last executing test programs:

4.920056386s ago: executing program 2 (id=3):
socket$inet6(0xa, 0x1, 0x0)

4.915593794s ago: executing program 1 (id=9):
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x14)

4.909768314s ago: executing program 1 (id=10):
socket$l2tp(0x2, 0x2, 0x73)

4.858469286s ago: executing program 2 (id=12):
splice(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)

4.858451382s ago: executing program 1 (id=13):
socket$tipc(0x1e, 0x2, 0x0)

4.858437999s ago: executing program 1 (id=14):
unshare(0x0)

4.858425498s ago: executing program 1 (id=15):
preadv(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0)

4.858413227s ago: executing program 0 (id=16):
syz_init_net_socket$llc(0x1a, 0x1, 0x0)

383.451434ms ago: executing program 0 (id=17):
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0)
r0 = socket$l2tp6(0xa, 0x2, 0x73)
unshare(0x2040400)
connect$l2tp6(r0, &(0x7f0000001080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0xfffffffe}, 0x20)

268.654183ms ago: executing program 0 (id=20):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000023000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000009b000000850000002300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x14, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c)

268.160899ms ago: executing program 0 (id=21):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x2, 0x56d, 0x2}, 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r0}, 0x38)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000300)={r0, &(0x7f0000000140), 0x0}, 0x20)

147.994566ms ago: executing program 0 (id=22):
getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x3d, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
listen(0xffffffffffffffff, 0x7)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x44000)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r0)
syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r0)
recvmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000009c0)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/195, 0xc3}, {&(0x7f0000000240)=""/171, 0xab}], 0x3}, 0x158}], 0x1, 0x2, 0x0)

147.778306ms ago: executing program 1 (id=18):
socket$nl_route(0x10, 0x3, 0x0)
unshare(0x2c060000)
unshare(0x2c020400)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r2}, 0x10)
mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0)
r3 = socket$vsock_stream(0x28, 0x1, 0x0)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r3, 0x0)
pipe(&(0x7f0000002740))
setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10)
r4 = accept4(r1, 0x0, 0x0, 0x0)
setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000080)=0x81, 0x4)
sendmsg$nl_route_sched_retired(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0)
recvmmsg(r4, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)=""/230, 0xe6}, {&(0x7f00000004c0)=""/168, 0xa8}, {&(0x7f0000000900)=""/106, 0x6a}, {&(0x7f00000000c0)=""/26, 0xfe4b}], 0x4}, 0x2000000}], 0x2, 0x101, 0x0)
read$alg(r4, &(0x7f00000009c0)=""/75, 0x4b)
write$tun(r0, &(0x7f0000000340)=ANY=[@ANYRESOCT=r0, @ANYBLOB="41bf0359dedeb1c9a2af5381a5e01b0749a78b97f0047d6f64b166f1c4bdd43a558ca6ce35d71616429ddc0de0190ec6fa84fffe5aff637d197bfbc63394a4dc076cb4b826235b5953a530060efd532bd1f87fde32bd", @ANYRESHEX, @ANYRESHEX=r0, @ANYRESOCT=r0], 0x141)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x8010, r5, 0x952de000)
r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x5, @any, 0x4, 0x1}, 0xe)

147.669045ms ago: executing program 2 (id=19):
r0 = socket$tipc(0x1e, 0x4, 0x0)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x4000042, 0x83f}, 0x10)
r1 = socket$tipc(0x1e, 0x5, 0x0)
sendmsg$tipc(r1, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10, 0x0}, 0x0)

756.895µs ago: executing program 2 (id=23):
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$SIOCRSSCAUSE(r0, 0x89e1, 0x0)

0s ago: executing program 0 (id=24):
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20)
setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth1_virt_wifi\x00', <r2=>0x0})
setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4)
bind$xdp(r0, &(0x7f00000001c0)={0x2c, 0x8, r2, 0x1000000}, 0x10)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:52764' (ED25519) to the list of known hosts.
syzkaller login: [   40.747173][ T5753] cgroup: Unknown subsys name 'net'
[   40.898799][ T5753] cgroup: Unknown subsys name 'cpuset'
[   40.907528][ T5753] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   42.153936][ T5753] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   51.711064][ T5854] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   51.714241][ T5854] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   51.717295][ T5854] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   51.720002][ T5854] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   51.722656][ T5854] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   51.852422][ T5854] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   51.855099][ T5854] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   51.859246][ T5218] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   51.861948][ T5218] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   51.864304][ T5218] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   51.869204][ T5218] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   51.872925][ T5218] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   51.875837][ T5218] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   51.895261][ T5865] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   51.898158][ T5865] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   51.913273][ T5853] chnl_net:caif_netlink_parms(): no params data found
[   52.006840][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.009669][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.012061][ T5853] bridge_slave_0: entered allmulticast mode
[   52.014884][ T5853] bridge_slave_0: entered promiscuous mode
[   52.020659][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.023109][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.025364][ T5853] bridge_slave_1: entered allmulticast mode
[   52.028138][ T5853] bridge_slave_1: entered promiscuous mode
[   52.062955][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   52.072443][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   52.105560][ T5853] team0: Port device team_slave_0 added
[   52.124078][ T5853] team0: Port device team_slave_1 added
[   52.177767][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0
[   52.179963][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.188727][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   52.202646][ T5860] chnl_net:caif_netlink_parms(): no params data found
[   52.208098][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1
[   52.210210][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.218428][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   52.279185][ T5853] hsr_slave_0: entered promiscuous mode
[   52.281982][ T5853] hsr_slave_1: entered promiscuous mode
[   52.284293][ T5861] chnl_net:caif_netlink_parms(): no params data found
[   52.328034][ T5860] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.330307][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.332582][ T5860] bridge_slave_0: entered allmulticast mode
[   52.335197][ T5860] bridge_slave_0: entered promiscuous mode
[   52.341707][ T5860] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.343940][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.346847][ T5860] bridge_slave_1: entered allmulticast mode
[   52.349620][ T5860] bridge_slave_1: entered promiscuous mode
[   52.386412][ T5860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   52.400024][ T5860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   52.411356][ T5861] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.413645][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.415933][ T5861] bridge_slave_0: entered allmulticast mode
[   52.418858][ T5861] bridge_slave_0: entered promiscuous mode
[   52.440325][ T5861] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.442546][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.444744][ T5861] bridge_slave_1: entered allmulticast mode
[   52.447851][ T5861] bridge_slave_1: entered promiscuous mode
[   52.461419][ T5860] team0: Port device team_slave_0 added
[   52.475725][ T5860] team0: Port device team_slave_1 added
[   52.489299][ T5861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   52.502056][ T5861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   52.534856][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_0
[   52.537337][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.545042][ T5860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   52.550442][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_1
[   52.552649][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.561645][ T5860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   52.569004][ T5861] team0: Port device team_slave_0 added
[   52.584039][ T5861] team0: Port device team_slave_1 added
[   52.629008][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_0
[   52.631124][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.640527][ T5861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   52.656673][ T5860] hsr_slave_0: entered promiscuous mode
[   52.658902][ T5860] hsr_slave_1: entered promiscuous mode
[   52.660947][ T5860] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   52.663371][ T5860] Cannot create hsr debugfs directory
[   52.665984][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_1
[   52.669289][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   52.679292][ T5861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   52.730165][ T5853] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   52.756942][ T5853] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   52.765368][ T5861] hsr_slave_0: entered promiscuous mode
[   52.768269][ T5861] hsr_slave_1: entered promiscuous mode
[   52.770569][ T5861] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   52.773267][ T5861] Cannot create hsr debugfs directory
[   52.775282][ T5853] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   52.787394][ T5853] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   52.872760][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   52.875187][ T5853] bridge0: port 2(bridge_slave_1) entered forwarding state
[   52.878044][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   52.880422][ T5853] bridge0: port 1(bridge_slave_0) entered forwarding state
[   52.899371][   T27] bridge0: port 1(bridge_slave_0) entered disabled state
[   52.902395][   T27] bridge0: port 2(bridge_slave_1) entered disabled state
[   52.966495][ T5860] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   52.972690][ T5860] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   52.979045][ T5860] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   52.989935][ T5860] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   53.019285][ T5861] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   53.027701][ T5861] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   53.032914][ T5861] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   53.039912][ T5861] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   53.055837][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0
[   53.082164][ T5853] 8021q: adding VLAN 0 to HW filter on device team0
[   53.097593][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.100078][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   53.111869][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.114634][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   53.168592][ T5860] 8021q: adding VLAN 0 to HW filter on device bond0
[   53.174433][ T5853] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   53.193061][ T5861] 8021q: adding VLAN 0 to HW filter on device bond0
[   53.198368][ T5860] 8021q: adding VLAN 0 to HW filter on device team0
[   53.210748][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.213226][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   53.217627][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.219999][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   53.232881][ T5861] 8021q: adding VLAN 0 to HW filter on device team0
[   53.247844][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.250126][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   53.263252][ T5860] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   53.267733][ T5860] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   53.275036][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.278076][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   53.329395][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0
[   53.352140][ T5861] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   53.355422][ T5861] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   53.411607][ T5853] veth0_vlan: entered promiscuous mode
[   53.420085][ T5853] veth1_vlan: entered promiscuous mode
[   53.455066][ T5860] 8021q: adding VLAN 0 to HW filter on device batadv0
[   53.471510][ T5853] veth0_macvtap: entered promiscuous mode
[   53.481613][ T5853] veth1_macvtap: entered promiscuous mode
[   53.498508][ T5861] 8021q: adding VLAN 0 to HW filter on device batadv0
[   53.503585][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0
[   53.513407][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1
[   53.528275][ T5853] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   53.531772][ T5853] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   53.535199][ T5853] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   53.540138][ T5853] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   53.548124][ T5860] veth0_vlan: entered promiscuous mode
[   53.566058][ T5860] veth1_vlan: entered promiscuous mode
[   53.597283][ T5861] veth0_vlan: entered promiscuous mode
[   53.608428][ T5861] veth1_vlan: entered promiscuous mode
[   53.623540][ T5860] veth0_macvtap: entered promiscuous mode
[   53.632631][ T1225] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   53.641298][ T1225] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   53.642921][ T5861] veth0_macvtap: entered promiscuous mode
[   53.651873][ T5860] veth1_macvtap: entered promiscuous mode
[   53.663020][ T5861] veth1_macvtap: entered promiscuous mode
[   53.669771][ T4431] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   53.672236][ T4431] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   53.675309][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_0
[   53.687512][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_0
[   53.693949][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_1
[   53.703389][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_1
[   53.704359][ T5853] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   53.710354][ T5861] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   53.713239][ T5861] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   53.717076][ T5861] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   53.719783][ T5861] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   53.725035][ T5860] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   53.728988][ T5860] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   53.731657][ T5860] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   53.734798][ T5860] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   53.757672][ T5865] Bluetooth: hci0: command tx timeout
[   53.841729][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   53.844179][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   53.868823][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   53.871248][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   53.896984][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   53.899716][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   53.916341][ T5865] Bluetooth: hci2: command tx timeout
[   53.919943][ T4431] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   53.923320][ T4431] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   53.926680][ T5865] Bluetooth: hci1: command tx timeout
[   54.013512][ T5930] GUP no longer grows the stack in syz.1.18 (5930): 200000002000-20000000a000 (200000001000)
[   54.018386][ T5930] CPU: 1 UID: 0 PID: 5930 Comm: syz.1.18 Not tainted 6.16.0-rc6-syzkaller-00135-gcf074eca0065-dirty #0 PREEMPT(full) 
[   54.018398][ T5930] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   54.018403][ T5930] Call Trace:
[   54.018406][ T5930]  <TASK>
[   54.018410][ T5930]  dump_stack_lvl+0x189/0x250
[   54.018425][ T5930]  ? __pfx_dump_stack_lvl+0x10/0x10
[   54.018434][ T5930]  ? __pfx__printk+0x10/0x10
[   54.018467][ T5930]  ? find_vma+0xe7/0x160
[   54.018484][ T5930]  __get_user_pages+0x2a60/0x30b0
[   54.018508][ T5930]  ? __pfx___get_user_pages+0x10/0x10
[   54.018521][ T5930]  __gup_longterm_locked+0xd66/0x15b0
[   54.018532][ T5930]  ? try_grab_folio_fast+0x35b/0x4f0
[   54.018545][ T5930]  ? sanity_check_pinned_pages+0x11c8/0x12c0
[   54.018557][ T5930]  gup_fast_fallback+0x1cd4/0x2260
[   54.018580][ T5930]  ? __pfx_gup_fast_fallback+0x10/0x10
[   54.018590][ T5930]  ? stack_depot_save_flags+0x429/0x900
[   54.018602][ T5930]  ? pin_user_pages_fast+0x4d/0xb0
[   54.018613][ T5930]  iov_iter_extract_pages+0x35a/0x5e0
[   54.018627][ T5930]  extract_iter_to_sg+0xe46/0x24e0
[   54.018641][ T5930]  ? __pfx_extract_iter_to_sg+0x10/0x10
[   54.018657][ T5930]  ? __asan_memset+0x22/0x50
[   54.018673][ T5930]  af_alg_get_rsgl+0x436/0x810
[   54.018688][ T5930]  aead_recvmsg+0x4cc/0x13f0
[   54.018706][ T5930]  ? __pfx_aead_recvmsg+0x10/0x10
[   54.018713][ T5930]  ? trace_sched_exit_tp+0x38/0x120
[   54.018722][ T5930]  ? bpf_lsm_socket_recvmsg+0x9/0x20
[   54.018731][ T5930]  ? __pfx_aead_recvmsg+0x10/0x10
[   54.018740][ T5930]  sock_recvmsg_nosec+0x186/0x1c0
[   54.018753][ T5930]  ____sys_recvmsg+0x3aa/0x460
[   54.018767][ T5930]  ? __pfx_____sys_recvmsg+0x10/0x10
[   54.018784][ T5930]  ? import_iovec+0x74/0xa0
[   54.018794][ T5930]  ___sys_recvmsg+0x1b5/0x510
[   54.018807][ T5930]  ? __pfx____sys_recvmsg+0x10/0x10
[   54.018830][ T5930]  ? __might_fault+0xb0/0x130
[   54.018841][ T5930]  do_recvmmsg+0x307/0x770
[   54.018851][ T5930]  ? __pfx_do_recvmmsg+0x10/0x10
[   54.018857][ T5930]  ? __ia32_sys_rt_sigreturn+0x6a2/0x7b0
[   54.018869][ T5930]  ? __pfx_do_futex+0x10/0x10
[   54.018885][ T5930]  __x64_sys_recvmmsg+0x190/0x240
[   54.018893][ T5930]  ? __pfx___x64_sys_recvmmsg+0x10/0x10
[   54.018899][ T5930]  ? rcu_is_watching+0x15/0xb0
[   54.018909][ T5930]  ? do_syscall_64+0xbe/0x3b0
[   54.018919][ T5930]  do_syscall_64+0xfa/0x3b0
[   54.018926][ T5930]  ? lockdep_hardirqs_on+0x9c/0x150
[   54.018933][ T5930]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   54.018940][ T5930]  ? exc_page_fault+0x9f/0xf0
[   54.018948][ T5930]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   54.018955][ T5930] RIP: 0033:0x7f073458e9a9
[   54.018963][ T5930] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   54.018969][ T5930] RSP: 002b:00007f07354c7038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
[   54.018977][ T5930] RAX: ffffffffffffffda RBX: 00007f07347b5fa0 RCX: 00007f073458e9a9
[   54.018982][ T5930] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 000000000000000b
[   54.018986][ T5930] RBP: 00007f0734610d69 R08: 0000000000000000 R09: 0000000000000000
[   54.018991][ T5930] R10: 0000000000000101 R11: 0000000000000246 R12: 0000000000000000
[   54.018995][ T5930] R13: 0000000000000000 R14: 00007f07347b5fa0 R15: 00007fff35619ef8
[   54.019006][ T5930]  </TASK>
Connection to localhost closed by remote host.
[   55.528565][ T5890] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   57.058637][ T5890] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   57.159235][ T5890] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   57.234291][ T5890] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   57.310586][ T5890] bridge_slave_1: left allmulticast mode
[   57.312580][ T5890] bridge_slave_1: left promiscuous mode
[   57.314935][ T5890] bridge0: port 2(bridge_slave_1) entered disabled state
[   57.319826][ T5890] bridge_slave_0: left allmulticast mode
[   57.321715][ T5890] bridge_slave_0: left promiscuous mode
[   57.323642][ T5890] bridge0: port 1(bridge_slave_0) entered disabled state
[   57.486049][ T5890] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   57.491025][ T5890] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   57.494627][ T5890] bond0 (unregistering): Released all slaves
[   57.719552][ T5890] hsr_slave_0: left promiscuous mode
[   57.721889][ T5890] hsr_slave_1: left promiscuous mode
[   57.724008][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   57.727600][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_0
[   57.730629][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   57.733089][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_1
[   57.741563][ T5890] veth1_macvtap: left promiscuous mode
[   57.743535][ T5890] veth0_macvtap: left promiscuous mode
[   57.745781][ T5890] veth1_vlan: left promiscuous mode
[   57.748614][ T5890] veth0_vlan: left promiscuous mode
[   57.956051][ T5890] team0 (unregistering): Port device team_slave_1 removed
[   57.978678][ T5890] team0 (unregistering): Port device team_slave_0 removed
[   58.549953][ T5890] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.604993][ T5890] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.675846][ T5890] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.734759][ T5890] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.838366][ T5890] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.875919][ T5890] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.943275][ T5890] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   58.983868][ T5890] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   59.070971][ T5890] bridge_slave_1: left allmulticast mode
[   59.073449][ T5890] bridge_slave_1: left promiscuous mode
[   59.075673][ T5890] bridge0: port 2(bridge_slave_1) entered disabled state
[   59.080106][ T5890] bridge_slave_0: left allmulticast mode
[   59.082489][ T5890] bridge_slave_0: left promiscuous mode
[   59.084962][ T5890] bridge0: port 1(bridge_slave_0) entered disabled state
[   59.090339][ T5890] bridge_slave_1: left allmulticast mode
[   59.092230][ T5890] bridge_slave_1: left promiscuous mode
[   59.094177][ T5890] bridge0: port 2(bridge_slave_1) entered disabled state
[   59.099628][ T5890] bridge_slave_0: left allmulticast mode
[   59.101516][ T5890] bridge_slave_0: left promiscuous mode
[   59.104072][ T5890] bridge0: port 1(bridge_slave_0) entered disabled state
[   59.273291][ T5890] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   59.278638][ T5890] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   59.282264][ T5890] bond0 (unregistering): Released all slaves
[   59.425166][ T5890] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   59.429314][ T5890] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   59.433002][ T5890] bond0 (unregistering): Released all slaves
[   59.747088][ T5890] hsr_slave_0: left promiscuous mode
[   59.749407][ T5890] hsr_slave_1: left promiscuous mode
[   59.751581][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   59.754082][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_0
[   59.757564][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   59.760121][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_1
[   59.764906][ T5890] hsr_slave_0: left promiscuous mode
[   59.767517][ T5890] hsr_slave_1: left promiscuous mode
[   59.769803][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   59.772281][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_0
[   59.775182][ T5890] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   59.777792][ T5890] batman_adv: batadv0: Removing interface: batadv_slave_1
[   59.789988][ T5890] veth1_macvtap: left promiscuous mode
[   59.791886][ T5890] veth0_macvtap: left promiscuous mode
[   59.793733][ T5890] veth1_vlan: left promiscuous mode
[   59.795491][ T5890] veth0_vlan: left promiscuous mode
[   59.799502][ T5890] veth1_macvtap: left promiscuous mode
[   59.801352][ T5890] veth0_macvtap: left promiscuous mode
[   59.803781][ T5890] veth1_vlan: left promiscuous mode
[   59.805621][ T5890] veth0_vlan: left promiscuous mode
[   60.051678][ T5890] team0 (unregistering): Port device team_slave_1 removed
[   60.069021][ T5890] team0 (unregistering): Port device team_slave_0 removed
[   60.372675][ T5890] team0 (unregistering): Port device team_slave_1 removed
[   60.391182][ T5890] team0 (unregistering): Port device team_slave_0 removed
[   71.120208][ T1359] ieee802154 phy0 wpan0: encryption failed: -22
[   71.122363][ T1359] ieee802154 phy1 wpan1: encryption failed: -22

VM DIAGNOSIS:
00:43:25  Registers:
info registers vcpu 0

CPU#0
RAX=2c65aa7b206f3e00 RBX=ffffffff81976a48 RCX=2c65aa7b206f3e00 RDX=0000000000000001
RSI=ffffffff8d996116 RDI=ffffffff8be28c00 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f5b R9 =1ffff110096065eb R10=dffffc0000000000 R11=ffffed10096065ec
R12=ffffffff8fa1d6f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6d84f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8623000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007fde47070580 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000000ff XMM01=0a0a0a0a0a0a0a0a 0a0a0a0a0a0a0a0a
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ac69bef305202300 RBX=ffffffff81976a48 RCX=ac69bef305202300 RDX=0000000000000001
RSI=ffffffff8d996116 RDI=ffffffff8be28c00 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f5b R9 =1ffff11026cc65eb R10=dffffc0000000000 R11=ffffed1026cc65ec
R12=ffffffff8fa1d6f0 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d4000
RIP=ffffffff8b6d84f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c23000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000559d0ade7a30 CR3=000000000df38000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000ff0000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=ff00000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
