last executing test programs:

1.069977594s ago: executing program 0 (id=888):
r0 = socket$kcm(0x2, 0x922000000001, 0x106)
sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x20000000)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, 0x3, 0x8, 0x401, 0x0, 0x0, {0x3, 0x0, 0x3}, [@CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_HEARTBEAT_SENT={0x8, 0x8, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT={0x8, 0x7, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0x30}, 0x1, 0x0, 0x0, 0x4008840}, 0x50)
perf_event_open(&(0x7f0000000380)={0x3, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x110}, 0x0, 0xca, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
close(r2)
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1509, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0xe}, 0x0, 0x4, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1)
r3 = socket$kcm(0xa, 0x5, 0x0)
setsockopt$sock_attach_bpf(r3, 0x0, 0x30, 0x0, 0x1000000)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x0, 0x2, &(0x7f0000000200)=ANY=[], 0x0}, 0x94)
socket$kcm(0xa, 0x5, 0x0)
openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYRES8=r2], 0x12)
setsockopt$sock_attach_bpf(r0, 0x1, 0x12, &(0x7f0000000000), 0x4)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x2404c854)

960.267692ms ago: executing program 0 (id=893):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1f, 0x2, &(0x7f0000000340)=ANY=[@ANYBLOB="85000000bf00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x39}, 0x90)

871.132983ms ago: executing program 0 (id=895):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000080000000000000000000000000000000044000500fc000000000000000000000000000001000000003c"], 0xfc}}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000008c0)=ANY=[@ANYBLOB="0002000021000100fcffffff000000000a010101000000000000000000000000fc02000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00001000000000009c00110000000000000000000000ffffac1414aaff0100000000000000000000000000010a010102000000000000000000000000fc0200000000000000000000000000003c000000000000000a0002"], 0x200}, 0x1, 0x0, 0x0, 0x24020004}, 0x0)

866.225682ms ago: executing program 0 (id=896):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(r1)
perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x98, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x402, 0x3, 0x0, 0x0, 0x400, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
write$cgroup_int(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000079000000010001"], 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x27, 0x8, 0x0, &(0x7f0000000180)="0005000000000001", 0x0, 0x405, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50)
recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [<r2=>0xffffffffffffffff]}}], 0x18}, 0x1c0)
write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYRES8=r1, @ANYBLOB="3ee901"], 0x9a)

692.413185ms ago: executing program 1 (id=898):
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6tnl0\x00', 0x200})
perf_event_open(&(0x7f00000001c0)={0x0, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0xfffffffffffffffd}, 0x8000, 0x0, 0x6, 0x0, 0x1ff, 0xfffffffd, 0x0, 0x0, 0xfffffffc}, 0x0, 0x2, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89b0, &(0x7f0000000080))

691.834686ms ago: executing program 0 (id=899):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x828, 0x0, 0x0, 0x0, 0x0, 0x7ffffd, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x14869}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$kcm(0x21, 0x2, 0x2)

633.296768ms ago: executing program 1 (id=900):
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f00000023c0), 0x0, 0x100, 0x2000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
perf_event_open(&(0x7f0000000000)={0x3, 0x80, 0x80, 0x3, 0x4, 0x0, 0x0, 0x6, 0x20202, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3, 0x2, @perf_config_ext={0x100000001, 0x400}, 0x5010, 0x102, 0x9, 0x5, 0x8, 0x100, 0x9, 0x0, 0x200, 0x0, 0x7}, 0x0, 0x3, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'netdevsim0\x00'})
socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
syz_clone(0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000080))

562.207869ms ago: executing program 2 (id=902):
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xb7}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x19}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70)

561.451234ms ago: executing program 0 (id=903):
socket$kcm(0x2b, 0x1, 0x0)
perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x53, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x4, 0x7, 0x6, 0x0, 0x0, 0x0, 0xa9e9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x106)
bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0)
r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x400000000000000d, 0x1954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0xfffffffffffffffe, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x24}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
perf_event_open(&(0x7f0000000a00)={0x1, 0x80, 0x5, 0x0, 0x3, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x3}, 0x9190, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, r0, 0xb, 0xffffffffffffffff, 0x0)
socket$kcm(0x10, 0x2, 0x4)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x21}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="6a0ac4ff0000000071104f000000000095000000001e0000af4fb8331220767ae2c45d36d35917cf1edafd3b0ff9bb4c7d77efcaca200afb7cc6edd4a37c27d7181c173e3c2e65070000000000000022ba8682e12314f1527751169abe7b1c4601d05ebe71bce08c9057667c9417f518377862243c2612fd344888487cf1ef2e55627b72d1a65c081d68fa3e0fc605f7c6a55cab97028ea18b70b700f5c0d9aa7561bf128c71"], &(0x7f0000000480)='GPL\x00'}, 0x94)
r1 = socket$kcm(0x10, 0x3, 0x10)
perf_event_open$cgroup(&(0x7f0000000200)={0x5, 0x80, 0x7, 0x9, 0x9, 0xfb, 0x0, 0x800, 0x1000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x7, 0x3}, 0x4, 0x5, 0x5d, 0x5, 0xfffffffffffffffc, 0x3ffc0, 0x649, 0x0, 0x565e, 0x0, 0x2}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x3)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0b0000000700000002"], 0x87)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r2}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='kmem_cache_free\x00', r3}, 0x10)
r4 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000200053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff2, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407ffd, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x7, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x7, 0x9e0}, 0x0, 0x0, 0x0, 0x8, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = socket$kcm(0x2, 0x1000000000000002, 0x0)
sendmsg$inet(r5, &(0x7f0000000b40)={&(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000800)="e9", 0x1}, {&(0x7f00000017c0)}], 0x2, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xd}, @loopback}}}], 0x20}, 0xe900)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="1400000024000b94f01013e175b7bd7d7edd7504", 0x14}], 0x1}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x200}, 0x50)
r6 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b35, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030036000b05d25a806c8c6f94f91824fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0)
socket$kcm(0x10, 0x400000002, 0x0)

516.146241ms ago: executing program 1 (id=904):
r0 = perf_event_open(&(0x7f00000000c0)={0x2, 0x6f, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1943}, 0x5000, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
recvmsg$unix(0xffffffffffffffff, 0x0, 0x0)
socket$kcm(0x2, 0x7, 0x84)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, 0x0, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000d00)=ANY=[], 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
socket$kcm(0x11, 0xa, 0x300)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa"], 0xcfa4)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90)
r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

450.758076ms ago: executing program 2 (id=905):
r0 = socket$kcm(0xa, 0x2, 0x73)
sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0xffac, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0xffa0}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000010c0)=[@ip_tos_int={{0x18, 0x29, 0x3b}}, @ip_tos_u8={{0x38, 0x29, 0x3b}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @loopback}}}], 0x50}, 0x0)

329.994818ms ago: executing program 2 (id=906):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000001140)=@newsa={0x1a0, 0x10, 0x1, 0x3, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x0, 0x0, 0x0, 0x2, 0x20, 0x0, 0x64}, {@in, 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x35}, {0x0, 0x0, 0x0, 0x0, 0x1000000}, {0xfffffffffffffffd, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x7fffffff}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x70bd2a, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'md5\x00'}, 0x0, 0x18}}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x4000084}, 0x0)

238.774194ms ago: executing program 2 (id=907):
socket$kcm(0x2, 0x922000000001, 0x106)
perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1946}, 0x0, 0x0, 0x0, 0x8, 0x3fe, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x800c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x9, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x13, &(0x7f00000009c0)=@framed={{}, [@printk={@li, {0x3, 0x3, 0x3, 0xa, 0x0, 0xfe00}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x6}, {0x6, 0x0, 0x2}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, @printk={@p, {0x3, 0x0, 0x6, 0xa, 0x1, 0xfff8, 0xa1}, {}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0xca}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x2, 0x3, &(0x7f0000000540)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x9, 0x0, r1}, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)

155.850866ms ago: executing program 1 (id=908):
perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @perf_config_ext={0x7, 0xffffffffffffffff}, 0x828, 0x0, 0x0, 0x0, 0x9, 0x800003, 0x4, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0)

91.371175ms ago: executing program 1 (id=909):
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="010000ff8d00"})
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2608064c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

1.129ms ago: executing program 2 (id=910):
r0 = socket$kcm(0x11, 0x3, 0x0)
recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0xffffffffffffffff, 0xa}, 0x0)

657.798µs ago: executing program 1 (id=911):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x14, 0x4, 0x4, 0xc}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000480)={r0, &(0x7f00000003c0), &(0x7f0000000400)=""/103}, 0x20)

0s ago: executing program 2 (id=912):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="c4000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000500000000000000fbffffffffffffff0000000000000000000000000000400000000000000000020000000000000000020000000000000000000000000000000c0015005e07350080"], 0xc4}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xfffffff7}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0xc}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x5}}}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94)
sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000087"], 0xb8}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:28553' (ED25519) to the list of known hosts.
syzkaller login: [   56.083831][ T5779] cgroup: Unknown subsys name 'net'
[   56.189024][ T5779] cgroup: Unknown subsys name 'cpuset'
[   56.193628][ T5779] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   57.875602][ T5779] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   68.341799][ T5866] chnl_net:caif_netlink_parms(): no params data found
[   68.351440][ T5871] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   68.569705][ T5866] bridge0: port 1(bridge_slave_0) entered blocking state
[   68.574127][ T5866] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.580667][ T5866] bridge_slave_0: entered allmulticast mode
[   68.583446][ T5866] bridge_slave_0: entered promiscuous mode
[   68.589686][ T5866] bridge0: port 2(bridge_slave_1) entered blocking state
[   68.591911][ T5866] bridge0: port 2(bridge_slave_1) entered disabled state
[   68.594158][ T5866] bridge_slave_1: entered allmulticast mode
[   68.596965][ T5866] bridge_slave_1: entered promiscuous mode
[   68.643658][ T5866] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   68.651981][ T5866] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   68.677560][ T5866] team0: Port device team_slave_0 added
[   68.681262][ T5866] team0: Port device team_slave_1 added
[   68.728359][ T5866] batman_adv: batadv0: Adding interface: batadv_slave_0
[   68.730555][ T5866] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   68.745748][ T5866] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   68.751079][ T5866] batman_adv: batadv0: Adding interface: batadv_slave_1
[   68.753351][ T5866] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   68.761998][ T5866] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   68.793881][ T5866] hsr_slave_0: entered promiscuous mode
[   68.796828][ T5866] hsr_slave_1: entered promiscuous mode
[   68.900384][ T5866] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   68.906707][ T5866] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   68.911103][ T5866] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   68.915544][ T5866] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   68.934735][ T5866] bridge0: port 2(bridge_slave_1) entered blocking state
[   68.937277][ T5866] bridge0: port 2(bridge_slave_1) entered forwarding state
[   68.940288][ T5866] bridge0: port 1(bridge_slave_0) entered blocking state
[   68.942653][ T5866] bridge0: port 1(bridge_slave_0) entered forwarding state
[   68.974799][ T5866] 8021q: adding VLAN 0 to HW filter on device bond0
[   68.988718][   T26] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.991986][   T26] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.000418][ T5866] 8021q: adding VLAN 0 to HW filter on device team0
[   69.007809][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.010057][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.015783][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.018217][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.121972][ T5866] 8021q: adding VLAN 0 to HW filter on device batadv0
[   69.146920][ T5866] veth0_vlan: entered promiscuous mode
[   69.152140][ T5866] veth1_vlan: entered promiscuous mode
[   69.169694][ T5866] veth0_macvtap: entered promiscuous mode
[   69.173676][ T5866] veth1_macvtap: entered promiscuous mode
[   69.184480][ T5866] batman_adv: batadv0: Interface activated: batadv_slave_0
[   69.190977][ T5866] batman_adv: batadv0: Interface activated: batadv_slave_1
[   69.198466][ T5677] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   69.202254][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   69.207761][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   69.210912][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   69.822256][ T5235] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   69.837538][ T5235] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   69.841453][ T5235] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   69.845444][ T5235] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   69.849573][ T5235] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   69.919217][ T5235] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   69.925521][ T5235] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   69.929201][ T5235] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   69.933580][ T5235] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   69.937397][ T5235] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   69.959669][ T5677] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   69.999659][ T5235] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   70.003630][ T5235] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   70.016330][ T5235] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   70.021128][ T5235] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   70.024734][ T5235] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   70.042930][ T5677] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   70.181000][ T5677] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   70.268938][ T5906] chnl_net:caif_netlink_parms(): no params data found
[   70.431171][ T5911] chnl_net:caif_netlink_parms(): no params data found
[   70.453052][ T5906] bridge0: port 1(bridge_slave_0) entered blocking state
[   70.455651][ T5906] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.458949][ T5906] bridge_slave_0: entered allmulticast mode
[   70.462259][ T5906] bridge_slave_0: entered promiscuous mode
[   70.495713][ T5906] bridge0: port 2(bridge_slave_1) entered blocking state
[   70.498941][ T5906] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.501324][ T5906] bridge_slave_1: entered allmulticast mode
[   70.504061][ T5906] bridge_slave_1: entered promiscuous mode
[   70.528172][ T5906] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   70.535570][ T5909] chnl_net:caif_netlink_parms(): no params data found
[   70.548938][ T5906] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   70.578781][ T5911] bridge0: port 1(bridge_slave_0) entered blocking state
[   70.581414][ T5911] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.583886][ T5911] bridge_slave_0: entered allmulticast mode
[   70.586877][ T5911] bridge_slave_0: entered promiscuous mode
[   70.620783][ T5911] bridge0: port 2(bridge_slave_1) entered blocking state
[   70.623291][ T5911] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.625756][ T5911] bridge_slave_1: entered allmulticast mode
[   70.629953][ T5911] bridge_slave_1: entered promiscuous mode
[   70.669314][ T5906] team0: Port device team_slave_0 added
[   70.673820][ T5906] team0: Port device team_slave_1 added
[   70.695656][ T5911] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   70.733908][ T5909] bridge0: port 1(bridge_slave_0) entered blocking state
[   70.736894][ T5909] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.739092][ T5909] bridge_slave_0: entered allmulticast mode
[   70.741764][ T5909] bridge_slave_0: entered promiscuous mode
[   70.748371][ T5911] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   70.752981][ T5909] bridge0: port 2(bridge_slave_1) entered blocking state
[   70.755610][ T5909] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.758922][ T5909] bridge_slave_1: entered allmulticast mode
[   70.761903][ T5909] bridge_slave_1: entered promiscuous mode
[   70.777761][ T5906] batman_adv: batadv0: Adding interface: batadv_slave_0
[   70.780264][ T5906] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   70.789916][ T5906] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   70.832385][ T5906] batman_adv: batadv0: Adding interface: batadv_slave_1
[   70.834906][ T5906] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   70.843735][ T5906] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   70.865138][ T5911] team0: Port device team_slave_0 added
[   70.869935][ T5911] team0: Port device team_slave_1 added
[   70.913760][ T5906] hsr_slave_0: entered promiscuous mode
[   70.917402][ T5906] hsr_slave_1: entered promiscuous mode
[   70.920029][ T5906] debugfs: 'hsr0' already exists in 'hsr'
[   70.921841][ T5906] Cannot create hsr debugfs directory
[   70.938863][ T5909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   70.960197][ T5911] batman_adv: batadv0: Adding interface: batadv_slave_0
[   70.962536][ T5911] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   70.971658][ T5911] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   70.977714][ T5909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   70.981424][ T5911] batman_adv: batadv0: Adding interface: batadv_slave_1
[   70.983861][ T5911] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   70.993143][ T5911] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.052746][ T5677] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   71.083332][ T5909] team0: Port device team_slave_0 added
[   71.098481][ T5909] team0: Port device team_slave_1 added
[   71.155818][ T5911] hsr_slave_0: entered promiscuous mode
[   71.158855][ T5911] hsr_slave_1: entered promiscuous mode
[   71.161522][ T5911] debugfs: 'hsr0' already exists in 'hsr'
[   71.163453][ T5911] Cannot create hsr debugfs directory
[   71.197401][ T5909] batman_adv: batadv0: Adding interface: batadv_slave_0
[   71.199970][ T5909] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.209552][ T5909] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   71.215020][ T5909] batman_adv: batadv0: Adding interface: batadv_slave_1
[   71.217996][ T5909] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   71.227082][ T5909] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   71.322395][ T5909] hsr_slave_0: entered promiscuous mode
[   71.325432][ T5909] hsr_slave_1: entered promiscuous mode
[   71.329446][ T5909] debugfs: 'hsr0' already exists in 'hsr'
[   71.331616][ T5909] Cannot create hsr debugfs directory
[   71.412031][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[   71.414257][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[   71.887377][   T54] Bluetooth: hci0: command tx timeout
[   71.966199][   T54] Bluetooth: hci1: command tx timeout
[   72.136232][   T54] Bluetooth: hci2: command tx timeout
[   72.492534][ T5677] bridge_slave_1: left allmulticast mode
[   72.494887][ T5677] bridge_slave_1: left promiscuous mode
[   72.498828][ T5677] bridge0: port 2(bridge_slave_1) entered disabled state
[   72.504299][ T5677] bridge_slave_0: left allmulticast mode
[   72.508463][ T5677] bridge_slave_0: left promiscuous mode
[   72.510874][ T5677] bridge0: port 1(bridge_slave_0) entered disabled state
[   72.791710][ T5677] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   72.797634][ T5677] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   72.802257][ T5677] bond0 (unregistering): Released all slaves
[   72.900932][ T5677] hsr_slave_0: left promiscuous mode
[   72.903963][ T5677] hsr_slave_1: left promiscuous mode
[   72.912252][ T5677] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   72.915189][ T5677] batman_adv: batadv0: Removing interface: batadv_slave_0
[   72.921726][ T5677] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   72.924645][ T5677] batman_adv: batadv0: Removing interface: batadv_slave_1
[   72.947205][ T5677] veth1_macvtap: left promiscuous mode
[   72.949422][ T5677] veth0_macvtap: left promiscuous mode
[   72.951485][ T5677] veth1_vlan: left promiscuous mode
[   72.953341][ T5677] veth0_vlan: left promiscuous mode
[   73.309777][ T5677] team0 (unregistering): Port device team_slave_1 removed
[   73.340148][ T5677] team0 (unregistering): Port device team_slave_0 removed
[   73.795596][ T5911] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   73.814224][ T5911] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   73.826422][ T5911] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   73.835607][ T5911] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   73.950221][ T5909] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   73.966031][   T54] Bluetooth: hci0: command tx timeout
[   73.968801][ T5909] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   73.994553][ T5909] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   74.018398][ T5909] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   74.048108][   T54] Bluetooth: hci1: command tx timeout
[   74.089340][ T5906] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   74.097899][ T5906] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   74.104414][ T5906] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   74.118348][ T5906] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   74.125653][ T5911] 8021q: adding VLAN 0 to HW filter on device bond0
[   74.150842][ T5911] 8021q: adding VLAN 0 to HW filter on device team0
[   74.173496][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[   74.176151][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[   74.189136][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   74.191439][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   74.206207][   T54] Bluetooth: hci2: command tx timeout
[   74.213688][ T5909] 8021q: adding VLAN 0 to HW filter on device bond0
[   74.251002][ T5909] 8021q: adding VLAN 0 to HW filter on device team0
[   74.267816][   T52] bridge0: port 1(bridge_slave_0) entered blocking state
[   74.270901][   T52] bridge0: port 1(bridge_slave_0) entered forwarding state
[   74.288762][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[   74.291003][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[   74.330661][ T5906] 8021q: adding VLAN 0 to HW filter on device bond0
[   74.350181][ T5906] 8021q: adding VLAN 0 to HW filter on device team0
[   74.365228][ T5909] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   74.370765][ T5909] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   74.388434][   T52] bridge0: port 1(bridge_slave_0) entered blocking state
[   74.391473][   T52] bridge0: port 1(bridge_slave_0) entered forwarding state
[   74.398762][   T52] bridge0: port 2(bridge_slave_1) entered blocking state
[   74.401894][   T52] bridge0: port 2(bridge_slave_1) entered forwarding state
[   74.461545][ T5906] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   74.464687][ T5906] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   74.502654][ T5911] 8021q: adding VLAN 0 to HW filter on device batadv0
[   74.532959][ T5911] veth0_vlan: entered promiscuous mode
[   74.540195][ T5911] veth1_vlan: entered promiscuous mode
[   74.567361][ T5911] veth0_macvtap: entered promiscuous mode
[   74.572607][ T5911] veth1_macvtap: entered promiscuous mode
[   74.598273][ T5911] batman_adv: batadv0: Interface activated: batadv_slave_0
[   74.605434][ T5911] batman_adv: batadv0: Interface activated: batadv_slave_1
[   74.619026][ T5885] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   74.640582][ T5885] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   74.649793][ T5885] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   74.653921][ T5885] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   74.683136][ T5909] 8021q: adding VLAN 0 to HW filter on device batadv0
[   74.714088][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   74.721135][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   74.753013][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   74.758705][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   74.761976][ T5906] 8021q: adding VLAN 0 to HW filter on device batadv0
[   74.824406][ T5909] veth0_vlan: entered promiscuous mode
[   74.837307][ T5909] veth1_vlan: entered promiscuous mode
[   74.880388][ T5906] veth0_vlan: entered promiscuous mode
[   74.898972][ T5906] veth1_vlan: entered promiscuous mode
[   74.906224][ T5909] veth0_macvtap: entered promiscuous mode
[   74.917965][ T5909] veth1_macvtap: entered promiscuous mode
[   74.964322][ T5906] veth0_macvtap: entered promiscuous mode
[   74.965533][ T5980] netlink: 'syz.0.17': attribute type 2 has an invalid length.
[   74.973972][ T5909] batman_adv: batadv0: Interface activated: batadv_slave_0
[   74.974191][ T5980] netlink: 164 bytes leftover after parsing attributes in process `syz.0.17'.
[   74.983039][ T5909] batman_adv: batadv0: Interface activated: batadv_slave_1
[   74.996778][ T5906] veth1_macvtap: entered promiscuous mode
[   75.007575][ T5932] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   75.011289][ T5932] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   75.028394][ T5932] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   75.052951][ T5906] batman_adv: batadv0: Interface activated: batadv_slave_0
[   75.060916][ T5932] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   75.096554][ T5906] batman_adv: batadv0: Interface activated: batadv_slave_1
[   75.122047][ T5932] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   75.134430][ T5932] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   75.170242][ T5932] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   75.204195][ T5932] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   75.223385][  T185] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   75.226510][  T185] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   75.291408][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   75.294590][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   75.318721][  T945] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   75.322214][  T945] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   75.403683][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   75.416423][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   75.849457][ T6012] netlink: 'syz.1.30': attribute type 10 has an invalid length.
[   75.903142][ T6017] netlink: 20 bytes leftover after parsing attributes in process `syz.2.33'.
[   75.943982][ T6012] team0: Device ipvlan1 failed to register rx_handler
[   76.046294][   T54] Bluetooth: hci0: command tx timeout
[   76.127516][   T54] Bluetooth: hci1: command tx timeout
[   76.151723][ T6012] syz.1.30 (6012) used greatest stack depth: 19664 bytes left
[   76.286248][   T54] Bluetooth: hci2: command tx timeout
[   76.545863][    C1] hrtimer: interrupt took 33533 ns
[   77.282333][ T6056] netlink: 'syz.1.44': attribute type 9 has an invalid length.
[   77.292911][ T6056] netlink: 204732 bytes leftover after parsing attributes in process `syz.1.44'.
[   77.424406][ T6062] syz.1.47 uses obsolete (PF_INET,SOCK_PACKET)
[   77.541189][    T9] cfg80211: failed to load regulatory.db
[   77.682819][ T6067] netlink: 204 bytes leftover after parsing attributes in process `syz.1.49'.
[   77.799900][ T6067] syz.1.49 (6067) used greatest stack depth: 19112 bytes left
[   78.126624][   T54] Bluetooth: hci0: command tx timeout
[   78.205993][   T54] Bluetooth: hci1: command tx timeout
[   78.364670][ T6075] netlink: 63503 bytes leftover after parsing attributes in process `syz.2.53'.
[   78.369263][   T54] Bluetooth: hci2: command tx timeout
[   79.021973][ T6093] netlink: 16 bytes leftover after parsing attributes in process `syz.1.61'.
[   79.160178][ T6095] netlink: 'syz.0.62': attribute type 3 has an invalid length.
[   79.307862][ T6100] veth0_vlan: entered allmulticast mode
[   79.455439][ T6102] veth0_vlan: left promiscuous mode
[   79.471737][ T6102] veth0_vlan: entered promiscuous mode
[   79.562709][ T6110] netlink: 60 bytes leftover after parsing attributes in process `syz.1.68'.
[   79.599526][ T6110] netlink: 60 bytes leftover after parsing attributes in process `syz.1.68'.
[   79.606529][ T6110] netlink: 60 bytes leftover after parsing attributes in process `syz.1.68'.
[   80.480113][ T6126] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   80.700200][ T6138] netlink: 'syz.2.80': attribute type 21 has an invalid length.
[   81.661036][ T6148] netlink: 'syz.2.84': attribute type 10 has an invalid length.
[   81.723969][ T6150] netlink: 'syz.0.85': attribute type 1 has an invalid length.
[   81.821057][ T6156] netlink: 'syz.1.88': attribute type 10 has an invalid length.
[   81.869350][ T6148] team0 (unregistering): Port device team_slave_0 removed
[   81.902717][ T6148] team0 (unregistering): Port device team_slave_1 removed
[   81.985256][ T6156] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.991432][ T6156] bridge0: port 1(bridge_slave_0) entered disabled state
[   82.014034][ T6156] bridge0: port 2(bridge_slave_1) entered blocking state
[   82.017488][ T6156] bridge0: port 2(bridge_slave_1) entered forwarding state
[   82.021134][ T6156] bridge0: port 1(bridge_slave_0) entered blocking state
[   82.024298][ T6156] bridge0: port 1(bridge_slave_0) entered forwarding state
[   82.043465][ T6156] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   82.264688][ T6168] netlink: 128124 bytes leftover after parsing attributes in process `syz.0.93'.
[   82.425814][ T6175] syzkaller0: entered promiscuous mode
[   82.434566][ T6175] syzkaller0: entered allmulticast mode
[   82.489733][ T6179] netlink: 'syz.0.99': attribute type 41 has an invalid length.
[   82.792493][ T6196] netlink: 36 bytes leftover after parsing attributes in process `syz.2.106'.
[   82.836529][ T6190] warning: `syz.1.103' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   82.979702][ T6205] netlink: 'syz.0.110': attribute type 11 has an invalid length.
[   83.004772][ T6205] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.110'.
[   83.084016][ T6204] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   83.253110][ T6220] netlink: 17 bytes leftover after parsing attributes in process `syz.0.117'.
[   83.452343][ T6229] netlink: 212940 bytes leftover after parsing attributes in process `syz.1.121'.
[   83.532653][ T6230] =======================================================
[   83.532653][ T6230] WARNING: The mand mount option has been deprecated and
[   83.532653][ T6230]          and is ignored by this kernel. Remove the mand
[   83.532653][ T6230]          option from the mount to silence this warning.
[   83.532653][ T6230] =======================================================
[   83.570123][ T6237] netlink: 60 bytes leftover after parsing attributes in process `syz.2.124'.
[   83.574029][ T6237] netlink: 60 bytes leftover after parsing attributes in process `syz.2.124'.
[   83.910498][ T6250] netlink: 'syz.2.129': attribute type 10 has an invalid length.
[   83.920207][ T6250] netlink: 55 bytes leftover after parsing attributes in process `syz.2.129'.
[   84.528554][ T6246] delete_channel: no stack
[   84.670156][ T6357] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.133'.
[   84.738908][ T6361] netlink: 'syz.1.135': attribute type 11 has an invalid length.
[   84.741543][ T6361] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.135'.
[   84.759938][ T6361] netlink: 'syz.1.135': attribute type 11 has an invalid length.
[   84.773268][ T6360] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   84.945645][   T33] audit: type=1107 audit(1757959230.405:2): pid=6374 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
[   85.980331][ T6423] netlink: 'syz.0.164': attribute type 21 has an invalid length.
[   85.983576][ T6423] netlink: 'syz.0.164': attribute type 1 has an invalid length.
[   86.425375][ T6432] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode
[   86.437940][ T6434] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode
[   87.859132][ T6475] __nla_validate_parse: 6 callbacks suppressed
[   87.859152][ T6475] netlink: 4 bytes leftover after parsing attributes in process `syz.1.185'.
[   88.393305][ T6487] netlink: 'syz.1.188': attribute type 10 has an invalid length.
[   88.467126][ T6487] bond0: (slave netdevsim0): Enslaving as an active interface with an up link
[   88.615370][ T6492] netlink: 'syz.2.191': attribute type 3 has an invalid length.
[   88.618919][ T6492] netlink: 'syz.2.191': attribute type 1 has an invalid length.
[   88.622201][ T6492] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.191'.
[   88.704346][ T6495] Zero length message leads to an empty skb
[   89.229524][ T6515] netlink: 8 bytes leftover after parsing attributes in process `syz.2.202'.
[   89.915217][ T6506] team0: Port device team_slave_0 removed
[   89.931357][ T6506] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check.
[   90.482082][    C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[   90.737116][ T6545] openvswitch: netlink: Flow actions attr not present in new flow.
[   91.003869][ T6559] netlink: 'syz.0.220': attribute type 10 has an invalid length.
[   91.013249][ T6559] netlink: 2 bytes leftover after parsing attributes in process `syz.0.220'.
[   91.023654][ T6559] bond0: entered promiscuous mode
[   91.027821][ T6559] bond_slave_0: entered promiscuous mode
[   91.034660][ T6559] bond_slave_1: entered promiscuous mode
[   91.046358][ T6559] bridge0: port 3(bond0) entered blocking state
[   91.049882][ T6559] bridge0: port 3(bond0) entered disabled state
[   91.058520][ T6559] bond0: entered allmulticast mode
[   91.061068][ T6559] bond_slave_0: entered allmulticast mode
[   91.063740][ T6559] bond_slave_1: entered allmulticast mode
[   91.125079][ T6559] bridge0: port 3(bond0) entered blocking state
[   91.128638][ T6559] bridge0: port 3(bond0) entered forwarding state
[   92.320427][ T6593] netlink: zone id is out of range
[   92.325616][ T6593] netlink: zone id is out of range
[   92.329540][ T6593] netlink: zone id is out of range
[   92.333352][ T6593] netlink: zone id is out of range
[   92.337829][ T6593] netlink: zone id is out of range
[   92.341176][ T6593] netlink: zone id is out of range
[   92.344339][ T6593] netlink: zone id is out of range
[   92.382362][ T6593] netlink: set zone limit has 4 unknown bytes
[   93.137974][ T6600] netlink: 14568 bytes leftover after parsing attributes in process `syz.1.238'.
[   93.274631][ T6609] Driver unsupported XDP return value 0 on prog  (id 100) dev N/A, expect packet loss!
[   93.378232][ T6616] netlink: 'syz.1.242': attribute type 21 has an invalid length.
[   93.386913][ T6616] netlink: 164 bytes leftover after parsing attributes in process `syz.1.242'.
[   93.610474][ T6626] netlink: 'syz.0.246': attribute type 1 has an invalid length.
[   93.619010][ T6626] netlink: 348 bytes leftover after parsing attributes in process `syz.0.246'.
[   93.778916][ T6626] lo speed is unknown, defaulting to 1000
[   93.783162][ T6626] lo speed is unknown, defaulting to 1000
[   93.902458][ T6626] lo speed is unknown, defaulting to 1000
[   94.044932][ T6626] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[   94.208080][ T6633] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2
[   94.399737][ T6637] netlink: 'syz.1.251': attribute type 29 has an invalid length.
[   94.403508][ T6637] netlink: 'syz.1.251': attribute type 3 has an invalid length.
[   94.417014][ T6637] netlink: 132 bytes leftover after parsing attributes in process `syz.1.251'.
[   94.495519][ T6626] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[   94.540182][ T6626] lo speed is unknown, defaulting to 1000
[   94.545506][ T6626] lo speed is unknown, defaulting to 1000
[   94.553166][ T6626] lo speed is unknown, defaulting to 1000
[   94.584210][ T6626] syz.0.246 (6626) used greatest stack depth: 18168 bytes left
[   95.345023][ T6674] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   95.350589][ T6674] netlink: 7 bytes leftover after parsing attributes in process `syz.2.267'.
[   95.522471][ T6674] netlink: 7 bytes leftover after parsing attributes in process `syz.2.267'.
[   95.681243][ T6682] netlink: 'syz.1.270': attribute type 10 has an invalid length.
[   95.690447][ T6682] netlink: 40 bytes leftover after parsing attributes in process `syz.1.270'.
[   95.695285][ T6682] batman_adv: batadv0: Adding interface: virt_wifi0
[   95.699178][ T6682] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   95.707950][ T6682] batman_adv: batadv0: Interface activated: virt_wifi0
[   95.893977][ T6696] netlink: 'syz.0.277': attribute type 2 has an invalid length.
[   95.899069][ T6696] netlink: 'syz.0.277': attribute type 1 has an invalid length.
[   95.902263][ T6696] netlink: 191376 bytes leftover after parsing attributes in process `syz.0.277'.
[   95.910945][ T6696] nbd: couldn't find a device at index 149
[   95.913317][ T6698] netlink: 48 bytes leftover after parsing attributes in process `syz.1.278'.
[   96.685104][ T6721] netlink: 'syz.2.288': attribute type 1 has an invalid length.
[   96.691668][ T6721] netlink: 'syz.2.288': attribute type 2 has an invalid length.
[   97.604206][ T6742] netlink: 'syz.2.297': attribute type 21 has an invalid length.
[   97.607783][ T6742] netlink: 156 bytes leftover after parsing attributes in process `syz.2.297'.
[   97.833798][ T6754] openvswitch: netlink: EtherType 50a is less than min 600
[   97.949553][ T6758] syzkaller0: entered promiscuous mode
[   97.952371][ T6758] syzkaller0: entered allmulticast mode
[   99.132535][ T6768] __nla_validate_parse: 4 callbacks suppressed
[   99.132554][ T6768] netlink: 830 bytes leftover after parsing attributes in process `syz.1.310'.
[   99.369305][ T6783] netlink: 152 bytes leftover after parsing attributes in process `syz.0.317'.
[   99.429837][ T6784] netlink: 'syz.1.314': attribute type 10 has an invalid length.
[   99.482890][ T6791] netlink: 'syz.1.314': attribute type 11 has an invalid length.
[   99.487830][ T6791] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.314'.
[   99.499539][ T6790] netlink: 'syz.0.320': attribute type 2 has an invalid length.
[   99.701807][   T54] Bluetooth: hci1: Dropping invalid advertising data
[   99.704896][   T54] Bluetooth: hci1: Malformed LE Event: 0x02
[   99.748209][ T6784] team0: Port device wlan1 added
[  100.021932][ T6806] netlink: 'syz.2.327': attribute type 7 has an invalid length.
[  100.041305][ T6775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  103.557931][    C1] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1720910601 wd_nsec: 1720910535
[  110.509478][ T6879] netlink: 'syz.2.356': attribute type 11 has an invalid length.
[  110.964104][ T6908] netlink: 'syz.2.370': attribute type 10 has an invalid length.
[  110.966993][ T6908] netlink: 65015 bytes leftover after parsing attributes in process `syz.2.370'.
[  111.301446][ T6928] netlink: 182 bytes leftover after parsing attributes in process `syz.2.380'.
[  111.311863][ T6928] netlink: 'syz.2.380': attribute type 10 has an invalid length.
[  111.367283][ T6928] netlink: 216 bytes leftover after parsing attributes in process `syz.2.380'.
[  111.426276][ T6928] netlink: 132 bytes leftover after parsing attributes in process `syz.2.380'.
[  111.460138][ T6941] netlink: 'syz.1.385': attribute type 1 has an invalid length.
[  111.462836][ T6941] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.385'.
[  111.861741][ T6959] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.393'.
[  112.421586][ T6981] netlink: 731 bytes leftover after parsing attributes in process `syz.2.402'.
[  112.547729][ T6986] netlink: 8 bytes leftover after parsing attributes in process `syz.2.404'.
[  112.658100][ T6988] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  112.661473][ T6988] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  112.918947][ T7002] netlink: 20 bytes leftover after parsing attributes in process `syz.0.410'.
[  112.922498][ T7002] netlink: 20 bytes leftover after parsing attributes in process `syz.0.410'.
[  112.988483][ T7003] delete_channel: no stack
[  113.518343][ T6988] syz.2.405 (6988) used greatest stack depth: 18064 bytes left
[  114.103425][ T7041] openvswitch: netlink: Multiple metadata blocks provided
[  116.315970][ T7103] __nla_validate_parse: 3 callbacks suppressed
[  116.315986][ T7103] netlink: 8 bytes leftover after parsing attributes in process `syz.0.449'.
[  116.353158][ T7103] : entered promiscuous mode
[  116.751960][ T7111] netlink: 8 bytes leftover after parsing attributes in process `syz.2.453'.
[  116.917609][ T7119] netlink: 132 bytes leftover after parsing attributes in process `syz.2.457'.
[  117.845483][ T7176] tap0: tun_chr_ioctl cmd 1074025672
[  117.848107][ T7176] tap0: ignored: set checksum enabled
[  117.975702][ T7184] netlink: 16 bytes leftover after parsing attributes in process `syz.0.489'.
[  117.983707][ T7184] netlink: 356 bytes leftover after parsing attributes in process `syz.0.489'.
[  118.576049][ T7211] netlink: 'syz.2.502': attribute type 1 has an invalid length.
[  120.159906][ T7289] netlink: 116572 bytes leftover after parsing attributes in process `syz.2.528'.
[  120.209915][ T7291] lo speed is unknown, defaulting to 1000
[  120.464420][ T7297] netlink: 208344 bytes leftover after parsing attributes in process `syz.0.539'.
[  120.472090][ T7297] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16)
[  120.482079][ T7297] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  120.536892][ T7300] netlink: 12 bytes leftover after parsing attributes in process `syz.1.540'.
[  120.549116][ T7300] netlink: 152 bytes leftover after parsing attributes in process `syz.1.540'.
[  120.892715][ T7317] netlink: 'syz.0.548': attribute type 1 has an invalid length.
[  121.225952][ T7313] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.546'.
[  122.558995][ T7340] netlink: 'syz.1.557': attribute type 3 has an invalid length.
[  123.026016][ T7376] netlink: 'syz.1.571': attribute type 10 has an invalid length.
[  123.029126][ T7376] netlink: 55 bytes leftover after parsing attributes in process `syz.1.571'.
[  123.045507][ T7379] netlink: 12 bytes leftover after parsing attributes in process `syz.2.572'.
[  123.050283][ T7379] netlink: 76 bytes leftover after parsing attributes in process `syz.2.572'.
[  123.060522][ T7379] netlink: 8 bytes leftover after parsing attributes in process `syz.2.572'.
[  124.243361][ T7423] sctp: [Deprecated]: syz.0.590 (pid 7423) Use of int in maxseg socket option.
[  124.243361][ T7423] Use struct sctp_assoc_value instead
[  125.109982][ T7434] netlink: 32 bytes leftover after parsing attributes in process `syz.2.595'.
[  125.455080][ T7458] netlink: 10 bytes leftover after parsing attributes in process `syz.2.608'.
[  125.504688][ T7462] netlink: 4 bytes leftover after parsing attributes in process `syz.1.610'.
[  125.689190][ T7475] xt_l2tp: unknown flags: 51
[  125.771077][ T7479] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes.
[  125.782210][ T7481] netlink: 'syz.1.619': attribute type 2 has an invalid length.
[  125.785413][ T7481] netlink: 'syz.1.619': attribute type 1 has an invalid length.
[  125.796390][ T7481] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.619'.
[  125.800359][ T7481] nbd: couldn't find device at index 16
[  125.920470][   T54] Bluetooth: hci1: unexpected event 0x08 length: 15 > 4
[  126.029144][ T7490] netlink: 8 bytes leftover after parsing attributes in process `syz.1.621'.
[  126.304312][ T7509] netlink: 'syz.0.631': attribute type 21 has an invalid length.
[  127.498533][ T7551] netlink: 'syz.0.648': attribute type 13 has an invalid length.
[  127.502182][ T7551] netlink: 'syz.0.648': attribute type 17 has an invalid length.
[  127.558680][ T7551] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  127.564121][ T5314] lo speed is unknown, defaulting to 1000
[  127.882564][ T7559] netlink: 'syz.0.652': attribute type 4 has an invalid length.
[  127.886430][ T7559] netlink: 152 bytes leftover after parsing attributes in process `syz.0.652'.
[  127.947473][ T7559] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check.
[  128.275048][ T7582] netlink: 208252 bytes leftover after parsing attributes in process `syz.0.663'.
[  128.284542][ T7582] netlink: 'syz.0.663': attribute type 1 has an invalid length.
[  128.290256][ T7582] netlink: 'syz.0.663': attribute type 2 has an invalid length.
[  128.293840][ T7582] netlink: 'syz.0.663': attribute type 3 has an invalid length.
[  128.302049][ T7582] netlink: 'syz.0.663': attribute type 4 has an invalid length.
[  128.374931][ T7599] netlink: 4 bytes leftover after parsing attributes in process `syz.2.671'.
[  128.439434][ T7605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.674'.
[  128.495457][   T54] Bluetooth: hci1: unexpected event 0x31 length: 82 > 6
[  129.143051][ T7636] openvswitch: netlink: EtherType 50a is less than min 600
[  129.361684][ T7641] netlink: 56429 bytes leftover after parsing attributes in process `syz.2.689'.
[  129.395638][ T7643] netlink: 'syz.1.690': attribute type 11 has an invalid length.
[  129.399177][ T7643] netlink: 'syz.1.690': attribute type 11 has an invalid length.
[  129.523945][ T7647] netlink: 48 bytes leftover after parsing attributes in process `syz.2.693'.
[  129.870862][ T7670] netlink: 204732 bytes leftover after parsing attributes in process `syz.0.701'.
[  130.447898][ T7673] IPv6: NLM_F_CREATE should be specified when creating new route
[  130.524566][ T7679] openvswitch: netlink: Invalid VLAN frame
[  131.005324][ T7706] netlink: 56 bytes leftover after parsing attributes in process `syz.2.720'.
[  131.016050][ T7706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.720'.
[  132.065540][ T7724] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.727'.
[  132.744748][ T7754] validate_nla: 3 callbacks suppressed
[  132.744779][ T7754] netlink: 'syz.0.741': attribute type 2 has an invalid length.
[  132.810852][ T7759] openvswitch: netlink: Multiple metadata blocks provided
[  132.852363][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  132.854962][ T1363] ieee802154 phy1 wpan1: encryption failed: -22
[  132.921033][ T7766] netlink: 360 bytes leftover after parsing attributes in process `syz.1.747'.
[  133.462306][ T7801] netlink: 'syz.2.764': attribute type 2 has an invalid length.
[  133.465433][ T7801] netlink: 137592 bytes leftover after parsing attributes in process `syz.2.764'.
[  133.549218][ T7803] bridge0: port 3(bond0) entered disabled state
[  133.552365][ T7803] bridge0: port 2(bridge_slave_1) entered disabled state
[  133.555780][ T7803] bridge0: port 1(bridge_slave_0) entered disabled state
[  133.603840][ T7803] bridge0: entered allmulticast mode
[  133.948362][ T7803] bond0: left allmulticast mode
[  133.950509][ T7803] bond_slave_0: left allmulticast mode
[  133.952713][ T7803] bond_slave_1: left allmulticast mode
[  133.954960][ T7803] bond0: left promiscuous mode
[  133.959694][ T7803] bond_slave_0: left promiscuous mode
[  133.963769][ T7803] bond_slave_1: left promiscuous mode
[  133.966946][ T7803] bridge0: port 3(bond0) entered disabled state
[  133.972213][ T7803] bridge_slave_1: left allmulticast mode
[  133.974381][ T7803] bridge_slave_1: left promiscuous mode
[  133.979321][ T7803] bridge0: port 2(bridge_slave_1) entered disabled state
[  133.989723][ T7803] bridge_slave_0: left allmulticast mode
[  133.991497][ T7803] bridge_slave_0: left promiscuous mode
[  133.993472][ T7803] bridge0: port 1(bridge_slave_0) entered disabled state
[  134.085618][ T7806] netlink: 830 bytes leftover after parsing attributes in process `syz.1.766'.
[  134.581808][ T7832] netlink: 24 bytes leftover after parsing attributes in process `syz.2.770'.
[  135.872789][   T33] audit: type=1107 audit(1757959281.335:3): pid=7880 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''
[  136.453837][ T7904] netlink: 'syz.0.807': attribute type 32 has an invalid length.
[  136.555145][ T7909] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  137.423629][ T7939] lo speed is unknown, defaulting to 1000
[  137.561832][ T7947] netlink: 8 bytes leftover after parsing attributes in process `syz.1.822'.
[  137.565183][ T7947] openvswitch: netlink: Invalid MD length 0 for MD type 0
[  137.571758][ T7947] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  138.059208][ T7970] netlink: 'syz.2.832': attribute type 40 has an invalid length.
[  138.064194][ T7970] bridge0: port 2(bridge_slave_1) entered disabled state
[  138.146419][ T7976] netlink: 'syz.2.835': attribute type 10 has an invalid length.
[  138.152154][ T7976] bond0: (slave hsr0): The slave device specified does not support setting the MAC address
[  138.156382][ T7976] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets).
[  138.161484][ T7976] bond0: (slave hsr0): Error -22 calling dev_set_mtu
[  139.825677][ T8047] lo speed is unknown, defaulting to 1000
[  140.107441][ T8067] netlink: 199820 bytes leftover after parsing attributes in process `syz.1.874'.
[  140.112026][ T8067] netlink: 5 bytes leftover after parsing attributes in process `syz.1.874'.
[  140.165737][ T8069] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  140.168961][ T8069] batman_adv: batadv0: Removing interface: batadv_slave_0
[  140.186636][ T8069] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  140.189510][ T8069] batman_adv: batadv0: Removing interface: batadv_slave_1
[  140.427719][ T8084] netlink: 12 bytes leftover after parsing attributes in process `syz.1.882'.
[  140.581297][ T8089] netlink: 8 bytes leftover after parsing attributes in process `syz.1.885'.
[  140.588889][ T8090] syzkaller0: tun_chr_ioctl cmd 1074025677
[  140.591979][ T8090] syzkaller0: linktype set to 801
[  140.988626][ T8111] netlink: 276 bytes leftover after parsing attributes in process `syz.0.895'.
[  140.996121][ T8112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.892'.
[  141.078688][   T54] Bluetooth: hci2: unexpected subevent 0x01 length: 150 > 18
[  141.253132][ T8123] lo speed is unknown, defaulting to 1000
[  141.398426][ T8128] netlink: 146936 bytes leftover after parsing attributes in process `syz.0.903'.
[  141.402981][ T8128] openvswitch: netlink: Message has 6 unknown bytes.
[  141.444309][ T8128] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  141.450027][ T8128] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  141.508038][ T8141] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.903'.
[  141.904102][ T8159] ==================================================================
[  141.906653][ T8160] netlink: 188 bytes leftover after parsing attributes in process `syz.1.914'.
[  141.906854][ T8159] BUG: KASAN: slab-use-after-free in __xfrm_state_lookup+0x6ad/0x8d0
[  141.912494][ T8159] Read of size 2 at addr ffff88810597cec2 by task syz.2.913/8159
[  141.916861][ T8159] 
[  141.917883][ T8159] CPU: 0 UID: 0 PID: 8159 Comm: syz.2.913 Not tainted syzkaller #0 PREEMPT(full) 
[  141.917902][ T8159] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  141.917913][ T8159] Call Trace:
[  141.917922][ T8159]  <TASK>
[  141.918010][ T8159]  dump_stack_lvl+0x189/0x250
[  141.918048][ T8159]  ? __kasan_check_byte+0x12/0x40
[  141.918073][ T8159]  ? __pfx_dump_stack_lvl+0x10/0x10
[  141.918087][ T8159]  ? lock_release+0x4b/0x3e0
[  141.918108][ T8159]  ? __virt_addr_valid+0x4a5/0x5c0
[  141.918124][ T8159]  print_report+0xca/0x240
[  141.918137][ T8159]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  141.918153][ T8159]  kasan_report+0x118/0x150
[  141.918173][ T8159]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  141.918189][ T8159]  __xfrm_state_lookup+0x6ad/0x8d0
[  141.918207][ T8159]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  141.918229][ T8159]  xfrm_state_add+0x27d/0xc40
[  141.918262][ T8159]  xfrm_add_sa+0x35a1/0x4070
[  141.918285][ T8159]  ? __pfx_xfrm_add_sa+0x10/0x10
[  141.918306][ T8159]  ? apparmor_capable+0x137/0x1b0
[  141.918325][ T8159]  ? __nla_parse+0x40/0x60
[  141.918340][ T8159]  xfrm_user_rcv_msg+0x7a3/0xab0
[  141.918363][ T8159]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  141.918395][ T8159]  ? __pfx___mutex_trylock_common+0x10/0x10
[  141.918406][ T8159]  ? rcu_is_watching+0x15/0xb0
[  141.918416][ T8159]  ? trace_contention_end+0x39/0x120
[  141.918424][ T8159]  ? __mutex_lock+0x335/0x1350
[  141.918437][ T8159]  netlink_rcv_skb+0x208/0x470
[  141.918447][ T8159]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  141.918460][ T8159]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  141.918472][ T8159]  ? netlink_deliver_tap+0x2e/0x1b0
[  141.918482][ T8159]  ? netlink_deliver_tap+0x2e/0x1b0
[  141.918491][ T8159]  xfrm_netlink_rcv+0x79/0x90
[  141.918503][ T8159]  netlink_unicast+0x82f/0x9e0
[  141.918513][ T8159]  ? __pfx_netlink_unicast+0x10/0x10
[  141.918522][ T8159]  ? netlink_sendmsg+0x642/0xb30
[  141.918531][ T8159]  ? skb_put+0x11b/0x210
[  141.918541][ T8159]  netlink_sendmsg+0x805/0xb30
[  141.918552][ T8159]  ? __pfx_netlink_sendmsg+0x10/0x10
[  141.918560][ T8159]  ? aa_sock_msg_perm+0xf1/0x1d0
[  141.918569][ T8159]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  141.918578][ T8159]  ? __pfx_netlink_sendmsg+0x10/0x10
[  141.918586][ T8159]  __sock_sendmsg+0x21c/0x270
[  141.918599][ T8159]  ____sys_sendmsg+0x505/0x830
[  141.918648][ T8159]  ? __pfx_____sys_sendmsg+0x10/0x10
[  141.918662][ T8159]  ? import_iovec+0x74/0xa0
[  141.918675][ T8159]  ___sys_sendmsg+0x21f/0x2a0
[  141.918686][ T8159]  ? __pfx____sys_sendmsg+0x10/0x10
[  141.918706][ T8159]  ? __fget_files+0x2a/0x420
[  141.918714][ T8159]  ? __fget_files+0x3a0/0x420
[  141.918723][ T8159]  __x64_sys_sendmsg+0x19b/0x260
[  141.918734][ T8159]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  141.918746][ T8159]  ? rcu_is_watching+0x15/0xb0
[  141.918754][ T8159]  ? do_syscall_64+0xbe/0x3b0
[  141.918764][ T8159]  do_syscall_64+0xfa/0x3b0
[  141.918773][ T8159]  ? lockdep_hardirqs_on+0x9c/0x150
[  141.918781][ T8159]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  141.918789][ T8159]  ? exc_page_fault+0x9f/0xf0
[  141.918797][ T8159]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  141.918805][ T8159] RIP: 0033:0x7f4338d8eba9
[  141.918816][ T8159] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  141.918824][ T8159] RSP: 002b:00007f4339be2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  141.918835][ T8159] RAX: ffffffffffffffda RBX: 00007f4338fd5fa0 RCX: 00007f4338d8eba9
[  141.918842][ T8159] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003
[  141.918847][ T8159] RBP: 00007f4338e11e19 R08: 0000000000000000 R09: 0000000000000000
[  141.918852][ T8159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  141.918858][ T8159] R13: 00007f4338fd6038 R14: 00007f4338fd5fa0 R15: 00007ffcf8452c08
[  141.918869][ T8159]  </TASK>
[  141.918872][ T8159] 
[  141.935589][ T8162] netlink: 'syz.1.915': attribute type 3 has an invalid length.
[  141.937531][ T8159] Allocated by task 6902:
[  141.937548][ T8159]  kasan_save_track+0x3e/0x80
[  141.937576][ T8159]  __kasan_slab_alloc+0x6c/0x80
[  141.937595][ T8159]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  141.937643][ T8159]  xfrm_state_alloc+0x24/0x2f0
[  141.939120][ T8162] netlink: 13435 bytes leftover after parsing attributes in process `syz.1.915'.
[  141.941163][ T8159]  __find_acq_core+0x8a7/0x1c00
[  141.941190][ T8159]  xfrm_find_acq+0x78/0xa0
[  141.941209][ T8159]  xfrm_alloc_userspi+0x6b3/0xc90
[  142.080339][ T8159]  xfrm_user_rcv_msg+0x7a3/0xab0
[  142.082360][ T8159]  netlink_rcv_skb+0x208/0x470
[  142.084306][ T8159]  xfrm_netlink_rcv+0x79/0x90
[  142.086212][ T8159]  netlink_unicast+0x82f/0x9e0
[  142.088131][ T8159]  netlink_sendmsg+0x805/0xb30
[  142.090036][ T8159]  __sock_sendmsg+0x21c/0x270
[  142.091808][ T8159]  ____sys_sendmsg+0x505/0x830
[  142.093476][ T8159]  ___sys_sendmsg+0x21f/0x2a0
[  142.095321][ T8159]  __x64_sys_sendmsg+0x19b/0x260
[  142.097259][ T8159]  do_syscall_64+0xfa/0x3b0
[  142.099089][ T8159]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  142.101446][ T8159] 
[  142.102417][ T8159] Freed by task 24:
[  142.103856][ T8159]  kasan_save_track+0x3e/0x80
[  142.105571][ T8159]  kasan_save_free_info+0x46/0x50
[  142.107473][ T8159]  __kasan_slab_free+0x5b/0x80
[  142.109280][ T8159]  kmem_cache_free+0x18f/0x400
[  142.111150][ T8159]  xfrm_state_gc_task+0x52d/0x6b0
[  142.113167][ T8159]  process_scheduled_works+0xae1/0x17b0
[  142.115320][ T8159]  worker_thread+0x8a0/0xda0
[  142.117205][ T8159]  kthread+0x711/0x8a0
[  142.118876][ T8159]  ret_from_fork+0x439/0x7d0
[  142.120696][ T8159]  ret_from_fork_asm+0x1a/0x30
[  142.122550][ T8159] 
[  142.123523][ T8159] The buggy address belongs to the object at ffff88810597cd80
[  142.123523][ T8159]  which belongs to the cache xfrm_state of size 928
[  142.128825][ T8159] The buggy address is located 322 bytes inside of
[  142.128825][ T8159]  freed 928-byte region [ffff88810597cd80, ffff88810597d120)
[  142.134101][ T8159] 
[  142.135081][ T8159] The buggy address belongs to the physical page:
[  142.137616][ T8159] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88810597ed00 pfn:0x10597c
[  142.141576][ T8159] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  142.144797][ T8159] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  142.147784][ T8159] page_type: f5(slab)
[  142.149344][ T8159] raw: 057ff00000000040 ffff88801c3ef500 dead000000000122 0000000000000000
[  142.152682][ T8159] raw: ffff88810597ed00 00000000800e0007 00000000f5000000 0000000000000000
[  142.155615][ T8159] head: 057ff00000000040 ffff88801c3ef500 dead000000000122 0000000000000000
[  142.158525][ T8159] head: ffff88810597ed00 00000000800e0007 00000000f5000000 0000000000000000
[  142.161531][ T8159] head: 057ff00000000002 ffffea0004165f01 00000000ffffffff 00000000ffffffff
[  142.164638][ T8159] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  142.167937][ T8159] page dumped because: kasan: bad access detected
[  142.169943][ T8159] page_owner tracks the page as allocated
[  142.171899][ T8159] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6035, tgid 6034 (syz.1.40), ts 76560371317, free_ts 76409964789
[  142.178486][ T8159]  post_alloc_hook+0x240/0x2a0
[  142.180445][ T8159]  get_page_from_freelist+0x21e4/0x22c0
[  142.182632][ T8159]  __alloc_frozen_pages_noprof+0x181/0x370
[  142.184660][ T8159]  alloc_pages_mpol+0x232/0x4a0
[  142.186647][ T8159]  allocate_slab+0x8a/0x370
[  142.188469][ T8159]  ___slab_alloc+0xbeb/0x1420
[  142.190367][ T8159]  kmem_cache_alloc_noprof+0x283/0x3c0
[  142.192461][ T8159]  xfrm_state_alloc+0x24/0x2f0
[  142.194311][ T8159]  pfkey_add+0x6e4/0x2e00
[  142.196052][ T8159]  pfkey_sendmsg+0xbfe/0x1090
[  142.197949][ T8159]  __sock_sendmsg+0x21c/0x270
[  142.199840][ T8159]  ____sys_sendmsg+0x505/0x830
[  142.201776][ T8159]  ___sys_sendmsg+0x21f/0x2a0
[  142.203665][ T8159]  __x64_sys_sendmsg+0x19b/0x260
[  142.205700][ T8159]  do_syscall_64+0xfa/0x3b0
[  142.208100][ T8159]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  142.210186][ T8159] page last free pid 5677 tgid 5677 stack trace:
[  142.212389][ T8159]  __free_frozen_pages+0xbc4/0xd30
[  142.214218][ T8159]  __put_partials+0x156/0x1a0
[  142.215933][ T8159]  put_cpu_partial+0x17c/0x250
[  142.217658][ T8159]  __slab_free+0x2d5/0x3c0
[  142.219271][ T8159]  qlist_free_all+0x97/0x140
[  142.220948][ T8159]  kasan_quarantine_reduce+0x148/0x160
[  142.222915][ T8159]  __kasan_slab_alloc+0x22/0x80
[  142.224636][ T8159]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[  142.226773][ T8159]  __alloc_skb+0x112/0x2d0
[  142.228364][ T8159]  mld_newpack+0x13c/0xc40
[  142.229971][ T8159]  add_grhead+0x5a/0x2a0
[  142.231463][ T8159]  add_grec+0x1452/0x1740
[  142.232971][ T8159]  mld_send_initial_cr+0x288/0x550
[  142.234739][ T8159]  ipv6_mc_dad_complete+0x88/0x410
[  142.236598][ T8159]  addrconf_dad_completed+0x6d5/0xd60
[  142.238505][ T8159]  addrconf_dad_work+0xc36/0x14b0
[  142.240285][ T8159] 
[  142.241148][ T8159] Memory state around the buggy address:
[  142.243116][ T8159]  ffff88810597cd80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  142.246013][ T8159]  ffff88810597ce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  142.248759][ T8159] >ffff88810597ce80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  142.251531][ T8159]                                            ^
[  142.253746][ T8159]  ffff88810597cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  142.256592][ T8159]  ffff88810597cf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  142.259416][ T8159] ==================================================================
[  142.262445][ T8159] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  142.265290][ T8159] CPU: 0 UID: 0 PID: 8159 Comm: syz.2.913 Not tainted syzkaller #0 PREEMPT(full) 
[  142.268637][ T8159] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  142.272216][ T8159] Call Trace:
[  142.273428][ T8159]  <TASK>
[  142.274503][ T8159]  dump_stack_lvl+0x99/0x250
[  142.276205][ T8159]  ? __asan_memcpy+0x40/0x70
[  142.277834][ T8159]  ? __pfx_dump_stack_lvl+0x10/0x10
[  142.279624][ T8159]  ? __pfx__printk+0x10/0x10
[  142.281239][ T8159]  vpanic+0x281/0x750
[  142.282697][ T8159]  ? __pfx_vpanic+0x10/0x10
[  142.284317][ T8159]  ? irqentry_exit+0x74/0x90
[  142.286009][ T8159]  panic+0xb9/0xc0
[  142.287314][ T8159]  ? __pfx_panic+0x10/0x10
[  142.288910][ T8159]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  142.290995][ T8159]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  142.293125][ T8159]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  142.295016][ T8159]  check_panic_on_warn+0x89/0xb0
[  142.296801][ T8159]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  142.298672][ T8159]  end_report+0x78/0x160
[  142.300163][ T8159]  kasan_report+0x129/0x150
[  142.301809][ T8159]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  142.303693][ T8159]  __xfrm_state_lookup+0x6ad/0x8d0
[  142.305518][ T8159]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  142.307529][ T8159]  xfrm_state_add+0x27d/0xc40
[  142.309256][ T8159]  xfrm_add_sa+0x35a1/0x4070
[  142.310936][ T8159]  ? __pfx_xfrm_add_sa+0x10/0x10
[  142.312709][ T8159]  ? apparmor_capable+0x137/0x1b0
[  142.314504][ T8159]  ? __nla_parse+0x40/0x60
[  142.316140][ T8159]  xfrm_user_rcv_msg+0x7a3/0xab0
[  142.317934][ T8159]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  142.319895][ T8159]  ? __pfx___mutex_trylock_common+0x10/0x10
[  142.322013][ T8159]  ? rcu_is_watching+0x15/0xb0
[  142.323729][ T8159]  ? trace_contention_end+0x39/0x120
[  142.325609][ T8159]  ? __mutex_lock+0x335/0x1350
[  142.327334][ T8159]  netlink_rcv_skb+0x208/0x470
[  142.329069][ T8159]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  142.330937][ T8159]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  142.332765][ T8159]  ? netlink_deliver_tap+0x2e/0x1b0
[  142.334655][ T8159]  ? netlink_deliver_tap+0x2e/0x1b0
[  142.336503][ T8159]  xfrm_netlink_rcv+0x79/0x90
[  142.338199][ T8159]  netlink_unicast+0x82f/0x9e0
[  142.339888][ T8159]  ? __pfx_netlink_unicast+0x10/0x10
[  142.341766][ T8159]  ? netlink_sendmsg+0x642/0xb30
[  142.343525][ T8159]  ? skb_put+0x11b/0x210
[  142.345050][ T8159]  netlink_sendmsg+0x805/0xb30
[  142.346797][ T8159]  ? __pfx_netlink_sendmsg+0x10/0x10
[  142.348676][ T8159]  ? aa_sock_msg_perm+0xf1/0x1d0
[  142.350440][ T8159]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  142.352336][ T8159]  ? __pfx_netlink_sendmsg+0x10/0x10
[  142.354221][ T8159]  __sock_sendmsg+0x21c/0x270
[  142.355930][ T8159]  ____sys_sendmsg+0x505/0x830
[  142.357658][ T8159]  ? __pfx_____sys_sendmsg+0x10/0x10
[  142.359539][ T8159]  ? import_iovec+0x74/0xa0
[  142.361198][ T8159]  ___sys_sendmsg+0x21f/0x2a0
[  142.362955][ T8159]  ? __pfx____sys_sendmsg+0x10/0x10
[  142.364838][ T8159]  ? __fget_files+0x2a/0x420
[  142.366494][ T8159]  ? __fget_files+0x3a0/0x420
[  142.368201][ T8159]  __x64_sys_sendmsg+0x19b/0x260
[  142.369997][ T8159]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  142.371960][ T8159]  ? rcu_is_watching+0x15/0xb0
[  142.373698][ T8159]  ? do_syscall_64+0xbe/0x3b0
[  142.375381][ T8159]  do_syscall_64+0xfa/0x3b0
[  142.377033][ T8159]  ? lockdep_hardirqs_on+0x9c/0x150
[  142.378902][ T8159]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  142.381052][ T8159]  ? exc_page_fault+0x9f/0xf0
[  142.382743][ T8159]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  142.384854][ T8159] RIP: 0033:0x7f4338d8eba9
[  142.386436][ T8159] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  142.393184][ T8159] RSP: 002b:00007f4339be2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  142.396139][ T8159] RAX: ffffffffffffffda RBX: 00007f4338fd5fa0 RCX: 00007f4338d8eba9
[  142.398920][ T8159] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003
[  142.401645][ T8159] RBP: 00007f4338e11e19 R08: 0000000000000000 R09: 0000000000000000
[  142.404421][ T8159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  142.407149][ T8159] R13: 00007f4338fd6038 R14: 00007f4338fd5fa0 R15: 00007ffcf8452c08
[  142.409978][ T8159]  </TASK>
[  142.411759][ T8159] Kernel Offset: disabled
[  142.413126][ T8159] Rebooting in 86400 seconds..

VM DIAGNOSIS:
18:01:27  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000032 RBX=0000000000000032 RCX=0000000000000000 RDX=00000000000003f8
RSI=000000000002348c RDI=000000000002348d RBP=00000000000003f8 RSP=ffffc90002f4e9d0
R8 =ffff88801f7e8237 R9 =1ffff11003efd046 R10=dffffc0000000000 R11=ffffffff854fa380
R12=dffffc0000000000 R13=ffffffff99b028fe R14=ffffffff99df7420 R15=0000000000000000
RIP=ffffffff854fa3fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f4339be26c0 ffffffff 00c00000
GS =0000 ffff8880b8613000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000000 CR3=00000000274e6000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f4338fa7498 00007f4338fa7470 XMM03=00007f4338fa74a8 00007f4338fa74a0
XMM04=00007f4339b0d100 00007f4338fa7460 XMM05=00007f4338fa7478 00007f4338fa74c0
XMM06=00007f4338fa74b8 00007f4338fa74b0 XMM07=00007f4338fa74a8 00007f4338fa74a0
XMM08=0000000000000000 00007f4338e12ee7 XMM09=0000000000000000 00007f4338e12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000001 RBX=ffffffff822e894a RCX=ffff88803ab3d640 RDX=0000000000000000
RSI=ffffffff822e894a RDI=ffffffff8e13a220 RBP=0000000000000001 RSP=ffffc90003ee74f0
R8 =0000000000000000 R9 =ffffffff822e894a R10=dffffc0000000000 R11=fffff940008aad71
R12=dffffc0000000000 R13=ffffffff822e894a R14=ffffffff8e13a220 R15=ffff88805fffa840
RIP=ffffffff819d84e4 RFL=00000297 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555584a8f500 ffffffff 00c00000
GS =0000 ffff8881a3c13000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2e220ff8 CR3=000000011058a000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffff81b7c9c8 ffffffff81b7c97a
XMM02=000300100bfc8009 ffffffff81b7c97a XMM03=35050002000a0005 001060fc2418f994
XMM04=00007ff74530d100 00007ff7447a7460 XMM05=00007ff7447a7478 00007ff7447a74c0
XMM06=00007ff7447a74b8 00007ff7447a74b0 XMM07=00007ff7447a74a8 00007ff7447a74a0
XMM08=263c2462783718f5 17947c6657908ce0 XMM09=0000000000000000 00007ff744612fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
