last executing test programs:

1.81871379s ago: executing program 0 (id=878):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000100001000000f500000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000002214000000110001"], 0xd8}}, 0x0)

1.818490652s ago: executing program 0 (id=879):
r0 = socket$rds(0x15, 0x5, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x14, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f00000001c0)=[{0x0, 0x4, 0x2, 0x6}, {0x1, 0x5, 0x9, 0x7}, {0x3, 0x2, 0x8000c}], 0x10, 0x4f}, 0x94) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@delqdisc={0x24, 0x25, 0x2, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0x6}, {0x3, 0xd}, {0x8, 0x2}}}, 0x24}}, 0x0) (async)
close(r0) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$inet_icmp(0x2, 0x2, 0x1) (async)
r3 = socket$netlink(0x10, 0x3, 0xa) (async, rerun: 32)
r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r1) (rerun: 32)
sendmsg$TIPC_CMD_SHOW_STATS(r3, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x2, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x10) (async)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x39}}, 0x10) (async)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x84) (async)
bind$rds(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) (async)
sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x2c}], 0x343, 0x5}}], 0x48}, 0x0) (async)
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @local, @val, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x28, 0x0, 0x1, @rand_addr=' \x01\x00', @dev, {[@hopopts={0x2f, 0x4, '\x00', [@calipso={0x7, 0x18, {0x0, 0x4, 0x0, 0xd600, [0x4, 0x0]}}, @pad1, @padn={0x1, 0x1, [0x0]}]}]}}}}}, 0x0)

1.760026046s ago: executing program 0 (id=880):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14)
sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2, 0xd9}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x1}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084)

1.759738982s ago: executing program 0 (id=881):
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r0, r1, 0x2}, 0x10)
socket$l2tp6(0xa, 0x2, 0x73)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000000c0), r2)
sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='\x00@\x00\x00', @ANYRES16=r3, @ANYBLOB="65572abd7000f9dbdf2504000000"], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x24004052)
r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r2)
sendmsg$NL802154_CMD_SET_CHANNEL(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40800}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x19}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x19}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000)
pipe(&(0x7f0000000000)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff})
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a300000000064000000060a010400000000000000000100000008000b40000000003c00048038000180080001006e6174002c00028008000540000000000800014000000000080006400000000d08000240ffff000a0800064000000025090001"], 0xd8}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
r8 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@ipv6_getaddr={0x18, 0x16, 0x4, 0x70bd26, 0x25dfdbfb, {0xa, 0x0, 0x88, 0xff}}, 0x18}}, 0x20040800)
getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9)
sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r9, @ANYBLOB="020000000000800080001200080001007674693674000200"], 0xa0}}, 0x0)
getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000080)={0x0, @loopback, @multicast2}, &(0x7f0000000100)=0xc)
sendmsg$nl_generic(r7, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x20, 0x8, 0x70bd2b, 0x25dfdbfb, {0x16}, [@nested={0x8, 0xe7, 0x0, 0x1, [@nested={0x4, 0x101}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000040}, 0x100)

1.695152301s ago: executing program 0 (id=883):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r1)
sendmsg$NLBL_MGMT_C_ADDDEF(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000040000e41300050003030000000a0000005dc000000000010800020005000000140006"], 0x4c}, 0x1, 0x0, 0x0, 0x20008084}, 0x4040000)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bf8200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94)
r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
syz_genetlink_get_family_id$nfc(&(0x7f0000000400), r1)
sendmsg$nl_xfrm(r5, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000000240)=ANY=[@ANYBLOB="240100001600010428bd700000000000fe8000000000000000000000000000bbfc01000000000000000000000000000100040000000000000000a00000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ff02000000000000000000000000000100000000330000000a0101010000000000000000000000000000000000004e340100000000000000000000000000000004000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000a0000002bbd70000000000000000200000000000000000008"], 0x124}}, 0x0)
sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_FIB_FLAGS={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x4048010)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4)
connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c)
sendto$inet6(r6, &(0x7f00000000c0)='K', 0x1, 0x44008011, 0x0, 0x0)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x40)
sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x30, 0x3, 0x6, 0x301, 0x0, 0x0, {0x5, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x10)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000003c0)={'vxcan0\x00', <r9=>0x0})
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r10 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0)
ioctl$PPPIOCNEWUNIT(r10, 0xc004743e, &(0x7f0000000100)=0x3)
ioctl$PPPIOCSACTIVE(r10, 0x40107446, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0xa, 0xfe, 0x8801}]})
write$ppp(r10, &(0x7f0000000440)='\x00\x00', 0x2)
sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newlink={0x80, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x900, 0x406c}, [@IFLA_GROUP={0x8}, @IFLA_OPERSTATE={0x5, 0x10, 0x4}, @IFLA_MAP={0x24, 0xe, {0xd, 0x4, 0x0, 0x1000, 0x9, 0x5}}, @IFLA_LINK={0x8, 0x5, r9}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x7}, @IFLA_PORT_SELF={0x1c, 0x19, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0x4}, @IFLA_PORT_REQUEST={0x5}, @IFLA_PORT_VF={0x8, 0x1, 0x9}]}]}, 0x80}}, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r7, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50)

1.638935628s ago: executing program 1 (id=885):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000240)="7800000018001f07b9409b0dffff000d0216be0402030605060140034300080012000000fac8388827a685a168d0bf46d323456511000000caaf6c26c2742145", 0x40, 0x4000000, 0x0, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macsec0\x00'}) (async)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macsec0\x00', <r3=>0x0})
socket$inet(0x2, 0x6, 0x1) (async)
r4 = socket$inet(0x2, 0x6, 0x1)
mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3000001, 0x31, r4, 0x0) (async)
mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3000001, 0x31, r4, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async)
bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r6, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) (async)
bind$inet(r6, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10)
sendto$inet(r6, &(0x7f00000000c0)="f72bacc3", 0x4, 0x0, &(0x7f00000004c0)={0x2, 0x4e20, @multicast1}, 0x10)
readv(r5, &(0x7f0000000500)=[{&(0x7f0000002100)=""/4076, 0x2d}], 0x57)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000240012800b0001006d616373656300001400028005000a0000"], 0x44}}, 0x0)
syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) (async)
r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0)
r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4000005, 0x10012, r8, 0xd55c6000)
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async)
r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) (async)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x2, 0x6b, 0x4, 0x8}, {0x8, 0x5d, 0x2, 0xffffffff}]}, 0x10)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
socket$kcm(0x2, 0xa, 0x2) (async)
r11 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
write$tun(r10, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000106"], 0xffe)
setsockopt$bt_l2cap_L2CAP_LM(r9, 0x6, 0x3, &(0x7f0000000040)=0x30, 0x5e)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00000000001080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008000}, 0x4040000)

1.509195654s ago: executing program 0 (id=886):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000100001000000fff5000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000002214000000110001"], 0xd8}}, 0x0)

759.986781ms ago: executing program 1 (id=892):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_int(r1, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4)
connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c)
recvmmsg(r1, &(0x7f00000002c0), 0x220, 0x100, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@loopback={0xff00000000000000, 0x777fe6a4b23f}, 0x0, 0x0, 0x2, 0xb, 0x5, 0xc03, 0x5}, 0x20)
r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syz_tun\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
r6 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0xa}, 0x1c)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', <r7=>0x0})
r8 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp_SCTP_CONTEXT(r8, 0x84, 0x11, 0x0, &(0x7f00000000c0))
clock_gettime(0x0, &(0x7f0000000140)={<r9=>0x0, <r10=>0x0})
sendmsg$can_bcm(r8, &(0x7f0000000300)={&(0x7f0000000080)={0x1d, r7}, 0x10, &(0x7f00000002c0)={&(0x7f0000000240)={0x5, 0x10, 0xd4fc, {0x0, 0x2710}, {r9, r10/1000+10000}, {0x2, 0x0, 0x1}, 0x1, @canfd={{0x1, 0x0, 0x1}, 0x0, 0x2, 0x0, 0x0, "bb3029e80fc1cf4e85c472366a7c11836b3b8f685ea0102070a6f6eee9ae0d623ed6d9819938cde25a0da6175c64de13a1201e9c6f0c86512257c03dfaa7ad46"}}, 0x80}, 0x1, 0x0, 0x0, 0x4094}, 0x4000c000)
sendto$packet(r6, 0x0, 0x0, 0x4000800, &(0x7f0000000200)={0x11, 0x3, r7, 0x1, 0x4b}, 0x14)
sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0x503, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xef}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x48}}, 0x0)
r11 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000008c0), r0)
sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000940)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010029bd7000ffdbdf250100000007000700e0000001080002000500000008000800001e01010c0001"], 0x38}, 0x1, 0x0, 0x0, 0x40010}, 0x80)

653.963231ms ago: executing program 2 (id=893):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r1, 0xc, 0x70bd2c, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4040000}, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="40c20000d00000002400128009000100626f6e640000000014000280080007000500d190"], 0x4c}}, 0x8000)
socket$inet6_tcp(0xa, 0x1, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200))
r3 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r3, &(0x7f00000000c0), 0x10)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'syz_tun\x00', <r5=>0x0})
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="1175b48950de11133203523519ff16424a66048ce628c778ad2d0632bf31de5bf1075327546833d79fbd8d7a3e6d5df675f533d7606de19a658ab9dadda3dab954819e2f029065e0e7b8024793b4b83ccf2bf9d39f190cecb52d84e5a624da7cfb864c5d6c7f743e8ceaa4ea156c3282c6a76d6b955a", @ANYRES32=r5, @ANYBLOB="000000000a000200000000000000000008000900fa000000"], 0x30}}, 0x4100)
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r3], 0x448}}, 0x0)
sendmsg$can_bcm(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="050000000808"], 0x80}}, 0x0)
sendmmsg$inet(r3, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100), 0x2}}], 0x40000000000003a, 0x0)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'dummy0\x00', <r9=>0x0})
sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0xb, 0xd}, {0xd}, {0x9, 0xc}}}, 0x24}}, 0x40004)
r10 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r7)
sendmsg$NLBL_MGMT_C_ADD(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a00)={0xf4, r10, 0xe701ac47a3d23ccd, 0x0, 0x2, {}, [@NLBL_MGMT_A_DOMAIN={0xce, 0x1, 'C\xec\xf8\xa0w\x15|\xd8\xbcs\xe1\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x17]\xd5\xd0\xf0\xa8\xeb\xd2g\x92\x04\x02\v\x00od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*\xb6(o\x91t\x12\x93UK\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xda\xe2&\"\xb4:\x13\xe9\tc\x85\xb4\xcb\x17\xbfm\x846\xe7\x7fp\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd6\n\x9d=~=\xe5\xdc\x90\a\xe7M\x9c<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}]}, 0xf4}, 0x1, 0x0, 0x0, 0x20084880}, 0x0)
r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000003c0), r7)
sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r7, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="00042cbd70153cfb0dbf9300ffdbdf25300000000a0001007770616e3400000005003300090000000a0001000000000000000000"], 0x34}, 0x1, 0x0, 0x0, 0x24040000}, 0x80)
socket$nl_route(0x10, 0x3, 0x0)
r12 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560", 0x28}], 0x1, 0x0, 0x6b}, 0x0)
sendmsg$nl_route(r12, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000010000d0400"/20, @ANYRES32=r12, @ANYBLOB="01000000000002004c0012800b00010067726574617000003c000280060011004e240000060018001f0100000800070000ffffff06000f00"], 0x6c}}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000340)={'ip6tnl0\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x4, 0x9, 0x1e, 0x3, 0x10, @mcast1, @local, 0x700, 0x20, 0x7, 0x7}})

580.107449ms ago: executing program 2 (id=894):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500e1fd08005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000003000000000000000000000000000000000000000000000000860090780000000000000000000000000000ee3f000000002b036f8c006e75021d683910c3090b3188a7c747eb2278a273c1b80029442911892704"], 0xfdef)

406.126065ms ago: executing program 2 (id=895):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r1)
r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48)
r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000040000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000530000008500000005000000bca90000000000003509020000d44a6be5000d0000000000b702000000000000739af0ff00000000c509040004100000c3aaf0ff00000000bf8600000000000007080000f8ffffffbfa400000000000007060000f0ffffffb70200000800000018220000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000004c0), r0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000540)={<r6=>0xffffffffffffffff})
r7 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000580), 0x80400)
r8 = socket(0x2, 0x2, 0x0)
getsockopt$nfc_llcp(r8, 0x88, 0x68, 0x0, 0xfffffffffffffc9a)
r9 = socket(0x1, 0x2, 0x0)
r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r10, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r9}, 0x20)
recvmmsg(r9, &(0x7f0000000880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000940)=""/199, 0xc7}], 0x1}}], 0x2, 0x60, 0x0)
sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x680000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x6c, r5, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x4}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x106}, @NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'GPL\x00'}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r9}}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000)
r11 = accept4$rose(0xffffffffffffffff, &(0x7f0000000040)=@full={0xb, @dev, @null, 0x0, [@null, @bcast, @remote, @default, @netrom, @bcast]}, &(0x7f0000000080)=0x40, 0x80000)
r12 = socket(0x10, 0x3, 0x0)
r13 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r14 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$EBT_SO_GET_INIT_ENTRIES(r14, 0x0, 0x83, &(0x7f0000000b00)={'nat\x00', 0x0, 0x3, 0x0, [0x9, 0x0, 0x7fffffffffffffff, 0x4991, 0x9, 0xf43], 0x0, 0x0, 0x0}, &(0x7f0000000800)=0x78)
r15 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r15, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xee00}, {@in6=@dev, 0x4d2, 0x2b}, @in6=@mcast1, {}, {0x0, 0x200000, 0x7}, {}, 0x0, 0xfffffffc, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@multicast2}]}, 0x104}}, 0x0)
bind$bt_hci(r13, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6)
getsockopt$IP_VS_SO_GET_DESTS(r13, 0x0, 0x484, 0x0, &(0x7f0000000440))
ioctl$sock_SIOCETHTOOL(r12, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xfffffffc, 0x1, 0x1000, 0x1, 0x4, 0x9, 0xa1, 0xfff, 0x3, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x80000000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x401, 0x6, 0x9, 0x4, 0x7, 0x5, 0x66c, 0x762, 0x1, 0x0, 0xe, 0x2b11, 0x104, 0x2, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x100, 0x3, 0x0, 0xfffe, 0x8, 0x7, 0x79c, 0x2, 0x1, 0x7f, 0x3ff, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa4860a, 0x7, 0xaa, 0xfff, 0x5, 0x180000, 0x80007, 0x80bf44, 0x5, 0x2af, 0xf5, 0xffffffff, 0x2, 0x6, 0x9, 0x4, 0x7, 0x5, 0xba2a, 0x4, 0x5, 0x8, 0x752, 0x5, 0x4, 0x0, 0x10001, 0x2, 0xffffffff, 0x0, 0x6, 0x8, 0x8, 0xffffffff, 0x2, 0x2, 0x81, 0x100, 0x5, 0x68, 0x81, 0xb, 0x5, 0x6, 0x5, 0x2, 0x1, 0x12, 0xd9a, 0x9, 0x2a2, 0x0, 0xffff, 0x9, 0x5, 0x8, 0x0, 0x98fa, 0x2, 0x0, 0x7, 0x4, 0x5, 0x401, 0xd, 0x0, 0x8, 0x1, 0x200, 0xc5e, 0xffffffff]}})
ioctl$SIOCRSACCEPT(r11, 0x89e3)
sendmsg$NLBL_CALIPSO_C_ADD(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000000)={0x24, r2, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0xc840}, 0x20020000)
sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r2, 0x1, 0x70bd29, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4c890}, 0x20000000)

349.865096ms ago: executing program 1 (id=896):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff})
getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14)
sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2, 0xd9ff}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x1}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084)

288.5745ms ago: executing program 2 (id=897):
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getpeername$packet(r1, &(0x7f0000000040)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14)
sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x1}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x240000d4)

286.571853ms ago: executing program 1 (id=898):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan3\x00'})
r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0)
sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r1, 0x800, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xffff}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}]}, 0x28}, 0x1, 0x0, 0x0, 0x10040001}, 0x8000)
ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'vlan0\x00', <r3=>0x0})
sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, r1, 0x2, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x40) (async)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) (async)
syz_80211_join_ibss(&(0x7f0000000340)='wlan0\x00', &(0x7f0000000380)=@default_ibss_ssid, 0x6, 0x0)
r4 = socket$phonet(0x23, 0x2, 0x1)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) (async)
r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000500), 0x4)
r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000600)=@o_path={&(0x7f00000005c0)='./file0\x00', 0x0, 0x4000, r4}, 0x18) (async)
r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000680)=@o_path={&(0x7f0000000640)='./file0\x00', 0x0, 0x4008, r2}, 0x18) (async)
r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0x0, 0x9, 0x10}, 0xc) (async)
r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)={0x1b, 0x0, 0x0, 0x5, 0x0, 0x1, 0x1, '\x00', r3, 0xffffffffffffffff, 0x2, 0x2, 0x4}, 0x50)
r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0xa, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @call={0x85, 0x0, 0x0, 0x8a}, @func={0x85, 0x0, 0x1, 0x0, 0x8}, @map_idx={0x18, 0x5, 0x5, 0x0, 0x8}, @ldst={0x0, 0x0, 0x0, 0x5, 0x4, 0xfffffffffffffff0, 0x1}, @call={0x85, 0x0, 0x0, 0x68}]}, &(0x7f0000000480)='syzkaller\x00', 0x9, 0x30, &(0x7f00000004c0)=""/48, 0x41000, 0x4, '\x00', r3, 0x0, r5, 0x8, &(0x7f0000000540)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x0, 0xe, 0x9, 0xffffffff}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000780)=[r6, 0xffffffffffffffff, 0xffffffffffffffff, r7, r8, r9, 0xffffffffffffffff], &(0x7f00000007c0)=[{0x1, 0x1, 0x5, 0xa}, {0x3, 0x2, 0xb, 0xb}, {0x4, 0x1, 0xc, 0xc}, {0x1, 0x2, 0x9, 0x4}], 0x10, 0xb}, 0x94) (async)
sendmsg$IEEE802154_SCAN_REQ(r0, &(0x7f00000009c0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000980)={&(0x7f0000000900)={0x64, r1, 0x100, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DURATION={0x5, 0x15, 0x7}, @IEEE802154_ATTR_SCAN_TYPE={0x5, 0x13, 0x5}, @IEEE802154_ATTR_SCAN_TYPE={0x5, 0x13, 0x5}, @IEEE802154_ATTR_SCAN_TYPE={0x5, 0x13, 0x7}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1}, @IEEE802154_ATTR_CHANNELS={0x8, 0x14, 0xb}, @IEEE802154_ATTR_DURATION={0x5, 0x15, 0x1}, @IEEE802154_ATTR_CHANNELS={0x8, 0x14, 0xd}, @IEEE802154_ATTR_DURATION={0x5, 0x15, 0x6}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x12}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) (async)
sendmsg$IEEE802154_LLSEC_LIST_KEY(r0, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r1, 0x0, 0x70bd28, 0x25dfdbfd, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004004) (async)
socketpair(0x14, 0x800, 0x5, &(0x7f0000000b00)={0xffffffffffffffff, <r11=>0xffffffffffffffff}) (async)
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000b40)=0xffffffffffffffff, 0x4)
setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000c00)=@nat={'nat\x00', 0x1b, 0x5, 0x6e8, 0x250, 0x250, 0xffffffff, 0x250, 0x0, 0x618, 0x618, 0xffffffff, 0x618, 0x618, 0x5, &(0x7f0000000b80), {[{{@uncond, 0x0, 0x208, 0x250, 0x0, {}, [@common=@rt={{0x138}, {0x6, [0x6e8b978, 0x8], 0xa, 0x1, 0x1, [@loopback, @dev={0xfe, 0x80, '\x00', 0x43}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, @dev={0xfe, 0x80, '\x00', 0x14}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, @private0, @initdev={0xfe, 0x88, '\x00', 0x8, 0x0}, @mcast1, @private2, @remote], 0x5}}, @common=@mh={{0x28}, {"d139", 0x1}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x12, @ipv4=@broadcast, @ipv4=@remote, @gre_key=0xffff, @gre_key=0xc}}}, {{@uncond, 0x0, 0x160, 0x1a8, 0x0, {}, [@common=@mh={{0x28}, {"1955"}}, @common=@srh1={{0x90}, {0x0, 0x6, 0x9, 0x1, 0xff81, @dev={0xfe, 0x80, '\x00', 0x3b}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3f}}, @rand_addr=' \x01\x00', [0x0, 0xffffffff, 0xff, 0xff], [0xff, 0xffffffff, 0xa481f2078c864b7b, 0xff], [0xffff00, 0xff, 0xff, 0xffffffff], 0x4}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x14, @ipv6=@dev={0xfe, 0x80, '\x00', 0x20}, @ipv4=@multicast2, @gre_key=0x9, @port=0x4e21}}}, {{@ipv6={@private0, @private1, [0xffffff00, 0xff, 0x0, 0xff], [], 'veth1_to_bridge\x00', 'tunl0\x00', {0xff}, {0xff}, 0x33, 0x5, 0x9, 0x4}, 0x0, 0x100, 0x148, 0x0, {}, [@common=@ah={{0x30}, {[0x4d4, 0x4d6], 0x3, 0x5, 0x2}}, @common=@unspec=@connlabel={{0x28}, {0x8}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x17, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, @ipv6=@loopback, @port=0x4e20, @port=0x4e21}}}, {{@ipv6={@mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [0x0, 0xffffff00, 0xff000000], [0xffffffff, 0xff, 0xff000000], 'veth1\x00', 'bond_slave_0\x00', {0xff}, {}, 0x0, 0xf9, 0x0, 0x16}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x10000, 0x401, 0xec3, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x748)
r12 = socket$l2tp6(0xa, 0x2, 0x73)
getpeername$l2tp6(r12, &(0x7f0000001380)={0xa, 0x0, 0x0, @remote}, &(0x7f00000013c0)=0x20) (async)
ioctl$AUTOFS_IOC_ASKUMOUNT(r2, 0x80049370, &(0x7f0000001400)) (async)
sendmsg$nl_route(r2, &(0x7f0000001540)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001500)={&(0x7f0000001480)=@ipv6_newnexthop={0x48, 0x68, 0x20, 0x70bd2a, 0x25dfdbfd, {0xa, 0x0, 0x1, 0x0, 0x18}, [@NHA_ENCAP_TYPE={0x6, 0x7, 0x1}, @NHA_GATEWAY={0x14, 0x6, @ip4=@private=0xa010100}, @NHA_FDB={0x4}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_OIF={0x8, 0x5, r3}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x8001)
ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000001640)={'netdevsim0\x00', &(0x7f0000001580)=@ethtool_rx_ntuple={0x35, {0x6, @esp_ip4_spec={@loopback, @local, 0x2, 0x2}, @ether_spec={@empty, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}, 0x8}, 0x1, 0x6c, 0x6a44ef0, 0x510, 0xfffffffffffffffe}}}) (async)
getsockname$packet(r11, &(0x7f0000001680)={0x11, 0x0, <r13=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000016c0)=0x14)
r14 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000017c0)={0x0, 0x8000}, 0xc)
bpf$PROG_LOAD(0x5, &(0x7f0000001980)={0x3, 0x8, &(0x7f0000001700)=@raw=[@call={0x85, 0x0, 0x0, 0x3f}, @map_idx={0x18, 0x9, 0x5, 0x0, 0x2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @exit, @call={0x85, 0x0, 0x0, 0xd2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}], &(0x7f0000001740)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0x4, '\x00', r13, @sched_cls=0x36, r5, 0x8, &(0x7f0000001780)={0xa, 0x3}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, r10, 0x9, &(0x7f0000001880)=[r9, r9, r7, r9, r8, r14, 0xffffffffffffffff, r7], &(0x7f00000018c0)=[{0x1, 0x2, 0xc, 0xc}, {0x1, 0x3, 0x2, 0xb}, {0x4, 0x1, 0x1, 0x1}, {0x3, 0x5, 0xc, 0x4}, {0x3, 0x1, 0x9, 0x9}, {0x3, 0x4, 0xc}, {0x4, 0x4, 0xd, 0x5}, {0x3, 0x4, 0xa, 0x4}, {0x1, 0x2, 0xd, 0x7}], 0x10, 0x9b7}, 0x94)

286.400996ms ago: executing program 2 (id=899):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), r0)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), r0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r3 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
write$tun(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="0000000d0003110004"], 0x10da)
getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000080)=0x30)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000400000008000200050000ffff000b000a00000000001000000a6bca766bd3a191f98ad48ba42162af1432324afad04e9c82e49c343170d296774384b643d93748abe144ce6fc8dd8d020f9256c9bbc189c6537846648f5eb1a83dcef43c48b1d3021667842b0839a774f385c5d8644c5edc500b9f1eab400e145511472b9130ff8555bcad5c71b9b40abf09f1a8d6ff8ebe0dc27f9a80581dcec020a9874c3346814fcdc93f2d72d1cedb4ba40ad430b0ba14a8c44f702aa8286128999616989cb9bc8cc1bccbd367a882b5d9f3df40538497c03b9d54927c804659239e7dc8c0252d1f88d1a17ce59e5d03e274d914663b884d1cafe397298d18efa1732dd44737c5a42577fe4480ab83fa9d73fa61142ef7"], 0x24}}, 0x0)

167.767779ms ago: executing program 1 (id=900):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r2, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0xc0)
sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)={0x20, r2, 0x12, 0x70bd2d, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x4000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x7, &(0x7f0000000000)=ANY=[@ANYBLOB="18"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48)
close(r3) (async)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@ipv4_newrule={0x30, 0x1e, 0x1, 0xfffffffd, 0x0, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x9}, @FRA_DST={0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x30}, 0x1, 0x0, 0x0, 0x2}, 0x0) (async)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10003, 0x9, 0x1}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r5, &(0x7f0000000000), &(0x7f0000001a00)=""/122}, 0x20) (async)
bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r3}, &(0x7f0000001780)=0x4, 0x0}, 0x20)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="9c000000100003040000000000004d259bc81374548d9037e523e53b00000027160654", @ANYRESDEC=r1, @ANYBLOB="00000000000000006c00128009000100766c616e000000005c00028006e40000000000004c0003800c00000c00010065000000000000000c00010003000000000000000c00010005000000000000000c00010000000000000000000c00000004000480080005"], 0x9c}, 0x1, 0xba01}, 0x850)
r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x28)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x8}, [@tail_call={{}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x53, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="280500003d0007010000000000000000017c0000040000000c0003"], 0x528}}, 0xc000) (async)
r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), r0)
socket$packet(0x11, 0x2, 0x300)
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007110b5000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000400000014000500fc01000000000000000000000000080008000200050000000a0006"], 0x4c}}, 0x0)

69.143073ms ago: executing program 1 (id=901):
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040))
ioctl$PPPIOCSNPMODE(r0, 0x4008744b, &(0x7f0000000080)={0x57})
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r1)
shutdown(0xffffffffffffffff, 0x1)
r3 = socket$igmp6(0xa, 0x3, 0x2)
setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488)
syz_emit_ethernet(0x106, &(0x7f00000004c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0xd0, 0x6, 0x0, @remote, @ipv4={'\x00', '\xff\xff', @local}, {[@dstopts={0xc8, 0xe, '\x00', [@ra={0x5, 0x2, 0x1}, @jumbo={0xc2, 0x4, 0x101}, @hao={0xc9, 0x10, @private1={0xfc, 0x1, '\x00', 0x1}}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0x1, 0x44, "43039e0bfe7dde8b840a7f04654896c1d05ab8f11c0db93b082697508aa8f1ffc295dd281beeb325d159a51d4c67a1d4af52af968332068240a8686d4eb202f06d629988"}, @ra={0x5, 0x2, 0x7f}, @pad1, @enc_lim={0x4, 0x1, 0x6}]}], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x14, 0x2, 0x11, 0x0, 0x0, {[@exp_fastopen={0xfe, 0x7, 0xf989, "a2f93e"}, @mptcp=@mp_join={0x1e, 0x3, 0xc}, @fastopen={0x22, 0x11, "801d8259015257f40b56dce7d9bd62"}, @fastopen={0x22, 0xa, "8d05717439c2392d"}, @mss={0x2, 0x4, 0x24}, @mptcp=@synack={0x1e, 0x10, 0xf, 0x2, 0x80, 0x80000001, 0x4}]}}}}}}}}, 0x0)
r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x55bf, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x50)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r4}, 0x8)
syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000000)=@framed={{0x1d, 0xa, 0xa, 0x0, 0x0, 0x61, 0x10, 0x20}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80)
sendmsg$NLBL_CALIPSO_C_REMOVE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="0100247fed961b8e76032946919525bd7000ffdbdf25"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000)

0s ago: executing program 2 (id=902):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500e1fd08005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000005000000000000000000000000000000000000000000000000860090780000000000000000000000000000ee3f000000002b036f8c006e75021d683910c3090b3188a7c747eb2278a273c1b80029442911892704"], 0xfdef)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:54230' (ED25519) to the list of known hosts.
syzkaller login: [   50.088596][ T5802] cgroup: Unknown subsys name 'net'
[   50.316495][ T5802] cgroup: Unknown subsys name 'cpuset'
[   50.320464][ T5802] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   51.635378][ T5802] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.763745][ T5813] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.774536][ T5813] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.783941][ T5813] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.788139][ T5813] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.791883][ T5813] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.876253][ T5813] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.879937][ T5813] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.885857][ T5203] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.889224][ T5203] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.893454][ T5203] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.896474][ T5203] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.899557][ T5820] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.925157][ T5822] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.927963][ T5822] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.939110][ T5203] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.983077][ T5811] chnl_net:caif_netlink_parms(): no params data found
[   56.111583][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.114647][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.117268][ T5811] bridge_slave_0: entered allmulticast mode
[   56.120232][ T5811] bridge_slave_0: entered promiscuous mode
[   56.127488][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.130029][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.132510][ T5811] bridge_slave_1: entered allmulticast mode
[   56.136125][ T5811] bridge_slave_1: entered promiscuous mode
[   56.212730][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.228414][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.286755][ T5815] chnl_net:caif_netlink_parms(): no params data found
[   56.297891][ T5811] team0: Port device team_slave_0 added
[   56.314889][ T5811] team0: Port device team_slave_1 added
[   56.371881][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.374366][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.382557][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.387527][ T5816] chnl_net:caif_netlink_parms(): no params data found
[   56.413076][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.416572][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.428294][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.513527][ T5815] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.516990][ T5815] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.519936][ T5815] bridge_slave_0: entered allmulticast mode
[   56.526123][ T5815] bridge_slave_0: entered promiscuous mode
[   56.566915][ T5815] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.570705][ T5815] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.574313][ T5815] bridge_slave_1: entered allmulticast mode
[   56.578214][ T5815] bridge_slave_1: entered promiscuous mode
[   56.596104][ T5816] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.599107][ T5816] bridge0: port 1(bridge_slave_0) entered disabled state
[   56.602108][ T5816] bridge_slave_0: entered allmulticast mode
[   56.606327][ T5816] bridge_slave_0: entered promiscuous mode
[   56.615465][ T5811] hsr_slave_0: entered promiscuous mode
[   56.618625][ T5811] hsr_slave_1: entered promiscuous mode
[   56.633498][ T5816] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.636828][ T5816] bridge0: port 2(bridge_slave_1) entered disabled state
[   56.639747][ T5816] bridge_slave_1: entered allmulticast mode
[   56.643479][ T5816] bridge_slave_1: entered promiscuous mode
[   56.661507][ T5815] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.666642][ T5815] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.719456][ T5816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   56.727805][ T5815] team0: Port device team_slave_0 added
[   56.732261][ T5816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.742090][ T5815] team0: Port device team_slave_1 added
[   56.796260][ T5816] team0: Port device team_slave_0 added
[   56.799293][ T5815] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.801529][ T5815] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.810446][ T5815] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.820172][ T5816] team0: Port device team_slave_1 added
[   56.823211][ T5815] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.825810][ T5815] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.834050][ T5815] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.893109][ T5815] hsr_slave_0: entered promiscuous mode
[   56.895986][ T5815] hsr_slave_1: entered promiscuous mode
[   56.898165][ T5815] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.901741][ T5815] Cannot create hsr debugfs directory
[   56.907708][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.910708][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.920453][ T5816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.926163][ T5816] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.928735][ T5816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.938167][ T5816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   57.008212][ T5816] hsr_slave_0: entered promiscuous mode
[   57.010750][ T5816] hsr_slave_1: entered promiscuous mode
[   57.013439][ T5816] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   57.019141][ T5816] Cannot create hsr debugfs directory
[   57.102892][ T5811] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   57.117196][ T5811] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   57.134739][ T5811] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   57.151253][ T5811] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   57.202261][ T5815] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   57.216811][ T5815] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   57.229662][ T5815] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   57.236002][ T5815] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   57.299152][ T5816] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   57.306616][ T5816] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   57.313118][ T5816] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   57.331083][ T5816] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   57.393028][ T5815] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.400720][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.417427][ T5811] 8021q: adding VLAN 0 to HW filter on device team0
[   57.438589][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.440953][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.446831][ T5815] 8021q: adding VLAN 0 to HW filter on device team0
[   57.460637][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.463603][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.472150][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.474890][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.499226][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.501918][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.550060][ T5816] 8021q: adding VLAN 0 to HW filter on device bond0
[   57.569656][ T5816] 8021q: adding VLAN 0 to HW filter on device team0
[   57.580565][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   57.582930][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   57.591752][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   57.594124][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   57.637105][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.695548][ T5811] veth0_vlan: entered promiscuous mode
[   57.712136][ T5811] veth1_vlan: entered promiscuous mode
[   57.759259][ T5815] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.762728][ T5811] veth0_macvtap: entered promiscuous mode
[   57.769486][ T5816] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.776164][ T5811] veth1_macvtap: entered promiscuous mode
[   57.790724][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.801533][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.811649][ T5811] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.815268][ T5811] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.817960][ T5811] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.820871][ T5811] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.824265][ T5203] Bluetooth: hci0: command tx timeout
[   57.891808][ T5815] veth0_vlan: entered promiscuous mode
[   57.902697][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.910613][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.918823][ T5816] veth0_vlan: entered promiscuous mode
[   57.922059][ T5815] veth1_vlan: entered promiscuous mode
[   57.936002][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.938144][ T5816] veth1_vlan: entered promiscuous mode
[   57.944350][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.957346][ T5815] veth0_macvtap: entered promiscuous mode
[   57.961237][ T5815] veth1_macvtap: entered promiscuous mode
[   57.974561][ T5203] Bluetooth: hci2: command tx timeout
[   57.980317][ T5816] veth0_macvtap: entered promiscuous mode
[   57.980709][ T5811] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.987570][ T5203] Bluetooth: hci1: command tx timeout
[   57.988635][ T5816] veth1_macvtap: entered promiscuous mode
[   57.995563][ T5815] batman_adv: batadv0: Interface activated: batadv_slave_0
[   58.006970][ T5815] batman_adv: batadv0: Interface activated: batadv_slave_1
[   58.013167][ T5815] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   58.017562][ T5815] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   58.020304][ T5815] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   58.023155][ T5815] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   58.038965][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_0
[   58.049804][ T5816] batman_adv: batadv0: Interface activated: batadv_slave_1
[   58.061672][ T5816] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   58.065442][ T5816] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   58.068416][ T5816] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   58.071090][ T5816] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   58.132997][  T748] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.142534][  T748] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.194300][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.197680][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.234980][  T748] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.237922][  T748] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.256306][ T5884] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5'.
[   58.256814][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   58.263233][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   58.318435][ T5884] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.326213][ T5884] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.357386][ T5884] Illegal XDP return value 4294967289 on prog  (id 3) dev N/A, expect packet loss!
[   58.450506][ T5892] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6'.
[   58.454821][ T5892] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6'.
[   58.552918][ T5899] tipc: Can't bind to reserved service type 0
[   58.562414][ T5894] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7'.
[   58.682247][ T5906] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9'.
[   58.688712][ T5906] netlink: 68 bytes leftover after parsing attributes in process `syz.1.9'.
[   58.712287][ T5906] bridge0: port 1(bridge_slave_0) entered disabled state
[   58.718169][ T5906] bridge0: port 2(bridge_slave_1) entered disabled state
[   58.754439][ T5909] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11'.
[   58.916243][ T5918] netlink: 'syz.2.14': attribute type 1 has an invalid length.
[   58.919187][ T5918] netlink: 72 bytes leftover after parsing attributes in process `syz.2.14'.
[   59.037988][ T5920] af_packet: tpacket_rcv: packet too big, clamped from 3958 to 3710. macoff=82
[   59.066559][ T5918] syz.2.14 uses obsolete (PF_INET,SOCK_PACKET)
[   59.068812][ T5927] netlink: 'syz.1.16': attribute type 1 has an invalid length.
[   59.071418][ T5927] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16'.
[   59.181692][ T5936] netlink: 108 bytes leftover after parsing attributes in process `syz.1.18'.
[   59.292079][ T5942] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   59.894818][ T5203] Bluetooth: hci0: command tx timeout
[   60.054028][ T5203] Bluetooth: hci1: command tx timeout
[   60.056492][ T5203] Bluetooth: hci2: command tx timeout
[   60.191532][ T6023] bond0: (slave bond_slave_1): Releasing backup interface
[   60.725322][ T6036] Zero length message leads to an empty skb
[   61.005392][ T6054] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.049174][ T6055] bond0: (slave macvlan2): Error -98 calling set_mac_address
[   61.072090][ T6054] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.175688][ T6054] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.247012][ T6054] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.323206][ T6062] warning: `syz.0.53' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   61.347748][ T6054] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0
[   61.360023][ T6054] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0
[   61.369433][ T6054] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0
[   61.379389][ T6054] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0
[   61.419605][ T6066] netlink: 'syz.2.54': attribute type 7 has an invalid length.
[   61.481557][ T6066] bridge0: port 1(bridge_slave_0) entered disabled state
[   61.487176][ T6066] bridge0: port 2(bridge_slave_1) entered disabled state
[   61.750860][ T6096] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check.
[   61.860588][ T6103] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[   61.983875][   T55] Bluetooth: hci0: command tx timeout
[   62.146378][ T5822] Bluetooth: hci1: command tx timeout
[   62.148290][ T5203] Bluetooth: hci2: command tx timeout
[   62.168238][ T6124] Cannot find set identified by id 0 to match
[   63.019098][ T6172] Bluetooth: MGMT ver 1.23
[   63.197237][ T6180] netlink: 'syz.2.88': attribute type 8 has an invalid length.
[   63.201805][ T6180] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING
[   63.319150][ T6184] x_tables: duplicate underflow at hook 1
[   63.421081][ T6186] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   63.782936][ T6196] __nla_validate_parse: 29 callbacks suppressed
[   63.782947][ T6196] netlink: 16 bytes leftover after parsing attributes in process `syz.0.93'.
[   64.054030][ T5203] Bluetooth: hci0: command tx timeout
[   64.213931][ T5822] Bluetooth: hci1: command tx timeout
[   64.216417][ T5203] Bluetooth: hci2: command 0x0419 tx timeout
[   64.422379][ T6208] netlink: 8 bytes leftover after parsing attributes in process `syz.1.97'.
[   64.500080][ T6208] netlink: 16 bytes leftover after parsing attributes in process `syz.1.97'.
[   64.536740][ T6217] x_tables: duplicate underflow at hook 1
[   64.587054][ T6219] bridge0: port 3(syz_tun) entered blocking state
[   64.589364][ T6219] bridge0: port 3(syz_tun) entered disabled state
[   64.591612][ T6219] syz_tun: entered allmulticast mode
[   64.597478][ T6219] syz_tun: entered promiscuous mode
[   64.600652][ T6219] netlink: 16 bytes leftover after parsing attributes in process `syz.2.99'.
[   64.611134][ T6224] netlink: 16 bytes leftover after parsing attributes in process `syz.2.99'.
[   64.631037][ T6221] x_tables: duplicate underflow at hook 1
[   64.723740][ T6234] netem: incorrect ge model size
[   64.726083][ T6234] netem: change failed
[   64.793633][ T6242] netlink: 48 bytes leftover after parsing attributes in process `syz.1.106'.
[   64.927093][ T6248] netlink: 'syz.1.108': attribute type 1 has an invalid length.
[   64.929660][ T6248] netlink: 4 bytes leftover after parsing attributes in process `syz.1.108'.
[   64.932754][ T6248] netlink: 4 bytes leftover after parsing attributes in process `syz.1.108'.
[   64.981735][ T6248] netlink: 56 bytes leftover after parsing attributes in process `syz.1.108'.
[   64.986117][ T6248] netlink: 56 bytes leftover after parsing attributes in process `syz.1.108'.
[   65.547022][ T6280] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check.
[   65.653880][ T6284] block nbd0: server does not support multiple connections per device.
[   65.661003][ T6284] block nbd0: shutting down sockets
[   65.796071][ T6294] tipc: Started in network mode
[   65.797812][ T6294] tipc: Node identity 9ab80ca04335, cluster identity 4711
[   65.800436][ T6294] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   65.837230][ T6294] syzkaller0: entered promiscuous mode
[   65.839115][ T6294] syzkaller0: entered allmulticast mode
[   65.841412][ T6294] tipc: Resetting bearer <eth:syzkaller0>
[   65.868146][ T6293] tipc: Resetting bearer <eth:syzkaller0>
[   66.293993][   T55] Bluetooth: hci2: command 0x0419 tx timeout
[   66.584649][ T6293] tipc: Disabling bearer <eth:syzkaller0>
[   66.589485][ T6300] veth0: entered promiscuous mode
[   66.591894][ T6301] veth0: left promiscuous mode
[   66.662854][ T6312] trusted_key: syz.0.130 sent an empty control message without MSG_MORE.
[   66.672067][ T6313] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (3)
[   67.009454][ T6353] netlink: 'syz.0.144': attribute type 1 has an invalid length.
[   67.012785][ T6353] netlink: 'syz.0.144': attribute type 1 has an invalid length.
[   67.104231][ T6360] bridge1: entered promiscuous mode
[   67.396508][ T6380] bond1: entered promiscuous mode
[   67.948094][ T6415] bridge1: entered promiscuous mode
[   68.591948][ T6461] netlink: 'syz.2.176': attribute type 1 has an invalid length.
[   68.619272][ T6461] 8021q: adding VLAN 0 to HW filter on device bond2
[   68.639567][ T6461] 8021q: adding VLAN 0 to HW filter on device bond2
[   68.642650][ T6461] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address
[   68.648879][ T6461] bond2: (slave vxcan3): Error -95 calling set_mac_address
[   68.684580][ T6463] gretap1: entered promiscuous mode
[   68.689430][ T6463] bond2: (slave gretap1): making interface the new active one
[   68.692689][ T6463] bond2: (slave gretap1): Enslaving as an active interface with an up link
[   68.707129][ T6461] bond2: (slave vlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1
[   68.775013][ T6463] syz.2.176 (6463) used greatest stack depth: 20760 bytes left
[   68.791678][ T6465] __nla_validate_parse: 23 callbacks suppressed
[   68.791694][ T6465] netlink: 24 bytes leftover after parsing attributes in process `syz.2.177'.
[   68.805061][ T6465] netlink: 'syz.2.177': attribute type 1 has an invalid length.
[   70.871931][ T1361] ieee802154 phy0 wpan0: encryption failed: -22
[   70.874639][ T1361] ieee802154 phy1 wpan1: encryption failed: -22
[   81.095283][   T10] cfg80211: failed to load regulatory.db
[   87.918195][ T6476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.181'.
[   87.936765][ T6476] netlink: 28 bytes leftover after parsing attributes in process `syz.1.181'.
[   88.100216][ T6485] netlink: 'syz.0.184': attribute type 21 has an invalid length.
[   88.103605][ T6485] netlink: 128 bytes leftover after parsing attributes in process `syz.0.184'.
[   88.107933][ T6485] netlink: 'syz.0.184': attribute type 5 has an invalid length.
[   88.111187][ T6485] netlink: 'syz.0.184': attribute type 6 has an invalid length.
[   88.116663][ T6485] netlink: 3 bytes leftover after parsing attributes in process `syz.0.184'.
[   88.200502][ T6488] netlink: 4 bytes leftover after parsing attributes in process `syz.1.187'.
[   88.238227][ T6486] netlink: 'syz.2.185': attribute type 1 has an invalid length.
[   88.241020][ T6486] netlink: 204 bytes leftover after parsing attributes in process `syz.2.185'.
[   88.245021][ T6491] netlink: 176 bytes leftover after parsing attributes in process `syz.1.188'.
[   88.248071][ T6491] ip6gretap0: entered promiscuous mode
[   88.250105][ T6491] netlink: 176 bytes leftover after parsing attributes in process `syz.1.188'.
[   88.253745][ T6486] netlink: 'syz.2.185': attribute type 1 has an invalid length.
[   88.519157][ T6502] netlink: 8 bytes leftover after parsing attributes in process `syz.0.191'.
[   89.157737][ T6519] netlink: 8 bytes leftover after parsing attributes in process `syz.1.194'.
[   89.862750][ T6555] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   89.956267][ T6555] netlink: 'syz.1.207': attribute type 1 has an invalid length.
[   89.963103][ T6555] netlink: 'syz.1.207': attribute type 11 has an invalid length.
[   90.247930][ T6586] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check.
[   90.859715][ T6630] Unsupported ieee802154 address type: 0
[   90.915304][ T6632] 8021q: adding VLAN 0 to HW filter on device bond1
[   91.065084][ T6632] bond1 (unregistering): Released all slaves
[   91.084432][ T6638] wg1 speed is unknown, defaulting to 1000
[   91.088951][ T6638] wg1 speed is unknown, defaulting to 1000
[   91.092709][ T6638] wg1 speed is unknown, defaulting to 1000
[   91.098808][ T6638] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   91.124416][ T6638] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[   91.162540][ T6638] wg1 speed is unknown, defaulting to 1000
[   91.165732][ T6638] wg1 speed is unknown, defaulting to 1000
[   91.168351][ T6638] wg1 speed is unknown, defaulting to 1000
[   91.258646][ T6645] vlan2: entered allmulticast mode
[   91.261623][ T6645] bond1: entered allmulticast mode
[   91.390959][   T10] wg1 speed is unknown, defaulting to 1000
[   91.555663][ T6671] netlink: 'syz.0.243': attribute type 16 has an invalid length.
[   91.826894][   T12] bond0: (slave bond_slave_0): interface is now down
[   91.830374][ T6694] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0)
[   91.864262][ T5857] bond0: (slave bond_slave_0): interface is now down
[   91.878497][ T5857] bond0: now running without any active interface!
[   92.596106][   T33] audit: type=1800 audit(1751706752.819:2): pid=6746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.266" name=34FFFF dev="tmpfs" ino=353 res=0 errno=0
[   92.948790][ T6775] xt_hashlimit: size too large, truncated to 1048576
[   92.951825][ T6775] xt_hashlimit: max too large, truncated to 1048576
[   92.976560][ T6776] __nla_validate_parse: 30 callbacks suppressed
[   92.976575][ T6776] netlink: 4 bytes leftover after parsing attributes in process `syz.0.272'.
[   93.051662][ T6784] netlink: 256 bytes leftover after parsing attributes in process `syz.0.275'.
[   93.057239][ T6784] netlink: 72 bytes leftover after parsing attributes in process `syz.0.275'.
[   93.060371][ T6784] openvswitch: netlink: Missing key (keys=40, expected=10000000)
[   93.063996][ T6784] netlink: 16 bytes leftover after parsing attributes in process `syz.0.275'.
[   93.140086][ T6792] x_tables: duplicate underflow at hook 2
[   93.199035][ T6795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.278'.
[   93.295832][ T6799] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   93.336645][ T6801] netlink: 8 bytes leftover after parsing attributes in process `syz.1.281'.
[   93.423069][ T6748] Bluetooth: hci0: Opcode 0x0401 failed: -4
[   93.484798][ T6809] netlink: 16 bytes leftover after parsing attributes in process `syz.2.285'.
[   93.619474][ T6814] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   93.682654][ T6811] syz_tun: entered promiscuous mode
[   93.685684][ T6811] syz_tun: entered allmulticast mode
[   94.051717][ T6827] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 0, id = 0
[   94.342872][ T6832] netlink: 4 bytes leftover after parsing attributes in process `syz.0.290'.
[   94.400997][ T6834] IPv6: sit1: Disabled Multicast RS
[   94.479149][ T6842] netlink: 16 bytes leftover after parsing attributes in process `syz.0.293'.
[   94.536588][ T6853] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[   94.540531][ T6853] xt_SECMARK: invalid mode: 0
[   94.576425][ T6859] netlink: 4 bytes leftover after parsing attributes in process `syz.0.296'.
[   94.614155][   T55] Bluetooth: hci0: command 0x0401 tx timeout
[   95.208844][ T6918] wg1 speed is unknown, defaulting to 1000
[   95.507149][ T6947] netlink: 'syz.1.329': attribute type 1 has an invalid length.
[   95.547722][ T6949] wg1 speed is unknown, defaulting to 1000
[   95.650480][ T6960] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) !
[   95.681544][ T6965] netlink: 'syz.0.336': attribute type 1 has an invalid length.
[   95.977850][ T6987] wg1 speed is unknown, defaulting to 1000
[   96.290706][ T7019] wg1 speed is unknown, defaulting to 1000
[   96.946218][ T7068] wg1 speed is unknown, defaulting to 1000
[   97.273310][ T7087] netlink: 'syz.1.374': attribute type 2 has an invalid length.
[   97.410086][ T7092] wg1 speed is unknown, defaulting to 1000
[   97.551612][ T7100] netlink: 'syz.1.379': attribute type 1 has an invalid length.
[   97.721471][ T7112] wg1 speed is unknown, defaulting to 1000
[   97.825786][ T7121] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma?
[   97.830829][ T7123] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0
[   97.951869][ T7129] netlink: 'syz.1.390': attribute type 23 has an invalid length.
[   98.001996][ T7137] wg1 speed is unknown, defaulting to 1000
[   98.260892][ T7154] delete_channel: no stack
[   98.292470][ T7159] Cannot find add_set index 4 as target
[   98.340359][ T7161] wg1 speed is unknown, defaulting to 1000
[   98.397560][ T7163] xt_CT: No such helper "snmp"
[   98.619000][ T7182] nbd: couldn't find device at index 536870912
[   98.621244][ T7183] nbd: couldn't find device at index 536870912
[   98.660958][ T7185] wg1 speed is unknown, defaulting to 1000
[   98.806259][ T7192] __nla_validate_parse: 73 callbacks suppressed
[   98.806270][ T7192] netlink: 8 bytes leftover after parsing attributes in process `syz.1.411'.
[   98.944828][ T7198] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.415'.
[   98.947859][ T7198] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[   99.411726][ T7201] netlink: 'syz.2.416': attribute type 10 has an invalid length.
[   99.415652][ T7201] bridge0: port 4(team0) entered blocking state
[   99.417694][ T7201] bridge0: port 4(team0) entered disabled state
[   99.419781][ T7201] team0: entered allmulticast mode
[   99.421396][ T7201] team_slave_0: entered allmulticast mode
[   99.423212][ T7201] team_slave_1: entered allmulticast mode
[   99.426392][ T7201] team0: entered promiscuous mode
[   99.428001][ T7201] team_slave_0: entered promiscuous mode
[   99.429822][ T7201] team_slave_1: entered promiscuous mode
[   99.512397][ T7206] wg1 speed is unknown, defaulting to 1000
[   99.627996][ T7209] digital: digital_start_poll: Unknown protocol
[   99.639276][ T7210] delete_channel: no stack
[   99.713511][ T7215] netlink: 'syz.1.421': attribute type 1 has an invalid length.
[   99.720263][ T7215] netlink: 144 bytes leftover after parsing attributes in process `syz.1.421'.
[   99.723308][ T7215] netlink: 28 bytes leftover after parsing attributes in process `syz.1.421'.
[   99.903926][ T7233] delete_channel: no stack
[   99.914194][ T7236] netlink: 'syz.1.428': attribute type 2 has an invalid length.
[   99.916616][ T7236] netlink: 12 bytes leftover after parsing attributes in process `syz.1.428'.
[   99.923534][ T7237] netlink: 'syz.1.428': attribute type 2 has an invalid length.
[   99.928052][ T7237] netlink: 12 bytes leftover after parsing attributes in process `syz.1.428'.
[  100.085662][ T7266] netlink: 16 bytes leftover after parsing attributes in process `syz.1.438'.
[  100.111655][ T7268] netlink: 8 bytes leftover after parsing attributes in process `syz.0.439'.
[  100.239778][ T7276] netlink: 'syz.2.441': attribute type 10 has an invalid length.
[  100.263144][ T7276] 8021q: adding VLAN 0 to HW filter on device batadv0
[  100.267309][ T7276] bond0: (slave batadv0): Enslaving as an active interface with an up link
[  100.274087][   T13] bond0: (slave batadv0): interface is now down
[  100.279249][   T13] bond0: now running without any active interface!
[  100.438374][ T7294] netlink: 8 bytes leftover after parsing attributes in process `syz.0.448'.
[  100.489250][ T7295] netlink: 224 bytes leftover after parsing attributes in process `syz.0.448'.
[  100.586990][ T7306] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  100.602942][ T7306] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  100.608515][ T7306] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  100.615387][ T7311] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  100.618205][ T7306] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  100.827754][ T7324] bridge2: entered allmulticast mode
[  100.860149][ T7276] syz.2.441 (7276) used greatest stack depth: 20696 bytes left
[  100.900656][ T7328] validate_nla: 2 callbacks suppressed
[  100.900666][ T7328] netlink: 'syz.1.459': attribute type 12 has an invalid length.
[  100.956497][   T32] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  100.959378][   T32] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  101.215430][ T7361] xt_CHECKSUM: unsupported CHECKSUM operation 68
[  101.235296][ T7361] wg1 speed is unknown, defaulting to 1000
[  101.922314][ T7430] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode
[  101.926576][ T7430] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  102.008819][ T7438] netlink: 'syz.2.496': attribute type 12 has an invalid length.
[  102.155330][ T7448] wg1 speed is unknown, defaulting to 1000
[  102.296219][ T7448] netlink: 'syz.2.500': attribute type 12 has an invalid length.
[  102.558721][   T55] Bluetooth: hci2: link tx timeout
[  102.560904][   T55] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa
[  102.805546][ T7491] netlink: 'syz.1.513': attribute type 11 has an invalid length.
[  102.809380][ T7491] netlink: 'syz.1.513': attribute type 1 has an invalid length.
[  102.985436][ T7505] netlink: zone id is out of range
[  102.991319][ T7505] netlink: zone id is out of range
[  102.994547][ T7505] netlink: set zone limit has 4 unknown bytes
[  103.040363][ T7511] macvlan0: entered promiscuous mode
[  103.047021][ T7511] netlink: 'syz.1.522': attribute type 1 has an invalid length.
[  103.058569][ T7511] netlink: 'syz.1.522': attribute type 2 has an invalid length.
[  103.068503][ T7513] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20001
[  103.633403][ T7535] infiniband syz0: set down
[  103.635667][ T7535] infiniband syz0: added ipvlan1
[  103.638161][ T7535] syz0: rxe_create_cq: returned err = -12
[  103.640897][ T7535] infiniband syz0: Couldn't create ib_mad CQ
[  103.644832][ T7535] infiniband syz0: Couldn't open port 1
[  103.665787][ T7535] RDS/IB: syz0: added
[  103.667340][ T7535] smc: adding ib device syz0 with port count 1
[  103.669358][ T7535] smc:    ib device syz0 port 1 has pnetid 
[  103.779480][ T7557] syz_tun: left allmulticast mode
[  103.781269][ T7557] syz_tun: left promiscuous mode
[  103.782977][ T7557] bridge0: port 3(syz_tun) entered disabled state
[  103.788583][ T7557] team0: left allmulticast mode
[  103.790183][ T7557] team_slave_0: left allmulticast mode
[  103.791972][ T7557] team_slave_1: left allmulticast mode
[  103.794683][ T7557] team0: left promiscuous mode
[  103.796450][ T7557] team_slave_0: left promiscuous mode
[  103.799061][ T7557] team_slave_1: left promiscuous mode
[  103.801113][ T7557] bridge0: port 4(team0) entered disabled state
[  103.818872][ T7557] bond0: (slave batadv0): Releasing backup interface
[  103.825278][ T7557] bridge_slave_0: left allmulticast mode
[  103.827110][ T7557] bridge_slave_0: left promiscuous mode
[  103.829922][ T7557] bridge0: port 1(bridge_slave_0) entered disabled state
[  103.835847][ T7557] bridge_slave_1: left allmulticast mode
[  103.837648][ T7557] bridge_slave_1: left promiscuous mode
[  103.839749][ T7557] bridge0: port 2(bridge_slave_1) entered disabled state
[  103.845098][ T7557] bond0: (slave bond_slave_0): Releasing backup interface
[  103.858020][ T7557] team0: Port device team_slave_0 removed
[  103.866619][ T7557] team0: Port device team_slave_1 removed
[  103.869045][ T7557] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  103.871415][ T7557] batman_adv: batadv0: Removing interface: batadv_slave_0
[  103.877116][ T7557] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  103.879497][ T7557] batman_adv: batadv0: Removing interface: batadv_slave_1
[  103.888607][ T7557] bond2: (slave gretap1): Releasing active interface
[  104.162684][ T7563] __nla_validate_parse: 20 callbacks suppressed
[  104.162693][ T7563] netlink: 16 bytes leftover after parsing attributes in process `syz.0.541'.
[  104.296597][ T7567] syzkaller1: entered promiscuous mode
[  104.298462][ T7567] syzkaller1: entered allmulticast mode
[  104.302002][ T7567] netlink: 830 bytes leftover after parsing attributes in process `syz.0.543'.
[  104.308553][ T7569] netlink: 'syz.1.544': attribute type 5 has an invalid length.
[  104.396874][ T7573] netlink: 'syz.1.546': attribute type 1 has an invalid length.
[  104.401820][ T7573] netlink: 32 bytes leftover after parsing attributes in process `syz.1.546'.
[  104.455448][ T7579] netlink: 'syz.1.548': attribute type 21 has an invalid length.
[  104.458767][ T7579] netlink: 128 bytes leftover after parsing attributes in process `syz.1.548'.
[  104.462518][ T7579] netlink: 3 bytes leftover after parsing attributes in process `syz.1.548'.
[  104.503098][ T7583] netlink: 8 bytes leftover after parsing attributes in process `syz.0.550'.
[  104.518282][ T7583] netlink: 28 bytes leftover after parsing attributes in process `syz.0.550'.
[  104.601719][ T7586] netlink: 12 bytes leftover after parsing attributes in process `syz.0.551'.
[  104.615428][ T5203] Bluetooth: hci2: command 0x0419 tx timeout
[  104.766074][ T7596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  104.829882][ T7607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.559'.
[  104.843794][ T7596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  104.892017][ T7607] netlink: 24 bytes leftover after parsing attributes in process `syz.2.559'.
[  104.901591][ T7596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  105.103544][ T7625] openvswitch: netlink: push_nsh: missing base or metadata attributes
[  105.110195][ T7625] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  105.146705][ T7629] delete_channel: no stack
[  105.440696][ T7660] pim6reg: entered allmulticast mode
[  106.171263][ T7719] validate_nla: 2 callbacks suppressed
[  106.171273][ T7719] netlink: 'syz.1.600': attribute type 1 has an invalid length.
[  106.176198][ T7719] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  106.707700][ T7770] netlink: 'syz.0.619': attribute type 4 has an invalid length.
[  106.740729][ T7777] netlink: 'syz.0.621': attribute type 1 has an invalid length.
[  107.076974][ T7806] xt_addrtype: both incoming and outgoing interface limitation cannot be selected
[  107.108944][ T7804] tc_dump_action: action bad kind
[  107.111061][ T7788] tc_dump_action: action bad kind
[  107.482781][ T7832] can: request_module (can-proto-0) failed.
[  107.579401][ T7841] x_tables: ip_tables: HMARK.0 target: invalid size 64 (kernel) != (user) 72
[  107.905672][ T7857] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  107.918775][ T7857] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  107.999613][ T7857] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0
[  108.002570][ T7857] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0
[  108.008608][ T7857] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0
[  108.012156][ T7857] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0
[  108.066548][ T7868] netlink: 'syz.1.650': attribute type 2 has an invalid length.
[  108.069683][ T7868] netlink: 'syz.1.650': attribute type 1 has an invalid length.
[  108.200340][ T7890] netlink: 'syz.2.653': attribute type 12 has an invalid length.
[  108.487942][ T7917] bridge_slave_0: left allmulticast mode
[  108.489936][ T7917] bridge_slave_0: left promiscuous mode
[  108.492019][ T7917] bridge0: port 1(bridge_slave_0) entered disabled state
[  108.497990][ T7917] bridge_slave_1: left allmulticast mode
[  108.499818][ T7917] bridge_slave_1: left promiscuous mode
[  108.501745][ T7917] bridge0: port 2(bridge_slave_1) entered disabled state
[  108.507595][ T7917] bond0: (slave bond_slave_0): Releasing backup interface
[  108.511844][ T7917] bond0: (slave bond_slave_1): Releasing backup interface
[  108.525656][ T7917] team0: Port device team_slave_0 removed
[  108.530698][ T7917] team0: Port device team_slave_1 removed
[  108.533042][ T7917] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  108.536675][ T7917] batman_adv: batadv0: Removing interface: batadv_slave_0
[  108.540618][ T7917] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  108.543118][ T7917] batman_adv: batadv0: Removing interface: batadv_slave_1
[  108.650979][ T7931] pimreg: entered allmulticast mode
[  109.024928][ T7948] nbd: socks must be embedded in a SOCK_ITEM attr
[  109.028732][ T7948] block nbd0: shutting down sockets
[  109.520324][ T7960] __nla_validate_parse: 30 callbacks suppressed
[  109.520333][ T7960] netlink: 16 bytes leftover after parsing attributes in process `syz.2.678'.
[  109.832436][ T7979] netlink: 16 bytes leftover after parsing attributes in process `syz.0.684'.
[  110.144041][ T5203] Bluetooth: hci2: command 0x0419 tx timeout
[  110.188687][ T8020] netlink: 8 bytes leftover after parsing attributes in process `syz.0.696'.
[  110.305626][ T8029] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes.
[  110.318846][ T8029] vlan2: entered allmulticast mode
[  110.321309][ T8029] veth0_vlan: entered allmulticast mode
[  110.371864][ T8033] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  110.374638][ T8033] IPv6: NLM_F_CREATE should be set when creating new route
[  110.376984][ T8033] IPv6: NLM_F_CREATE should be set when creating new route
[  110.379298][ T8033] IPv6: NLM_F_CREATE should be set when creating new route
[  110.383133][ T8033] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  110.427174][ T8035] IPVS: stopping backup sync thread 6827 ...
[  110.455396][ T8038] netlink: 32 bytes leftover after parsing attributes in process `syz.1.703'.
[  110.462515][ T8038] netlink: 'syz.1.703': attribute type 1 has an invalid length.
[  110.537626][ T8050] netlink: 44 bytes leftover after parsing attributes in process `syz.0.708'.
[  110.543306][ T8051] netlink: 44 bytes leftover after parsing attributes in process `syz.0.708'.
[  110.595440][ T8058] netlink: 8 bytes leftover after parsing attributes in process `syz.1.711'.
[  110.599112][ T8058] netlink: 68 bytes leftover after parsing attributes in process `syz.1.711'.
[  110.748409][ T8069] sctp: [Deprecated]: syz.2.715 (pid 8069) Use of struct sctp_assoc_value in delayed_ack socket option.
[  110.748409][ T8069] Use struct sctp_sack_info instead
[  110.889507][ T8084] netlink: 24 bytes leftover after parsing attributes in process `syz.0.720'.
[  111.012534][ T8102] netlink: 8 bytes leftover after parsing attributes in process `syz.1.726'.
[  111.941444][ T8187] SET target dimension over the limit!
[  112.508821][ T8221] netlink: 'syz.1.771': attribute type 2 has an invalid length.
[  112.567010][ T8229] nbd: couldn't find device at index 536870912
[  112.629795][ T8238] sctp: [Deprecated]: syz.1.775 (pid 8238) Use of int in max_burst socket option.
[  112.629795][ T8238] Use struct sctp_assoc_value instead
[  113.090729][ T8264] syzkaller0: tun_chr_ioctl cmd 1074025673
[  113.096689][ T8263] syzkaller0: tun_chr_ioctl cmd 1074025677
[  113.099402][ T8263] syzkaller0: linktype set to 774
[  113.827061][ T8295] x_tables: duplicate underflow at hook 2
[  113.960268][ T8308] Cannot find del_set index 4 as target
[  114.242230][ T8345] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  114.292346][ T8350] Cannot find add_set index 0 as target
[  114.306952][ T1086] wlan1: Trigger new scan to find an IBSS to join
[  114.317002][  T790] IPVS: starting estimator thread 0...
[  114.353032][ T8355] tap0: tun_chr_ioctl cmd 1074025677
[  114.358871][ T8355] tap0: linktype set to 768
[  114.450152][ T8352] IPVS: using max 80 ests per chain, 192000 per kthread
[  114.601324][ T8387] __nla_validate_parse: 21 callbacks suppressed
[  114.601341][ T8387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.826'.
[  114.862252][ T8409] netlink: 4 bytes leftover after parsing attributes in process `syz.0.831'.
[  115.335151][ T8432] netlink: 8 bytes leftover after parsing attributes in process `syz.0.834'.
[  115.346401][ T8432] netlink: zone id is out of range
[  115.619850][ T8449] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  115.946022][ T8469] netlink: 8 bytes leftover after parsing attributes in process `syz.0.848'.
[  115.950151][ T8470] netlink: 8 bytes leftover after parsing attributes in process `syz.0.848'.
[  115.957817][ T8469] netlink: 12 bytes leftover after parsing attributes in process `syz.0.848'.
[  116.150994][ T8472] netlink: 4 bytes leftover after parsing attributes in process `syz.0.849'.
[  116.196894][ T8476] netlink: 16 bytes leftover after parsing attributes in process `syz.0.850'.
[  116.553119][ T8497] netlink: 112 bytes leftover after parsing attributes in process `syz.1.856'.
[  116.647367][ T8507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.861'.
[  117.099923][ T8565] netlink: 'syz.0.881': attribute type 1 has an invalid length.
[  117.139526][ T8569] netlink: 'syz.1.882': attribute type 3 has an invalid length.
[  117.332097][ T5682] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  117.336944][ T1089] wlan1: Trigger new scan to find an IBSS to join
[  117.396362][ T5682] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  117.445821][ T5682] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  117.500500][ T5682] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  117.525637][   T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  117.529533][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  117.533518][   T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  117.539673][   T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  117.543087][   T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  118.135580][ T5682] bond0 (unregistering): Released all slaves
[  118.176912][ T8606] (unnamed net_device) (uninitialized): option arp_interval: invalid value (18446744071844200453)
[  118.180495][ T8606] (unnamed net_device) (uninitialized): option arp_interval: allowed values 0 - 2147483647
[  118.376382][ T8584] chnl_net:caif_netlink_parms(): no params data found
[  118.650450][ T8584] bridge0: port 1(bridge_slave_0) entered blocking state
[  118.655486][ T8584] bridge0: port 1(bridge_slave_0) entered disabled state
[  118.658593][ T8584] bridge_slave_0: entered allmulticast mode
[  118.682473][ T8640] block nbd1: not configured, cannot reconfigure
[  118.693822][ T8584] bridge_slave_0: entered promiscuous mode
[  118.716155][ T8632] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4300
[  118.719728][ T8584] bridge0: port 2(bridge_slave_1) entered blocking state
[  118.722437][ T8584] bridge0: port 2(bridge_slave_1) entered disabled state
[  118.733859][ T8584] bridge_slave_1: entered allmulticast mode
[  118.739366][ T8584] bridge_slave_1: entered promiscuous mode
[  118.811618][ T5682] hsr_slave_0: left promiscuous mode
[  118.816071][ T5682] hsr_slave_1: left promiscuous mode
[  118.840677][ T5682] veth1_macvtap: left promiscuous mode
[  118.842718][ T5682] veth0_macvtap: left promiscuous mode
[  118.844771][ T5682] veth1_vlan: left promiscuous mode
[  118.847113][ T5682] veth0_vlan: left promiscuous mode
[  119.006879][ T4481] smc: removing ib device syz0
[  119.470328][ T8584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  119.511473][   T10] ==================================================================
[  119.514225][   T10] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190
[  119.517112][   T10] Read of size 8 at addr ffff8881104402e8 by task kworker/0:1/10
[  119.520454][   T10] 
[  119.521270][   T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  119.521279][   T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  119.521285][   T10] Workqueue: events smc_ib_port_event_work
[  119.521298][   T10] Call Trace:
[  119.521302][   T10]  <TASK>
[  119.521307][   T10]  dump_stack_lvl+0x189/0x250
[  119.521319][   T10]  ? __virt_addr_valid+0x1c8/0x5c0
[  119.521326][   T10]  ? rcu_is_watching+0x15/0xb0
[  119.521337][   T10]  ? __pfx_dump_stack_lvl+0x10/0x10
[  119.521347][   T10]  ? rcu_is_watching+0x15/0xb0
[  119.521356][   T10]  ? lock_release+0x4b/0x3e0
[  119.521367][   T10]  ? __virt_addr_valid+0x1c8/0x5c0
[  119.521373][   T10]  ? __virt_addr_valid+0x4a5/0x5c0
[  119.521380][   T10]  print_report+0xd2/0x2b0
[  119.521389][   T10]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  119.521398][   T10]  kasan_report+0x118/0x150
[  119.521406][   T10]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  119.521416][   T10]  __ethtool_get_link_ksettings+0x6e/0x190
[  119.521425][   T10]  ib_get_eth_speed+0x15e/0x7b0
[  119.521434][   T10]  ? __pfx_ib_get_eth_speed+0x10/0x10
[  119.521443][   T10]  ? do_raw_spin_unlock+0x4d/0x240
[  119.521452][   T10]  rxe_query_port+0x93/0x3b0
[  119.521464][   T10]  ib_query_port+0x170/0x830
[  119.521473][   T10]  smc_ib_port_event_work+0x15a/0x940
[  119.521484][   T10]  ? _raw_spin_unlock_irq+0x23/0x50
[  119.521493][   T10]  ? process_scheduled_works+0x9ef/0x17b0
[  119.521504][   T10]  ? process_scheduled_works+0x9ef/0x17b0
[  119.521514][   T10]  process_scheduled_works+0xae1/0x17b0
[  119.521528][   T10]  ? __pfx_process_scheduled_works+0x10/0x10
[  119.521540][   T10]  worker_thread+0x8a0/0xda0
[  119.521551][   T10]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  119.521561][   T10]  ? __kthread_parkme+0x7b/0x200
[  119.521569][   T10]  kthread+0x711/0x8a0
[  119.521577][   T10]  ? __pfx_worker_thread+0x10/0x10
[  119.521587][   T10]  ? __pfx_kthread+0x10/0x10
[  119.521594][   T10]  ? _raw_spin_unlock_irq+0x23/0x50
[  119.521603][   T10]  ? lockdep_hardirqs_on+0x9c/0x150
[  119.521613][   T10]  ? __pfx_kthread+0x10/0x10
[  119.521620][   T10]  ret_from_fork+0x3fc/0x770
[  119.521630][   T10]  ? __pfx_ret_from_fork+0x10/0x10
[  119.521640][   T10]  ? __switch_to_asm+0x39/0x70
[  119.521646][   T10]  ? __switch_to_asm+0x33/0x70
[  119.521653][   T10]  ? __pfx_kthread+0x10/0x10
[  119.521660][   T10]  ret_from_fork_asm+0x1a/0x30
[  119.521669][   T10]  </TASK>
[  119.521672][   T10] 
[  119.599003][   T10] Allocated by task 5811:
[  119.600448][   T10]  kasan_save_track+0x3e/0x80
[  119.601986][   T10]  __kasan_kmalloc+0x93/0xb0
[  119.603476][   T10]  __kvmalloc_node_noprof+0x30d/0x5f0
[  119.605278][   T10]  alloc_netdev_mqs+0xa6/0x11e0
[  119.606902][   T10]  rtnl_create_link+0x31f/0xd10
[  119.608542][   T10]  rtnl_newlink_create+0x25c/0xb00
[  119.610270][   T10]  rtnl_newlink+0x16d6/0x1c70
[  119.611876][   T10]  rtnetlink_rcv_msg+0x7cf/0xb70
[  119.613532][   T10]  netlink_rcv_skb+0x208/0x470
[  119.615129][   T10]  netlink_unicast+0x75b/0x8d0
[  119.616706][   T10]  netlink_sendmsg+0x805/0xb30
[  119.618309][   T10]  __sock_sendmsg+0x21c/0x270
[  119.619837][   T10]  __sys_sendto+0x3bd/0x520
[  119.621292][   T10]  __x64_sys_sendto+0xde/0x100
[  119.622878][   T10]  do_syscall_64+0xfa/0x3b0
[  119.624386][   T10]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  119.626347][   T10] 
[  119.627147][   T10] Freed by task 5682:
[  119.628425][   T10]  kasan_save_track+0x3e/0x80
[  119.630003][   T10]  kasan_save_free_info+0x46/0x50
[  119.631707][   T10]  __kasan_slab_free+0x62/0x70
[  119.633360][   T10]  kfree+0x18e/0x440
[  119.634732][   T10]  device_release+0x9c/0x1c0
[  119.636317][   T10]  kobject_put+0x22b/0x480
[  119.637836][   T10]  netdev_run_todo+0xd2e/0xea0
[  119.639465][   T10]  default_device_exit_batch+0x81e/0x890
[  119.641265][   T10]  ops_undo_list+0x525/0x990
[  119.642879][   T10]  cleanup_net+0x4c5/0x800
[  119.644371][   T10]  process_scheduled_works+0xae1/0x17b0
[  119.646227][   T10]  worker_thread+0x8a0/0xda0
[  119.647811][   T10]  kthread+0x711/0x8a0
[  119.649175][   T10]  ret_from_fork+0x3fc/0x770
[  119.650652][   T10]  ret_from_fork_asm+0x1a/0x30
[  119.652246][   T10] 
[  119.653110][   T10] The buggy address belongs to the object at ffff888110440000
[  119.653110][   T10]  which belongs to the cache kmalloc-cg-4k of size 4096
[  119.657693][   T10] The buggy address is located 744 bytes inside of
[  119.657693][   T10]  freed 4096-byte region [ffff888110440000, ffff888110441000)
[  119.662068][   T10] 
[  119.662869][   T10] The buggy address belongs to the physical page:
[  119.664926][   T10] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110440
[  119.667751][   T10] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  119.670493][   T10] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  119.672951][   T10] page_type: f5(slab)
[  119.674288][   T10] raw: 057ff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[  119.677177][   T10] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[  119.679928][   T10] head: 057ff00000000040 ffff88801a44b500 dead000000000122 0000000000000000
[  119.682692][   T10] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000
[  119.685482][   T10] head: 057ff00000000003 ffffea0004411001 00000000ffffffff 00000000ffffffff
[  119.688239][   T10] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  119.691032][   T10] page dumped because: kasan: bad access detected
[  119.693167][   T10] page_owner tracks the page as allocated
[  119.695063][   T10] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5811, tgid 5811 (syz-executor), ts 56703155592, free_ts 56701150853
[  119.702550][   T10]  post_alloc_hook+0x240/0x2a0
[  119.704186][   T10]  get_page_from_freelist+0x21e4/0x22c0
[  119.706032][   T10]  __alloc_frozen_pages_noprof+0x181/0x370
[  119.707923][   T10]  alloc_pages_mpol+0x232/0x4a0
[  119.709470][   T10]  allocate_slab+0x8a/0x3b0
[  119.710948][   T10]  ___slab_alloc+0xbfc/0x1480
[  119.712500][   T10]  __kvmalloc_node_noprof+0x429/0x5f0
[  119.714225][   T10]  alloc_netdev_mqs+0xa6/0x11e0
[  119.715796][   T10]  rtnl_create_link+0x31f/0xd10
[  119.717424][   T10]  rtnl_newlink_create+0x25c/0xb00
[  119.719084][   T10]  rtnl_newlink+0x16d6/0x1c70
[  119.720549][   T10]  rtnetlink_rcv_msg+0x7cf/0xb70
[  119.722166][   T10]  netlink_rcv_skb+0x208/0x470
[  119.723707][   T10]  netlink_unicast+0x75b/0x8d0
[  119.725266][   T10]  netlink_sendmsg+0x805/0xb30
[  119.726869][   T10]  __sock_sendmsg+0x21c/0x270
[  119.728520][   T10] page last free pid 5811 tgid 5811 stack trace:
[  119.730565][   T10]  __free_frozen_pages+0xc71/0xe70
[  119.732211][   T10]  __put_partials+0x161/0x1c0
[  119.733737][   T10]  put_cpu_partial+0x17c/0x250
[  119.735262][   T10]  __slab_free+0x2f7/0x400
[  119.736747][   T10]  qlist_free_all+0x97/0x140
[  119.738284][   T10]  kasan_quarantine_reduce+0x148/0x160
[  119.740084][   T10]  __kasan_slab_alloc+0x22/0x80
[  119.741666][   T10]  __kmalloc_cache_noprof+0x1be/0x3d0
[  119.743408][   T10]  ref_tracker_alloc+0x133/0x460
[  119.745064][   T10]  register_netdevice+0x14a3/0x1ae0
[  119.746784][   T10]  virt_wifi_newlink+0x428/0x860
[  119.748426][   T10]  rtnl_newlink_create+0x310/0xb00
[  119.750148][   T10]  rtnl_newlink+0x16d6/0x1c70
[  119.751723][   T10]  rtnetlink_rcv_msg+0x7cf/0xb70
[  119.753373][   T10]  netlink_rcv_skb+0x208/0x470
[  119.754976][   T10]  netlink_unicast+0x75b/0x8d0
[  119.756564][   T10] 
[  119.757339][   T10] Memory state around the buggy address:
[  119.759200][   T10]  ffff888110440180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.761823][   T10]  ffff888110440200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.764386][   T10] >ffff888110440280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.767039][   T10]                                                           ^
[  119.769528][   T10]  ffff888110440300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.772206][   T10]  ffff888110440380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  119.774877][   T10] ==================================================================
[  119.778080][   T55] Bluetooth: hci0: command tx timeout
[  119.783899][   T10] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  119.786251][   T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  119.790165][   T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  119.793401][   T10] Workqueue: events smc_ib_port_event_work
[  119.795311][   T10] Call Trace:
[  119.796436][   T10]  <TASK>
[  119.797478][   T10]  dump_stack_lvl+0x99/0x250
[  119.799009][   T10]  ? __asan_memcpy+0x40/0x70
[  119.800552][   T10]  ? __pfx_dump_stack_lvl+0x10/0x10
[  119.802200][   T10]  ? __pfx__printk+0x10/0x10
[  119.803769][   T10]  panic+0x2db/0x790
[  119.805100][   T10]  ? __pfx_panic+0x10/0x10
[  119.806593][   T10]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[  119.808612][   T10]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  119.810743][   T10]  ? print_memory_metadata+0x314/0x400
[  119.812561][   T10]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  119.814540][   T10]  check_panic_on_warn+0x89/0xb0
[  119.816200][   T10]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  119.818226][   T10]  end_report+0x78/0x160
[  119.819699][   T10]  kasan_report+0x129/0x150
[  119.821211][   T10]  ? __ethtool_get_link_ksettings+0x6e/0x190
[  119.823222][   T10]  __ethtool_get_link_ksettings+0x6e/0x190
[  119.825151][   T10]  ib_get_eth_speed+0x15e/0x7b0
[  119.826783][   T10]  ? __pfx_ib_get_eth_speed+0x10/0x10
[  119.828605][   T10]  ? do_raw_spin_unlock+0x4d/0x240
[  119.830310][   T10]  rxe_query_port+0x93/0x3b0
[  119.831860][   T10]  ib_query_port+0x170/0x830
[  119.833458][   T10]  smc_ib_port_event_work+0x15a/0x940
[  119.835701][   T10]  ? _raw_spin_unlock_irq+0x23/0x50
[  119.837963][   T10]  ? process_scheduled_works+0x9ef/0x17b0
[  119.840429][   T10]  ? process_scheduled_works+0x9ef/0x17b0
[  119.842367][   T10]  process_scheduled_works+0xae1/0x17b0
[  119.844224][   T10]  ? __pfx_process_scheduled_works+0x10/0x10
[  119.846549][   T10]  worker_thread+0x8a0/0xda0
[  119.848469][   T10]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  119.851118][   T10]  ? __kthread_parkme+0x7b/0x200
[  119.853207][   T10]  kthread+0x711/0x8a0
[  119.854890][   T10]  ? __pfx_worker_thread+0x10/0x10
[  119.857008][   T10]  ? __pfx_kthread+0x10/0x10
[  119.858914][   T10]  ? _raw_spin_unlock_irq+0x23/0x50
[  119.861103][   T10]  ? lockdep_hardirqs_on+0x9c/0x150
[  119.863055][   T10]  ? __pfx_kthread+0x10/0x10
[  119.864583][   T10]  ret_from_fork+0x3fc/0x770
[  119.866238][   T10]  ? __pfx_ret_from_fork+0x10/0x10
[  119.867882][   T10]  ? __switch_to_asm+0x39/0x70
[  119.869414][   T10]  ? __switch_to_asm+0x33/0x70
[  119.870958][   T10]  ? __pfx_kthread+0x10/0x10
[  119.872484][   T10]  ret_from_fork_asm+0x1a/0x30
[  119.874077][   T10]  </TASK>
[  119.875866][   T10] Kernel Offset: disabled
[  119.877341][   T10] Rebooting in 86400 seconds..

VM DIAGNOSIS:
09:12:59  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000038 RBX=0000000000000038 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900000d7090
R8 =ffff888021750237 R9 =1ffff110042ea046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac48f3 R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f5dfbc2efc8 CR3=000000010fc2e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ff00ff0000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffffffff ff00ff0000000000 XMM05=0000000000000000 00007f0f7c011b1f
XMM06=0000000000000000 00007f0f7c011b19 XMM07=0000000000000000 00007f0f7c011b2d
XMM08=0000000000000000 00007f0f7c011bb3 XMM09=0000000000000000 00007f0f7c011c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=1ffff1100466fa01 RBX=ffffffff8f50ffb0 RCX=ffffffff819da768 RDX=0000000000000000
RSI=0000000000000008 RDI=ffffffff8f50ff60 RBP=1ffffffff1ea1fec RSP=ffffc90002cbf3a8
R8 =ffffffff8f50ff67 R9 =1ffffffff1ea1fec R10=dffffc0000000000 R11=fffffbfff1ea1fed
R12=ffffffff8f50ff60 R13=ffffffff8f50ffb0 R14=dffffc0000000000 R15=ffff88801ba81cc0
RIP=ffffffff819da768 RFL=00000256 [---ZAP-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f89ac75b740 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c382c17 CR3=0000000028bb4000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffff00ffffff00 ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffffffff ffffff0000000000 XMM05=0000000000000071 0000000000000000
XMM06=ff00000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffffffffffff XMM09=00326e6170772f74 656e2f317968702f
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
