603fd7f8898c70b5c65f2e28f22e1a79a6af3a54861b07f124642e98389557affbdede09b5566a4a1ee73b20846810030a754acddcdafe3ceeeebc0b5f2fedfe7d198e3067f3dbac9441a9ab8409cbbb7e15b9ae3944097de34de2001c8533a3766e6e4c4c4702ccb932a27a3962814cd6aa8fc684beeaa3932efae3a9052be8eec1e95f6ad8d41dd34829503ba4b66e27154cb6e34aa13450522df1723130b6fe347c93f00e40e293c98d849a33f773c743728992f40faccd5c23130a1c6bfd6fc661bca1598137ddd1090ded672f5a48a40cab3f640c8241a364cbdd3f188eec7da7bccafbd5bf28a46f0eecc6b550471b0b0770c6a5a411c0e0b19e15a461e7c6833ba936e214b013f2819ec6572a43b5cd32b11d7e4f8dcf8f7820a17b7b2ee6178a03351dd25091e46bfd82a3979b9cad109fd6217cd52aa81bdabd50826a674bd16b8f7e6aed12a305366599f5f029a7b24558c027518c669760500002f1c19d16a6f391906000000cc0bbbfb8c698ecc137d96711100e0108d3bd2afed0b279ebf0527552a9331e646c424b14ffbb815622bfd2f635855bed1b164d0a56bd104be069854111c5b26ec3c652b5f0a6b9676dae987ec23456ba05a4dfb15321ef6b76e7e547a688c67ab531cfc784c9f940d9fb0464a6cce635e14b80dc5c1c64e75e6bd5355d84f8df272f18f58c570e7afd83ee77f157c146aa747b728969aeb4aba1d8f9de1b3fb8ab6ea50e884c2ea98e6400bf0c5ae2887cd1da0e57ccfdf5eca2b455247efcc13102846c0a85f20c80007c0ce6efce627b95b8ad3003385de97101678fb2163ecea6e70a77a6fbc089e31a5ccece932229b8f79faa6863d6857c3d9a9710f9f8ad16eeb8342278f311cbc226498028234d21466892983378fe64acbb44f694cd78e43c74aa75505cb1c91b189f8f89f233a05f5cd4e173a373178557843dd705268f74a9e5429945503195aefd6706b584d8408c9652b3fe68500747f7ee8375fa559c3ad195d3795df1a8364cd13acc3256ee4634c73eeb6954d0fcf09ab84df0b8900e0c6fea2ccb600ae7a4b128cae19df160e7c207b89132d1d5bdc9ffc79f0549b82df521817651d5fead5128205b92ccdccc69407ab556217af277af911dbd456dfc43dd061b6c91485dcc208cf0b3d0bf851de413f5de5ec015e296914afab6411109355e027ce04990d9aae251b9deb11b7db45b9f15b7b55d8fdbedd9e6cf891205694f02be8b9ea8ecd41308a0e1b93ae3435bfa88b440b1f701b4d0fc49c82193f27f8023b630ea97edbf3bf421a0a1a2b4ac7bb30bcd1cdd172c0df37408fd6827bb03e8742fc1c7a2befd1299928c5f79e846a8dc7ca648d960a759e6711b69776896a9656d59af6d44bc5348229fa84ae78af8421a22c4b4c17a3d24a4a0104000000000000d77cc4eef51c2b417c8c7458ddd7dd9d1a863bf0a9e1a30a19020490038017a5c7e474c83302a2c2b5c976dacf3dda7191c757f208000000000000005f7ed983f65723fbb36b9b51abb0dbcd335700000000000000000000000000000086666201251aa4f139d0485ffcf89f01639fd1579a3802f720a0215c720a97071f5065a23642a58275dbca444b00e2e5835185d5d5b2796eb0fe32cf3b0633f58ecc7648c3c6efe82f93a3008052416512eea30ea9472e0b456a652883c0907323cf03be193a05008cdef7a98a1671a1918df310dc4bfd61c3db4819ab1c57b348a8ff1ed36364a20fe846f1cd086058d139ce528425b31c5d08b433562ffb318c1285011f9b78b2401989384311101e452f54661ecdb2514a6ae50dbdd422de0f0f8c670000000000390be79688f80c47314cb1b14afcaa5d23f9032e0ec51f45f447d6a7c798fcf7e60e2180e289410801e4f03a0e140f388f25b92da1025d8409e171a2336ed71cca86eb4658fe06df286e0e20276b0618eeffd05774f15686cd9d3182ca2fec863875f305fed6baf48a594db12582a38cfdffffffffffffff0cf8d920517835fe7d09cfcb624f6931f1cc6f6b71f58de9ddc38e0c43992f6bc57a718d0cfd197b5324b4e05ef1caa96db3ae1f2f2e5791faba2ebbe1a6faf21f2748fb1fb6743c3ca8af4e6b02518c9b7fdc1b5721eb1c3ed98db25536f74ac7861afc94544e52dcb5c60460a05802e3b437ac977bfa26b887a2443e8d559c58187f004eb82b07937df6e96f77ed551926bec4e0188fae10a35d1c5f1768ac6be829bea46f1babc3d74adc31ca71bdab9079e4288881b434484eadde9da6b81802842abd462d546c59d87acc014f81d3414759bda12d2a2c6bc1bfa807bd3101eb227184a61107b6d0618e2a3b842671e084ac3f0ff94dc48b51601247318ab4d1c5106458000000000008000000000000cfee0107e6c2fe8639d926829fdbbd86bf591a8c3c235d8939af9d923f648165881a6c29997234406400b3b1c321cc158dbe17123eace30000000000009ea77cb4d3ca892600000000796de6ae4ae40bdf9a6e8c5dc29562262af9cd54e8e3ecc7e3c8cba0ecc791683496c4e5c1a5729714d9f9031f49b400cd2667b4ea6df54809615a4f973f93e6ccec72f16ff998e29ed99df733680a9d5cea57f99cc139b6ea9014f3000000000000000000000000000000000000feeab45a4046a622b0dceb413e4e39b7317e92cbed46b41ab5115bfb542c933783d750852dfdc6656aaf15e10615a88821f2f1bc53969b52d6852755e7681ad5beda80b38ccd34116b99f50b4fdd967b3f20f260455412b67563e40e323bde9d673fceda0ad6981565c8a183d928903b4f4472dde41b6dcd75314c31e704dfcb222c8359fe88944f852242270c932abfaeece0843d708f5cd25b2a63ae1e79723c1c3c013836b47da0a35d0f34c070000000000000422ae2c148d444dd437a7d2f5e575009bc2d17a199802409329dae8baa58d3de63ad45328a9d4dc1ace543dfe11913c6c6413f8f7a15657d012fea460bb4656a20df1ba26932b0ef49f8ea88d7b4c1289314ba789661640f1b5d7cbae103fa95b0035f1e8e866207d4796eab0992704f9e00be4b1af8dfa9e94ad74e607ea9d7d7a95ed5a15429426abbed8d2c657018305c6f9e5159a5453f958991a908ff4cb2e8cbccb1d3c8daf754e4b01b2edd023e5bfdf293bd28fc1f8885f6edd5a715df4d180247feb08e9e2e5126c48be6098e711f0d86de5d76fdccae34eef9197c32ab4e6fcb52eb9ce18fdb621a75913a97254d783778203ec0bd1a8859683e1d01da4e81fb73bb3b358340a0310bf5ae17b917208da607fd7b125cf99fd3e9056f5184df7570ede94b736ae354b5b8ae2cc473b455f2f86d47c69027676bf1141f316b0f278f1692406572ee82766f8e5ff1cfec2a7a6cab7d0f2582a877c9bd4ca81089373f738d02e6bb4d3df30ac0f041e51ad36e1ff140812baf54b80635cc80963c8f69fa4506f7a30c99d3e538cc0aeafcad86ead38ed949aa3c204aea50e5e0039f01b82595b7dc921a8acc1f76340f060cc9a3acad3451c17dc9b5ca5d10a0cb1708592d1900a046f33761d50895febd9fd58cb132989766cf7c252daac259576ec218e3857e6fa97fe445d1fab51d87302a4bb28a4cfe462ee4849cc6832650188ca187d85509d8beccf9d9cf752368985804195b9fd2faf1aff8248f3981bd55cbbf514cd8365fee72cc7af053e5388ceadadb96a9acd5261df6a90cab13f58f6d563c9ab4ad37297aecffd8446cb2b14ec36a99af8393e3760d5970ba1debdcbccd54012c559ee2797ff962328aa6a252c0756e396ce4d52937546675203bdf1d6b120acac576523f8b1daa922188bf61536312f90dba92fb380c3c6fb5f9883a2c4dd99a1bac9b7cb25ff2ef9bd58ff97ddfdd2d4bcc371ee82245b57cd91a7fa3479cd339f54a5c422b753cd42d441ea881d46e419312db1f0cccced13468a188df7ab4840b9961e2a8b5202c9d9b00ee912572eea15d13abdf3b21ad680c88a513021c1d3a7b30d64960c03a01364b2324966bd89d917b15dcb4f8cbacfe05ddcc213d14189edcd9f8b828ebaaab4f56470d3abef47b6d88dc438c9b0a253c26c386464754e76c0d7bfbc1dfa7248982ec26bd725eb623bb12f96e63eb5d1a0030e58a6653247c986c7ca9f15fd84d5eb1cd5ee35c4f464dc1a789b06c6c7074fc927680eac8546b2aee2f8867d6bf36b88a99ff67c7b2dd68ae3380622653efcad276a0f4b446091b80653014e67629dfde0091c7f090a22b5c427d03ddbc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa6, 0x0, 0x0, 0x10, 0x3}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x20e, 0xe40, 0xfd000004, &(0x7f00000004c0)="b9180bb76003070c009e40f086dd1fff31000000330020010010ac14142ee0080001c699da153f0ae0e6e380f60115f683317585d7473ce0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0x31, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28)

260.341555ms ago: executing program 0 (id=414):
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x2, {0x2, 0x0, @empty}}, 0x80, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x0)
r0 = socket$kcm(0xa, 0x5, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, 0x0}, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000002280)=ANY=[@ANYBLOB="18020000e2ffffff00000000000000c685000000360000009500001800000000922ae83713ab9600010000801b10fb54a8cb72d232ad558c46fff4208d4990ec11ce9413ac30e00bd0081f8504e19a5183d769676520e98a263345e44d5ad12bca35510100c4d86abeb12303ff1c9fe0d0020000d60400000007d3670000008aff66d6b3181ffc1d62a3954c1198bbc4fa13aee48ca9e8969faebf3183fe803ab3f5024b52dc265b36fc9dae00a09404f01f9504d0976d252bd8d24538556e5e57bee3b8cf464ef3c6a7def8bad3ca6e3abdb21696e340bb8e2a093add57196b40def3858ef569147fa4108328392d322ab5df10a2f69a6bdf72ee7944e810d0223917c3d042410f57466f59544047d6d8ac44060000000000ee16c729300d2301800000000000002b5a8b05fcc154ad5290a8cdb97c343f454ff69dd6cbde49b28a6cb5f4fc0001745cff6e00e7ffffff0000acf3209a08439f1ff01779b6f6df7e02aa6d7760525b595fe1f697bc114ed1778e97a3f0395f946974cfb458be2a34cf924dc37b5592bf17956f3547497aba814382ff67b345b677a9d6523d87008000000400000000003fe8613ca29ff92be0d8deffff7b68136b0046d535dd39c0f35408869e9b342b953f91447e6b9eab304f134306320600a44095254b45a6c1312a13696c7202df5f764713504facc532c5a6d44d99ec7530ed7b0311000000000000e54e9072a22d911f4a2c2e2fa806e63c5cd98a8569a6d6bcfb000064885117e2ad910eae67e0ebe380d0f648713e68153579e02d71c58d147b00821ab9a6475b31e1ebf1369a04000000fbf3983f283f2f00000000992774814d63c933912d000006000000a66acb0a38856929e7d8b1b06c9bd5d7e5490f3b8596b694ea9483bd4bd287c83dd998a74694d18bdd8ad0983bc90770bbd26a82b9d99d5fc04563b523c47ef8c33400e90d02000000000000000edf1147a7afe772cd45af8aeffe2753088e02ca6bb2feec446ce7dbce66f0a93a03371320980865c7c62ea4d8f8a864dce9fa85aeb0454349100296ee2dba39c3f6fd6cf96714e11fe03b5062809a7418b165dd0336d226bac1e1223be1c97b15175d0e664beb126000e96549e1a1228c686edb475b705eaa9515c96f4fc6b3c925ea404e0f1de61026dc6c6618580fd6ce9eac602c1756f6d1056712412131ed9925989e01eae489ec7052e0ed72c326c7a8aa63999e2297c54ce1822d14b7c7699a9d0600f11f2e7f474cffbc35bc8623cd5eb68af82275a940be0400000000423346da092cbe220de96d6a8e9f32f18d1f606b381e4903b500000000000000000000004a2357ba5f03000000000000005dcf4f2aaee86d4802000000000000007cdb686d5da2a42e4b5024b6535811f362201d4f82012e6af704973d04ea923c19e6cb723c1923b3eea2d73e176dff383c9fbbac53dfdcb1a68c98e96fe39eec23963faf3ebed3409144c7c53d6318ced678a621450a9b01e9f2772e5f2999d3435da02556e36c3215d2bd4e96c93bff3ad04a82ff3cfadcf65eb92adc6c68d66b11cb2d7556414a86dfa94bb7aa52c7febb1e9b2efcbbc5bccf9d39bed802f4f056976a9a362ee9cc624ec454b90200fd9603f96908bddc14500000000000000000000000000044d917c62b27679913075731e8fddb07c10c82002d60181588ae63a440454287de9e340f611267f37bdd0f2d21cb06fcaf45a0a297e396f428d43371424b307eef82c5d6d19f3ef0d3b8f7fa51957e3099caab31133b34a1d3eebc0f0c9056df2e9667ba0b55695c7894010079b07e7aef7785e248deb8c83ab6eb2c72c484241dc3b66da78260f800fffd39368b952f6f4a10295c50c887a31d8b543c5d10f2dbd4d0b84eaad43feb6e169a9f2fcff7000000000000000000e011bc6366f56fa787f212c1f8c0f47f5078191c8a02ad436725771738a2a98891971e3b932352896e1ea10f62e8ef7a87e16151b39d6c27575714540d8c293a3fa4b5a825360423c1cbc8b5d19167152823ed853140edda002c16c842b168bb55f6bb713deb57d0aa78d6d4e5fc5be2c402bd77125d98120358900000892b135a92e8c844938aa98ba4839a1408a696454d40e5eed4d4dce481ca86bfac54c330331b7f2cde17cbaeb0377696faf546ecbe742d73d47d726a50f6e752f3325255bd7e8b5923aa3cfb6f7e06494f21ca450139c558000000000000000000000800000000000000000075aa0000000000000000000000005560bd9eb81e839e4992e64b074a66cccccf00334fa94da8477be7d99b558ec6a5b1596ac1e7617c6b32eed0cc70286caf2c5189a103f4b0b04aff171c4d388ccf67fea37e782f025c94c853cde330a193a967d907a8c88fcb033e680f559a72150cb900bafcd536f48797915a2fe9922ce27300009e1b36aa4730117d9b00000000003c630000000000008fbbd11b015c415ca04192fbfb1a8b0e3460af35771dbac10062835c9bab3ad09f7a022c52d8000000000000000000004000000000000000000000000000000000000000000400000000000000000000000000006ec473c54399b7b8aa1ee46132fc45da8292631178cecf19550108b8b8423de4295777a17bf4dfdfee5de0f3e4dadf51ab9562827b762fa611ba5f32861c19dffe1dc9fd5c41cd46cf131fd6b0c2ddad90ac33f768f9ecc70327c59918fa5a249befe98262f53c8182d95f6da3698a6a88c2c31d801a8f1f5e0ce05138d5422da0a6a62b9dfe1f39775d1d0c9186096415f544aaf76b0a1c877a6c826a5adcfb22c4a0e5a46271caa3eaf4f389dd5f3c20dbddc0377a4266d7b9fd61b9287e9b4be0a413ee31be0ddecab0ef7b25cba1fb3654ddf291ecb7768ac1e177042cb4c452fa6b3966950000000000000000c187da23d6855500fe8510b51e13a890e394b84a6ea2cc8d42b97c697c29122298d55e2e1cca8e07abda2606a3f381c64b9fec0000000a7965e4854e8e3572ad5149b3872342dea9252132860c9af1bd5fe263c0313dea5d6e0c11a466d6892ed65f34667dd79b07b5cbdd8aa7dd561a26b5562d4861a7e1b0f48930e0b696ea3bee7eb72794e163d7aeac9a0fa5403ac9cb421eae283b0550f1d0d339cd7b96e71d3ab48ad9d7975e0c9b117f71d3ab80a0c9b0284ecc469fa6181c9c71fce07a6ffb23296a107763138e8d9876291af2076890c47925ac773d95d2ca42acb3e5f3a1550665b898462c139ffd0106bc8a61b6117d252efcab7106b4c3a3c13a70ff452e9d2096142c517b0e91b5cf88332faca5b3ee96363065c3ce32d3d39ec36e20d597e05664f2526bd918090649da11f7299789d00f502cdf1e99d3efecb9b457642fe810370ba4fbe00fa60a28af966a27a1659e448bbe43a1dcd2ea760018b57a36ac41ef2051a7b703d55c0602540663016e20d50385766df4dac47802a55bd38dd767ee9960c6daa704fc5d01a14591f26b7b538c9bb22f6a2f7a34d1b9edfd125a9e25a110228c64253588ff420644dbc0854e69a7bdda72f93ceaccf92cfe7dd6296c950db10f6dd8a5ef9b73cf6a12a1ba16fdc7e35b805f4fd2fcff0a623722149c1465e4de2d53f0f10b14c21865027abc71a12cb1e9f8029c7a20000000eeb0d53a83e518c8d2052c08b515d9d0bde24ac4e798040c7db0bb03c019507d6377f3d5dd94a27abc6d6b120d61f772407e0d2cb50d29168b68aef9f176b4c3aa8b21279d4ea9c1f669aa8c2c17d5b3a8d1dda58d26f1019af04b7774c85d5bce8be010f27c5211938031c3404680b01279c778bd1fe1b48c4b5b8e0fe756e54a8d76b7cec5e3407d93b4eadc446440607de844acf5524a4657e33af2115547b735b57b5092d0bc8fa6acb832509abe0882d570ce400aaebd7baff88526608d6991aac95751671174129457e4a03aca69d82b64b89e6ad6ed1e275ec5002e48170e4c7b4f3971481098dedb88fba90770e44bf404d5a97fefe2fe8e459fe45933b78c7ab5fe985a480193a20fb07da1455fb283df68af569ac82aa6dc703e29bf158931fb79f2abfa6ff7eb8c4f381c9da58bea460e2ead969933e5391970ca4fddd64da2e5df9c4d82044068caaaab771b37bb06bbe673056d849825525f1120b2250f6b8520381f7a74b1c687781cb6b23e67b918844b83dbaeeb559ec8520d710dd6d6b4e64838bd434a36ed03fc0c488b24571032ffbc9f8ce97041e1bc4729d539358dc9599c1266b9ce2cb6dd0ad57a6e9d3d4a11a27f70b2934c96237e2ba09c58eeda678d4d08b6da99b7a86e946215afb1b48792fde54492e306cb5342e2589874b603a1de972b1f09cc350096f5c3e814118af9ba0793cfdf20c77b34eacfdf63ce59ec4d2f867bf884e941559b068d908325667672b5e1cf71f4829c0493e8b141399ed926b822becead7a0a2b4a4c008ab16b616d60f347e4da54f06443507efe57ea62399ef4eb11b2f559e1b056456a53998bf1c6d13c92e75136147f91ae3a75ca15eb1b51bf700b3c0bf54bc3745ff313c5e75dc66386897f6ee45429371b8d0878c442ad2fe9baf85c1390da13efc353ccbef950c29f39ddf436f0d9bf1be1515ed251d8b6f11ecb16b1e8d1ed04196e9b6c2f9e068b7749bb6c1f533e493f22c901662c65cb761dc2eeff2f698bd4dbae83e2dfdc4f1c7f918a00515c1bc189d10ec22b35c92725cbf0ba244fd029c4f026f68e000000060000ab0476c3fd7f7c1e5c000000000000000000000011e43e39d3f4394fbfa13c416b1c443c5e52eea726491ad75100ebad7c6d5a665c59a3fb158e43da904f19e7e8daa4e90390b8da945f6cd78536c0d2be07221f85ad46b180f256d4d84592691d15d65896b66b63a46705338b67b72dc1c3075fcdc5cbffb0366151632ba5be8ae815dfea9fadfd31c473a24a73d3e5116c3023b3563c72d26fbd59877132bde5ca4ef8d92fd3613c768b35223f6fd0b5e9a8b98cccf1e2b4612e620e3a159d6365c9045aaa826aa0ee6d26cf0397ce674c20824584b464ebdc2f3ea26a7aec4570b242a6677a4e9187f8591c3a9bdc0000001a002364bbd93964a8d0bdc802b9be2500"/3636], &(0x7f0000000040)='GPL\x00', 0x4, 0xfdc0, &(0x7f0000000300)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70)
setsockopt$sock_attach_bpf(r0, 0x29, 0x22, &(0x7f0000000100)=r1, 0x20)

180.415492ms ago: executing program 0 (id=415):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='signal_generate\x00', r1}, 0x18)
perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8020, 0x90000, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x2, 0x6}, 0x8224, 0x2, 0x2, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)

129.827339ms ago: executing program 0 (id=416):
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @local}}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000ac0)="ee", 0x1}, {0x0, 0x2}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0)

129.508718ms ago: executing program 0 (id=417):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0)
write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7)
r2 = openat$cgroup_procs(r0, &(0x7f00000001c0)='tasks\x00', 0x2, 0x0)
r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
write$cgroup_pid(r2, &(0x7f0000000180)=r3, 0x12)
write$cgroup_freezer_state(r1, &(0x7f0000000080)='THAWED\x00', 0x7)

59.305754ms ago: executing program 2 (id=418):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x2c, 0x2b, 0xb, 0x0, 0x0, {0x9}, [@typed={0x4, 0x3}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @pid}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd}]}, 0x2c}}, 0x4004800)

288.793µs ago: executing program 2 (id=419):
r0 = socket$kcm(0x11, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000000440)={&(0x7f0000001340)=@phonet={0x23, 0x2, 0x7, 0xa}, 0x80, 0x0}, 0x0)

0s ago: executing program 0 (id=420):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@expire={0x104, 0x18, 0x1, 0x70bd2a, 0x25dfdbfd, {{{@in6=@empty, @in=@broadcast, 0x4e22, 0x6, 0x4e23, 0x4, 0x2, 0x0, 0xa0, 0xd5}, {@in6=@remote, 0x4d5, 0x3c}, @in=@rand_addr=0x64010102, {0x515a9802, 0x7f, 0xffffffffffffffff, 0xd, 0x8000000000000000, 0xba, 0x7, 0xe}, {0x3f, 0xffffffffffffff4d, 0x6, 0x4}, {0x5, 0x10, 0x97}, 0x70bd25, 0x3500, 0xa, 0x7, 0x9, 0x8}, 0xd}, [@mark={0xc, 0x15, {0x35075a, 0x9}}]}, 0x104}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:1159' (ED25519) to the list of known hosts.
syzkaller login: [   56.385106][ T5793] cgroup: Unknown subsys name 'net'
[   56.497429][ T5793] cgroup: Unknown subsys name 'cpuset'
[   56.505273][ T5793] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.614209][ T5793] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.739857][   T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.744682][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.748772][   T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.752931][   T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.756523][   T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.811168][ T5236] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.823337][ T5236] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.827038][ T5236] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.834040][ T5850] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.839015][ T5850] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.843772][ T5855] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.893660][ T5856] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.898289][ T5856] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.903515][ T5856] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.908486][ T5856] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   64.129754][ T5847] chnl_net:caif_netlink_parms(): no params data found
[   64.199894][ T5852] chnl_net:caif_netlink_parms(): no params data found
[   64.264741][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.268799][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.272360][ T5847] bridge_slave_0: entered allmulticast mode
[   64.277076][ T5847] bridge_slave_0: entered promiscuous mode
[   64.290487][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.294551][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.297721][ T5847] bridge_slave_1: entered allmulticast mode
[   64.301747][ T5847] bridge_slave_1: entered promiscuous mode
[   64.410546][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.436205][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.468019][ T5852] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.471110][ T5852] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.475426][ T5852] bridge_slave_0: entered allmulticast mode
[   64.479454][ T5852] bridge_slave_0: entered promiscuous mode
[   64.504190][ T5847] team0: Port device team_slave_0 added
[   64.507228][ T5852] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.510279][ T5852] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.514025][ T5852] bridge_slave_1: entered allmulticast mode
[   64.517889][ T5852] bridge_slave_1: entered promiscuous mode
[   64.535168][ T5854] chnl_net:caif_netlink_parms(): no params data found
[   64.556671][ T5847] team0: Port device team_slave_1 added
[   64.568869][ T5852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.596090][ T5852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.645851][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.648567][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.660430][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.667554][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.670814][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.681531][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.697419][ T5852] team0: Port device team_slave_0 added
[   64.716192][ T5852] team0: Port device team_slave_1 added
[   64.809502][ T5854] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.812511][ T5854] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.816064][ T5854] bridge_slave_0: entered allmulticast mode
[   64.819712][ T5854] bridge_slave_0: entered promiscuous mode
[   64.829322][ T5847] hsr_slave_0: entered promiscuous mode
[   64.832550][ T5847] hsr_slave_1: entered promiscuous mode
[   64.839359][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.842222][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.853765][ T5852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.858803][ T5854] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.861567][ T5854] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.864171][ T5854] bridge_slave_1: entered allmulticast mode
[   64.867152][ T5854] bridge_slave_1: entered promiscuous mode
[   64.896514][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.898827][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.908019][ T5852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.930833][ T5854] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.951070][ T5854] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   65.018341][ T5854] team0: Port device team_slave_0 added
[   65.045277][ T5854] team0: Port device team_slave_1 added
[   65.117255][ T5852] hsr_slave_0: entered promiscuous mode
[   65.120627][ T5852] hsr_slave_1: entered promiscuous mode
[   65.124334][ T5852] debugfs: 'hsr0' already exists in 'hsr'
[   65.126909][ T5852] Cannot create hsr debugfs directory
[   65.152272][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_0
[   65.155670][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.168308][ T5854] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   65.188993][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_1
[   65.191905][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   65.203417][ T5854] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   65.362187][ T5854] hsr_slave_0: entered promiscuous mode
[   65.365887][ T5854] hsr_slave_1: entered promiscuous mode
[   65.368798][ T5854] debugfs: 'hsr0' already exists in 'hsr'
[   65.371151][ T5854] Cannot create hsr debugfs directory
[   65.560720][ T5847] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   65.570992][ T5847] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   65.593397][ T5847] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   65.617944][ T5847] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   65.660516][ T5852] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   65.685375][ T5852] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   65.709232][ T5852] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   65.728225][ T5852] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.774838][ T5854] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   65.781759][ T5854] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   65.798278][ T5854] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.808990][ T5854] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.813596][ T5236] Bluetooth: hci0: command tx timeout
[   65.884300][ T5236] Bluetooth: hci1: command tx timeout
[   65.940021][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.963335][ T5236] Bluetooth: hci2: command tx timeout
[   65.978193][ T5847] 8021q: adding VLAN 0 to HW filter on device team0
[   65.986567][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.017663][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.020803][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.046964][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.050132][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.069211][ T5852] 8021q: adding VLAN 0 to HW filter on device team0
[   66.078209][ T5854] 8021q: adding VLAN 0 to HW filter on device bond0
[   66.094466][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.097236][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.106959][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.109424][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.162495][ T5854] 8021q: adding VLAN 0 to HW filter on device team0
[   66.188778][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   66.191004][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   66.196178][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   66.198689][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   66.429699][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.496135][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.528257][ T5847] veth0_vlan: entered promiscuous mode
[   66.563518][ T5854] 8021q: adding VLAN 0 to HW filter on device batadv0
[   66.568824][ T5847] veth1_vlan: entered promiscuous mode
[   66.602107][ T5852] veth0_vlan: entered promiscuous mode
[   66.630064][ T5852] veth1_vlan: entered promiscuous mode
[   66.641605][ T5847] veth0_macvtap: entered promiscuous mode
[   66.661283][ T5847] veth1_macvtap: entered promiscuous mode
[   66.686782][ T5854] veth0_vlan: entered promiscuous mode
[   66.716114][ T5854] veth1_vlan: entered promiscuous mode
[   66.721342][ T5852] veth0_macvtap: entered promiscuous mode
[   66.727871][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.740092][ T5852] veth1_macvtap: entered promiscuous mode
[   66.747444][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.770470][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.787114][ T5854] veth0_macvtap: entered promiscuous mode
[   66.813802][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.824916][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.828858][ T5854] veth1_macvtap: entered promiscuous mode
[   66.833831][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.847943][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.870127][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1
[   66.912180][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_0
[   66.920319][ T5874] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   66.928032][ T5874] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   66.931891][ T5874] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   66.949542][  T953] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.952078][  T953] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.962508][ T5874] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.971186][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_1
[   67.018114][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   67.024008][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   67.036943][  T953] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.040522][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   67.044111][  T953] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.067863][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   67.095767][ T1088] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.098373][ T1088] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.111274][ T5847] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   67.142196][ T1088] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.151903][ T1088] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.222712][    C1] hrtimer: interrupt took 97604 ns
[   67.224575][  T953] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.230498][  T953] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.317952][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   67.350088][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   67.656510][ T5926] netlink: 68 bytes leftover after parsing attributes in process `syz.1.9'.
[   67.713437][ T5926] netlink: 'syz.1.9': attribute type 21 has an invalid length.
[   67.734565][ T5926] netlink: 'syz.1.9': attribute type 10 has an invalid length.
[   67.896661][ T5236] Bluetooth: hci0: command tx timeout
[   67.964244][ T5236] Bluetooth: hci1: command tx timeout
[   68.045377][ T5236] Bluetooth: hci2: command tx timeout
[   68.154446][ T5930] netlink: 'syz.0.10': attribute type 12 has an invalid length.
[   68.159030][ T5930] netlink: 132 bytes leftover after parsing attributes in process `syz.0.10'.
[   68.357802][ T5937] netlink: 'syz.0.13': attribute type 13 has an invalid length.
[   68.360885][ T5937] netlink: 14581 bytes leftover after parsing attributes in process `syz.0.13'.
[   69.401948][ T5959] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   69.412410][ T5959] sock: sock_timestamping_bind_phc: sock not bind to device
[   69.443514][ T5961] warning: `syz.0.24' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   69.459627][ T5961] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[   69.507628][ T5961] netlink: 'syz.0.24': attribute type 10 has an invalid length.
[   69.584739][ T5961] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   69.600796][ T5972] netlink: 'syz.1.28': attribute type 7 has an invalid length.
[   69.605125][ T5972] netlink: 'syz.1.28': attribute type 8 has an invalid length.
[   69.923767][ T5236] Bluetooth: hci1: unexpected event 0x01 length: 151 > 1
[   69.961905][ T5995] netlink: 'syz.1.39': attribute type 6 has an invalid length.
[   69.964978][ T5236] Bluetooth: hci0: command tx timeout
[   69.971456][ T5995] netlink: 168 bytes leftover after parsing attributes in process `syz.1.39'.
[   70.043684][ T5236] Bluetooth: hci1: command tx timeout
[   70.126391][ T5236] Bluetooth: hci2: command tx timeout
[   70.128199][ T5997] netlink: 'syz.1.40': attribute type 10 has an invalid length.
[   70.191636][ T6007] netlink: 'syz.2.45': attribute type 1 has an invalid length.
[   70.408545][ T5997] bond0: (slave dummy0): Enslaving as an active interface with an up link
[   70.464585][ T6017] netlink: 144 bytes leftover after parsing attributes in process `syz.2.50'.
[   70.518199][ T6020] netlink: 132 bytes leftover after parsing attributes in process `syz.2.52'.
[   70.577785][ T6025] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.51'.
[   70.581614][ T6021] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.51'.
[   70.590030][ T6025] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.51'.
[   70.666461][ T6023] netlink: 132 bytes leftover after parsing attributes in process `syz.1.53'.
[   70.685841][ T6029] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096
[   71.149211][ T6063] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   71.157809][ T6063] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[   71.212766][ T6066] Zero length message leads to an empty skb
[   71.309886][ T6072] sctp: [Deprecated]: syz.0.74 (pid 6072) Use of struct sctp_assoc_value in delayed_ack socket option.
[   71.309886][ T6072] Use struct sctp_sack_info instead
[   71.724717][   T26] wlan1: Trigger new scan to find an IBSS to join
[   72.043848][ T5236] Bluetooth: hci0: command tx timeout
[   72.133787][ T5236] Bluetooth: hci1: command tx timeout
[   72.212988][ T5236] Bluetooth: hci2: command tx timeout
[   72.579999][ T6111] =======================================================
[   72.579999][ T6111] WARNING: The mand mount option has been deprecated and
[   72.579999][ T6111]          and is ignored by this kernel. Remove the mand
[   72.579999][ T6111]          option from the mount to silence this warning.
[   72.579999][ T6111] =======================================================
[   72.685370][ T6113] __nla_validate_parse: 3 callbacks suppressed
[   72.685392][ T6113] netlink: 40227 bytes leftover after parsing attributes in process `syz.1.93'.
[   72.760553][ T6117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.94'.
[   72.778069][ T6117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.94'.
[   72.790391][ T6121] validate_nla: 1 callbacks suppressed
[   72.790429][ T6121] netlink: 'syz.1.96': attribute type 1 has an invalid length.
[   72.870246][ T6123] netlink: 188 bytes leftover after parsing attributes in process `syz.2.97'.
[   73.347773][ T6150] netlink: 48 bytes leftover after parsing attributes in process `syz.0.110'.
[   74.682820][   T27] wlan1: Trigger new scan to find an IBSS to join
[   74.932264][ T6193] raw_sendmsg: syz.2.130 forgot to set AF_INET. Fix it!
[   75.018126][ T6196] netlink: 40 bytes leftover after parsing attributes in process `syz.2.130'.
[   75.153215][ T6196] netlink: 40 bytes leftover after parsing attributes in process `syz.2.130'.
[   75.239045][ T6196] netlink: 40 bytes leftover after parsing attributes in process `syz.2.130'.
[   75.260957][ T6203] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.132'.
[   75.562384][ T6218] netlink: 'syz.1.137': attribute type 1 has an invalid length.
[   75.685966][ T6220] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.139'.
[   75.698671][ T6220] netlink: zone id is out of range
[   75.701073][ T6220] netlink: zone id is out of range
[   75.708567][ T6220] netlink: get zone limit has 8 unknown bytes
[   75.817854][ T6225] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   76.676125][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   76.679142][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   77.190147][ T6263] netlink: 'syz.1.155': attribute type 1 has an invalid length.
[   77.559107][ T6266] netlink: 'syz.2.156': attribute type 29 has an invalid length.
[   77.571986][ T6266] netlink: 'syz.2.156': attribute type 29 has an invalid length.
[   77.578790][ T6266] netlink: 'syz.2.156': attribute type 29 has an invalid length.
[   77.707958][ T6276] netlink: 'syz.2.161': attribute type 2 has an invalid length.
[   77.710924][ T6276] netlink: 'syz.2.161': attribute type 1 has an invalid length.
[   77.717147][ T6276] __nla_validate_parse: 4 callbacks suppressed
[   77.717158][ T6276] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.161'.
[   78.175654][ T6306] Illegal XDP return value 576076160 on prog  (id 45) dev N/A, expect packet loss!
[   78.776298][ T6329] netlink: 'syz.1.187': attribute type 21 has an invalid length.
[   78.779497][ T6329] netlink: 16166 bytes leftover after parsing attributes in process `syz.1.187'.
[   79.009391][ T6341] netlink: 20 bytes leftover after parsing attributes in process `syz.2.193'.
[   79.439165][ T6363] netlink: 'syz.2.199': attribute type 25 has an invalid length.
[   79.517313][ T6368] netlink: 56 bytes leftover after parsing attributes in process `syz.0.201'.
[   79.694263][ T6380] netlink: 132 bytes leftover after parsing attributes in process `syz.1.207'.
[   79.704529][ T5236] Bluetooth: hci1: unexpected subevent 0x04 length: 150 > 11
[   79.758017][ T6386] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.210'.
[   80.507698][ T6418] netlink: 'syz.1.225': attribute type 1 has an invalid length.
[   80.514622][ T6418] netlink: 17 bytes leftover after parsing attributes in process `syz.1.225'.
[   80.927520][ T6430] netlink: 'syz.2.231': attribute type 10 has an invalid length.
[   80.937751][ T6430] geneve0: entered promiscuous mode
[   80.961431][ T6430] bond0: (slave geneve0): Enslaving as an active interface with an up link
[   81.069702][ T6434] syzkaller0: entered promiscuous mode
[   81.072164][ T6434] syzkaller0: entered allmulticast mode
[   81.341087][ T6449] syz.2.238: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
[   81.353750][ T6449] CPU: 0 UID: 0 PID: 6449 Comm: syz.2.238 Not tainted syzkaller #0 PREEMPT(full) 
[   81.353785][ T6449] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   81.353793][ T6449] Call Trace:
[   81.353799][ T6449]  <TASK>
[   81.353805][ T6449]  dump_stack_lvl+0x189/0x250
[   81.353852][ T6449]  ? __pfx_dump_stack_lvl+0x10/0x10
[   81.353863][ T6449]  ? __pfx__printk+0x10/0x10
[   81.353877][ T6449]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   81.353891][ T6449]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[   81.353901][ T6449]  ? cpuset_print_current_mems_allowed+0x2ee/0x360
[   81.353911][ T6449]  warn_alloc+0x214/0x310
[   81.353920][ T6449]  ? stack_depot_save_flags+0x41b/0x860
[   81.353935][ T6449]  ? __pfx_warn_alloc+0x10/0x10
[   81.353944][ T6449]  ? kasan_save_track+0x4f/0x80
[   81.353955][ T6449]  ? xskq_create+0x56/0x170
[   81.353964][ T6449]  ? xsk_init_queue+0xb0/0x110
[   81.353970][ T6449]  ? xsk_setsockopt+0x57b/0x8d0
[   81.353981][ T6449]  ? do_sock_setsockopt+0x17c/0x1b0
[   81.353992][ T6449]  ? __x64_sys_setsockopt+0x13f/0x1b0
[   81.354001][ T6449]  ? do_syscall_64+0xfa/0x3b0
[   81.354011][ T6449]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.354023][ T6449]  __vmalloc_node_range_noprof+0x125/0x12f0
[   81.354048][ T6449]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[   81.354061][ T6449]  ? __kasan_kmalloc+0x93/0xb0
[   81.354073][ T6449]  vmalloc_user_noprof+0xad/0xf0
[   81.354084][ T6449]  ? xskq_create+0xbf/0x170
[   81.354092][ T6449]  xskq_create+0xbf/0x170
[   81.354101][ T6449]  xsk_init_queue+0xb0/0x110
[   81.354110][ T6449]  xsk_setsockopt+0x57b/0x8d0
[   81.354122][ T6449]  ? __pfx_xsk_setsockopt+0x10/0x10
[   81.354133][ T6449]  ? __pfx_aa_sk_perm+0x10/0x10
[   81.354142][ T6449]  ? __fget_files+0x2a/0x420
[   81.354149][ T6449]  ? aa_sock_opt_perm+0xff/0x1b0
[   81.354159][ T6449]  ? bpf_lsm_socket_setsockopt+0x9/0x20
[   81.354168][ T6449]  ? __pfx_xsk_setsockopt+0x10/0x10
[   81.354180][ T6449]  do_sock_setsockopt+0x17c/0x1b0
[   81.354191][ T6449]  __x64_sys_setsockopt+0x13f/0x1b0
[   81.354203][ T6449]  do_syscall_64+0xfa/0x3b0
[   81.354212][ T6449]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.354219][ T6449]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   81.354247][ T6449]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   81.354254][ T6449] RIP: 0033:0x7f17c178eba9
[   81.354264][ T6449] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   81.354271][ T6449] RSP: 002b:00007f17c2545038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[   81.354309][ T6449] RAX: ffffffffffffffda RBX: 00007f17c19d6090 RCX: 00007f17c178eba9
[   81.354316][ T6449] RDX: 0000000000000002 RSI: 000000000000011b RDI: 000000000000000b
[   81.354321][ T6449] RBP: 00007f17c1811e19 R08: 0000000000000004 R09: 0000000000000000
[   81.354326][ T6449] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000
[   81.354331][ T6449] R13: 00007f17c19d6128 R14: 00007f17c19d6090 R15: 00007ffdf6c2b2b8
[   81.354347][ T6449]  </TASK>
[   81.357929][ T6449] Mem-Info:
[   81.569808][ T6453] netlink: 'syz.1.241': attribute type 11 has an invalid length.
[   81.569839][ T6453] netlink: 'syz.1.241': attribute type 6 has an invalid length.
[   81.602924][ T6449] active_anon:5292 inactive_anon:0 isolated_anon:0
[   81.602924][ T6449]  active_file:1286 inactive_file:38242 isolated_file:0
[   81.602924][ T6449]  unevictable:1768 dirty:1475 writeback:0
[   81.602924][ T6449]  slab_reclaimable:9487 slab_unreclaimable:52746
[   81.602924][ T6449]  mapped:18127 shmem:2431 pagetables:974
[   81.602924][ T6449]  sec_pagetables:0 bounce:0
[   81.602924][ T6449]  kernel_misc_reclaimable:0
[   81.602924][ T6449]  free:300319 free_pcp:19335 free_cma:0
[   81.618914][ T6449] Node 0 active_anon:12416kB inactive_anon:0kB active_file:3600kB inactive_file:147648kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:40564kB dirty:5624kB writeback:0kB shmem:4744kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7752kB pagetables:2028kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   81.699358][ T6449] Node 1 active_anon:8752kB inactive_anon:0kB active_file:1544kB inactive_file:5320kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:31944kB dirty:276kB writeback:0kB shmem:4980kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:3648kB pagetables:1800kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[   81.717081][ T6449] Node 0 DMA free:15360kB boost:0kB min:640kB low:800kB high:960kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[   81.746685][ T6449] lowmem_reserve[]: 0 811 811 811 811
[   81.754316][ T6449] Node 0 DMA32 free:267032kB boost:0kB min:33660kB low:42072kB high:50484kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12444kB inactive_anon:0kB active_file:3600kB inactive_file:147648kB unevictable:3536kB writepending:5624kB present:1556484kB managed:830888kB mlocked:0kB bounce:0kB free_pcp:41780kB local_pcp:21636kB free_cma:0kB
[   81.788710][ T6449] lowmem_reserve[]: 0 0 0 0 0
[   81.791950][ T6449] Node 1 DMA32 free:458616kB boost:0kB min:19192kB low:23988kB high:28784kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:524152kB managed:458616kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[   81.805325][ T6449] lowmem_reserve[]: 0 0 854 854 854
[   81.809282][ T6449] Node 1 Normal free:460192kB boost:0kB min:36612kB low:45764kB high:54916kB reserved_highatomic:0KB free_highatomic:0KB active_anon:8764kB inactive_anon:0kB active_file:1544kB inactive_file:5320kB unevictable:3536kB writepending:276kB present:1048576kB managed:874952kB mlocked:0kB bounce:0kB free_pcp:36160kB local_pcp:17364kB free_cma:0kB
[   81.831264][ T6449] lowmem_reserve[]: 0 0 0 0 0
[   81.834530][ T6449] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[   81.847460][ T6449] Node 0 DMA32: 348*4kB (UM) 155*8kB (UM) 147*16kB (UME) 173*32kB (UM) 32*64kB (UM) 8*128kB (UM) 6*256kB (UM) 2*512kB (M) 3*1024kB (UM) 3*2048kB (UME) 59*4096kB (M) = 267032kB
[   81.857742][ T6449] Node 1 DMA32: 2*4kB (M) 2*8kB (M) 2*16kB (M) 2*32kB (M) 2*64kB (M) 1*128kB (M) 2*256kB (M) 2*512kB (M) 2*1024kB (M) 2*2048kB (M) 110*4096kB (M) = 458616kB
[   81.867400][ T6449] Node 1 Normal: 336*4kB (ME) 102*8kB (UME) 57*16kB (UME) 137*32kB (UME) 40*64kB (UME) 11*128kB (UME) 1*256kB (M) 0*512kB 2*1024kB (UE) 2*2048kB (UE) 108*4096kB (M) = 460192kB
[   81.880716][ T6449] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   81.885518][ T6449] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[   81.888918][ T6449] 41961 total pagecache pages
[   81.890536][ T6449] 0 pages in swap cache
[   81.892140][ T6449] Free swap  = 124996kB
[   81.894361][ T6449] Total swap = 124996kB
[   81.901469][ T6449] 786301 pages RAM
[   81.905508][ T6449] 0 pages HighMem/MovableOnly
[   81.907150][ T6449] 241347 pages reserved
[   81.908810][ T6449] 0 pages cma reserved
[   82.365440][ T6459] netlink: 188 bytes leftover after parsing attributes in process `syz.2.244'.
[   83.150705][ T6476] openvswitch: netlink: Flow set message rejected, Key attribute missing.
[   84.113722][ T6489] sctp: [Deprecated]: syz.1.254 (pid 6489) Use of struct sctp_assoc_value in delayed_ack socket option.
[   84.113722][ T6489] Use struct sctp_sack_info instead
[   84.124735][ T6491] netlink: 24 bytes leftover after parsing attributes in process `syz.0.256'.
[   84.128023][ T6491] netlink: 24 bytes leftover after parsing attributes in process `syz.0.256'.
[   84.232360][ T6495] netlink: 24 bytes leftover after parsing attributes in process `syz.2.258'.
[   85.603694][ T6522] netlink: 802 bytes leftover after parsing attributes in process `syz.2.269'.
[   85.607037][ T6524] netlink: 2 bytes leftover after parsing attributes in process `syz.1.268'.
[   85.618112][ T6525] netlink: 8 bytes leftover after parsing attributes in process `syz.0.270'.
[   86.019520][ T6548] bridge_slave_1: left allmulticast mode
[   86.021880][ T6548] bridge_slave_1: left promiscuous mode
[   86.048522][ T6548] bridge0: port 2(bridge_slave_1) entered disabled state
[   86.129990][ T6548] bridge_slave_0: left allmulticast mode
[   86.136198][ T6548] bridge_slave_0: left promiscuous mode
[   86.142685][ T6548] bridge0: port 1(bridge_slave_0) entered disabled state
[   86.627735][   T10] cfg80211: failed to load regulatory.db
[   86.759445][ T6559] netlink: 'syz.1.285': attribute type 9 has an invalid length.
[   87.082162][ T6571] netlink: 152 bytes leftover after parsing attributes in process `syz.0.291'.
[   87.086431][ T6571] netlink: 6 bytes leftover after parsing attributes in process `syz.0.291'.
[   87.345042][ T6584] netlink: 'syz.0.296': attribute type 7 has an invalid length.
[   87.624998][ T6592] netlink: 8 bytes leftover after parsing attributes in process `syz.0.297'.
[   87.686033][ T6594] netlink: 'syz.1.300': attribute type 29 has an invalid length.
[   87.694600][ T6594] netlink: 'syz.1.300': attribute type 29 has an invalid length.
[   87.704023][ T6594] netlink: 500 bytes leftover after parsing attributes in process `syz.1.300'.
[   87.707155][ T6594] unsupported nla_type 58
[   87.836801][   T33] audit: type=1107 audit(1758259943.942:2): pid=6595 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=':8=5MHCIT2x'!{x5	E&'
[   88.455419][ T6610] netlink: 'syz.0.308': attribute type 3 has an invalid length.
[   88.568107][   T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.654006][   T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.757398][   T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   88.878197][   T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.114140][   T13] bridge_slave_1: left allmulticast mode
[   89.116936][   T13] bridge_slave_1: left promiscuous mode
[   89.119852][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   89.128364][ T6623] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[   89.142938][ T6623] openvswitch: netlink: Duplicate key (type 0).
[   89.147211][   T13] bridge_slave_0: left allmulticast mode
[   89.153223][   T13] bridge_slave_0: left promiscuous mode
[   89.161203][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   89.300564][ T5856] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   89.305207][ T5856] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   89.308586][ T5856] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   89.312574][ T5856] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   89.323549][ T5856] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   89.817248][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   89.826721][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   89.832851][   T13] bond0 (unregistering): (slave dummy0): Releasing backup interface
[   89.839507][   T13] bond0 (unregistering): Released all slaves
[   90.617311][ T6629] chnl_net:caif_netlink_parms(): no params data found
[   90.775267][   T13] hsr_slave_0: left promiscuous mode
[   90.790286][   T13] hsr_slave_1: left promiscuous mode
[   90.798416][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   90.801692][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   90.806390][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   90.821310][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   90.865199][   T13] veth1_macvtap: left promiscuous mode
[   90.880662][   T13] veth0_macvtap: left promiscuous mode
[   90.889186][   T13] veth1_vlan: left promiscuous mode
[   90.891529][   T13] veth0_vlan: left promiscuous mode
[   91.402797][ T5236] Bluetooth: hci0: command tx timeout
[   91.442141][ T6672] __nla_validate_parse: 1 callbacks suppressed
[   91.442154][ T6672] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.327'.
[   93.494108][ T5236] Bluetooth: hci0: command tx timeout
[   93.628547][   T13] team0 (unregistering): Port device team_slave_1 removed
[   93.685898][   T13] team0 (unregistering): Port device team_slave_0 removed
[   93.847530][ T6687] IPv6: Can't replace route, no match found
[   94.048795][ T6687] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[   94.228299][ T6701] netlink: 132 bytes leftover after parsing attributes in process `syz.0.336'.
[   94.246242][ T6629] bridge0: port 1(bridge_slave_0) entered blocking state
[   94.249264][ T6629] bridge0: port 1(bridge_slave_0) entered disabled state
[   94.257846][ T6629] bridge_slave_0: entered allmulticast mode
[   94.272063][ T6629] bridge_slave_0: entered promiscuous mode
[   94.280124][ T6629] bridge0: port 2(bridge_slave_1) entered blocking state
[   94.286071][ T6629] bridge0: port 2(bridge_slave_1) entered disabled state
[   94.289376][ T6629] bridge_slave_1: entered allmulticast mode
[   94.295056][ T6629] bridge_slave_1: entered promiscuous mode
[   94.382578][ T6705] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   94.385662][ T6705] IPv6: NLM_F_CREATE should be set when creating new route
[   94.388614][ T6705] IPv6: NLM_F_CREATE should be set when creating new route
[   94.391095][ T6703] rdma_rxe: rxe_newlink: failed to add lo
[   94.391529][ T6705] IPv6: NLM_F_CREATE should be set when creating new route
[   94.406620][ T6629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   94.421770][ T6629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   94.526487][ T6629] team0: Port device team_slave_0 added
[   94.543419][ T6629] team0: Port device team_slave_1 added
[   94.671996][ T6629] batman_adv: batadv0: Adding interface: batadv_slave_0
[   94.682463][ T6629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.706656][ T6629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   94.716851][ T6629] batman_adv: batadv0: Adding interface: batadv_slave_1
[   94.719350][ T6629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   94.732146][ T6629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   94.798448][ T6629] hsr_slave_0: entered promiscuous mode
[   94.801437][ T6629] hsr_slave_1: entered promiscuous mode
[   95.447851][ T6757] netlink: 56 bytes leftover after parsing attributes in process `syz.2.354'.
[   95.462211][ T6629] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   95.489177][ T6629] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   95.498929][ T6629] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   95.506663][ T6629] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   95.563831][ T5236] Bluetooth: hci0: command tx timeout
[   95.607259][ T6629] 8021q: adding VLAN 0 to HW filter on device bond0
[   95.621445][ T6629] 8021q: adding VLAN 0 to HW filter on device team0
[   95.629569][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   95.631973][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   95.646349][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   95.649027][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   95.877203][ T6629] 8021q: adding VLAN 0 to HW filter on device batadv0
[   95.916666][ T6629] veth0_vlan: entered promiscuous mode
[   95.934604][ T6629] veth1_vlan: entered promiscuous mode
[   95.982302][ T6629] veth0_macvtap: entered promiscuous mode
[   95.988195][ T6629] veth1_macvtap: entered promiscuous mode
[   96.000285][ T6629] batman_adv: batadv0: Interface activated: batadv_slave_0
[   96.009865][ T6629] batman_adv: batadv0: Interface activated: batadv_slave_1
[   96.018960][ T5874] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   96.022604][ T5874] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   96.032400][ T5909] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   96.042281][ T5909] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   96.120010][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.126847][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.161760][  T953] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.168365][  T953] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.276390][ T6802] netlink: 12 bytes leftover after parsing attributes in process `syz.1.309'.
[   96.949773][ T6849] netlink: 60 bytes leftover after parsing attributes in process `syz.1.380'.
[   96.961711][ T6844] netlink: 60 bytes leftover after parsing attributes in process `syz.1.380'.
[   96.971425][ T6850] netlink: 'syz.0.382': attribute type 29 has an invalid length.
[   96.975552][ T6850] netlink: 4 bytes leftover after parsing attributes in process `syz.0.382'.
[   96.979154][ T6849] netlink: 60 bytes leftover after parsing attributes in process `syz.1.380'.
[   97.328633][ T6862] netlink: 16 bytes leftover after parsing attributes in process `syz.2.387'.
[   97.466628][ T6870] netlink: 152 bytes leftover after parsing attributes in process `syz.2.391'.
[   97.643556][ T5236] Bluetooth: hci0: command tx timeout
[   98.250177][ T6908] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   98.823481][ T6922] bridge_slave_1: left allmulticast mode
[   98.825591][ T6922] bridge_slave_1: left promiscuous mode
[   98.828271][ T6922] bridge0: port 2(bridge_slave_1) entered disabled state
[   99.246064][ T6922] bridge_slave_0: left allmulticast mode
[   99.248747][ T6922] bridge_slave_0: left promiscuous mode
[   99.251725][ T6922] bridge0: port 1(bridge_slave_0) entered disabled state
[   99.478069][ T6936] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   99.529637][ T6939] netlink: 'syz.2.418': attribute type 1 has an invalid length.
[   99.533898][ T6939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.418'.
[   99.612521][ T6943] ==================================================================
[   99.615779][ T6943] BUG: KASAN: slab-use-after-free in __xfrm_state_lookup+0x6ad/0x8d0
[   99.618882][ T6943] Read of size 2 at addr ffff88810f0b0142 by task syz.0.420/6943
[   99.622195][ T6943] 
[   99.623014][ T6943] CPU: 0 UID: 0 PID: 6943 Comm: syz.0.420 Not tainted syzkaller #0 PREEMPT(full) 
[   99.623037][ T6943] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   99.623047][ T6943] Call Trace:
[   99.623055][ T6943]  <TASK>
[   99.623062][ T6943]  dump_stack_lvl+0x189/0x250
[   99.623087][ T6943]  ? __kasan_check_byte+0x12/0x40
[   99.623112][ T6943]  ? __pfx_dump_stack_lvl+0x10/0x10
[   99.623127][ T6943]  ? lock_release+0x4b/0x3e0
[   99.623149][ T6943]  ? __virt_addr_valid+0x4a5/0x5c0
[   99.623169][ T6943]  print_report+0xca/0x240
[   99.623179][ T6943]  ? __xfrm_state_lookup+0x6ad/0x8d0
[   99.623194][ T6943]  kasan_report+0x118/0x150
[   99.623214][ T6943]  ? __xfrm_state_lookup+0x6ad/0x8d0
[   99.623228][ T6943]  __xfrm_state_lookup+0x6ad/0x8d0
[   99.623244][ T6943]  ? __pfx___xfrm_state_lookup+0x10/0x10
[   99.623260][ T6943]  ? xfrm_state_lookup+0x45/0x1e0
[   99.623276][ T6943]  xfrm_state_lookup+0x11e/0x1e0
[   99.623298][ T6943]  xfrm_add_sa_expire+0x19c/0x4b0
[   99.623320][ T6943]  ? __pfx_xfrm_add_sa_expire+0x10/0x10
[   99.623340][ T6943]  ? __nla_parse+0x40/0x60
[   99.623356][ T6943]  xfrm_user_rcv_msg+0x7a3/0xab0
[   99.623378][ T6943]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[   99.623406][ T6943]  ? __pfx___mutex_trylock_common+0x10/0x10
[   99.623423][ T6943]  ? rcu_is_watching+0x15/0xb0
[   99.623435][ T6943]  ? trace_contention_end+0x39/0x120
[   99.623449][ T6943]  ? __mutex_lock+0x335/0x1350
[   99.623465][ T6943]  netlink_rcv_skb+0x208/0x470
[   99.623511][ T6943]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[   99.623533][ T6943]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   99.623546][ T6943]  ? netlink_deliver_tap+0x2e/0x1b0
[   99.623555][ T6943]  ? netlink_deliver_tap+0x2e/0x1b0
[   99.623564][ T6943]  xfrm_netlink_rcv+0x79/0x90
[   99.623576][ T6943]  netlink_unicast+0x82f/0x9e0
[   99.623585][ T6943]  ? __pfx_netlink_unicast+0x10/0x10
[   99.623591][ T6943]  ? netlink_sendmsg+0x642/0xb30
[   99.623599][ T6943]  ? skb_put+0x11b/0x210
[   99.623608][ T6943]  netlink_sendmsg+0x805/0xb30
[   99.623617][ T6943]  ? __pfx_netlink_sendmsg+0x10/0x10
[   99.623626][ T6943]  ? aa_sock_msg_perm+0xf1/0x1d0
[   99.623634][ T6943]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   99.623643][ T6943]  ? __pfx_netlink_sendmsg+0x10/0x10
[   99.623651][ T6943]  __sock_sendmsg+0x21c/0x270
[   99.623664][ T6943]  ____sys_sendmsg+0x505/0x830
[   99.623674][ T6943]  ? __pfx_____sys_sendmsg+0x10/0x10
[   99.623684][ T6943]  ? import_iovec+0x74/0xa0
[   99.623694][ T6943]  ___sys_sendmsg+0x21f/0x2a0
[   99.623703][ T6943]  ? __pfx____sys_sendmsg+0x10/0x10
[   99.623724][ T6943]  ? __fget_files+0x2a/0x420
[   99.623733][ T6943]  ? __fget_files+0x3a0/0x420
[   99.623742][ T6943]  __x64_sys_sendmsg+0x19b/0x260
[   99.623752][ T6943]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   99.623764][ T6943]  ? rcu_is_watching+0x15/0xb0
[   99.623774][ T6943]  ? do_syscall_64+0xbe/0x3b0
[   99.623786][ T6943]  do_syscall_64+0xfa/0x3b0
[   99.623795][ T6943]  ? lockdep_hardirqs_on+0x9c/0x150
[   99.623802][ T6943]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.623810][ T6943]  ? exc_page_fault+0x9f/0xf0
[   99.623817][ T6943]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.623824][ T6943] RIP: 0033:0x7f80a578eba9
[   99.623833][ T6943] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   99.623840][ T6943] RSP: 002b:00007f80a6685038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   99.623851][ T6943] RAX: ffffffffffffffda RBX: 00007f80a59d5fa0 RCX: 00007f80a578eba9
[   99.623857][ T6943] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003
[   99.623862][ T6943] RBP: 00007f80a5811e19 R08: 0000000000000000 R09: 0000000000000000
[   99.623867][ T6943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   99.623872][ T6943] R13: 00007f80a59d6038 R14: 00007f80a59d5fa0 R15: 00007ffccd9c0dc8
[   99.623881][ T6943]  </TASK>
[   99.623884][ T6943] 
[   99.759099][ T6943] Allocated by task 6920:
[   99.760851][ T6943]  kasan_save_track+0x3e/0x80
[   99.762745][ T6943]  __kasan_slab_alloc+0x6c/0x80
[   99.764702][ T6943]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[   99.766768][ T6943]  xfrm_state_alloc+0x24/0x2f0
[   99.768582][ T6943]  __find_acq_core+0x8a7/0x1c00
[   99.770409][ T6943]  xfrm_find_acq+0x78/0xa0
[   99.771991][ T6943]  xfrm_alloc_userspi+0x6b3/0xc90
[   99.773823][ T6943]  xfrm_user_rcv_msg+0x7a3/0xab0
[   99.775626][ T6943]  netlink_rcv_skb+0x208/0x470
[   99.777492][ T6943]  xfrm_netlink_rcv+0x79/0x90
[   99.779307][ T6943]  netlink_unicast+0x82f/0x9e0
[   99.781233][ T6943]  netlink_sendmsg+0x805/0xb30
[   99.783019][ T6943]  __sock_sendmsg+0x21c/0x270
[   99.784790][ T6943]  ____sys_sendmsg+0x505/0x830
[   99.786650][ T6943]  ___sys_sendmsg+0x21f/0x2a0
[   99.788489][ T6943]  __x64_sys_sendmsg+0x19b/0x260
[   99.790373][ T6943]  do_syscall_64+0xfa/0x3b0
[   99.792125][ T6943]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.794421][ T6943] 
[   99.795482][ T6943] Freed by task 24:
[   99.796993][ T6943]  kasan_save_track+0x3e/0x80
[   99.798831][ T6943]  kasan_save_free_info+0x46/0x50
[   99.800822][ T6943]  __kasan_slab_free+0x5b/0x80
[   99.802681][ T6943]  kmem_cache_free+0x18f/0x400
[   99.804737][ T6943]  xfrm_state_gc_task+0x52d/0x6b0
[   99.806731][ T6943]  process_scheduled_works+0xae1/0x17b0
[   99.808840][ T6943]  worker_thread+0x8a0/0xda0
[   99.810480][ T6943]  kthread+0x711/0x8a0
[   99.811831][ T6943]  ret_from_fork+0x439/0x7d0
[   99.813343][ T6943]  ret_from_fork_asm+0x1a/0x30
[   99.815185][ T6943] 
[   99.816128][ T6943] The buggy address belongs to the object at ffff88810f0b0000
[   99.816128][ T6943]  which belongs to the cache xfrm_state of size 928
[   99.820906][ T6943] The buggy address is located 322 bytes inside of
[   99.820906][ T6943]  freed 928-byte region [ffff88810f0b0000, ffff88810f0b03a0)
[   99.825920][ T6943] 
[   99.826847][ T6943] The buggy address belongs to the physical page:
[   99.829243][ T6943] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f0b0
[   99.832166][ T6943] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   99.835049][ T6943] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[   99.837588][ T6943] page_type: f5(slab)
[   99.838951][ T6943] raw: 057ff00000000040 ffff88801beec640 dead000000000122 0000000000000000
[   99.841783][ T6943] raw: 0000000000000000 00000000800e000e 00000000f5000000 0000000000000000
[   99.844750][ T6943] head: 057ff00000000040 ffff88801beec640 dead000000000122 0000000000000000
[   99.848085][ T6943] head: 0000000000000000 00000000800e000e 00000000f5000000 0000000000000000
[   99.851498][ T6943] head: 057ff00000000002 ffffea00043c2c01 00000000ffffffff 00000000ffffffff
[   99.854393][ T6943] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[   99.857297][ T6943] page dumped because: kasan: bad access detected
[   99.859431][ T6943] page_owner tracks the page as allocated
[   99.861320][ T6943] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6920, tgid 6917 (syz.0.410), ts 98513201581, free_ts 98294309203
[   99.868217][ T6943]  post_alloc_hook+0x240/0x2a0
[   99.870197][ T6943]  get_page_from_freelist+0x21e4/0x22c0
[   99.872292][ T6943]  __alloc_frozen_pages_noprof+0x181/0x370
[   99.874383][ T6943]  alloc_pages_mpol+0x232/0x4a0
[   99.876174][ T6943]  allocate_slab+0x8a/0x370
[   99.877907][ T6943]  ___slab_alloc+0xbeb/0x1420
[   99.879583][ T6943]  kmem_cache_alloc_noprof+0x283/0x3c0
[   99.881550][ T6943]  xfrm_state_alloc+0x24/0x2f0
[   99.883243][ T6943]  __find_acq_core+0x8a7/0x1c00
[   99.885004][ T6943]  xfrm_find_acq+0x78/0xa0
[   99.886717][ T6943]  xfrm_alloc_userspi+0x6b3/0xc90
[   99.888666][ T6943]  xfrm_user_rcv_msg+0x7a3/0xab0
[   99.890486][ T6943]  netlink_rcv_skb+0x208/0x470
[   99.892297][ T6943]  xfrm_netlink_rcv+0x79/0x90
[   99.893967][ T6943]  netlink_unicast+0x82f/0x9e0
[   99.895705][ T6943]  netlink_sendmsg+0x805/0xb30
[   99.897243][ T6943] page last free pid 6904 tgid 6903 stack trace:
[   99.899528][ T6943]  __free_frozen_pages+0xbc4/0xd30
[   99.901365][ T6943]  __slab_free+0x303/0x3c0
[   99.902981][ T6943]  qlist_free_all+0x97/0x140
[   99.904614][ T6943]  kasan_quarantine_reduce+0x148/0x160
[   99.906515][ T6943]  __kasan_slab_alloc+0x22/0x80
[   99.908386][ T6943]  kmem_cache_alloc_lru_noprof+0x1c6/0x3d0
[   99.910658][ T6943]  sock_alloc_inode+0x28/0xc0
[   99.912561][ T6943]  alloc_inode+0x6a/0x1b0
[   99.913962][ T6943]  __sock_create+0x12d/0x9f0
[   99.915724][ T6943]  __sys_socket+0xd7/0x1b0
[   99.917679][ T6943]  __x64_sys_socket+0x7a/0x90
[   99.919729][ T6943]  do_syscall_64+0xfa/0x3b0
[   99.921579][ T6943]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   99.923899][ T6943] 
[   99.924712][ T6943] Memory state around the buggy address:
[   99.926924][ T6943]  ffff88810f0b0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   99.929671][ T6943]  ffff88810f0b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   99.932532][ T6943] >ffff88810f0b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   99.935708][ T6943]                                            ^
[   99.938105][ T6943]  ffff88810f0b0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   99.941210][ T6943]  ffff88810f0b0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   99.943813][ T6943] ==================================================================
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   99.984383][ T6943] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   99.987312][ T6943] CPU: 0 UID: 0 PID: 6943 Comm: syz.0.420 Not tainted syzkaller #0 PREEMPT(full) 
[   99.990646][ T6943] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   99.994152][ T6943] Call Trace:
[   99.995292][ T6943]  <TASK>
[   99.996633][ T6943]  dump_stack_lvl+0x99/0x250
[   99.998582][ T6943]  ? __asan_memcpy+0x40/0x70
[  100.000490][ T6943]  ? __pfx_dump_stack_lvl+0x10/0x10
[  100.002573][ T6943]  ? __pfx__printk+0x10/0x10
[  100.004085][ T6943]  vpanic+0x281/0x750
[  100.005343][ T6943]  ? preempt_schedule+0xae/0xc0
[  100.007037][ T6943]  ? __pfx_vpanic+0x10/0x10
[  100.008690][ T6943]  ? preempt_schedule_common+0x83/0xd0
[  100.010535][ T6943]  ? preempt_schedule+0xae/0xc0
[  100.012058][ T6943]  ? __pfx_preempt_schedule+0x10/0x10
[  100.013825][ T6943]  panic+0xb9/0xc0
[  100.015177][ T6943]  ? __pfx_panic+0x10/0x10
[  100.016633][ T6943]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[  100.018462][ T6943]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  100.020102][ T6943]  check_panic_on_warn+0x89/0xb0
[  100.021554][ T6943]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  100.023125][ T6943]  end_report+0x78/0x160
[  100.024462][ T6943]  kasan_report+0x129/0x150
[  100.025972][ T6943]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  100.028012][ T6943]  __xfrm_state_lookup+0x6ad/0x8d0
[  100.029633][ T6943]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  100.031364][ T6943]  ? xfrm_state_lookup+0x45/0x1e0
[  100.032922][ T6943]  xfrm_state_lookup+0x11e/0x1e0
[  100.034626][ T6943]  xfrm_add_sa_expire+0x19c/0x4b0
[  100.036240][ T6943]  ? __pfx_xfrm_add_sa_expire+0x10/0x10
[  100.037954][ T6943]  ? __nla_parse+0x40/0x60
[  100.039359][ T6943]  xfrm_user_rcv_msg+0x7a3/0xab0
[  100.040963][ T6943]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  100.042752][ T6943]  ? __pfx___mutex_trylock_common+0x10/0x10
[  100.044882][ T6943]  ? rcu_is_watching+0x15/0xb0
[  100.046644][ T6943]  ? trace_contention_end+0x39/0x120
[  100.048352][ T6943]  ? __mutex_lock+0x335/0x1350
[  100.049916][ T6943]  netlink_rcv_skb+0x208/0x470
[  100.051541][ T6943]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  100.053237][ T6943]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  100.054877][ T6943]  ? netlink_deliver_tap+0x2e/0x1b0
[  100.056571][ T6943]  ? netlink_deliver_tap+0x2e/0x1b0
[  100.058304][ T6943]  xfrm_netlink_rcv+0x79/0x90
[  100.059848][ T6943]  netlink_unicast+0x82f/0x9e0
[  100.061477][ T6943]  ? __pfx_netlink_unicast+0x10/0x10
[  100.063302][ T6943]  ? netlink_sendmsg+0x642/0xb30
[  100.064894][ T6943]  ? skb_put+0x11b/0x210
[  100.066217][ T6943]  netlink_sendmsg+0x805/0xb30
[  100.067936][ T6943]  ? __pfx_netlink_sendmsg+0x10/0x10
[  100.069757][ T6943]  ? aa_sock_msg_perm+0xf1/0x1d0
[  100.071390][ T6943]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  100.073124][ T6943]  ? __pfx_netlink_sendmsg+0x10/0x10
[  100.074869][ T6943]  __sock_sendmsg+0x21c/0x270
[  100.076617][ T6943]  ____sys_sendmsg+0x505/0x830
[  100.078400][ T6943]  ? __pfx_____sys_sendmsg+0x10/0x10
[  100.080197][ T6943]  ? import_iovec+0x74/0xa0
[  100.081745][ T6943]  ___sys_sendmsg+0x21f/0x2a0
[  100.083188][ T6943]  ? __pfx____sys_sendmsg+0x10/0x10
[  100.084933][ T6943]  ? __fget_files+0x2a/0x420
[  100.086644][ T6943]  ? __fget_files+0x3a0/0x420
[  100.088467][ T6943]  __x64_sys_sendmsg+0x19b/0x260
[  100.090045][ T6943]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  100.092254][ T6943]  ? rcu_is_watching+0x15/0xb0
[  100.094168][ T6943]  ? do_syscall_64+0xbe/0x3b0
[  100.096106][ T6943]  do_syscall_64+0xfa/0x3b0
[  100.097601][ T6943]  ? lockdep_hardirqs_on+0x9c/0x150
[  100.099215][ T6943]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  100.101485][ T6943]  ? exc_page_fault+0x9f/0xf0
[  100.103307][ T6943]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  100.105568][ T6943] RIP: 0033:0x7f80a578eba9
[  100.106979][ T6943] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  100.112919][ T6943] RSP: 002b:00007f80a6685038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  100.115724][ T6943] RAX: ffffffffffffffda RBX: 00007f80a59d5fa0 RCX: 00007f80a578eba9
[  100.118243][ T6943] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003
[  100.120715][ T6943] RBP: 00007f80a5811e19 R08: 0000000000000000 R09: 0000000000000000
[  100.123149][ T6943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  100.126023][ T6943] R13: 00007f80a59d6038 R14: 00007f80a59d5fa0 R15: 00007ffccd9c0dc8
[  100.128953][ T6943]  </TASK>
[  100.130808][ T6943] Kernel Offset: disabled
[  100.132198][ T6943] Rebooting in 86400 seconds..

VM DIAGNOSIS:
05:32:35  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000005 RBX=0000000000000005 RCX=0000000000000000 RDX=00000000000003f9
RSI=00000000000011df RDI=00000000000011e0 RBP=00000000000003f9 RSP=ffffc90002ceea30
R8 =ffff888107690237 R9 =1ffff11020ed2046 R10=dffffc0000000000 R11=ffffffff854fa240
R12=dffffc0000000000 R13=dffffc0000000000 R14=ffffffff99df7420 R15=0000000000000000
RIP=ffffffff854fa2bc RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f80a66856c0 ffffffff 00c00000
GS =0000 ffff8880b8613000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f80a6684fc8 CR3=0000000023db4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f80a59a7498 00007f80a59a7470 XMM03=00007f80a59a74a8 00007f80a59a74a0
XMM04=00007f80a650d100 00007f80a59a7460 XMM05=00007f80a59a7478 00007f80a59a74c0
XMM06=00007f80a59a74b8 00007f80a59a74b0 XMM07=00007f80a59a74a8 00007f80a59a74a0
XMM08=0000000000000000 00007f80a5812ee7 XMM09=0000000000000000 00007f80a5812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=66b415dd335dfb00 RBX=ffffffff819695f8 RCX=66b415dd335dfb00 RDX=0000000000000001
RSI=ffffffff8d9ba17b RDI=ffffffff8be33e80 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f9b R9 =1ffff11026cc65f3 R10=dffffc0000000000 R11=ffffed1026cc65f4
R12=ffffffff8fa3a930 R13=0000000000000001 R14=0000000000000001 R15=1ffff1102001f000
RIP=ffffffff8b7a53f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c13000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000100 CR3=0000000110cc4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 00007f80a5812e53
XMM06=0000000000000000 00007f80a5812e4d XMM07=0000000000000000 00007f80a5812e61
XMM08=0000000000000000 00007f80a5812ee7 XMM09=0000000000000000 00007f80a5812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
