last executing test programs:

21.929636616s ago: executing program 0 (id=591):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94)
r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r0}, 0x10)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095", @ANYRES8, @ANYRES16=r1, @ANYRES64=r0, @ANYRESDEC=r1], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x480000}, 0x94)
r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='xen_mc_flush\x00', r2}, 0xfff2)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000180)={'wlan0\x00', <r6=>0x0})
sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f0000000400)=ANY=[@ANYRES64=r3, @ANYRES16=r4, @ANYRES16=r3, @ANYRES32=r6], 0x30}, 0x1, 0x0, 0x0, 0x48d4}, 0x40010)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10)
r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYRESOCT=r0], 0x0, 0x37}, 0x28)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1830ebff00000000000000000300000095"], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94)
ioctl$sock_bt_hci(r7, 0x400448cb, 0x0)
r8 = epoll_create(0x7)
epoll_pwait(r8, &(0x7f0000000380)=[{}], 0x1, 0x3f38, 0x0, 0x0)
r9 = socket$igmp(0x2, 0x3, 0x2)
ioctl$sock_SIOCGPGRP(r9, 0x8904, &(0x7f0000000040)=<r10=>0x0)
ioctl$sock_FIOSETOWN(r9, 0x8901, &(0x7f0000000300)=r10)
socket$netlink(0x10, 0x3, 0x0)
r11 = socket(0x10, 0x803, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000))
bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1200000009000000080000000200000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000000000bff9a3299648e7fdd7", @ANYRES32=0x0, @ANYRES32], 0x50)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
getsockopt$bt_BT_RCVMTU(r11, 0x112, 0xd, &(0x7f0000000440)=0x8, &(0x7f0000000480)=0x2)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r13}, 0x10)
ppoll(&(0x7f0000000500)=[{r12}], 0x1, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40, 0x3, 0xfffffffffffffffd, 0x155400}, 0x0, &(0x7f00000002c0)={0x3fb, 0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0xb}, 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(r11, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0xffffffff, 0x0, 0x0, 0x4, 0x2, 0x1}})

21.027257736s ago: executing program 0 (id=595):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_int(r0, 0x6, 0x6, &(0x7f0000000040)=0x24, 0x4) (async)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x3) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = openat$cgroup_int(r2, &(0x7f0000001180)='hugetlb.2MB.rsvd.limit_in_bytes\x00', 0x2, 0x0)
write$cgroup_subtree(r3, &(0x7f00000000c0)=ANY=[], 0x27) (async)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_netdev_private(r4, 0x89f8, &(0x7f0000000240)="57efdeaef39cde208c240690377512e7a1a125e513ce107369095081cbac1f96f7aed572196a0ee7b31c2847936af3ec06e62d6711195cbd71d86402b1f7b2d304c9aa6e9aa2eefbd6c4e08a4c") (async, rerun: 32)
getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000140)={'ah\x00'}, &(0x7f0000000180)=0x1e) (async, rerun: 32)
r5 = accept$packet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x14)
setsockopt$packet_fanout_data(r5, 0x107, 0x16, &(0x7f0000000200)={0x3, &(0x7f00000001c0)=[{0x5c, 0x6, 0xa8, 0x2}, {0xf96, 0x3, 0x4, 0x3}, {0xac, 0x9, 0xc, 0x62f}]}, 0x10) (async, rerun: 64)
setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x4}, 0x4) (async, rerun: 64)
setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000000)=0x1001, 0x4)

20.95113913s ago: executing program 0 (id=596):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000000)='inet_sock_set_state\x00', r0, 0x0, 0x3}, 0x18)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_tcp_int(r1, 0x6, 0x8, &(0x7f0000000000)=0x1, 0xffffffffffffffad)
sendmmsg(r1, &(0x7f00000007c0)=[{{&(0x7f0000000380)=@in={0x2, 0x4e24, @local}, 0x80, &(0x7f0000000140)=[{&(0x7f00000004c0)='&', 0x1}], 0x1}}], 0xf00, 0x2c000011)

20.950580062s ago: executing program 0 (id=597):
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
close(0x4)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00')
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
unshare(0x6a040000)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c)
listen(r1, 0x0)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
r3 = accept(r1, 0x0, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x20048054}, 0x0)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3)
sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x38, r4, 0x8, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macvtap0\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048801}, 0x88c0)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x14, 0x0, 0x8, 0x301, 0x0, 0x0, {0xa, 0x0, 0x6}}, 0x14}}, 0x0)
sendmsg$NFT_BATCH(r2, 0x0, 0x0)

20.010632269s ago: executing program 0 (id=599):
r0 = socket$kcm(0x10, 0x400000002, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r2 = socket(0x400000000010, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd26, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {}, {0x3, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff7, 0xc}}]}}]}, 0x40}, 0x1, 0x2000000, 0x0, 0x10}, 0x84)
sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="6000fca22e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0)

19.865468938s ago: executing program 0 (id=600):
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmmsg$inet(r0, &(0x7f0000000f00)=[{{&(0x7f0000000180)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000300)}}, {{&(0x7f0000000300)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000740)=[{&(0x7f0000000580)="82907c94bb6f14e4971ad797171adfb0537c49e527c20703e40f44f8eac6fa14a60b7c378bab64a2e3ba40edc14bb8eb3779da36f3", 0x35}, {&(0x7f00000005c0)="86ca221f50be6492fbe4289f81a934a359e5be7dc6bb79dd53319ab82253f2912f30c0d21a5451958e8b661a22110005fcd033cfe5486e7c7393484be5a415466cbedd1c4e906fc59c15c926d9239cce7fc60d047a2a2856a80278bc96d8dc4c8946d405a439601110b5bbc8eff43686b51e31d8d02899", 0x77}, {&(0x7f0000000640)="cdda8a54d48abca24edf42081a455268b7bb9e7233d737f11cb8c7e77618938467cf34af8fd1adb79c81f3d519bf0305387d064a800f463e2338a7145a08e343662dfc8c68b4274521994e3c09f2a8bd3d234f0262a159e9289ab3c26a7e9057f94dd4708c19eef5984e5fe80253c31ffd59f6025653ded693c9344c00d595cf5596cb9c2fa039657dd7c70b2c6c6264bcb33a3f2310238a7c8f7bf11cdc68dede0c2a4aa0b5ab48f9e0d065a1360f45ea2a6eafe4fae9a08330034170a829a87e73307b458baf939f56d48adc0de6de86b3375d803fa4c7", 0xd8}], 0x3, &(0x7f0000000780)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x4}}, @ip_ttl={{0x14, 0x0, 0x2, 0x54}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_ttl={{0x14, 0x0, 0x2, 0x6}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1e}}], 0x78}}, {{&(0x7f0000000800)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000a40)=[{&(0x7f0000000840)="2b4583b67e6e9a6e05c0bfd62c1de4df5c771f734da989744232354c02a93af99910015db7908be31b4d8ca6bb6e83fe5f7f30cf650d990a3a64ab1af3b2546830ccca3acb2f020828c57029dbbae89812c096d7d6d716c2d51c5e1e9598caa97510b4ddafdc704ed8c9d536dc3963550c17360335e8d998face0b0462c080c535a2b1e2589d31c95087c5491db91f9547303e99a6088300043bdbb8f5f150817b73279f6ce573997b3e2e37d082e010faaf15f4b2582b11ec76b2c9092d986df7fe5617b4a6e00a1e951d2945ef8160a18c761487c1147ae0c6d5070ac7e6adf55ec089b577cfda787ee83287aad6ca7804c16a0806ad52ea08a06ea934", 0xfe}, {&(0x7f0000000940)="153a2f1c2c43c697757ed43f07691e469ac1f749c7b980131b062b94093a3370cb3cbb8817d06397df00b51210aeb524c266a95f2f4d21bbf79a16ed8f742737bf91408421d688fe70eb6038248a2490c9046c13990a8c5cfd502ccc29992ba02d06e8408d93b43409f3960fb1519191eb28486216aba4fd689b83ed79ba562a25d73a096e66e0e27add514285f828d990aa9425beca2d55b83cec8e3e526ed15122e657e32cd202", 0xa8}, {&(0x7f0000000a00)="a21e8c0444e6f2b7f66633470a08571d2d69d040f8fd02d914b0b1211342c990a09cf7ccbaf7d4ece60a3caba64e35568fc3c749", 0x34}], 0x3, &(0x7f0000000ac0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_retopts={{0x98, 0x0, 0x7, {[@lsrr={0x83, 0x27, 0xd, [@dev={0xac, 0x14, 0x14, 0xf2}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x30}, @multicast1, @remote, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @local]}, @timestamp_prespec={0x44, 0x2c, 0xde, 0x3, 0xe, [{@loopback, 0xfffffff5}, {@dev={0xac, 0x14, 0x14, 0x25}, 0x9}, {@dev={0xac, 0x14, 0x14, 0x12}, 0x7}, {@private=0xa010100, 0x1}, {@rand_addr=0x64010100, 0x9}]}, @timestamp={0x44, 0x10, 0x61, 0x0, 0x0, [0x37, 0x100, 0x6]}, @timestamp={0x44, 0x24, 0x51, 0x0, 0x3, [0x80000000, 0x5c, 0x8, 0x0, 0x9, 0xa, 0x0, 0x3]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xd49}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x2b}, @rand_addr=0x64010100}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @broadcast}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xfe93}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @broadcast}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x3a}, @loopback}}}], 0x180}}, {{&(0x7f0000000c40)={0x2, 0x4e24, @empty}, 0x10, &(0x7f0000000d80)=[{&(0x7f0000000c80)="8cad205a82321e0b174cc67affd568d54cbfd911b607bc22a1f525220af4afe079d114230a294f5104d4708fd973ee45108e2a33b65c14008b8c39293f2aaa2ca426a4f641ef699d68391de643fc85af85029513596af076d9973cf15447c5d8999151d4c702d7f28b206f9d612ae5c633320573d6f2e3bfe4d6d8e04f63614c920341d55f903493608f1a4537e7b0fa28fac5274fef99fdba24623bee1e3de8d2bd7a446802547244ef8ceb09ccaa09996ce9a687e10c83817fb2cf86423d99b9b347b69affb67704d7e1acac0fba00b464b4a8a463d76b3abf46c9edb735af", 0xe0}], 0x1}}], 0x4, 0x4040000)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r1, 0x0, 0x0, &(0x7f0000000040)=0x80000001, 0x4)
listen(r1, 0x40200002)
socket$nl_route(0x10, 0x3, 0x0)
socketpair(0x25, 0x1, 0x600, &(0x7f0000000500)={<r2=>0xffffffffffffffff})
ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000540)={r0})
r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x54, 0x2, 0x6, 0x5, 0x7, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x20044454)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=<r5=>0x0)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r7)
sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x1c, r8, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x4008004)
write$nci(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="414601", @ANYRES32=r6], 0x4)
syz_emit_ethernet(0x4a, &(0x7f0000000400)={@local, @random='\x00 \x00\x00\x00\b', @void, {@ipv4={0x800, @tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0xd}, {[@ssrr={0x89, 0x7, 0xa2, [@broadcast]}, @generic={0x86, 0x4, "c7be"}, @cipso={0x86, 0x6, 0xffffffffffffffff}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0)
r9 = socket$inet_mptcp(0x2, 0x1, 0x106)
r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r10, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78)
setsockopt$inet_int(r9, 0x0, 0xf, &(0x7f0000000080)=0x7fffffff, 0x4)
r11 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r11, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x19}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x80)
r12 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0)
write$rfkill(r12, &(0x7f00000002c0)={0x6, 0x0, 0x3, 0x1}, 0x8)

18.521789861s ago: executing program 1 (id=610):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
close(0xffffffffffffffff)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f0000002140)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(michael_mic-generic,xchacha20-generic)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r1, 0x117, 0x7, &(0x7f00000000c0)="f8ffffff", 0x4)
r2 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10)
r3 = socket(0x15, 0xa, 0x5)
ioctl$sock_inet_SIOCRTMSG(r3, 0x890d, &(0x7f0000000180)={0x0, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e24, @multicast1}, {0x2, 0x4e20, @local}, 0x2, 0x0, 0x0, 0x0, 0xf2, 0x0, 0xfff, 0x4, 0x2})
getpeername$packet(r3, &(0x7f00000003c0)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14)
sendmmsg$inet(r2, &(0x7f0000000780)=[{{&(0x7f0000000100)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000200)="02e37e1f40bfee7609f1eeddfd22fb38f332ce9db24cd3ad698297580d821357c075a12f4c0407e795077239aea24a4fed9716c287df513a5036a9a96c2c226c95a4f9becc19013da21f7204f134cd582765b55b38f47665837afc994226a7276fdef53747734d8478ae3de5a0216b502c680c69b6328b4e12efe67ce4052dd43ca10eb610d7b9328871c522287d13871e", 0x91}, {&(0x7f0000000300)="b6f23d8363c6b11b487fc92f", 0xc}, {&(0x7f0000000500)="a41c8de7a44b3c7ec014f0ce6ead1f7fdc325ae41158494916bc9db36bd929d2aa4acb17d7c9bb04483db1d16f6eda9908f2028c45abcbfc480734feaf2aa0665528e5c401cd86bc82c4237f4609b21bc72f8b63d143b0e7e5342f17632255266119fbca525ec4482ea55e04cb7919ab6d4a79eec672c5722dacc6712367adb2247ade314f21ec6dfbf94f88e554f6c6d79d2122cc08e7273333dc85acea34e040cb8ed82d76058f5f91987a5600c9fb967e6489dfa2bc07665d74324c0aaa8c81caddc3a5302923953dc1eeedad2aa6f56e1da9618b01e7f9d3a6b44074c886cfdf22607496f2a1096f6eb55690b0ffc4c50c", 0xf3}], 0x3, &(0x7f0000000600)=[@ip_ttl={{0x14, 0x0, 0x2, 0x489bff02}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @loopback, @dev={0xac, 0x14, 0x14, 0x14}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8b}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_retopts={{0x70, 0x0, 0x7, {[@ssrr={0x89, 0xf, 0xc6, [@private=0xa010102, @loopback, @broadcast]}, @timestamp_addr={0x44, 0xc, 0x76, 0x1, 0x3, [{@private=0xa010101, 0x7ff}]}, @timestamp_prespec={0x44, 0x24, 0x25, 0x3, 0x8, [{@local, 0x4e004081}, {@broadcast, 0x4}, {@private=0xa010100, 0x6ab76604}, {@remote, 0x9}]}, @cipso={0x86, 0x1f, 0xffffffffffffffff, [{0x2, 0x4, "1379"}, {0x2, 0xa, "244b06f583b2475a"}, {0x1, 0x3, '/'}, {0x7, 0x8, "6dda93d19099"}]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfe6e}}, @ip_retopts={{0x68, 0x0, 0x7, {[@lsrr={0x83, 0x27, 0xe6, [@private=0xa010101, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @empty, @multicast2, @private=0xa010102, @empty, @empty]}, @timestamp_addr={0x44, 0x1c, 0xda, 0x1, 0x6, [{@private=0xa010101, 0x8}, {@dev={0xac, 0x14, 0x14, 0x3e}, 0x3}, {@empty, 0xff}]}, @generic={0x7, 0xe, "b70fbc16a327e38b7caef53d"}, @ra={0x94, 0x4}]}}}], 0x170}}], 0x1, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000380), r0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4)
r5 = syz_open_procfs$namespace(0xffffffffffffffff, 0x0)
write$cgroup_subtree(r5, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1801000000000000000000004b84ffec850000006d000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
sendto$inet(r6, &(0x7f0000000d40)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a", 0xfffffd61, 0x4000800, 0x0, 0xfffffffffffffef8)
recvmmsg(r6, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000d00)=[{0x0}, {&(0x7f0000000080)=""/43, 0x2b}], 0x2}, 0x2}], 0x2, 0x22, 0x0)
socket(0x400000000010, 0x6, 0xdc1f)
r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r8 = socket$vsock_stream(0x28, 0x1, 0x0)
ioctl$int_in(r8, 0x73, &(0x7f0000000080)=0xfffffffffc000000)
connect$vsock_stream(r8, &(0x7f0000000280)={0x28, 0x0, 0x0, @local}, 0x10)
r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r9, 0x0, 0x8}, 0x18)
ppoll(&(0x7f0000000500)=[{r7}], 0x1, 0x0, 0x0, 0x0)

17.64192176s ago: executing program 1 (id=614):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000001580), &(0x7f00000015c0)=0x4)
r2 = socket$nl_route(0x10, 0x3, 0x0)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={<r3=>0xffffffffffffffff})
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14)
sendmsg$nl_route_sched(r2, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000b00)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x10000000}, 0x1, r4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0)
r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000021c0)=ANY=[@ANYBLOB="181600002400e5ff25bd7000fedbdf2505"], 0x1618}], 0x1}, 0x0)
readv(r6, &(0x7f0000000140)=[{&(0x7f0000000040)=""/222, 0xde}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000200)=""/75, 0x4b}, {&(0x7f0000001380)=""/224, 0xe0}, {&(0x7f0000001480)=""/242, 0xf2}], 0x5)
writev(r1, &(0x7f0000001480)=[{&(0x7f0000000200)="4ea21354621658b8c517b34e857568b9a3e5b4459a306b119e6469a6b3067fa4c921d739dc46abef4c042513c4b3b0af9a555205e55756ed5f17d3be65aa58011a548b884e7b6b781eaf29599aaf2d5350f072a5a23782770aa0c9a7f5c7325ba4acda2a7646c6092c8bbe4af33be1802936bc7b8b585c540cf5a043fb6041c6bacea395d1052e0ee9d3967e6ef21447a472e59abf851f6ff6b53dd3a8d0c2f7c921af071c5b3791349c88de24c802eee48257d0040de930e4e2505fc01b28cd86f2142abd60a0f4319f261f6bebdce95eacf61247ac69c0c12aef24b971635476b3da77884631c9bb122c996241a1eeeacd34e715bf378c5d6c8616eb696c08923fe334ddd4c5e16ead0c470efff7089f81e19b34f872e2c9be94fbebafaa2202e1d0d7a3f5f7374b8e0cffc14a24ac0c8bdb7c52a671a32306a2a64bf2d8288571dc638bebdcc72b27a04ba002619cab4e082c669061c3788ff1456c69dc494ba20ae1506e04dd1efcce449b0feb4fcd0da72e98dc295c19c0f8ed7acfecf434a62934f4f4f6657ff32e67674aa1da9825913bfa59a666266be08cee69303a37819dd93e803ac63349f4c5e3e943faf56f4f91bc4712c28a54e66ebebf60359386b55527d9084bbe9d2406ce6b3c685096d6ae99ede25b42097a88c29743e0c46ad65cd82c6eec924456d1793340675df561175b594aeff1466a25137a9e46d30606c9727dd14aea637848c52e8a4db6979d52b2a4188dde24c94beee4387cd844dac2b0ea325e0c2ba2242080a6236dd02defdc74bc3bdc705ae5ad03d0535a722a5d15b6a83556bb261f8498e471bb508c488c4bbd47eadc8e51b84886af3ebfa26b42be4827db2bdd77bad5227f2e00e7a412bb80a34187a3814a1ab3b571a446837443cb75613ed4bca12a7e874987ab0e8b4ae1557d53b19411bf4cbc2e24ade0b766d2c5154fc47a3b1cbd812ba9274010c0f74467fcf0e98c1544e7a7cf9ac6d782513e4d489fdaaaa03f896c500140ae832d14405fe11f670f31f636f32ca8b4c8fbcc2ed887e87ad7dfe853aa0496e2f89b65a2cf17fea13b2b0a880dfd7e7293eb7e8c7a248fee166883c82ad60ad65cadb52c3ac33863edfc1140cac25ab252994a2d05443437cace9728ce57226f1aabf488fb4f5b9684d41dd74747b6360e3d774e080abd264ff1ba218f593f1d4c4306a1ddd11188f0a077b19e846a1c512c2bf4f7239d51b05026301f5ad763b5a112e66f26c92665f72560fed88a9909f3cb314e8765cb6fc7c0404d21982ae6e6ef7c04e51faf795304f926ea36fa68120d7d1e9e5297725bf70b36501470192a4a54079431e417650923358b78ae159e164135418cf8786412f54efd32a201de6afe46361aa9969474309585f535a4e9ac076fc6486a09eaca1cc82e27015a2e21370e657652ab111669f08343161cbfcfaf9695fbe7e436207ad89eb9c5855675d373e9e34f4e4bfc097e80fde3dea76c52504191a4a0554ca817785b4894addb53a78d07cb7aaa9201ff2b304ede073e38deccc98ed7eb3113385ea30f80fd2fbdb92e1e37c595c4c02758cbbdee962d691a25973f133e570e4ef0360e35de0b50bd4311818a2c286a0be20bc29614ad3e8894474acd8865f58deeb4fe5645d03b8c3334689cc322326bab364fd31b3daaa22369b894eb0e54856e7682b7affce90b6f569a1e2299b7aea193d3b9410575327e4f06079693090ada9d342fb8e09ee5b68ca7ac2dd6b73bd272756e7640a8d303d744281eddfcdba4103f16fa67ffb904d707b6c618eecaa8e68dd3204471fc89a1920f2c3dc0913094030e6026cba08021112cccddf0149f763b16c3a3bd724d93838fd8b74d0bbe2f8110f3e8cb3470a9a1d6978c3fd4bf2d244460dcb4db8f07deab62fd3d06950d28ea43a90d4fdd6e05bae1743e10b7d137fafe8aa9e2491c34a0495def97312f276aa3c3682d5389843c247f21d1a8a389a77f0b1094f27adc4f2155f7c22d52266d8a9ca98ee42acb1eea60ac3c4424c23cce93d846495a835a56e4b18cabc88292dabd1a7cb3ac5a580b9cadd9ef8bc7aee3a3f40da9c106eb4452b91285054874cb27749cfba5b5fe2cf792e19574a727fbe92e254a82fb6f6d6e23d9d4fd585c5df3448df2b351982c1704e6129e79522477859d0c9b4a62aed24f3ede19ffb71d744c052d6eb9f81950724b09dfa9a224a15b0d2c7999763fc12bee4642771a81c2e9f38cf72a1704084dd200f4d46abdfb57917cdab28ba0b3546efbc088536698ea1951e2b3f0c1cceec049ac29e7b9f240a24bc4523bda5c4dddc97d568d6fd2fd92c6986b7f9d53db7095150ecfd6f614a9bff729da88cd969a2cf1373783d2b39d9bbef486e2235422f27c302dacc27b76577202b750fe980be053a4c06c8c4d0664811f181f170b095868b719bf44d73f13f3bf98af1aea9e10fec0a6ba3361371f2a4b3214af5e9c1d489b5d2209b009e445723e632285809693caecf737766259b31ebe91a0d9ce1023d0749a089568f7ab473ca6819c725c9556294e0e82f4f3a6b96dfc6580f1d1b1d240bc93a6cb553375508b235a4de93d0f6182c2861299d425c74cf7fdfd61bcb0ee5b2995eccbd11f48f500e4f1e3400bced1bcb45c69849179a48e7dfd548994a898d79474bbe4f2df2d815d1f554dbb8a0d8592c1c45cf01f18ca70ec5305931a302d454b2649284337ea5e9a9f162601b7a12a845261cdc167c8a155c75135981337ae42a5796956831f29ea2f1a6674d7b91258e45c2de42c8f0e50dc174da34b166f9622982168760faf3d397fd25bdc27712ac9972fe417d1eb934199a53fb2cac753b1fb7a6c870b718bee44b625f9cb979433b0645d9e105fc9a458d09880d07dbfbcdc0d75a2422c849693b6ab31b4844914510352d9545b8cfd244339cc421b2cb5f992febfb57706f71a259e683130a2700a32a2471d04efc190650a4bb1e7d194944393356fd0d1fbba190ee19fb788a01c6a4b60f9e6f7905c922f455759c1f7b4e73f4bf4cc5c165440b11ce4ddc1e274dc0b2fa0cd67fefeefe02b6992bf3a5dd230e044b9b72fca2014dd1a20d14250612c4c85bd5e8e7481e3fc0f33a75f05ec6e75bb369d164fa49b30fd510024586a2a2272e0739659022067185c5d1d37970740796cd8cd32a4bd7549a8352f8e18bfbc517f4452474fa951f0d13122f372b8b1ad6c188479d0291265676211a5825d90db2e63081e7162e87541ef073667b55b371b3f1c48193c24cdd6e140dcf52d8cad4c84ec4dac76ef08f4973dd3e9b36cc3f26b8abecbfd6d2e793b57012ca6ad1e52954e927747a7183b14e8e34896c5cc9e9b838c7d5d41c1134184b352d4330e3de1f5cb2eb3177708ae33e75911cdfd6c438ce785e13dc84b4d67b121e3a4cbe59e0de895fd45c2af32f558c5682e8aedb6a50d6072a3b27c2b9360251e27dd421a74dfb87b3e7307eca36299572c3076a09e9a42539fb16b9d2bf07e91fcf3b88b26aaf73c72c4720de5163898ac809135c052e310a6fad920b90e56b0d2b066bfdd614dd4eaba94cf7e57d14fa91aec1f5a7949064a7c752492f0b4d98053033369ba11e460c1a80cdc7afc067db9c65e7e6e93481bface264b341a93446a87f7566aeb64529364f97962456b3c3ceb8504bfa8899d6033bd2f6db801855857340530fd7dc834812b36d16eb3b11ea940d904b871133fac6fc44c40e6a7249542f45424fd2dbe81cf1e9228f4175f93d474ab765f679bc01c003739326528896a68d021522459f40147fab0e1991bd1ddb83386fd2f75651f3d27fb0c86337aaf460a18ab238b8410c0d7f35a8ef8af3dd48dee991bf6fca7080daef951132807fd30c988aaf97263511330ca85c94fcfdf675c14214f855581c222683879e88f34b0320f7a38b9137e8c3e36f48c689589fe762aef0b8cd71fe0831ed567787b94dc5c45157e24d4297f5e2a95b7f11a830e5542e2b2c1cc6547a51f785d2c5cb7808ffa617857eb5de33c5a0db042542afb2761adfbc99387912101bdbc803dcd5368fa796f9156b1a1256aaff170dcadd65910e22f9793d0b92ffe8fe082b15f4b66a1e6552eb4a52c019c1dc263b28a0d9049cb049fc2ab13bfb5a263e37f22202166685c33fef0eaeba6f65894132833ce8e809e944b0373a05dffebb120702f7b2e156a8a4d0385bec0d824cefe3bc368596d37cc08c312ab2669cbd9a4090240051023a42f8e621e7bf6bd56b4ee83120751f647da1573f7d4956b675cb77465a2d7d0827bad462a50f2262f8d9d9422d5c2f6644d74a4aa661436a6dc754279b49ef6f72f39b937b04f4c071715d62ffcf6801b4fc5a8105a1d4d4318c47b4bc70754bfa6e39ddf519f0993edae9b9135f43a9911fab3930f0b747020b578d0121b42ca47ea59e1cb1baadbdbb71659b377ee932446667ba6bdb325da96bfbab9d18a3c740dcdbfacb7553e0020f294829bb47b7ae8bfc04506a4baba1c7671e3dd2ffe1824f07ffbf18de9e83ecbaabfc69b1a626ba8eb71fe4e8c994426b096c202c9cb1d7126527ba92c8a2428a08e6ec2d94e99446b65e46e67c25260c19617ef07eb9beb07c386fca04d507f62a8a1d13fa467c89484a38027be8410d5366145f88ed4c55490f067481f903e7294173cf0bfa3a953b1846dd57697b64046604606252467fe385ec3737a6963dc94aa9a9d003de8b288c477530548df5fd9f668e46d63f57296246d1d237f218f6c178ca94168060517cb8799c79de1ab0b6eae4e189d38ea879b7309fa1e2ba3bf1ea81aea286e78b63294256fb7135b6f319bc3bda3a490105eaecda9e8eb029c6c9357a1bbb3ec370ae4b2f681b0edf5faf3a0d85d241acdf649f9e5b544d71fdfa6c386aa46f13cb772cbb73ba7c5232f58f1cb0490139b636f2a3a709d3693c55a959a844c6fb632fd5b8bd58aca87e39d767e7a9be089284820f1d0e3a98c9ab7b1b2ff5aa0aa27697cc26e72e5ca04d4cf2f8e536f8bdc389450f2529e56d4f591fb017422547ca287b84f0b6d88ffa189f44461692cd6536c103a000fae7e2c4fca38d08e680437687c7da969edb84fca2c625c63a9461b2b42885ae6b0cf3d43f9e05aca08028bcad498e5c3663d9a0857879357f83dfa15375cc0b66d01d3fcc2bc489efebe41507e3c98e041b515d854a35f1fc7023aab3b46e71052f04deb8966b4ffae5ea1c7922433b309f02b393b3f9a048c409dd1619212e5e12f94059a8bf13325416669af5e8557f362a9eeaedf8c120de7934d82cd955a3c12c27c38328037d04e8849c1f92a57071e02cea36744f9270b70fe7c7e6a0d653b5e175f3e3be1e72ee3023d6842c787bc98d0d6a37e5592381052bb8e1832ac661f363ad87ac46ed968d1d876a2e860599dc1af6c28c69efda92cace1ef99db4bd9f02338b0c74e9a3d16be70fb96279d8517eab63f931464a585b9fce0520abef7f431f4f7e007296ddab0525e9047f6c7cc17be35ebbb704aaa5a130a7adba32d59ab00db45db661271aded9c0716b408f82029ba81fdc231bcb9e2182d8bdc5316153c56e8e33e563ff31aa6c007bbd4bb4e7ed84a231b7bc547b4b49fcb969a6ca24144b2cf13da656f423d1e54907daca3d37578ce994b6088db0144759b7c94161d584345a10c03059629048cd8d68020dcc290957f1c3131adfbc7c39b76a48956537b030bbe677f2c6b5f0859dc3775845808d73027c9b7824062a62d801e7a1c95bb0d0403", 0x1000}, {&(0x7f0000000100)="533c610558eb3bcbeb1627dd03a24175ac35aebaef3746fcdbdff89c58350237ab777d78c2576bbf193aef96bb2fe6a21a8830de4e38164557eabb7ee067f42be2aa57de8e2783856382bc3fbdbecc03f0b4643d87c3ce8be189675df803fa658092", 0x62}, {&(0x7f0000000180)="229e0c69071b2ed223acadfd4a854304d230f1b82286352bae39634c05e5daa67f79729fff2efe6a99c74e01", 0x2c}, {&(0x7f0000001200)="fecd9ca849e14caee5505d2c771bdc669ef1f436983defca2911c130f8ab1f278c3f68eb72743710e9ca9c20bb43fa8b74d038763c1f467f4c484aeda77cf4d9c35fe6d4", 0x44}, {&(0x7f0000001280)="3746ae56656004b8eed4b1e3235bdfbca1dd1ff992124d8e9c5e77c366b77d4a3e9ad7273cd933c4501c2efe072fa2a2a051869622bc904f2482901dbb03bc64b026c49c6ccdb454b189929e8af502ea699ad4b36c4411b3dc902196a6a00068d398f9982969a145c9ae24db959ae922cbd09cf50c5e8f117615c900fe49d15c251195346eec510e01ff362ff7528086118aa4e4e9ff5cde536e505a4fd4b7a259459093a84324e70a5bee897085cc872bbae5aa19b656c4ddcfd8747053a7289cd81beb25de494c5811158cd19304519759406467a653be0abf49f2cf7b74a3023cd6ff5d370f5f2820ad69236d6f", 0xef}, {&(0x7f0000001380)="a3acb54d471f4da18a0c8e5e205e9cbf4062f0adae38c99511debf1fff8c6bfc8e620a052c9b525b77f327d52af397064d6236b166dd0c48024a39df8617959e22b228814ecf40e5324b564a7444afa4571dbf27486825a4a26ddf4c993c80e258719833904fca5512e9f106f90ea9d01a011fcc4d6b8f1406a5eeaf7831909c507bd88b10cfc5e829417150a8ed26945efe4949bf9469615195ec1471af60c8520be1a49b0cfd3946330bd64a1cdf468ddc90617dd5a0aad90f7389c44d5d882c33ae31740236427233e05b", 0xcc}], 0x6)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0)
getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, &(0x7f0000000000)=""/136, &(0x7f00000000c0)=0x88)

17.641321477s ago: executing program 1 (id=615):
socket$pppl2tp(0x18, 0x1, 0x1)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket(0x400000000010, 0x3, 0x0)
r3 = socket$unix(0x1, 0x1, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f00000007c0), 0x480402, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettfilter={0x24, 0x2e, 0x1, 0x70bd31, 0x25dfdc03, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {0x0, 0xb}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000890}, 0x240410c0)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b000000080000fc8d9fe300090000000100005e4fc35f00", @ANYRESHEX=r0, @ANYBLOB='\x00'/20, @ANYBLOB="6e216a7bedcd7506268afb6227e4e32bcc412985fb552ff9e8f3203ecf04b15b25074360c1853a4ac695970b103b741287488eaade3b99feb52d8eb3016c86f93cc9c2ff0be72f4c162dab44e90e4dd123ea9cc85180255983e9640f6653b63ba63bb95e4ba6992fdcfbf4853e98ce0941e19194e406fe52c24c91ad6f505755bad817e3e61e9608801a7309f423938136339bcc9afe6ce7c3662f3e2adf0a451f2369a260c73a0056749798ed60d1b665c798f1a39ca497aea5e90455b5aaf3ed6a567efd56c34bc6c1e81d43b2accda98484ff480ec39e91a2d49ffdbffcdd966bcf6beb8005ed5827a972699df1fc936c20813fe92fe468aac520a33520b07b8c8ff873ce50509d274ee6fa78", @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000100001ff00000000000000000000000a2c000000050a01020000000000000000020000000900030073797a32000000000900010073797a300000000014000000020a031747d21400000000000000000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4006000}, 0x0)
r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0)
sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f0000000500)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0xa0000002}, 0xc, &(0x7f00000004c0)={&(0x7f0000000980)={0x94, r6, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@ETHTOOL_A_RINGS_HEADER={0x64, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}]}, @ETHTOOL_A_RINGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x6}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x38}]}, 0x94}, 0x1, 0x0, 0x0, 0x8000}, 0x4000)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x1b, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000b000000000000000000000a20000000000a0300000000f5ffffff00010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f08000340000000045c0000000c0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xe8}}, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14000000100001ff00000000000000000000000a2c000000050a01020000000000000000020000000900030073797a32000000000900010073797a30000000000b00000002"], 0x68}}, 0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000b000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000044000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f08000340000000045c0000000c0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xe8}}, 0x8040)
r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000040000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000023010000"], 0x48)
socket$kcm(0xa, 0x3, 0x87)
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r11 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r10, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef)
sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000740)={&(0x7f0000000680)={0x44, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40895)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000a80)='mm_page_free\x00', r9}, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0)

17.451953023s ago: executing program 1 (id=616):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)
socket$inet6_sctp(0xa, 0x5, 0x84)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020500040e000000000000000000000005000600000000000a00000000000000ff01000000000000000000000000000100000000000000000200010000000000000000000000000005000500000000000a00000000000000fe9f000000000000eeffffff00"/112], 0x70}, 0x1, 0x7}, 0x0)
r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000)
sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0xf5, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x28, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4044050}, 0x40)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0)
ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000040))
ioctl$PPPIOCSACTIVE(r4, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0})
ppoll(&(0x7f00000001c0)=[{r4, 0x1080}, {r4, 0xc200}], 0x2, 0x0, 0x0, 0x0)
write$ppp(r4, &(0x7f0000000200)="bc72", 0x2)
ioctl$SIOCNRDECOBS(r2, 0x89e2)
ioctl$int_in(r0, 0x5421, &(0x7f0000000140)=0x2f)
r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xf, 0x4, 0x8, 0x4, 0x0, 0xffffffffffffffff, 0x400000}, 0x50)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r6=>0xffffffffffffffff})
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r5, <r7=>0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)=r6}, 0x20)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={r7, &(0x7f0000000040), 0x0}, 0x20)
connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
r8 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r8, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10)
connect$inet(r8, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10)
sendmmsg$inet(r8, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="bccd84", 0x3}], 0x1}}], 0x1, 0x8011)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffff78}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x5}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000)

17.060435189s ago: executing program 2 (id=625):
socket$netlink(0x10, 0x3, 0x10)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10)
setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff9, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100a3df00000000240001060001008db446e61d34ae42845578b0338dc0cc02000000000000000000000000000000ae8d0000008c78670ea84f2af3a650ec04179562b1266312f70335f5e106d35bace411835d37c8584f560dcac2a44f7109a1ebad58a40ba92e84a4e2979971a940cbbb478c71fe76deec3d85e84684c5c4001fa49812e933e1ddeaa78b8f578327722165fae08129b81c71952a3708e1f879e81f8d59f6b14b701b6cf0ceaa7674d645a65acf2e3361554a24dbfedaa6ceaaa133d1f7d2c74e910dfbae4802fdb74d8100765c9b5d00456ee58f87b63960dffb7c7ee735"], 0x38}}, 0x8845)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
close(r5)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10)
sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a90000000060a0b0400000000000000000200000064000480600001800a000100696e6e6572f7ff005000028008000240000000840800034000000002100005800c0001007061796c6f616400080001400000000024000580090001006d6574610000000014100280080001400000000e08000240000000010900010073797a3000000000fc43890900020073797a000000000000000100000a"], 0xb8}}, 0x0)
r7 = socket$inet(0x2, 0x80000, 0x52)
r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r8}, 0x10)
setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4)
shutdown(r7, 0x0)
recvmmsg(r7, &(0x7f00000066c0), 0xa0d, 0x0, 0x0)
r9 = socket$inet6_mptcp(0xa, 0x1, 0x106)
listen(r9, 0x0)
r10 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r10, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff)

16.551593927s ago: executing program 1 (id=626):
r0 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c)
setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c)
setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000]}}, 0x5c)
setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x4}, 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x89f, 0x8, 0x1]}}, 0x5c)
setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000340)=0x6, 0x4)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x3)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
r7 = socket(0x400000000010, 0x3, 0x0)
r8 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000940)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0xa000, {0x0, 0x0, 0x0, r9, {0xe, 0x7}, {0x0, 0xfff1}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x1, 0xe}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000008f8ff000028000000000006907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5cc2000090780000"], 0x0)
r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_GET_WOWLAN(r1, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)={0x24, r10, 0x301, 0x0, 0x25dfdbff, {{0x5}, {@val={0x8, 0x1, 0x7c}, @val={0x8}, @void}}}, 0x24}, 0x1, 0x0, 0x0, 0x4044041}, 0x20000000)

16.451810851s ago: executing program 1 (id=627):
r0 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2042, 0x4, 0x1}, 0x10)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0x8000}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001e334185850000007300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000a80)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r2 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r2, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x10000000}}, 0x10)
r3 = socket$inet6_mptcp(0xa, 0x1, 0x106)
sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x78, 0x0, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x578}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7f}]}, @TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x48025}, 0x8050)
setsockopt$sock_int(r3, 0x1, 0x1, &(0x7f00000000c0)=0x3a7b, 0x4)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[@ANYBLOB="8400000010000305000000040000000000000000", @ANYRES32=0x0, @ANYBLOB="1546010000000000540012800c0001006d6163766c616e0044000280060002000100000008000100010000000800030003000000080007000500000008000100100000000600020001000000100005800a"], 0x84}}, 0x20008040)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f00000027c0)=@file={0x0, './file0\x00'}, 0x6e)
r6 = socket$netlink(0x10, 0x3, 0x0)
writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1)
writev(r6, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1)
sendmsg$NFT_BATCH(r6, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1200030}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xd}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}, 0x1, 0x0, 0x0, 0x40885}, 0x40001)
r7 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r7, &(0x7f00000000c0), 0x10)
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r7], 0x448}}, 0x0)
sendmmsg$inet(r7, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086", 0x2b}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100)}}], 0x2, 0x0)
sendmmsg$unix(r5, &(0x7f00000bd000), 0x2d, 0x20040040)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000580)=ANY=[@ANYBLOB="180000002d00010026bd7000ecdbdf2504000e80ee9710844e40c2bf66a4b426571659e900000000"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)
ppoll(&(0x7f00000000c0)=[{r5, 0x2045}, {r5, 0x212bdb8c3662ab0c}], 0x2, 0x0, 0x0, 0x0)
r9 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/pid\x00')
ioctl$NS_GET_PARENT(r9, 0x8004b707, 0x0)
connect$unix(r5, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f0000000180)={0x20000010})

16.172250557s ago: executing program 2 (id=628):
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x8001, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x80000000}]}]}, 0xfc}}, 0x0)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="84010000210001000000000000000000fc020000000000000000000000000000fe80000000000000000000000000003500000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000034011100ac14140c000000000000000000000000fc000000000000000000000000000001fc020000000000000000000000000000fe8000000000000000000000000000aa6c01a8000200000002000a00ac1414aa000000000000000000000000fe8000000000000000000000000000aa00000000000000000000000000000000ff020000000000000000000000000001ff020000003500000a000800ac1414bb000000000000000000000000fc02000000000000000000000000000064010102000000000000000000000000fe8000000000000000000000000000323c"], 0x184}}, 0x0)
shutdown(r0, 0x0)
recvmmsg(r0, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000004a00)=[{&(0x7f0000001a00)=""/4099, 0x1003}], 0x1}}], 0x1003, 0x10122, 0x0)

16.119840459s ago: executing program 2 (id=629):
socket$packet(0x11, 0x2, 0x300) (async)
socket$packet(0x11, 0x2, 0x300)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00'})
sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001940)=@newchain={0x0, 0x64, 0x300, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x3, 0xc}, {0xfffe, 0x4}, {0xb, 0x9}}, [@TCA_RATE={0x0, 0x5, {0x80, 0x3}}, @TCA_RATE={0x0, 0x5, {0x3, 0xe}}, @TCA_RATE={0x0, 0x5, {0x1, 0x5}}, @filter_kind_options=@f_bpf={{}, {0x0, 0x2, [@TCA_BPF_ACT={0x0, 0x1, [@m_skbmod={0x0, 0x9, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_SKBMOD_SMAC={0x0, 0x4, @local}, @TCA_SKBMOD_DMAC={0x0, 0x3, @local}, @TCA_SKBMOD_DMAC={0x0, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, @TCA_SKBMOD_SMAC, @TCA_SKBMOD_ETYPE={0x0, 0x5, 0xdddc}]}, {0x0, 0x6, "56f2cd"}, {}, {0x0, 0x8, {0x3, 0x1}}}}]}, @TCA_BPF_FD, @TCA_BPF_FLAGS={0x0, 0x8, 0x1}, @TCA_BPF_FLAGS={0x0, 0x8, 0x1}, @TCA_BPF_CLASSID={0x0, 0x3, {0xffe0, 0xf}}, @TCA_BPF_CLASSID={0x0, 0x3, {0xfff2, 0x8}}]}}, @TCA_RATE={0x0, 0x5, {0xb, 0x2}}]}, 0x12c}}, 0x0)
socket$inet_mptcp(0x2, 0x1, 0x106) (async)
socket$inet_mptcp(0x2, 0x1, 0x106)
socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x60, 0x2, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) (async)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4)
r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00"/12], 0x48)
socket$inet(0x2b, 0x801, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000003f00000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10)
ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0)
r5 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) (async)
bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58)
socket(0x10, 0x803, 0x0) (async)
socket(0x10, 0x803, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0)
close(r6)
socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$SIOCSIFHWADDR(r6, 0x8b26, &(0x7f0000000200)={'wlan1\x00', @random="ffffff8dffff"})
r7 = socket$inet_tcp(0x2, 0x1, 0x0)
syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) (async)
bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10)
connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async)
connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000140)='cubic', 0x4)

16.022152549s ago: executing program 2 (id=630):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x2, 0x4)
ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x4e24, @multicast1}, {0x2, 0x4e20, @broadcast}, {0x2, 0x4e23, @loopback}, 0x90, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000000)='wlan0\x00', 0x5, 0x0, 0x5})

16.0208549s ago: executing program 2 (id=631):
socket$inet6_mptcp(0xa, 0x1, 0x106)
pipe(&(0x7f00000001c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
pipe(&(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
splice(r3, 0x0, r1, 0x0, 0xf3a, 0x0) (async)
splice(r3, 0x0, r1, 0x0, 0xf3a, 0x0)
splice(r0, 0x0, r5, 0x0, 0x80, 0x0)
write(r2, 0x0, 0x0)
r6 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r6, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async)
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) (async)
r9 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48)
bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r10}, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000006c0)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async)
r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000006c0)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r11, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="cedd00"/14, 0x0, 0x21fe4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r11, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="cedd00"/14, 0x0, 0x21fe4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)
ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000000)={'wpan1\x00', <r12=>0x0})
sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)={0x5c, r9, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_SEC_DEVKEY={0x40, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0x28, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x12, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa3}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x5c}}, 0x0) (async)
sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)={0x5c, r9, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_SEC_DEVKEY={0x40, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0x28, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x12, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa3}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x5c}}, 0x0)
r13 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000280), r8)
ioctl$sock_SIOCOUTQNSD(r4, 0x894b, &(0x7f0000000000))
sendmsg$NLBL_CIPSOV4_C_ADD(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000000000000000100000008000100040000002c000480050003ff800000000500030080ffffff05000300000000000500036c1dff00000500030080ffffff0800020003"], 0x50}, 0x1, 0x0, 0x0, 0x20000002}, 0x0)
setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18)
socket$inet6(0xa, 0x800, 0x9)
r14 = accept4(r6, 0x0, 0x0, 0x0)
sendmsg$TIPC_NL_MEDIA_SET(r14, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000240)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4044090}, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'bridge_slave_1\x00'})
recvmsg$unix(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)=""/44, 0x2c}, {&(0x7f0000002840)=""/4080, 0xff0}], 0x2}, 0x0) (async)
recvmsg$unix(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)=""/44, 0x2c}, {&(0x7f0000002840)=""/4080, 0xff0}], 0x2}, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) (async)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48)
setsockopt$inet_sctp6_SCTP_NODELAY(r14, 0x84, 0x3, &(0x7f00000001c0)=0xd, 0x4)
socket$netlink(0x10, 0x3, 0x0) (async)
socket$netlink(0x10, 0x3, 0x0)

15.871560055s ago: executing program 2 (id=632):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
r1 = openat$cgroup_devices(r0, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0)
write$cgroup_devices(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='b *:462', @ANYRES16=r1], 0xa)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$SO_TIMESTAMP(r2, 0x1, 0x24, &(0x7f0000000340)=0x7e, 0x4)
listen(r2, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8)
write$cgroup_subtree(r4, &(0x7f0000000280)={[{0x2b, 'rlimit'}]}, 0x8)
r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ANNOUNCE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r5, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x9dfe7809f5da41d5}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x4048004}, 0x800)

4.035866888s ago: executing program 32 (id=600):
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmmsg$inet(r0, &(0x7f0000000f00)=[{{&(0x7f0000000180)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000300)}}, {{&(0x7f0000000300)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000740)=[{&(0x7f0000000580)="82907c94bb6f14e4971ad797171adfb0537c49e527c20703e40f44f8eac6fa14a60b7c378bab64a2e3ba40edc14bb8eb3779da36f3", 0x35}, {&(0x7f00000005c0)="86ca221f50be6492fbe4289f81a934a359e5be7dc6bb79dd53319ab82253f2912f30c0d21a5451958e8b661a22110005fcd033cfe5486e7c7393484be5a415466cbedd1c4e906fc59c15c926d9239cce7fc60d047a2a2856a80278bc96d8dc4c8946d405a439601110b5bbc8eff43686b51e31d8d02899", 0x77}, {&(0x7f0000000640)="cdda8a54d48abca24edf42081a455268b7bb9e7233d737f11cb8c7e77618938467cf34af8fd1adb79c81f3d519bf0305387d064a800f463e2338a7145a08e343662dfc8c68b4274521994e3c09f2a8bd3d234f0262a159e9289ab3c26a7e9057f94dd4708c19eef5984e5fe80253c31ffd59f6025653ded693c9344c00d595cf5596cb9c2fa039657dd7c70b2c6c6264bcb33a3f2310238a7c8f7bf11cdc68dede0c2a4aa0b5ab48f9e0d065a1360f45ea2a6eafe4fae9a08330034170a829a87e73307b458baf939f56d48adc0de6de86b3375d803fa4c7", 0xd8}], 0x3, &(0x7f0000000780)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x4}}, @ip_ttl={{0x14, 0x0, 0x2, 0x54}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_ttl={{0x14, 0x0, 0x2, 0x6}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1e}}], 0x78}}, {{&(0x7f0000000800)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000a40)=[{&(0x7f0000000840)="2b4583b67e6e9a6e05c0bfd62c1de4df5c771f734da989744232354c02a93af99910015db7908be31b4d8ca6bb6e83fe5f7f30cf650d990a3a64ab1af3b2546830ccca3acb2f020828c57029dbbae89812c096d7d6d716c2d51c5e1e9598caa97510b4ddafdc704ed8c9d536dc3963550c17360335e8d998face0b0462c080c535a2b1e2589d31c95087c5491db91f9547303e99a6088300043bdbb8f5f150817b73279f6ce573997b3e2e37d082e010faaf15f4b2582b11ec76b2c9092d986df7fe5617b4a6e00a1e951d2945ef8160a18c761487c1147ae0c6d5070ac7e6adf55ec089b577cfda787ee83287aad6ca7804c16a0806ad52ea08a06ea934", 0xfe}, {&(0x7f0000000940)="153a2f1c2c43c697757ed43f07691e469ac1f749c7b980131b062b94093a3370cb3cbb8817d06397df00b51210aeb524c266a95f2f4d21bbf79a16ed8f742737bf91408421d688fe70eb6038248a2490c9046c13990a8c5cfd502ccc29992ba02d06e8408d93b43409f3960fb1519191eb28486216aba4fd689b83ed79ba562a25d73a096e66e0e27add514285f828d990aa9425beca2d55b83cec8e3e526ed15122e657e32cd202", 0xa8}, {&(0x7f0000000a00)="a21e8c0444e6f2b7f66633470a08571d2d69d040f8fd02d914b0b1211342c990a09cf7ccbaf7d4ece60a3caba64e35568fc3c749", 0x34}], 0x3, &(0x7f0000000ac0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_retopts={{0x98, 0x0, 0x7, {[@lsrr={0x83, 0x27, 0xd, [@dev={0xac, 0x14, 0x14, 0xf2}, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x30}, @multicast1, @remote, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @local]}, @timestamp_prespec={0x44, 0x2c, 0xde, 0x3, 0xe, [{@loopback, 0xfffffff5}, {@dev={0xac, 0x14, 0x14, 0x25}, 0x9}, {@dev={0xac, 0x14, 0x14, 0x12}, 0x7}, {@private=0xa010100, 0x1}, {@rand_addr=0x64010100, 0x9}]}, @timestamp={0x44, 0x10, 0x61, 0x0, 0x0, [0x37, 0x100, 0x6]}, @timestamp={0x44, 0x24, 0x51, 0x0, 0x3, [0x80000000, 0x5c, 0x8, 0x0, 0x9, 0xa, 0x0, 0x3]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xd49}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x2b}, @rand_addr=0x64010100}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @broadcast}}}, @ip_ttl={{0x14, 0x0, 0x2, 0xfe93}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @broadcast}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x3a}, @loopback}}}], 0x180}}, {{&(0x7f0000000c40)={0x2, 0x4e24, @empty}, 0x10, &(0x7f0000000d80)=[{&(0x7f0000000c80)="8cad205a82321e0b174cc67affd568d54cbfd911b607bc22a1f525220af4afe079d114230a294f5104d4708fd973ee45108e2a33b65c14008b8c39293f2aaa2ca426a4f641ef699d68391de643fc85af85029513596af076d9973cf15447c5d8999151d4c702d7f28b206f9d612ae5c633320573d6f2e3bfe4d6d8e04f63614c920341d55f903493608f1a4537e7b0fa28fac5274fef99fdba24623bee1e3de8d2bd7a446802547244ef8ceb09ccaa09996ce9a687e10c83817fb2cf86423d99b9b347b69affb67704d7e1acac0fba00b464b4a8a463d76b3abf46c9edb735af", 0xe0}], 0x1}}], 0x4, 0x4040000)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r1, 0x0, 0x0, &(0x7f0000000040)=0x80000001, 0x4)
listen(r1, 0x40200002)
socket$nl_route(0x10, 0x3, 0x0)
socketpair(0x25, 0x1, 0x600, &(0x7f0000000500)={<r2=>0xffffffffffffffff})
ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000540)={r0})
r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x54, 0x2, 0x6, 0x5, 0x7, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x20044454)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet_udp(0x2, 0x2, 0x0)
ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=<r5=>0x0)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r7)
sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x1c, r8, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x4008004)
write$nci(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="414601", @ANYRES32=r6], 0x4)
syz_emit_ethernet(0x4a, &(0x7f0000000400)={@local, @random='\x00 \x00\x00\x00\b', @void, {@ipv4={0x800, @tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0xd}, {[@ssrr={0x89, 0x7, 0xa2, [@broadcast]}, @generic={0x86, 0x4, "c7be"}, @cipso={0x86, 0x6, 0xffffffffffffffff}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0)
r9 = socket$inet_mptcp(0x2, 0x1, 0x106)
r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r10, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78)
setsockopt$inet_int(r9, 0x0, 0xf, &(0x7f0000000080)=0x7fffffff, 0x4)
r11 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r11, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x19}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x80)
r12 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0)
write$rfkill(r12, &(0x7f00000002c0)={0x6, 0x0, 0x3, 0x1}, 0x8)

1.019925367s ago: executing program 33 (id=627):
r0 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2042, 0x4, 0x1}, 0x10)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x0, 0x8000}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001e334185850000007300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000a80)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r2 = socket$tipc(0x1e, 0x2, 0x0)
bind$tipc(r2, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x10000000}}, 0x10)
r3 = socket$inet6_mptcp(0xa, 0x1, 0x106)
sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)={0x78, 0x0, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x578}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7f}]}, @TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x48025}, 0x8050)
setsockopt$sock_int(r3, 0x1, 0x1, &(0x7f00000000c0)=0x3a7b, 0x4)
bind$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[@ANYBLOB="8400000010000305000000040000000000000000", @ANYRES32=0x0, @ANYBLOB="1546010000000000540012800c0001006d6163766c616e0044000280060002000100000008000100010000000800030003000000080007000500000008000100100000000600020001000000100005800a"], 0x84}}, 0x20008040)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f00000027c0)=@file={0x0, './file0\x00'}, 0x6e)
r6 = socket$netlink(0x10, 0x3, 0x0)
writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1)
writev(r6, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1)
sendmsg$NFT_BATCH(r6, &(0x7f0000000680)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1200030}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xd}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x28}, 0x1, 0x0, 0x0, 0x40885}, 0x40001)
r7 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r7, &(0x7f00000000c0), 0x10)
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r7], 0x448}}, 0x0)
sendmmsg$inet(r7, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086", 0x2b}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100)}}], 0x2, 0x0)
sendmmsg$unix(r5, &(0x7f00000bd000), 0x2d, 0x20040040)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000580)=ANY=[@ANYBLOB="180000002d00010026bd7000ecdbdf2504000e80ee9710844e40c2bf66a4b426571659e900000000"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000)
ppoll(&(0x7f00000000c0)=[{r5, 0x2045}, {r5, 0x212bdb8c3662ab0c}], 0x2, 0x0, 0x0, 0x0)
r9 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/pid\x00')
ioctl$NS_GET_PARENT(r9, 0x8004b707, 0x0)
connect$unix(r5, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r5, &(0x7f0000000180)={0x20000010})

0s ago: executing program 34 (id=632):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
r1 = openat$cgroup_devices(r0, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0)
write$cgroup_devices(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='b *:462', @ANYRES16=r1], 0xa)
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$SO_TIMESTAMP(r2, 0x1, 0x24, &(0x7f0000000340)=0x7e, 0x4)
listen(r2, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8)
write$cgroup_subtree(r4, &(0x7f0000000280)={[{0x2b, 'rlimit'}]}, 0x8)
r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ANNOUNCE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r5, 0x300, 0x70bd28, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x9dfe7809f5da41d5}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x68}, 0x1, 0x0, 0x0, 0x4048004}, 0x800)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:60436' (ED25519) to the list of known hosts.
syzkaller login: [   56.148593][ T5841] cgroup: Unknown subsys name 'net'
[   56.265084][ T5841] cgroup: Unknown subsys name 'cpuset'
[   56.272652][ T5841] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.165209][ T5841] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.334983][ T5857] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.338809][ T5857] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.342053][ T5857] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.345358][ T5857] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.356985][ T5860] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.361254][ T5860] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.364626][ T5860] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.367921][ T5857] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.371778][ T5860] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.376304][ T5860] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.378986][ T5860] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   63.399697][ T5866] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.404370][ T5866] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.408518][ T5866] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.415972][ T5866] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.689386][ T5863] chnl_net:caif_netlink_parms(): no params data found
[   63.739899][ T5853] chnl_net:caif_netlink_parms(): no params data found
[   63.785180][ T5854] chnl_net:caif_netlink_parms(): no params data found
[   63.834724][ T5863] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.838485][ T5863] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.841659][ T5863] bridge_slave_0: entered allmulticast mode
[   63.845783][ T5863] bridge_slave_0: entered promiscuous mode
[   63.872286][ T5863] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.875266][ T5863] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.878695][ T5863] bridge_slave_1: entered allmulticast mode
[   63.882579][ T5863] bridge_slave_1: entered promiscuous mode
[   63.923398][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.926454][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.929560][ T5853] bridge_slave_0: entered allmulticast mode
[   63.933520][ T5853] bridge_slave_0: entered promiscuous mode
[   63.975137][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.978606][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.981488][ T5853] bridge_slave_1: entered allmulticast mode
[   63.984543][ T5853] bridge_slave_1: entered promiscuous mode
[   63.998957][ T5863] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.017706][ T5854] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.020468][ T5854] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.023330][ T5854] bridge_slave_0: entered allmulticast mode
[   64.028278][ T5854] bridge_slave_0: entered promiscuous mode
[   64.033733][ T5863] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.039263][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.042899][ T5854] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.045952][ T5854] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.048899][ T5854] bridge_slave_1: entered allmulticast mode
[   64.051945][ T5854] bridge_slave_1: entered promiscuous mode
[   64.056356][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.115089][ T5853] team0: Port device team_slave_0 added
[   64.134332][ T5854] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.139956][ T5853] team0: Port device team_slave_1 added
[   64.144381][ T5863] team0: Port device team_slave_0 added
[   64.149771][ T5854] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.175636][ T5863] team0: Port device team_slave_1 added
[   64.215035][ T5863] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.217645][ T5863] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.225743][ T5863] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.230777][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.233026][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.242001][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.247719][ T5854] team0: Port device team_slave_0 added
[   64.250877][ T5863] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.253655][ T5863] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.262783][ T5863] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.266805][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.269149][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.277929][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.283208][ T5854] team0: Port device team_slave_1 added
[   64.316201][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.318717][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.328751][ T5854] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.334897][ T5854] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.337883][ T5854] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.347468][ T5854] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.404462][ T5863] hsr_slave_0: entered promiscuous mode
[   64.409243][ T5863] hsr_slave_1: entered promiscuous mode
[   64.430183][ T5853] hsr_slave_0: entered promiscuous mode
[   64.433099][ T5853] hsr_slave_1: entered promiscuous mode
[   64.435778][ T5853] debugfs: 'hsr0' already exists in 'hsr'
[   64.438175][ T5853] Cannot create hsr debugfs directory
[   64.458784][ T5854] hsr_slave_0: entered promiscuous mode
[   64.462543][ T5854] hsr_slave_1: entered promiscuous mode
[   64.465559][ T5854] debugfs: 'hsr0' already exists in 'hsr'
[   64.468157][ T5854] Cannot create hsr debugfs directory
[   64.775213][ T5854] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   64.787795][ T5854] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   64.792851][ T5854] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   64.799563][ T5854] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   64.890493][ T5863] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   64.902531][ T5863] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   64.909182][ T5863] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   64.925335][ T5863] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   64.978586][ T5853] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   64.985230][ T5853] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   64.993102][ T5853] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   65.000791][ T5853] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   65.110260][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.116532][ T5854] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.146426][ T5853] 8021q: adding VLAN 0 to HW filter on device team0
[   65.158711][ T5863] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.167593][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.170825][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.180536][ T5854] 8021q: adding VLAN 0 to HW filter on device team0
[   65.202666][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.205557][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.213882][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.216907][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.224715][   T40] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.227704][   T40] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.242770][ T5863] 8021q: adding VLAN 0 to HW filter on device team0
[   65.256817][   T40] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.259091][   T40] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.273838][ T4345] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.276717][ T4345] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.419062][   T55] Bluetooth: hci2: command tx timeout
[   65.421210][   T55] Bluetooth: hci0: command tx timeout
[   65.501290][ T5866] Bluetooth: hci1: command tx timeout
[   65.517700][ T5863] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.526033][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.564166][ T5854] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.601301][ T5853] veth0_vlan: entered promiscuous mode
[   65.609338][ T5863] veth0_vlan: entered promiscuous mode
[   65.629724][ T5863] veth1_vlan: entered promiscuous mode
[   65.635227][ T5853] veth1_vlan: entered promiscuous mode
[   65.645821][ T5854] veth0_vlan: entered promiscuous mode
[   65.669769][ T5854] veth1_vlan: entered promiscuous mode
[   65.702084][ T5853] veth0_macvtap: entered promiscuous mode
[   65.710776][ T5853] veth1_macvtap: entered promiscuous mode
[   65.718357][ T5863] veth0_macvtap: entered promiscuous mode
[   65.734974][ T5863] veth1_macvtap: entered promiscuous mode
[   65.743232][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.751680][ T5854] veth0_macvtap: entered promiscuous mode
[   65.761569][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.768902][ T5854] veth1_macvtap: entered promiscuous mode
[   65.779257][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.790110][ T5863] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.793102][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.811993][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.819572][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.827618][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.836574][ T5863] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.848993][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.854819][ T5887] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.888194][ T5887] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.910283][ T5887] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.913502][ T5887] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.953602][ T5887] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.957646][ T5887] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.967987][  T182] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.971445][  T182] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.974009][ T5887] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.982878][ T5887] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   66.035563][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.047339][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.065285][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.072395][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.114108][ T5853] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   66.123486][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.126011][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.154655][ T4345] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.167007][ T4345] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.175438][ T5923] netlink: 'syz.2.3': attribute type 2 has an invalid length.
[   66.181443][ T1091] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.184614][ T5923] netlink: 'syz.2.3': attribute type 1 has an invalid length.
[   66.187483][ T1091] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.197761][ T5923] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3'.
[   66.335548][ T5928] netlink: 'syz.1.2': attribute type 1 has an invalid length.
[   66.469824][ T5941] bridge0: port 2(bridge_slave_1) entered disabled state
[   66.473724][ T5941] bridge0: port 1(bridge_slave_0) entered disabled state
[   66.535494][ T5948] Zero length message leads to an empty skb
[   66.563217][ T5941] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   66.572963][ T5941] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   66.695833][   T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.709797][   T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.712842][   T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.736703][ T5954] pim6reg1: entered promiscuous mode
[   66.739272][ T5954] pim6reg1: entered allmulticast mode
[   66.748581][ T5944] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8'.
[   66.764111][   T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.790310][ T5963] netlink: 'syz.1.10': attribute type 10 has an invalid length.
[   66.801411][ T5963] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   66.820211][ T5962] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10'.
[   66.824024][ T5962] bridge_slave_1: left allmulticast mode
[   66.826314][ T5962] bridge_slave_1: left promiscuous mode
[   66.830508][ T5962] bridge0: port 2(bridge_slave_1) entered disabled state
[   66.849423][ T5962] bridge_slave_0: left allmulticast mode
[   66.852499][ T5962] bridge_slave_0: left promiscuous mode
[   66.855414][ T5962] bridge0: port 1(bridge_slave_0) entered disabled state
[   66.881510][ T5962] bond0: (slave bridge0): Releasing backup interface
[   67.497169][ T5866] Bluetooth: hci0: command tx timeout
[   67.498959][   T55] Bluetooth: hci2: command tx timeout
[   67.577053][   T55] Bluetooth: hci1: command tx timeout
[   68.620697][ T5979] bridge0: port 2(bridge_slave_1) entered disabled state
[   68.623334][ T5979] bridge0: port 1(bridge_slave_0) entered disabled state
[   68.691180][ T5979] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   68.699026][ T5979] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   68.768948][   T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   68.772029][   T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   68.785565][   T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   68.791866][   T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   68.823201][ T5987] netlink: 16 bytes leftover after parsing attributes in process `syz.0.17'.
[   68.864265][ T5989] netlink: 20 bytes leftover after parsing attributes in process `syz.2.18'.
[   68.997220][ T5999] pim6reg1: entered promiscuous mode
[   68.999531][ T5999] pim6reg1: entered allmulticast mode
[   69.003266][ T5999] netlink: 32 bytes leftover after parsing attributes in process `syz.2.20'.
[   69.111735][ T6008] netlink: 12 bytes leftover after parsing attributes in process `syz.1.21'.
[   69.115433][ T6008] netlink: 8 bytes leftover after parsing attributes in process `syz.1.21'.
[   69.577874][ T5866] Bluetooth: hci0: command tx timeout
[   69.580236][   T55] Bluetooth: hci2: command tx timeout
[   69.657022][   T55] Bluetooth: hci1: command tx timeout
[   69.793080][ T6033] syzkaller1: entered promiscuous mode
[   69.795394][ T6033] syzkaller1: entered allmulticast mode
[   69.832152][ T6035] netlink: 8 bytes leftover after parsing attributes in process `syz.0.27'.
[   69.854286][ T6035] syzkaller1: entered promiscuous mode
[   69.856157][ T6035] syzkaller1: entered allmulticast mode
[   69.860832][ T6036] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   70.035841][ T6045] netlink: 16 bytes leftover after parsing attributes in process `syz.1.31'.
[   70.059562][ T6043] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.063006][ T6043] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.129462][ T6043] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   70.136078][ T6043] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   70.232291][   T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.236100][   T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.254078][   T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.259201][   T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   70.275350][ T6053] pim6reg1: entered promiscuous mode
[   70.277729][ T6053] pim6reg1: entered allmulticast mode
[   70.289291][ T6057] bond0: (slave vlan2): Opening slave failed
[   70.532871][ T6072] netlink: 'syz.2.37': attribute type 1 has an invalid length.
[   70.965165][ T6107] netlink: 'syz.2.44': attribute type 10 has an invalid length.
[   70.979022][ T6107] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   70.995200][ T6107] bridge_slave_1: left allmulticast mode
[   70.997918][ T6107] bridge_slave_1: left promiscuous mode
[   71.000335][ T6107] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.005419][ T6107] bridge_slave_0: left allmulticast mode
[   71.008825][ T6107] bridge_slave_0: left promiscuous mode
[   71.011697][ T6107] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.025860][ T6107] bond0: (slave bridge0): Releasing backup interface
[   71.259799][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   71.262076][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.361323][ T6132] warning: `syz.0.47' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   71.501151][ T6143] __nla_validate_parse: 2 callbacks suppressed
[   71.501163][ T6143] netlink: 36 bytes leftover after parsing attributes in process `syz.0.48'.
[   71.657329][   T55] Bluetooth: hci2: command tx timeout
[   71.659654][   T55] Bluetooth: hci0: command tx timeout
[   71.747190][   T55] Bluetooth: hci1: command tx timeout
[   72.557673][ T6236] netlink: 12 bytes leftover after parsing attributes in process `syz.0.55'.
[   73.131527][ T6264] pim6reg1: entered promiscuous mode
[   73.133553][ T6264] pim6reg1: entered allmulticast mode
[   73.137597][ T6264] netlink: 32 bytes leftover after parsing attributes in process `syz.2.60'.
[   73.229934][ T6267] netlink: 'syz.1.61': attribute type 4 has an invalid length.
[   73.935599][ T6278] netlink: 'syz.0.64': attribute type 11 has an invalid length.
[   73.976035][ T6280] netlink: 40 bytes leftover after parsing attributes in process `syz.0.65'.
[   73.992679][ T6280] netlink: 'syz.0.65': attribute type 11 has an invalid length.
[   73.996295][ T6280] netlink: 244 bytes leftover after parsing attributes in process `syz.0.65'.
[   74.076023][ T6287] netlink: 8 bytes leftover after parsing attributes in process `syz.2.68'.
[   74.245176][ T6294] netlink: 'syz.0.67': attribute type 1 has an invalid length.
[   74.248909][ T6294] netlink: 220 bytes leftover after parsing attributes in process `syz.0.67'.
[   74.263093][ T6299] netlink: 8 bytes leftover after parsing attributes in process `syz.2.69'.
[   74.484926][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.70'.
[   74.488713][ T6305] batman_adv: batadv0: Removing interface: batadv_slave_0
[   74.492980][ T6305] batman_adv: batadv0: Removing interface: batadv_slave_1
[   74.992651][ T6316] netlink: 'syz.1.74': attribute type 16 has an invalid length.
[   75.005148][ T6316] netlink: 'syz.1.74': attribute type 17 has an invalid length.
[   75.013368][ T6316] netlink: 4 bytes leftover after parsing attributes in process `syz.1.74'.
[   75.167535][ T6309] netlink: 'syz.0.72': attribute type 1 has an invalid length.
[   75.170841][ T6309] nbd: error processing sock list
[   75.173100][ T6309] block nbd0: shutting down sockets
[   75.206441][ T6323] 8021q: adding VLAN 0 to HW filter on device bond0
[   75.212312][ T6323] 8021q: adding VLAN 0 to HW filter on device team0
[   75.222553][ T6323] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   76.128460][ T6353] syz.0.85 uses obsolete (PF_INET,SOCK_PACKET)
[   76.196207][ T6361] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   76.419423][ T6372] ieee802154 phy0 wpan0: encryption failed: -22
[   76.510572][ T6382] __nla_validate_parse: 6 callbacks suppressed
[   76.510584][ T6382] netlink: 40 bytes leftover after parsing attributes in process `syz.2.94'.
[   76.521029][ T6382] netlink: 20 bytes leftover after parsing attributes in process `syz.2.94'.
[   76.571961][ T6388] netlink: 112 bytes leftover after parsing attributes in process `syz.1.96'.
[   76.838004][ T6402] netlink: 16 bytes leftover after parsing attributes in process `syz.2.102'.
[   76.853093][ T6402] bond0: entered promiscuous mode
[   76.855325][ T6402] bond_slave_0: entered promiscuous mode
[   76.859052][ T6402] bond_slave_1: entered promiscuous mode
[   76.865541][ T6402] bond0: left promiscuous mode
[   76.868525][ T6402] bond_slave_0: left promiscuous mode
[   76.871644][ T6402] bond_slave_1: left promiscuous mode
[   77.675053][ T6423] pim6reg1: entered promiscuous mode
[   77.677372][ T6423] pim6reg1: entered allmulticast mode
[   77.682622][ T6423] netlink: 32 bytes leftover after parsing attributes in process `syz.1.109'.
[   77.980981][ T6427] netlink: 24 bytes leftover after parsing attributes in process `syz.2.110'.
[   78.848514][ T6451] netlink: 'syz.2.116': attribute type 5 has an invalid length.
[   78.980944][ T6462] netlink: 16 bytes leftover after parsing attributes in process `syz.1.120'.
[   79.009363][ T6463] IPVS: set_ctl: invalid protocol: 115 172.20.20.25:20001
[   79.160644][ T6470] netlink: 7 bytes leftover after parsing attributes in process `syz.0.121'.
[   79.819464][ T6486] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   80.108023][ T6498] netlink: 28 bytes leftover after parsing attributes in process `syz.0.127'.
[   80.259287][ T6500] syzkaller0: entered promiscuous mode
[   80.261254][ T6500] syzkaller0: entered allmulticast mode
[   80.277313][ T6500] netlink: 16 bytes leftover after parsing attributes in process `syz.2.128'.
[   80.867026][ T6532] tipc: Started in network mode
[   80.869051][ T6532] tipc: Node identity ac14142f, cluster identity 4711
[   80.873173][ T6532] tipc: New replicast peer: 0.0.0.0
[   80.877412][ T6532] tipc: Enabled bearer <udp:syz2>, priority 10
[   81.705613][ T6564] macsec1: entered promiscuous mode
[   81.707859][ T6564] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode
[   81.710794][ T6564] macsec1: entered allmulticast mode
[   81.713091][ T6564] mac80211_hwsim hwsim5 wlan0: entered allmulticast mode
[   81.998029][   T47] tipc: Node number set to 2886997039
[   82.206964][ T6581] __nla_validate_parse: 3 callbacks suppressed
[   82.206983][ T6581] netlink: 596 bytes leftover after parsing attributes in process `syz.0.155'.
[   82.826558][ T6605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.162'.
[   82.829234][ T6606] netlink: 4 bytes leftover after parsing attributes in process `syz.1.162'.
[   82.904885][ T6612] netlink: 4 bytes leftover after parsing attributes in process `syz.1.164'.
[   82.909507][ T6612] netlink: 16 bytes leftover after parsing attributes in process `syz.1.164'.
[   82.942808][ T6614] tipc: Started in network mode
[   82.944652][ T6614] tipc: Node identity 66efad7159e6, cluster identity 4711
[   82.947809][ T6614] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   82.989410][ T6614] syzkaller0: entered promiscuous mode
[   82.991734][ T6614] syzkaller0: entered allmulticast mode
[   82.994512][ T6614] tipc: Resetting bearer <eth:syzkaller0>
[   83.007025][ T6613] tipc: Resetting bearer <eth:syzkaller0>
[   83.243423][ T6616] netlink: 12 bytes leftover after parsing attributes in process `syz.2.166'.
[   83.816914][ T5866] Bluetooth: hci2: command 0x0405 tx timeout
[   83.987175][ T5919] tipc: Node number set to 1057598833
[   83.988874][ T6613] tipc: Disabling bearer <eth:syzkaller0>
[   84.114362][ T6635] syzkaller1: entered promiscuous mode
[   84.117311][ T6635] syzkaller1: entered allmulticast mode
[   84.152517][ T6637] netlink: 12 bytes leftover after parsing attributes in process `syz.2.171'.
[   84.375251][ T6657] netlink: 8 bytes leftover after parsing attributes in process `syz.2.175'.
[   84.616365][ T6671] netlink: 16 bytes leftover after parsing attributes in process `syz.1.179'.
[   85.085117][ T6685] netlink: 'syz.0.183': attribute type 10 has an invalid length.
[   85.100951][ T6685] bond0: (slave bridge0): Enslaving as an active interface with an up link
[   85.105348][ T6685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.183'.
[   85.109552][ T6685] bridge_slave_1: left allmulticast mode
[   85.111824][ T6685] bridge_slave_1: left promiscuous mode
[   85.114228][ T6685] bridge0: port 2(bridge_slave_1) entered disabled state
[   85.121773][ T6685] bridge_slave_0: left allmulticast mode
[   85.124042][ T6685] bridge_slave_0: left promiscuous mode
[   85.127008][ T6685] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.155968][ T6685] bond0: (slave bridge0): Releasing backup interface
[   85.786984][ T6705] netlink: 'syz.2.188': attribute type 1 has an invalid length.
[   85.790002][ T6705] nbd: error processing sock list
[   85.792176][ T6705] block nbd0: shutting down sockets
[   86.618147][   T10] cfg80211: failed to load regulatory.db
[   86.771539][ T6765] tipc: New replicast peer: 0.0.0.0
[   86.773811][ T6765] tipc: Enabled bearer <udp:syz2>, priority 10
[   86.778277][ T6765] tipc: New replicast peer: 255.255.255.255
[   87.294778][ T6776] __nla_validate_parse: 5 callbacks suppressed
[   87.294790][ T6776] netlink: 16 bytes leftover after parsing attributes in process `syz.0.207'.
[   87.304745][ T6776] netlink: 16 bytes leftover after parsing attributes in process `syz.0.207'.
[   87.528150][ T6783] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   87.531749][ T6783] syzkaller0: entered promiscuous mode
[   87.534086][ T6783] syzkaller0: entered allmulticast mode
[   87.546027][ T6783] tipc: Resetting bearer <eth:syzkaller0>
[   87.550747][ T6782] tipc: Resetting bearer <eth:syzkaller0>
[   87.561738][ T6782] tipc: Disabling bearer <eth:syzkaller0>
[   87.990611][ T6801] netlink: 'syz.1.213': attribute type 16 has an invalid length.
[   87.994054][ T6801] netlink: 'syz.1.213': attribute type 17 has an invalid length.
[   88.192786][ T6815] netlink: 48 bytes leftover after parsing attributes in process `syz.1.218'.
[   88.199744][ T6815] netlink: 48 bytes leftover after parsing attributes in process `syz.1.218'.
[   88.203240][ T6815] netlink: 20 bytes leftover after parsing attributes in process `syz.1.218'.
[   88.277874][ T6827] netlink: 'syz.1.221': attribute type 16 has an invalid length.
[   88.281764][ T6827] netlink: 'syz.1.221': attribute type 17 has an invalid length.
[   88.362709][ T6827] mac80211_hwsim hwsim5 wlan0: left allmulticast mode
[   88.364875][ T6827] mac80211_hwsim hwsim5 wlan0: left promiscuous mode
[   88.368682][ T6830] netlink: 4 bytes leftover after parsing attributes in process `syz.1.221'.
[   88.373998][ T6827] IPv6: NLM_F_REPLACE set, but no existing node found!
[   88.458858][ T6838] netlink: 32 bytes leftover after parsing attributes in process `syz.1.225'.
[   88.721897][ T6856] netlink: 12 bytes leftover after parsing attributes in process `syz.2.230'.
[   88.875521][ T6861] netlink: 16 bytes leftover after parsing attributes in process `syz.2.231'.
[   89.111775][ T6867] netlink: 32 bytes leftover after parsing attributes in process `syz.2.233'.
[   89.484824][ T6883] ieee802154 phy0 wpan0: encryption failed: -22
[   90.961687][ T6937] IPVS: set_ctl: invalid protocol: 46 127.0.0.1:20000
[   92.280602][ T6996] sctp: [Deprecated]: syz.0.268 (pid 6996) Use of struct sctp_assoc_value in delayed_ack socket option.
[   92.280602][ T6996] Use struct sctp_sack_info instead
[   92.314711][ T6998] __nla_validate_parse: 13 callbacks suppressed
[   92.314725][ T6998] netlink: 2 bytes leftover after parsing attributes in process `syz.2.269'.
[   92.455365][ T7002] netlink: 'syz.2.270': attribute type 16 has an invalid length.
[   92.459907][ T7002] netlink: 'syz.2.270': attribute type 17 has an invalid length.
[   92.472527][ T7002] netlink: 4 bytes leftover after parsing attributes in process `syz.2.270'.
[   92.476340][ T7002] IPv6: NLM_F_REPLACE set, but no existing node found!
[   92.989877][ T7015] netlink: 'syz.1.272': attribute type 1 has an invalid length.
[   92.992556][ T7015] netlink: 220 bytes leftover after parsing attributes in process `syz.1.272'.
[   93.240316][ T7022] !: renamed from dummy0
[   93.260296][ T7022] Bluetooth: MGMT ver 1.23
[   93.367587][ T7029] netlink: 16 bytes leftover after parsing attributes in process `syz.0.274'.
[   93.402673][ T7031] syzkaller1: entered promiscuous mode
[   93.405015][ T7031] syzkaller1: entered allmulticast mode
[   93.561828][ T7034] Unsupported ieee802154 address type: 0
[   93.564524][ T7033] Unsupported ieee802154 address type: 0
[   94.708124][ T7071] netlink: 48 bytes leftover after parsing attributes in process `syz.2.289'.
[   94.723145][ T7074] netlink: 32 bytes leftover after parsing attributes in process `syz.1.290'.
[   94.815179][ T7077] ieee802154 phy0 wpan0: encryption failed: -22
[   95.103937][ T7086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.294'.
[   95.224212][ T7094] can: request_module (can-proto-3) failed.
[   95.283357][ T7095] netlink: 36 bytes leftover after parsing attributes in process `syz.0.296'.
[   95.286377][ T7095] netlink: 40 bytes leftover after parsing attributes in process `syz.0.296'.
[   95.289947][ T7095] netlink: 12 bytes leftover after parsing attributes in process `syz.0.296'.
[   95.639914][ T7122] trusted_key: syz.0.303 sent an empty control message without MSG_MORE.
[   95.705898][ T7129] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[   96.369146][   T10] IPVS: starting estimator thread 0...
[   96.457268][ T7151] IPVS: using max 63 ests per chain, 151200 per kthread
[   96.762333][ T7160] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   96.765379][ T7160] syzkaller0: entered promiscuous mode
[   96.768079][ T7160] syzkaller0: entered allmulticast mode
[   96.899714][ T7162] netlink: 'syz.0.311': attribute type 10 has an invalid length.
[   97.459249][ T7156] tipc: Resetting bearer <eth:syzkaller0>
[   97.473964][ T7156] tipc: Disabling bearer <eth:syzkaller0>
[   97.574871][ T7179] Bluetooth: MGMT ver 1.23
[   97.728695][ T7188] __nla_validate_parse: 3 callbacks suppressed
[   97.728713][ T7188] netlink: 4 bytes leftover after parsing attributes in process `syz.1.318'.
[   97.734834][ T7187] netlink: 4 bytes leftover after parsing attributes in process `syz.1.318'.
[   98.057107][ T7192] netlink: 'syz.1.319': attribute type 1 has an invalid length.
[   98.060757][ T7192] nbd: error processing sock list
[   98.063616][ T7192] block nbd0: shutting down sockets
[   98.176456][ T7199] netlink: 24 bytes leftover after parsing attributes in process `syz.0.320'.
[   98.239207][ T7204] netlink: 8 bytes leftover after parsing attributes in process `syz.0.320'.
[   98.242616][ T7204] netlink: 8 bytes leftover after parsing attributes in process `syz.0.320'.
[   98.722138][ T7207] netlink: 36 bytes leftover after parsing attributes in process `syz.1.323'.
[   98.725705][ T7207] netlink: 16 bytes leftover after parsing attributes in process `syz.1.323'.
[   98.729855][ T7207] netlink: 36 bytes leftover after parsing attributes in process `syz.1.323'.
[   98.734885][ T7207] netlink: 36 bytes leftover after parsing attributes in process `syz.1.323'.
[   99.019434][ T7209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.324'.
[   99.210000][ T7222] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-alb(6)
[   99.215566][ T7223] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-alb(6)
[   99.312477][ T7229] block nbd0: not configured, cannot reconfigure
[   99.424063][ T7233] netlink: 'syz.2.330': attribute type 6 has an invalid length.
[   99.428292][ T7233] IPv6: NLM_F_CREATE should be specified when creating new route
[  100.166165][ T7261] netlink: 'syz.0.336': attribute type 16 has an invalid length.
[  100.169638][ T7261] netlink: 'syz.0.336': attribute type 17 has an invalid length.
[  100.175240][ T7261] IPv6: NLM_F_REPLACE set, but no existing node found!
[  100.756634][ T7278] 8021q: adding VLAN 0 to HW filter on device bond1
[  100.770791][ T7278] sit1: entered promiscuous mode
[  100.772862][ T7278] sit1: entered allmulticast mode
[  100.781042][ T7278] 8021q: adding VLAN 0 to HW filter on device bond1
[  100.784065][ T7278] bond1: (slave sit1): The slave device specified does not support setting the MAC address
[  100.788287][ T7278] bond1: (slave sit1): Setting fail_over_mac to active for active-backup mode
[  100.797146][ T7278] bond1: (slave sit1): making interface the new active one
[  100.801600][ T7278] bond1: (slave sit1): Enslaving as an active interface with an up link
[  100.911722][ T7285] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan1, syncid = 3, id = 0
[  101.019463][ T7292] netlink: 'syz.1.344': attribute type 2 has an invalid length.
[  101.022241][ T7292] netlink: 'syz.1.344': attribute type 1 has an invalid length.
[  101.069001][ T7296] netlink: 'syz.0.346': attribute type 10 has an invalid length.
[  102.816026][ T7341] netlink: 'syz.2.358': attribute type 1 has an invalid length.
[  102.819422][ T7341] __nla_validate_parse: 54 callbacks suppressed
[  102.819446][ T7341] netlink: 220 bytes leftover after parsing attributes in process `syz.2.358'.
[  103.025784][ T7350] ieee802154 phy0 wpan0: encryption failed: -22
[  103.614073][ T7355] netlink: 'syz.2.363': attribute type 1 has an invalid length.
[  103.647547][ T7355] bond1: (slave bridge3): making interface the new active one
[  103.650998][ T7355] bond1: (slave bridge3): Enslaving as an active interface with an up link
[  103.728807][ T7358] IPVS: ip_vs_edit_dest(): server weight less than zero
[  104.675422][ T7373] netlink: 'syz.2.367': attribute type 1 has an invalid length.
[  105.347140][ T7388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.370'.
[  105.485803][ T7396] netlink: 'syz.2.374': attribute type 10 has an invalid length.
[  105.490746][ T7396] netlink: 4 bytes leftover after parsing attributes in process `syz.2.374'.
[  105.495462][ T7396] netlink: 4 bytes leftover after parsing attributes in process `syz.2.374'.
[  105.570218][ T7398] netlink: 24 bytes leftover after parsing attributes in process `syz.2.374'.
[  106.049305][ T7403] syzkaller1: entered promiscuous mode
[  106.051259][ T7403] syzkaller1: entered allmulticast mode
[  106.057377][ T7403] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: invalid value (71)
[  106.230757][ T7407] netlink: 28 bytes leftover after parsing attributes in process `syz.1.376'.
[  106.408517][ T7414] netlink: 'syz.2.379': attribute type 10 has an invalid length.
[  106.411715][ T7414] netlink: 4 bytes leftover after parsing attributes in process `syz.2.379'.
[  106.614537][ T7424] netlink: 24 bytes leftover after parsing attributes in process `syz.2.382'.
[  106.740314][ T7431] netlink: 40 bytes leftover after parsing attributes in process `syz.2.384'.
[  106.743931][ T7432] netlink: 40 bytes leftover after parsing attributes in process `syz.2.384'.
[  106.762410][ T5887] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  106.765777][ T5887] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  106.769582][ T5887] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  106.773170][ T5887] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  107.538207][ T7476] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  107.983181][ T7480] __nla_validate_parse: 3 callbacks suppressed
[  107.983197][ T7480] netlink: 16 bytes leftover after parsing attributes in process `syz.2.397'.
[  108.124722][ T7484] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  108.207429][ T7487] netlink: 8 bytes leftover after parsing attributes in process `syz.1.399'.
[  108.330988][ T7491] tun0: tun_chr_ioctl cmd 1074025681
[  108.754527][ T7515] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  108.822028][ T7516] netlink: 8 bytes leftover after parsing attributes in process `syz.2.409'.
[  108.949159][ T7518] netlink: 28 bytes leftover after parsing attributes in process `syz.2.410'.
[  109.055434][ T7527] syzkaller1: entered promiscuous mode
[  109.058606][ T7527] syzkaller1: entered allmulticast mode
[  110.038954][ T7561] netlink: 72 bytes leftover after parsing attributes in process `syz.1.421'.
[  110.062299][ T7561] netdevsim netdevsim1 netdevsim0: entered allmulticast mode
[  110.153918][ T7566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.423'.
[  110.290651][ T5855] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0
[  110.293972][ T5855] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0
[  110.333660][ T5855] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[  110.350032][ T7577] netlink: 8 bytes leftover after parsing attributes in process `syz.1.426'.
[  110.352802][ T7577] netlink: 32 bytes leftover after parsing attributes in process `syz.1.426'.
[  110.495385][ T7589] netlink: 36 bytes leftover after parsing attributes in process `syz.0.427'.
[  110.498849][ T7589] netlink: 16 bytes leftover after parsing attributes in process `syz.0.427'.
[  110.534118][ T7591] netlink: 'syz.2.430': attribute type 10 has an invalid length.
[  112.788231][ T7663] nftables ruleset with unbound chain
[  113.339300][ T7666] veth1_vlan: left promiscuous mode
[  113.341757][ T7666] veth1_vlan: entered promiscuous mode
[  113.344182][ T7666] veth1_vlan: entered allmulticast mode
[  113.436527][ T7669] __nla_validate_parse: 11 callbacks suppressed
[  113.436547][ T7669] netlink: 8 bytes leftover after parsing attributes in process `syz.0.454'.
[  113.443127][ T7669] netlink: 12 bytes leftover after parsing attributes in process `syz.0.454'.
[  113.510662][ T7670] netlink: 'syz.0.454': attribute type 16 has an invalid length.
[  113.513776][ T7670] netlink: 'syz.0.454': attribute type 17 has an invalid length.
[  113.527592][ T7670] netlink: 4 bytes leftover after parsing attributes in process `syz.0.454'.
[  113.596619][ T7675] netlink: 24 bytes leftover after parsing attributes in process `syz.2.455'.
[  113.770758][ T7691] netlink: 'syz.1.461': attribute type 11 has an invalid length.
[  114.551068][ T7707] ieee802154 phy0 wpan0: encryption failed: -22
[  114.688540][ T7716] netlink: 20 bytes leftover after parsing attributes in process `syz.0.466'.
[  114.712458][ T7719] netlink: 8 bytes leftover after parsing attributes in process `syz.2.465'.
[  114.768978][ T7721] netlink: 'syz.1.467': attribute type 1 has an invalid length.
[  114.772106][ T7721] netlink: 'syz.1.467': attribute type 2 has an invalid length.
[  114.775177][ T7721] netlink: 'syz.1.467': attribute type 1 has an invalid length.
[  114.789685][ T7721] netlink: 'syz.1.467': attribute type 2 has an invalid length.
[  114.855892][ T7725] netlink: 16 bytes leftover after parsing attributes in process `syz.1.469'.
[  115.387276][ T7739] netlink: 'syz.1.474': attribute type 1 has an invalid length.
[  115.391025][ T7739] nbd: error processing sock list
[  115.393464][ T7739] block nbd0: shutting down sockets
[  115.970683][ T7750] netlink: 4 bytes leftover after parsing attributes in process `syz.1.477'.
[  116.383210][ T7764] netlink: 'syz.2.481': attribute type 9 has an invalid length.
[  116.488540][ T7769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.482'.
[  117.489456][   T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  117.493742][   T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  117.497314][   T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  117.500795][   T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  117.883366][ T7816] netlink: 6032 bytes leftover after parsing attributes in process `syz.2.496'.
[  117.894498][ T7816] Illegal XDP return value 4217941349 on prog  (id 315) dev N/A, expect packet loss!
[  117.908493][ T7818] macvtap1: entered allmulticast mode
[  117.910275][ T7818] veth0_macvtap: entered allmulticast mode
[  117.946425][   T56] block nbd0: Receive control failed (result -104)
[  118.127289][ T7829] xt_policy: too many policy elements
[  119.217588][ T7861] tls_set_device_offload_rx: netdev not found
[  119.368503][ T7870] __nla_validate_parse: 1 callbacks suppressed
[  119.368519][ T7870] netlink: 32 bytes leftover after parsing attributes in process `syz.1.511'.
[  120.108705][ T7896] netlink: 8 bytes leftover after parsing attributes in process `syz.0.517'.
[  120.145880][ T7901] netlink: 'syz.0.518': attribute type 11 has an invalid length.
[  120.700411][ T7921] syzkaller0: mtu greater than device maximum
[  121.908670][   T33] audit: type=1107 audit(1758974375.838:2): pid=7961 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ATJtc!5929pXou2a6a(Yѯ1<rQRm:'
[  122.001825][ T7966] netlink: 'syz.2.537': attribute type 16 has an invalid length.
[  122.004514][ T7966] netlink: 'syz.2.537': attribute type 17 has an invalid length.
[  122.008411][ T7966] netlink: 4 bytes leftover after parsing attributes in process `syz.2.537'.
[  122.012022][ T7966] IPv6: NLM_F_REPLACE set, but no existing node found!
[  122.719127][ T7991] raw_sendmsg: syz.1.544 forgot to set AF_INET. Fix it!
[  122.806186][ T7996] netlink: 'syz.2.545': attribute type 10 has an invalid length.
[  122.810167][ T7996] netlink: 4 bytes leftover after parsing attributes in process `syz.2.545'.
[  123.593793][ T8013] netlink: 'syz.1.550': attribute type 3 has an invalid length.
[  123.597469][ T8013] netlink: 'syz.1.550': attribute type 1 has an invalid length.
[  123.600676][ T8013] netlink: 220 bytes leftover after parsing attributes in process `syz.1.550'.
[  123.604429][ T8013] netlink: 'syz.1.550': attribute type 9 has an invalid length.
[  123.610204][ T8013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.550'.
[  123.613613][ T8013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.550'.
[  123.619785][ T8013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.550'.
[  123.673841][ T8015] syzkaller1: entered promiscuous mode
[  123.676112][ T8015] syzkaller1: entered allmulticast mode
[  123.685214][ T8016] netlink: 244 bytes leftover after parsing attributes in process `syz.1.551'.
[  123.690974][ T8015] tipc: Enabling of bearer <udp:syz2> rejected, already enabled
[  123.932439][ T8036] netlink: 36 bytes leftover after parsing attributes in process `syz.0.557'.
[  124.516415][ T8085] __nla_validate_parse: 8 callbacks suppressed
[  124.516432][ T8085] netlink: 8 bytes leftover after parsing attributes in process `syz.0.567'.
[  124.523023][ T8085] netlink: 8 bytes leftover after parsing attributes in process `syz.0.567'.
[  125.309758][ T8110] netlink: 72 bytes leftover after parsing attributes in process `syz.1.574'.
[  125.313461][ T8110] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check.
[  125.325808][ T8110] netlink: 204 bytes leftover after parsing attributes in process `syz.1.574'.
[  125.379465][ T8114] netlink: 32 bytes leftover after parsing attributes in process `syz.0.576'.
[  125.468729][ T8119] netlink: 12 bytes leftover after parsing attributes in process `syz.0.578'.
[  126.132383][ T8126] netlink: 40 bytes leftover after parsing attributes in process `syz.2.580'.
[  126.138228][ T8126] netlink: 8 bytes leftover after parsing attributes in process `syz.2.580'.
[  126.141858][ T8126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.580'.
[  126.262280][ T8132] netlink: 12 bytes leftover after parsing attributes in process `syz.1.582'.
[  126.434680][ T8144] netlink: 'syz.1.584': attribute type 1 has an invalid length.
[  127.578670][ T8172] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0
[  129.218833][ T8223] openvswitch: netlink: Key type 186 is out of range max 32
[  130.057660][ T8227] __nla_validate_parse: 11 callbacks suppressed
[  130.057670][ T8227] netlink: 8 bytes leftover after parsing attributes in process `syz.2.607'.
[  130.067399][ T8225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.607'.
[  130.093334][ T8225] netlink: 4 bytes leftover after parsing attributes in process `syz.2.607'.
[  131.015671][ T8256] netlink: 5636 bytes leftover after parsing attributes in process `syz.1.614'.
[  131.027091][   T55] Bluetooth: hci1: command 0x0c1a tx timeout
[  131.029999][ T8198] Bluetooth: hci1: Opcode 0x0c1a failed: -110
[  131.032438][ T8198] Bluetooth: hci1: Error when powering off device on rfkill (-110)
[  131.405021][ T8274] netlink: 48 bytes leftover after parsing attributes in process `syz.2.621'.
[  131.415597][ T8274] netlink: 'syz.2.621': attribute type 3 has an invalid length.
[  131.418596][ T8274] netlink: 4 bytes leftover after parsing attributes in process `syz.2.621'.
[  131.462956][ T8276] veth1_to_team: entered promiscuous mode
[  131.465996][ T8276] bond0: entered promiscuous mode
[  131.468613][ T8276] bond_slave_0: entered promiscuous mode
[  131.471253][ T8276] bond_slave_1: entered promiscuous mode
[  131.474617][ T8276] hsr1: Slave A (veth1_to_team) is not up; please bring it up to get a fully working HSR network
[  131.478952][ T8276] hsr1: Slave B (bond0) is not up; please bring it up to get a fully working HSR network
[  131.483324][ T8276] hsr1: entered allmulticast mode
[  131.485377][ T8276] veth1_to_team: entered allmulticast mode
[  131.488208][ T8276] bond0: entered allmulticast mode
[  131.490255][ T8276] bond_slave_0: entered allmulticast mode
[  131.492504][ T8276] bond_slave_1: entered allmulticast mode
[  131.636514][ T8285] netlink: 12 bytes leftover after parsing attributes in process `syz.2.625'.
[  131.803354][ T8198] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  131.805842][ T8198] Bluetooth: hci2: Error when powering off device on rfkill (-4)
[  132.208679][ T8292] netlink: 'syz.1.627': attribute type 4 has an invalid length.
[  132.215229][ T8292] netlink: 'syz.1.627': attribute type 4 has an invalid length.
[  132.223924][ T8292] netlink: 4 bytes leftover after parsing attributes in process `syz.1.627'.
[  132.699895][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  132.702044][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  194.141633][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  194.144196][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  255.582584][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  255.585063][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  281.177217][   T34] INFO: task kworker/1:3:2300 blocked for more than 143 seconds.
[  281.180524][   T34]       Not tainted syzkaller #0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  281.184548][   T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  281.188490][   T34] task:kworker/1:3     state:D stack:24520 pid:2300  tgid:2300  ppid:2      task_flags:0x4208060 flags:0x00004000
[  281.192594][   T34] Workqueue: events rfkill_global_led_trigger_worker
[  281.194824][   T34] Call Trace:
[  281.195954][   T34]  <TASK>
[  281.199036][   T34]  __schedule+0x1798/0x4cc0
[  281.207037][   T34]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  281.209110][   T34]  ? __pfx___schedule+0x10/0x10
[  281.211067][   T34]  ? schedule+0x91/0x360
[  281.212857][   T34]  schedule+0x165/0x360
[  281.214486][   T34]  schedule_preempt_disabled+0x13/0x30
[  281.216676][   T34]  __mutex_lock+0x7e6/0x1350
[  281.228503][   T34]  ? __mutex_lock+0x5bb/0x1350
[  281.230320][   T34]  ? rfkill_global_led_trigger_worker+0x27/0xd0
[  281.232628][   T34]  ? __pfx___mutex_lock+0x10/0x10
[  281.234600][   T34]  ? process_scheduled_works+0x9ef/0x17b0
[  281.236606][   T34]  ? process_scheduled_works+0x9ef/0x17b0
[  281.239373][   T34]  rfkill_global_led_trigger_worker+0x27/0xd0
[  281.241734][   T34]  ? process_scheduled_works+0x9ef/0x17b0
[  281.243859][   T34]  process_scheduled_works+0xae1/0x17b0
[  281.245923][   T34]  ? __pfx_process_scheduled_works+0x10/0x10
[  281.249211][   T34]  worker_thread+0x8a0/0xda0
[  281.250870][   T34]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  281.252988][   T34]  ? __kthread_parkme+0x7b/0x200
[  281.254633][   T34]  kthread+0x711/0x8a0
[  281.256028][   T34]  ? __pfx_worker_thread+0x10/0x10
[  281.260511][   T34]  ? __pfx_kthread+0x10/0x10
[  281.262116][   T34]  ? _raw_spin_unlock_irq+0x23/0x50
[  281.263821][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.265596][   T34]  ? __pfx_kthread+0x10/0x10
[  281.267953][   T34]  ret_from_fork+0x439/0x7d0
[  281.269563][   T34]  ? __pfx_ret_from_fork+0x10/0x10
[  281.271286][   T34]  ? __switch_to_asm+0x39/0x70
[  281.272831][   T34]  ? __switch_to_asm+0x33/0x70
[  281.274676][   T34]  ? __pfx_kthread+0x10/0x10
[  281.276668][   T34]  ret_from_fork_asm+0x1a/0x30
[  281.279402][   T34]  </TASK>
[  281.280658][   T34] INFO: task syz.0.600:8197 blocked for more than 143 seconds.
[  281.283560][   T34]       Not tainted syzkaller #0
[  281.285506][   T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  281.289774][   T34] task:syz.0.600       state:D stack:25096 pid:8197  tgid:8197  ppid:5854   task_flags:0x400040 flags:0x00004004
[  281.294352][   T34] Call Trace:
[  281.295680][   T34]  <TASK>
[  281.298517][   T34]  __schedule+0x1798/0x4cc0
[  281.300320][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.302141][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.303793][   T34]  ? __pfx___schedule+0x10/0x10
[  281.305420][   T34]  ? schedule+0x91/0x360
[  281.307290][   T34]  schedule+0x165/0x360
[  281.309140][   T34]  schedule_preempt_disabled+0x13/0x30
[  281.310984][   T34]  __mutex_lock+0x7e6/0x1350
[  281.312531][   T34]  ? __mutex_lock+0x5bb/0x1350
[  281.314074][   T34]  ? rfkill_unregister+0xc8/0x220
[  281.315707][   T34]  ? __pfx___mutex_lock+0x10/0x10
[  281.317492][   T34]  ? __pfx_device_del+0x10/0x10
[  281.319313][   T34]  rfkill_unregister+0xc8/0x220
[  281.321274][   T34]  nfc_unregister_device+0x96/0x2a0
[  281.323329][   T34]  ? __pfx_virtual_ncidev_close+0x10/0x10
[  281.325541][   T34]  virtual_ncidev_close+0x56/0x90
[  281.327871][   T34]  __fput+0x44c/0xa70
[  281.329277][   T34]  task_work_run+0x1d4/0x260
[  281.330973][   T34]  ? __pfx_task_work_run+0x10/0x10
[  281.332807][   T34]  ? exit_to_user_mode_loop+0x40/0x110
[  281.334830][   T34]  exit_to_user_mode_loop+0xec/0x110
[  281.336549][   T34]  do_syscall_64+0x2bd/0x3b0
[  281.338799][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.340783][   T34]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.342978][   T34]  ? exc_page_fault+0x9f/0xf0
[  281.344544][   T34]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.346663][   T34] RIP: 0033:0x7f6a7e78ec29
[  281.348352][   T34] RSP: 002b:00007ffdc7de8c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
[  281.351014][   T34] RAX: 0000000000000000 RBX: 00007f6a7e9d7da0 RCX: 00007f6a7e78ec29
[  281.353522][   T34] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
[  281.356422][   T34] RBP: 00007f6a7e9d7da0 R08: 0000000000000230 R09: 0000001ec7de8f4f
[  281.359670][   T34] R10: 00007f6a7e9d7cb0 R11: 0000000000000246 R12: 000000000001f9e3
[  281.362821][   T34] R13: 00007ffdc7de8d50 R14: ffffffffffffffff R15: 00007ffdc7de8d70
[  281.366119][   T34]  </TASK>
[  281.368160][   T34] INFO: task syz.0.600:8198 blocked for more than 143 seconds.
[  281.371029][   T34]       Not tainted syzkaller #0
[  281.372603][   T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  281.375313][   T34] task:syz.0.600       state:D stack:25328 pid:8198  tgid:8197  ppid:5854   task_flags:0x400140 flags:0x00004006
[  281.380053][   T34] Call Trace:
[  281.381141][   T34]  <TASK>
[  281.382090][   T34]  __schedule+0x1798/0x4cc0
[  281.383554][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.385180][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.386979][   T34]  ? __pfx___schedule+0x10/0x10
[  281.388563][   T34]  ? schedule+0x91/0x360
[  281.390039][   T34]  schedule+0x165/0x360
[  281.391470][   T34]  schedule_preempt_disabled+0x13/0x30
[  281.393166][   T34]  __mutex_lock+0x7e6/0x1350
[  281.394654][   T34]  ? __mutex_lock+0x5bb/0x1350
[  281.396121][   T34]  ? nfc_rfkill_set_block+0x50/0x2e0
[  281.400468][   T34]  ? __pfx___mutex_lock+0x10/0x10
[  281.402077][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.403703][   T34]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  281.405604][   T34]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  281.407791][   T34]  ? __pfx_nfc_rfkill_set_block+0x10/0x10
[  281.409566][   T34]  nfc_rfkill_set_block+0x50/0x2e0
[  281.411229][   T34]  ? __pfx_nfc_rfkill_set_block+0x10/0x10
[  281.413022][   T34]  rfkill_set_block+0x1d2/0x440
[  281.414582][   T34]  rfkill_fop_write+0x44b/0x570
[  281.416097][   T34]  ? __pfx_rfkill_fop_write+0x10/0x10
[  281.418027][   T34]  ? security_file_permission+0x60/0x290
[  281.420001][   T34]  ? rw_verify_area+0x255/0x4d0
[  281.421542][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.423069][   T34]  ? __pfx_rfkill_fop_write+0x10/0x10
[  281.424775][   T34]  vfs_write+0x27e/0xb30
[  281.426124][   T34]  ? __pfx_vfs_write+0x10/0x10
[  281.427957][   T34]  ? __fget_files+0x2a/0x420
[  281.429817][   T34]  ? __fget_files+0x2a/0x420
[  281.431917][   T34]  ? __fget_files+0x3a0/0x420
[  281.433821][   T34]  ? __fget_files+0x2a/0x420
[  281.435701][   T34]  ksys_write+0x145/0x250
[  281.437584][   T34]  ? __pfx_ksys_write+0x10/0x10
[  281.439555][   T34]  ? rcu_is_watching+0x15/0xb0
[  281.441492][   T34]  ? do_syscall_64+0xbe/0x3b0
[  281.443149][   T34]  do_syscall_64+0xfa/0x3b0
[  281.444665][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.446333][   T34]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.448460][   T34]  ? exc_page_fault+0x9f/0xf0
[  281.449948][   T34]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.451787][   T34] RIP: 0033:0x7f6a7e78ec29
[  281.453216][   T34] RSP: 002b:00007f6a7f68d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  281.455958][   T34] RAX: ffffffffffffffda RBX: 00007f6a7e9d5fa0 RCX: 00007f6a7e78ec29
[  281.458733][   T34] RDX: 0000000000000008 RSI: 00002000000002c0 RDI: 000000000000000f
[  281.461560][   T34] RBP: 00007f6a7e811e41 R08: 0000000000000000 R09: 0000000000000000
[  281.464609][   T34] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  281.467848][   T34] R13: 00007f6a7e9d6038 R14: 00007f6a7e9d5fa0 R15: 00007ffdc7de8af8
[  281.470874][   T34]  </TASK>
[  281.472088][   T34] INFO: task syz.1.627:8292 blocked for more than 143 seconds.
[  281.474980][   T34]       Not tainted syzkaller #0
[  281.477038][   T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  281.480145][   T34] task:syz.1.627       state:D stack:20600 pid:8292  tgid:8291  ppid:5863   task_flags:0x400140 flags:0x00004004
[  281.484762][   T34] Call Trace:
[  281.486085][   T34]  <TASK>
[  281.487505][   T34]  __schedule+0x1798/0x4cc0
[  281.489161][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.491014][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.492940][   T34]  ? __pfx___schedule+0x10/0x10
[  281.494879][   T34]  ? schedule+0x91/0x360
[  281.496548][   T34]  schedule+0x165/0x360
[  281.498435][   T34]  schedule_preempt_disabled+0x13/0x30
[  281.500543][   T34]  __mutex_lock+0x7e6/0x1350
[  281.502397][   T34]  ? rcu_is_watching+0x15/0xb0
[  281.504188][   T34]  ? __mutex_lock+0x5bb/0x1350
[  281.506080][   T34]  ? rfkill_register+0x37/0x8e0
[  281.508175][   T34]  ? __pfx___mutex_lock+0x10/0x10
[  281.510074][   T34]  ? netdev_run_todo+0xe1d/0xea0
[  281.512086][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.514176][   T34]  ? __pfx_netdev_run_todo+0x10/0x10
[  281.516349][   T34]  ? __pfx_mod_delayed_work_on+0x10/0x10
[  281.518915][   T34]  rfkill_register+0x37/0x8e0
[  281.520500][   T34]  wiphy_register+0x2231/0x2aa0
[  281.522047][   T34]  ? __pfx_wiphy_register+0x10/0x10
[  281.523647][   T34]  ? minstrel_ht_alloc+0x6dd/0x7e0
[  281.525252][   T34]  ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0
[  281.527462][   T34]  ieee80211_register_hw+0x3442/0x40a0
[  281.529221][   T34]  ? ieee80211_register_hw+0x1461/0x40a0
[  281.531049][   T34]  ? __pfx_ieee80211_register_hw+0x10/0x10
[  281.532867][   T34]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  281.534845][   T34]  ? __hrtimer_setup+0x187/0x210
[  281.536386][   T34]  ? __pfx_mac80211_hwsim_beacon+0x10/0x10
[  281.538367][   T34]  mac80211_hwsim_new_radio+0x2f0e/0x5340
[  281.540129][   T34]  ? __pfx__printk+0x10/0x10
[  281.541505][   T34]  ? __pfx_mac80211_hwsim_new_radio+0x10/0x10
[  281.543361][   T34]  ? __nla_validate_parse+0x251c/0x2d40
[  281.545051][   T34]  ? __sock_sendmsg+0x21c/0x270
[  281.546568][   T34]  ? ____sys_sendmsg+0x505/0x830
[  281.548361][   T34]  ? ___sys_sendmsg+0x21f/0x2a0
[  281.549865][   T34]  ? __x64_sys_sendmsg+0x19b/0x260
[  281.551386][   T34]  hwsim_new_radio_nl+0xea4/0x1b10
[  281.552987][   T34]  ? __pfx___nla_validate_parse+0x10/0x10
[  281.554779][   T34]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  281.556500][   T34]  ? __nla_parse+0x40/0x60
[  281.558031][   T34]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  281.559966][   T34]  genl_family_rcv_msg_doit+0x215/0x300
[  281.561664][   T34]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  281.563509][   T34]  ? bpf_lsm_capable+0x9/0x20
[  281.564981][   T34]  ? security_capable+0x7e/0x2e0
[  281.566718][   T34]  genl_rcv_msg+0x60e/0x790
[  281.568530][   T34]  ? __pfx_genl_rcv_msg+0x10/0x10
[  281.570522][   T34]  ? __pfx_hwsim_new_radio_nl+0x10/0x10
[  281.572594][   T34]  netlink_rcv_skb+0x208/0x470
[  281.574432][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.576204][   T34]  ? __pfx_genl_rcv_msg+0x10/0x10
[  281.578078][   T34]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  281.579804][   T34]  ? down_read+0x1ad/0x2e0
[  281.581200][   T34]  genl_rcv+0x28/0x40
[  281.582476][   T34]  netlink_unicast+0x82f/0x9e0
[  281.583967][   T34]  ? __pfx_netlink_unicast+0x10/0x10
[  281.585614][   T34]  ? netlink_sendmsg+0x642/0xb30
[  281.587376][   T34]  ? skb_put+0x11b/0x210
[  281.588712][   T34]  netlink_sendmsg+0x805/0xb30
[  281.590273][   T34]  ? __pfx_netlink_sendmsg+0x10/0x10
[  281.591957][   T34]  ? aa_sock_msg_perm+0xf1/0x1d0
[  281.593509][   T34]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  281.595159][   T34]  ? __pfx_netlink_sendmsg+0x10/0x10
[  281.596941][   T34]  __sock_sendmsg+0x21c/0x270
[  281.598442][   T34]  ____sys_sendmsg+0x505/0x830
[  281.599934][   T34]  ? __pfx_____sys_sendmsg+0x10/0x10
[  281.601562][   T34]  ? import_iovec+0x74/0xa0
[  281.602967][   T34]  ___sys_sendmsg+0x21f/0x2a0
[  281.604606][   T34]  ? __pfx____sys_sendmsg+0x10/0x10
[  281.606975][   T34]  ? __fget_files+0x2a/0x420
[  281.608822][   T34]  ? __fget_files+0x3a0/0x420
[  281.610730][   T34]  __x64_sys_sendmsg+0x19b/0x260
[  281.612728][   T34]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  281.614934][   T34]  ? do_syscall_64+0xbe/0x3b0
[  281.617122][   T34]  do_syscall_64+0xfa/0x3b0
[  281.619056][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.621251][   T34]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.623573][   T34]  ? exc_page_fault+0x9f/0xf0
[  281.625155][   T34]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.627667][   T34] RIP: 0033:0x7f706338ec29
[  281.629105][   T34] RSP: 002b:00007f7064241038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  281.631708][   T34] RAX: ffffffffffffffda RBX: 00007f70635d5fa0 RCX: 00007f706338ec29
[  281.634115][   T34] RDX: 0000000020000000 RSI: 0000200000000140 RDI: 000000000000000b
[  281.636509][   T34] RBP: 00007f7063411e41 R08: 0000000000000000 R09: 0000000000000000
[  281.639104][   T34] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  281.641561][   T34] R13: 00007f70635d6038 R14: 00007f70635d5fa0 R15: 00007fffa01c81b8
[  281.644010][   T34]  </TASK>
[  281.645029][   T34] INFO: task syz.2.632:8311 blocked for more than 143 seconds.
[  281.647663][   T34]       Not tainted syzkaller #0
[  281.649187][   T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  281.651804][   T34] task:syz.2.632       state:D stack:27264 pid:8311  tgid:8310  ppid:5853   task_flags:0x400140 flags:0x00004004
[  281.655399][   T34] Call Trace:
[  281.656416][   T34]  <TASK>
[  281.657446][   T34]  __schedule+0x1798/0x4cc0
[  281.658879][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.660413][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.661892][   T34]  ? __pfx___schedule+0x10/0x10
[  281.663406][   T34]  ? schedule+0x91/0x360
[  281.664702][   T34]  schedule+0x165/0x360
[  281.665935][   T34]  schedule_preempt_disabled+0x13/0x30
[  281.667777][   T34]  __mutex_lock+0x7e6/0x1350
[  281.669200][   T34]  ? __mutex_lock+0x5bb/0x1350
[  281.670670][   T34]  ? genl_rcv_msg+0x10d/0x790
[  281.672114][   T34]  ? __pfx___mutex_lock+0x10/0x10
[  281.673669][   T34]  ? stack_trace_save+0x9c/0xe0
[  281.675165][   T34]  ? __pfx_stack_trace_save+0x10/0x10
[  281.676879][   T34]  ? radix_tree_lookup+0x240/0x290
[  281.678455][   T34]  genl_rcv_msg+0x10d/0x790
[  281.679897][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.681393][   T34]  ? __pfx_genl_rcv_msg+0x10/0x10
[  281.682928][   T34]  netlink_rcv_skb+0x208/0x470
[  281.684391][   T34]  ? __lock_acquire+0xab9/0xd20
[  281.685866][   T34]  ? __pfx_genl_rcv_msg+0x10/0x10
[  281.687644][   T34]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  281.689326][   T34]  ? down_read+0x1ad/0x2e0
[  281.690731][   T34]  genl_rcv+0x28/0x40
[  281.691935][   T34]  netlink_unicast+0x82f/0x9e0
[  281.693382][   T34]  ? __pfx_netlink_unicast+0x10/0x10
[  281.695319][   T34]  ? netlink_sendmsg+0x642/0xb30
[  281.697063][   T34]  ? skb_put+0x11b/0x210
[  281.698422][   T34]  netlink_sendmsg+0x805/0xb30
[  281.699953][   T34]  ? __pfx_netlink_sendmsg+0x10/0x10
[  281.701681][   T34]  ? aa_sock_msg_perm+0xf1/0x1d0
[  281.703277][   T34]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  281.705059][   T34]  ? __pfx_netlink_sendmsg+0x10/0x10
[  281.706725][   T34]  __sock_sendmsg+0x21c/0x270
[  281.708534][   T34]  __sys_sendto+0x3bd/0x520
[  281.710059][   T34]  ? __pfx___sys_sendto+0x10/0x10
[  281.711769][   T34]  ? count_memcg_event_mm+0x21/0x260
[  281.713438][   T34]  ? exc_page_fault+0x76/0xf0
[  281.715046][   T34]  ? do_user_addr_fault+0xc8a/0x1390
[  281.716897][   T34]  __x64_sys_sendto+0xde/0x100
[  281.718452][   T34]  do_syscall_64+0xfa/0x3b0
[  281.719927][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.721639][   T34]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.723583][   T34]  ? exc_page_fault+0x9f/0xf0
[  281.725166][   T34]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  281.727264][   T34] RIP: 0033:0x7f52fef90abc
[  281.728673][   T34] RSP: 002b:00007f52ffedaec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
[  281.731481][   T34] RAX: ffffffffffffffda RBX: 00007f52ffedafc0 RCX: 00007f52fef90abc
[  281.733944][   T34] RDX: 0000000000000024 RSI: 00007f52ffedb010 RDI: 0000000000000007
[  281.736515][   T34] RBP: 0000000000000000 R08: 00007f52ffedaf14 R09: 000000000000000c
[  281.739391][   T34] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000007
[  281.741949][   T34] R13: 00007f52ffedaf68 R14: 00007f52ffedb010 R15: 0000000000000000
[  281.744532][   T34]  </TASK>
[  281.745748][   T34] 
[  281.745748][   T34] Showing all locks held in the system:
[  281.748731][   T34] 1 lock held by khungtaskd/34:
[  281.750247][   T34]  #0: ffffffff8e13a0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
[  281.753484][   T34] 3 locks held by kworker/1:3/2300:
[  281.755391][   T34]  #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  281.759016][   T34]  #1: ffffc9000a687bc0 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  281.763119][   T34]  #2: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0
[  281.767601][   T34] 2 locks held by getty/5675:
[  281.769403][   T34]  #0: ffff8881097590a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
[  281.772412][   T34]  #1: ffffc900029032f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400
[  281.775748][   T34] 2 locks held by syz.0.600/8197:
[  281.777566][   T34]  #0: ffff888111db2100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0
[  281.780898][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220
[  281.784772][   T34] 2 locks held by syz.0.600/8198:
[  281.786716][   T34]  #0: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_write+0x191/0x570
[  281.791009][   T34]  #1: ffff888111db2100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0
[  281.794666][   T34] 3 locks held by syz.1.627/8292:
[  281.796581][   T34]  #0: ffffffff8f59fc50 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  281.799946][   T34]  #1: ffffffff8f59fa68 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790
[  281.803396][   T34]  #2: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.807486][   T34] 2 locks held by syz.2.632/8311:
[  281.809433][   T34]  #0: ffffffff8f59fc50 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  281.812615][   T34]  #1: ffffffff8f59fa68 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790
[  281.816023][   T34] 2 locks held by syz-executor/8314:
[  281.818384][   T34]  #0: ffff88801274b118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.822052][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.825459][   T34] 2 locks held by syz-executor/8317:
[  281.827763][   T34]  #0: ffff8880287d1118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.831545][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.835446][   T34] 2 locks held by syz-executor/8320:
[  281.837655][   T34]  #0: ffff88803a0a1118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.841472][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.845310][   T34] 2 locks held by syz-executor/8322:
[  281.847581][   T34]  #0: ffff88803a8df918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.851410][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.855160][   T34] 2 locks held by syz-executor/8325:
[  281.857576][   T34]  #0: ffff888109b76918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.861356][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.865518][   T34] 2 locks held by syz-executor/8328:
[  281.868025][   T34]  #0: ffff88803a55f118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.872329][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.876501][   T34] 2 locks held by syz-executor/8334:
[  281.878261][   T34]  #0: ffff8880409c5118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.881493][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.885662][   T34] 2 locks held by syz-executor/8337:
[  281.887807][   T34]  #0: ffff888109b73918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.891291][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.894856][   T34] 2 locks held by syz-executor/8339:
[  281.897020][   T34]  #0: ffff88803b09c118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650
[  281.900520][   T34]  #1: ffffffff8f809248 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0
[  281.903927][   T34] 
[  281.904888][   T34] =============================================
[  281.904888][   T34] 
[  281.908387][   T34] NMI backtrace for cpu 0
[  281.908417][   T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
[  281.908433][   T34] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  281.908440][   T34] Call Trace:
[  281.908446][   T34]  <TASK>
[  281.908455][   T34]  dump_stack_lvl+0x189/0x250
[  281.908478][   T34]  ? __pfx_dump_stack_lvl+0x10/0x10
[  281.908492][   T34]  ? __pfx__printk+0x10/0x10
[  281.908518][   T34]  nmi_cpu_backtrace+0x39e/0x3d0
[  281.908538][   T34]  ? __pfx_nmi_cpu_backtrace+0x10/0x10
[  281.908556][   T34]  ? __pfx__printk+0x10/0x10
[  281.908574][   T34]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[  281.908595][   T34]  nmi_trigger_cpumask_backtrace+0x17a/0x300
[  281.908613][   T34]  watchdog+0xf93/0xfe0
[  281.908634][   T34]  ? watchdog+0x1de/0xfe0
[  281.908653][   T34]  kthread+0x711/0x8a0
[  281.908671][   T34]  ? __pfx_watchdog+0x10/0x10
[  281.908685][   T34]  ? __pfx_kthread+0x10/0x10
[  281.908700][   T34]  ? _raw_spin_unlock_irq+0x23/0x50
[  281.908717][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.908735][   T34]  ? __pfx_kthread+0x10/0x10
[  281.908749][   T34]  ret_from_fork+0x439/0x7d0
[  281.908764][   T34]  ? __pfx_ret_from_fork+0x10/0x10
[  281.908780][   T34]  ? __switch_to_asm+0x39/0x70
[  281.908795][   T34]  ? __switch_to_asm+0x33/0x70
[  281.908808][   T34]  ? __pfx_kthread+0x10/0x10
[  281.908823][   T34]  ret_from_fork_asm+0x1a/0x30
[  281.908848][   T34]  </TASK>
[  281.908854][   T34] Sending NMI from CPU 0 to CPUs 1:
[  281.962684][    C1] NMI backtrace for cpu 1
[  281.962722][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
[  281.962733][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  281.962739][    C1] RIP: 0010:pv_native_safe_halt+0x13/0x20
[  281.962762][    C1] Code: 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa eb 07 0f 00 2d b3 49 15 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90
[  281.962769][    C1] RSP: 0018:ffffc90000177de0 EFLAGS: 00000282
[  281.962779][    C1] RAX: cd877d76083f6400 RBX: ffffffff819683f8 RCX: cd877d76083f6400
[  281.962785][    C1] RDX: 0000000000000001 RSI: ffffffff8d9b06d9 RDI: ffffffff8be33f00
[  281.962791][    C1] RBP: ffffc90000177f20 R08: ffff888136632f9b R09: 1ffff11026cc65f3
[  281.962797][    C1] R10: dffffc0000000000 R11: ffffed1026cc65f4 R12: ffffffff8fa2ee30
[  281.962803][    C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff1102001f000
[  281.962809][    C1] FS:  0000000000000000(0000) GS:ffff8881a3c3d000(0000) knlGS:0000000000000000
[  281.962815][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  281.962820][    C1] CR2: 00007ffce5cacfb8 CR3: 000000010e5aa000 CR4: 00000000000006f0
[  281.962848][    C1] Call Trace:
[  281.962856][    C1]  <TASK>
[  281.962861][    C1]  default_idle+0x13/0x20
[  281.962872][    C1]  default_idle_call+0x74/0xb0
[  281.962883][    C1]  do_idle+0x1e8/0x510
[  281.962897][    C1]  ? asm_sysvec_call_function_single+0x1a/0x20
[  281.962908][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.962920][    C1]  ? __pfx_do_idle+0x10/0x10
[  281.962935][    C1]  ? do_idle+0x4ef/0x510
[  281.962947][    C1]  cpu_startup_entry+0x44/0x60
[  281.962958][    C1]  start_secondary+0x101/0x110
[  281.962971][    C1]  common_startup_64+0x13e/0x147
[  281.962987][    C1]  </TASK>
[  281.963575][   T34] Kernel panic - not syncing: hung_task: blocked tasks
[  281.963589][   T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
[  281.963599][   T34] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  281.963604][   T34] Call Trace:
[  281.963612][   T34]  <TASK>
[  281.963618][   T34]  dump_stack_lvl+0x99/0x250
[  281.963634][   T34]  ? __asan_memcpy+0x40/0x70
[  281.963645][   T34]  ? __pfx_dump_stack_lvl+0x10/0x10
[  281.963654][   T34]  ? __pfx__printk+0x10/0x10
[  281.963671][   T34]  vpanic+0x281/0x750
[  281.963681][   T34]  ? __pfx_vpanic+0x10/0x10
[  281.963688][   T34]  ? __x2apic_send_IPI_mask+0x1e4/0x260
[  281.963700][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.963717][   T34]  panic+0xb9/0xc0
[  281.963725][   T34]  ? __pfx_panic+0x10/0x10
[  281.963734][   T34]  ? irq_work_queue+0xc3/0x140
[  281.963747][   T34]  ? nmi_trigger_cpumask_backtrace+0x234/0x300
[  281.963759][   T34]  watchdog+0xfd2/0xfe0
[  281.963773][   T34]  ? watchdog+0x1de/0xfe0
[  281.963785][   T34]  kthread+0x711/0x8a0
[  281.963797][   T34]  ? __pfx_watchdog+0x10/0x10
[  281.963806][   T34]  ? __pfx_kthread+0x10/0x10
[  281.963816][   T34]  ? _raw_spin_unlock_irq+0x23/0x50
[  281.963829][   T34]  ? lockdep_hardirqs_on+0x9c/0x150
[  281.963839][   T34]  ? __pfx_kthread+0x10/0x10
[  281.963849][   T34]  ret_from_fork+0x439/0x7d0
[  281.963858][   T34]  ? __pfx_ret_from_fork+0x10/0x10
[  281.963868][   T34]  ? __switch_to_asm+0x39/0x70
[  281.963878][   T34]  ? __switch_to_asm+0x33/0x70
[  281.963887][   T34]  ? __pfx_kthread+0x10/0x10
[  281.963896][   T34]  ret_from_fork_asm+0x1a/0x30
[  281.963912][   T34]  </TASK>
[  282.086234][   T34] Kernel Offset: disabled
[  282.087650][   T34] Rebooting in 86400 seconds..

VM DIAGNOSIS:
12:02:15  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000020007 RBX=0000000000000002 RCX=0000000000000002 RDX=0000000000000003
RSI=0000000000000000 RDI=ffff8881096db980 RBP=0000000000000000 RSP=ffffc900032bf3d8
R8 =0000000000000000 R9 =ffffffff822ab949 R10=dffffc0000000000 R11=fffff9400088306f
R12=0000000000000002 R13=0000000000000001 R14=ffff8881096dc4e8 R15=0000000000000004
RIP=ffffffff819d658c RFL=00000087 [--S--PC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b863d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f8bc5507d60 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00007f8bc49a76c3 00007f8bc49a76c3 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 00ff000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000ff0000 XMM05=0000000000000000 000000000003bf12
XMM06=10000580041a0800 0c08000100000007 XMM07=060a016e00000000 756301ffffffffff
XMM08=fffffff508058003 2010000600000006 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000020 RBX=0000000000000020 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000068f6b0
R8 =ffff8881076c8237 R9 =1ffff11020ed9046 R10=dffffc0000000000 R11=ffffffff854fac30
R12=dffffc0000000000 R13=ffffffff99ad78d0 R14=ffffffff99dcc480 R15=0000000000000000
RIP=ffffffff854facac RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c3d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffce5cacfb8 CR3=0000000023dfe000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000001a4 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
